Server Message Block (SMB) is an application-level client- server protocol that enables sharing resources - files, printers and serial ports between users on the network. Microsoft version of SMB running over TCP/IP is called Common Internet File System (CIFS) and is used by Microsoft Windows OS to provide access to shared Windows resources such as files and printers. Due to enormous popularity of Windows OS, CIFS protocol traffic has become extremely common in modern TCP/IP networks. On internal LANs or Intranets that are often comprised of hundreds or thousands of personal workstations running Microsoft Windows, CIFS protocol can account for majority of traffic passed between hosts. As CIFS protocol transactions carry data payload, modern security devices, such as Firewalls and Intrusion Detection Devices, often implement CIFS-specific enforcement that ensures security and integrity of file sharing transactions. Additionally, due to widespread presence of virus and worm infections, security devices deploy CIFS-aware deep inspection to find and block these malicious elements embedded in files carried by CIFS protocol. As CIFS deep inspection and application aware security requires significant amounts of processing on part of security devises, these devices are likely to become a source of performance bottlenecks and severely compromise quality of network user experience.