Hi, We are experiencing strange behavior with CIFS server.
CIFS server is dropping connection after serving data repeatedly. CIFS server is sending FIN/RST packet from CIFS server. There are two requests CIFS server is getting from client <1> QUERY_INFO , QUERY_PATH_INFO [ls command] <2> WRITE_ANDX After receiving ANDX requests, it servers QUERY_PATH_INFO and then it sends FIN and RST packet to client. This behaviour gets repeated. As for every request from cifs client, connection is getting setup after RST, it takes time to get data on cifs client. Like command execution of ls is very slow. It takes 10-15 seconds to get output of ls . SMB signing is off on server. Tcpdump while doing communication is as follows: ============================================================ 280 145.554664 10.2.1.128 10.2.47.4 SMB 117 Negotiate Protocol Request 281 145.554757 10.2.47.4 10.2.1.128 TCP 66 [TCP Window Update] microsoft-ds > 37580 [ACK] Seq=1 Ack=1 Win=1049792 Len=0 TSval=2945122452 TSecr=678854387 282 145.555039 10.2.47.4 10.2.1.128 SMB 258 Negotiate Protocol Response 283 145.555044 10.2.1.128 10.2.47.4 TCP 66 37580 > microsoft-ds [ACK] Seq=52 Ack=193 Win=7168 Len=0 TSval=678854387 TSecr=2945122452 284 145.555077 10.2.1.128 10.2.47.4 SMB 302 Session Setup AndX Request, NTLMSSP_NEGOTIATE 285 145.556114 10.2.47.4 10.2.1.128 SMB 334 Session Setup AndX Response, NTLMSSP_CHALLENGE, Error: STATUS_MORE_PROCESSING_REQUIRED 286 145.556155 10.2.1.128 10.2.47.4 SMB 556 Session Setup AndX Request, NTLMSSP_AUTH, User: PAYCHEX\_EASA_P 287 145.561173 10.2.47.4 10.2.1.128 TCP 66 microsoft-ds > 37580 [ACK] Seq=461 Ack=778 Win=1049792 Len=0 TSval=2945122453 TSecr=678854388 288 145.607085 10.2.47.4 10.2.1.128 SMB 152 Session Setup AndX Response 289 145.607111 10.2.1.128 10.2.47.4 SMB 164 Tree Connect AndX Request, Path: \\10.2.47.4\kazindex 290 145.608136 10.2.47.4 10.2.1.128 SMB 132 Tree Connect AndX Response 291 145.608250 10.2.1.128 10.2.47.4 SMB 296 NT Create AndX Request, FID: 0x0001, Path: \application\customize\db\data\base\10819\pg_internal.init.9135 292 145.609163 10.2.47.4 10.2.1.128 SMB 173 NT Create AndX Response, FID: 0x0001 293 145.609168 10.2.1.128 10.2.47.4 SMB 166 Tree Connect AndX Request, Path: \\10.2.47.4\holder 294 145.609944 10.2.47.4 10.2.1.128 SMB 132 Tree Connect AndX Response 295 145.610053 10.2.1.128 10.2.47.4 SMB 154 Trans2 Request, FIND_FIRST2, Pattern: \* 296 145.610319 10.2.1.128 10.2.47.4 SMB 1514 Trans2 Request, QUERY_PATH_INFO, Query File All Info, Path: \sideline\fs_1073872904\search\index_0\Groupings 297 145.610524 10.2.47.4 10.2.1.128 TCP 66 microsoft-ds > 37580 [ACK] Seq=786 Ack=2742 Win=1048320 Len=0 TSval=2945122457 TSecr=678854442 298 145.610536 10.2.1.128 10.2.47.4 TCP 4410 [TCP segment of a reassembled PDU] 299 145.610719 10.2.47.4 10.2.1.128 TCP 66 microsoft-ds > 37580 [ACK] Seq=786 Ack=5638 Win=1048320 Len=0 TSval=2945122457 TSecr=678854443 300 145.610725 10.2.1.128 10.2.47.4 TCP 4410 [TCP segment of a reassembled PDU] 301 145.610744 10.2.47.4 10.2.1.128 TCP 66 microsoft-ds > 37580 [ACK] Seq=786 Ack=7086 Win=1049792 Len=0 