How can I log the IP addresses of SMB login attempts? I want to automatically ban IP address which attempt to login to my file server unauthorized.

I can log SSH login attempts including IP address in macOS to a syslog format file for further processing with fail2ban like so:

log stream --predicate '(process == "sshd")' --style syslog --level info --type=log &gt;&gt; /opt/local/var/log/logstreams/sshd.log


However, the smbd process doesn't seem to log IP by default. How can I achieve the above for smbd?
You could fire up and configure the BSD packetfilter - create a rule that will match incoming 'rogue' SMB requests, and in that rule use the log keyword which will cause all packets matching that rule to be, er, logged.

Walkthough here: https://blog.neilsabol.site/post/quickly-easily-adding-pf-packet-filter-firewall-rules-macos-osx/

In-depth explanation here: http://marckerr.com/a-simple-guild-to-the-mac-pf-firewall/

Explanation of the pf logging function here:https://www.openbsd.org/faq/pf/logging.html

Setting up pfctl anchors for a protocol:
https://ikawnoclast.com/systems/firewall/mac-os-x-pf-firewall/