How can I log the IP addresses of SMB login attempts?

Solution 1:

You could fire up and configure the BSD packetfilter - create a rule that will match incoming 'rogue' SMB requests, and in that rule use the log keyword which will cause all packets matching that rule to be, er, logged.

Walkthough here: https://blog.neilsabol.site/post/quickly-easily-adding-pf-packet-filter-firewall-rules-macos-osx/

In-depth explanation here: http://marckerr.com/a-simple-guild-to-the-mac-pf-firewall/

Explanation of the pf logging function here:https://www.openbsd.org/faq/pf/logging.html

Setting up pfctl anchors for a protocol: https://ikawnoclast.com/systems/firewall/mac-os-x-pf-firewall/