TSval=2945122457 TSecr=678854443 302 145.610749 10.2.1.128 10.2.47.4 TCP 2962 [TCP segment of a reassembled PDU] 303 145.610901 10.2.47.4 10.2.1.128 TCP 66 microsoft-ds > 37580 [ACK] Seq=786 Ack=9982 Win=1046848 Len=0 TSval=2945122457 TSecr=678854443 304 145.610905 10.2.1.128 10.2.47.4 TCP 2962 [TCP segment of a reassembled PDU] 305 145.610907 10.2.1.128 10.2.47.4 SMB 1094 Write AndX Request, FID: 0x0001, 16128 bytes at offset 0 [FID: 0x0001 (\application\customize\db\data\base\10819\pg_internal.init.9135)] 306 145.610951 10.2.47.4 10.2.1.128 TCP 66 microsoft-ds > 37580 [ACK] Seq=786 Ack=12878 Win=1043968 Len=0 TSval=2945122457 TSecr=678854443 307 145.610959 10.2.47.4 10.2.1.128 TCP 66 microsoft-ds > 37580 [ACK] Seq=786 Ack=14326 Win=1049792 Len=0 TSval=2945122457 TSecr=678854443 308 145.611075 10.2.47.4 10.2.1.128 TCP 1514 [TCP segment of a reassembled PDU] 309 145.611080 10.2.47.4 10.2.1.128 TCP 1514 [TCP segment of a reassembled PDU] 310 145.611082 10.2.47.4 10.2.1.128 SMB 422 Trans2 Response, FIND_FIRST2, Files: . .. cd sideline search cdlinks Testing Murphy export files .kazeon .fsid cache Razo, Victor duplication restoresymtable.hdr db Direct Processing 7114 311 145.611087 10.2.1.128 10.2.47.4 TCP 66 37580 > microsoft-ds [ACK] Seq=18250 Ack=3682 Win=13824 Len=0 TSval=678854443 TSecr=2945122457 312 145.611163 10.2.47.4 10.2.1.128 SMB 202 Trans2 Response, QUERY_PATH_INFO 313 145.611168 10.2.47.4 10.2.1.128 TCP 66 microsoft-ds > 37580 [ACK] Seq=4174 Ack=17222 Win=1046848 Len=0 TSval=2945122457 TSecr=678854443 314 145.611171 10.2.47.4 10.2.1.128 TCP 66 microsoft-ds > 37580 [ACK] Seq=4174 Ack=18250 Win=1049536 Len=0 TSval=2945122457 TSecr=678854443 315 145.611172 10.2.1.128 10.2.47.4 TCP 66 37580 > microsoft-ds [ACK] Seq=18250 Ack=4174 Win=19968 Len=0 TSval=678854443 TSecr=2945122457 316 145.611243 10.2.1.128 10.2.47.4 TCP 138 [TCP segment of a reassembled PDU] 317 145.611589 10.2.47.4 10.2.1.128 TCP 66 microsoft-ds > 37580 [FIN, ACK] Seq=4174 Ack=18322 Win=1049792 Len=0 TSval=2945122458 TSecr=678854443 318 145.651538 10.2.1.128 10.2.47.4 TCP 66 37580 > microsoft-ds [ACK] Seq=18322 Ack=4175 Win=19968 Len=0 TSval=678854484 TSecr=2945122458 319 157.333117 10.2.1.128 10.2.47.4 TCP 144 [TCP segment of a reassembled PDU] 320 157.333264 10.2.47.4 10.2.1.128 TCP 60 microsoft-ds > 37580 [RST] Seq=4175 Win=0 Len=0 .............. 341 213.077932 10.2.1.128 10.2.47.4 TCP 74 39921 > microsoft-ds [SYN] Seq=0 Win=5840 Len=0 MSS=1460 SACK_PERM=1 TSval=678921910 TSecr=0 WS=512 342 213.078113 10.2.47.4 10.2.1.128 TCP 74 microsoft-ds > 39921 [SYN, ACK] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 WS=64 SACK_PERM=1 TSval=1263214265 TSecr=678921910 343 213.078124 10.2.1.128 10.2.47.4 TCP 66 39921 > microsoft-ds [ACK] Seq=1 Ack=1 Win=6144 Len=0 TSval=678921910 TSecr=1263214265 344 213.078162 10.2.1.128 10.2.47.4 SMB 117 Negotiate Protocol Request ============================================================== Thanks, Rahul
_______________________________________________ cifs-protocol mailing list [email protected] https://lists.samba.org/mailman/listinfo/cifs-protocol
