smb-failed.d

#!/usr/sbin/dtrace -qCs

#define	NT_STATUS_WRONG_PASSWORD	0xC000006A
#define	NT_STATUS_LOGON_FAILURE		0xC000006D

BEGIN
{
	printf("%-32s %s\n", "USER", "IP");
}

pid$target::smb_logon:entry
{
    self->logon = args[0]
}

pid$target::smb_logon:return
/self->logon->lg_status == NT_STATUS_WRONG_PASSWORD ||
 self->logon->lg_status == NT_STATUS_LOGON_FAILURE/
{
    uaddrp = (userland ipaddr_t *)&self->logon->lg_clnt_ipaddr.au_addr.au_ipv4;
    addrp = copyin((uintptr_t)uaddrp, 4);
    user = (uintptr_t)self->logon->lg_username;
    printf("%-32s %s\n", copyinstr(user), inet_ntoa(addrp));
}

pid$target::smb_logon:return
{
    self->logon = 0;
}