It appears that SMB directly over TCP is really similar to NBT, there isn't just any handshake, and the length field is supposed to be 24bits instead of 17, but we don't care