On Tue, May 21, 2013 at 11:21 PM, Rahul Katariya <[email protected]> wrote: > Hi, > > We are experiencing strange behavior with CIFS server. > > CIFS server is dropping connection after serving data repeatedly. > > CIFS server is sending FIN/RST packet from CIFS server. > > There are two requests CIFS server is getting from client > <1> QUERY_INFO , QUERY_PATH_INFO [ls command] > <2> WRITE_ANDX > > After receiving ANDX requests, it servers QUERY_PATH_INFO and then it sends > FIN and RST packet to client. This behaviour gets repeated. As for every > request from cifs client, connection is getting setup after RST, it takes > time to get data on cifs client. Like command execution of ls is very slow. > It takes 10-15 seconds to get output of ls . > > > SMB signing is off on server. > > Tcpdump while doing communication is as follows: > ============================================================ > 280 145.554664 10.2.1.128 10.2.47.4 SMB 117 Negotiate Protocol Request > > 281 145.554757 10.2.47.4 10.2.1.128 TCP 66 [TCP Window Update] microsoft-ds >> 37580 [ACK] Seq=1 Ack=1 Win=1049792 Len=0 TSval=2945122452 TSecr=678854387 > > 282 145.555039 10.2.47.4 10.2.1.128 SMB 258 Negotiate Protocol Response > > 283 145.555044 10.2.1.128 10.2.47.4 TCP 66 37580 > microsoft-ds [ACK] Seq=52 > Ack=193 Win=7168 Len=0 TSval=678854387 TSecr=2945122452 > > 284 145.555077 10.2.1.128 10.2.47.4 SMB 302 Session Setup AndX Request, > NTLMSSP_NEGOTIATE > > 285 145.556114 10.2.47.4 10.2.1.128 SMB 334 Session Setup AndX Response, > NTLMSSP_CHALLENGE, Error: STATUS_MORE_PROCESSING_REQUIRED > > 286 145.556155 10.2.1.128 10.2.47.4 SMB 556 Session Setup AndX Request, > NTLMSSP_AUTH, User: PAYCHEX\_EASA_P > > 287 145.561173 10.2.47.4 10.2.1.128 TCP 66 microsoft-ds > 37580 [ACK] > Seq=461 Ack=778 Win=1049792 Len=0 TSval=2945122453 TSecr=678854388 > > 288 145.607085 10.2.47.4 10.2.1.128 SMB 152 Session Setup AndX Response > > 289 145.607111 10.2.1.128 10.2.47.4 SMB 164 Tree Connect AndX Request, Path: > \\10.2.47.4\kazindex > > 290 145.608136 10.2.47.4 10.2.1.128 SMB 132 Tree Connect AndX Response > > 291 145.608250 10.2.1.128 10.2.47.4 SMB 296 NT Create AndX Request, FID: > 0x0001, Path: > \application\customize\db\data\base\10819\pg_internal.init.9135 > > 292 145.609163 10.2.47.4 10.2.1.128 SMB 173 NT Create AndX Response, FID: > 0x0001 > > 293 145.609168 10.2.1.128 10.2.47.4 SMB 166 Tree Connect AndX Request, Path: > \\10.2.47.4\holder > > 294 145.609944 10.2.47.4 10.2.1.128 SMB 132 Tree Connect AndX Response > > 295 145.610053 10.2.1.128 10.2.47.4 SMB 154 Trans2 Request, FIND_FIRST2, > Pattern: \* > > 296 145.610319 10.2.1.128 10.2.47.4 SMB 1514 Trans2 Request, > QUERY_PATH_INFO, Query File All Info, Path: > \sideline\fs_1073872904\search\index_0\Groupings > > 297 145.610524 10.2.47.4 10.2.1.128 TCP 66 microsoft-ds > 37580 [ACK] > Seq=786 Ack=2742 Win=1048320 Len=0 TSval=2945122457 TSecr=678854442 > > 298 145.610536 10.2.1.128 10.2.47.4 TCP 4410 [TCP segment of a reassembled > PDU] > > 299 145.610719 10.2.47.4 10.2.1.128 TCP 66 microsoft-ds > 37580 [ACK] > Seq=786 Ack=5638 Win=1048320 Len=0 TSval=2945122457 TSecr=678854443 > > 300 145.610725 10.2.1.128 10.2.47.4 TCP 4410 [TCP segment of a reassembled > PDU] > > 301 145.610744 10.2.47.4 10.2.1.128 TCP 66 microsoft-ds > 37580 [ACK] > Seq=786 Ack=7086 Win=1049792 Len=0 TSval=2945122457 TSecr=678854443 > > 302 145.610749 10.2.1.128 10.2.47.4 TCP 2962 [TCP segment of a reassembled > PDU] > > 303 145.610901 10.2.47.4 10.2.1.128 TCP 66 microsoft-ds > 37580 [ACK] > Seq=786 Ack=9982 Win=1046848 Len=0 TSval=2945122457 TSecr=678854443 > > 304 145.610905 10.2.1.128 10.2.47.4 TCP 2962 [TCP segment of a reassembled > PDU] > > 305 145.610907 10.2.1.128 10.2.47.4 SMB 1094 Write AndX Request, FID: > 0x0001, 16128 bytes at offset 0 [FID: 0x0001 > (\application\customize\db\data\base\10819\pg_internal.init.9135)] > > 306 145.610951 10.2.47.4 10.2.1.128 TCP 66 microsoft-ds > 37580 [ACK] > Seq=786 Ack=12878 Win=1043968 Len=0 TSval=2945122457 TSecr=678854443 > > 307 145.610959 10.2.47.4 10.2.1.128 TCP 66 microsoft-ds > 37580 [ACK] > Seq=786 Ack=14326 Win=1049792 Len=0 TSval=2945122457 TSecr=678854443 > > 308 145.611075 10.2.47.4 10.2.1.128 TCP 1514 [TCP segment of a reassembled > PDU] > > 309 145.611080 10.2.47.4 10.2.1.128 TCP 1514 [TCP segment of a reassembled > PDU] > > 310 145.611082 10.2.47.4 10.2.1.128 SMB 422 Trans2 Response, FIND_FIRST2, > Files: . .. cd sideline search cdlinks Testing Murphy export files .kazeon > .fsid cache Razo, Victor duplication restoresymtable.hdr db Direct > Processing 7114 > > 311 145.611087 10.2.1.128 10.2.47.4 TCP 66 37580 > microsoft-ds [ACK] > Seq=18250 Ack=3682 Win=13824 Len=0 TSval=678854443 TSecr=2945122457 > > 312 145.611163 10.2.47.4 10.2.1.128 SMB 202 Trans2 Response, QUERY_PATH_INFO > > 313 145.611168 10.2.47.4 10.2.1.128 TCP 66 microsoft-ds > 37580 [ACK] > Seq=4174 Ack=17222 Win=1046848 Len=0 TSval=2945122457 TSecr=678854443 > > 314 145.611171 10.2.47.4 10.2.1.128 TCP 66 microsoft-ds > 37580 [ACK] > Seq=4174 Ack=18250 Win=1049536 Len=0 TSval=2945122457 TSecr=678854443 > > 315 145.611172 10.2.1.128 10.2.47.4 TCP 66 37580 > microsoft-ds [ACK] > Seq=18250 Ack=4174 Win=19968 Len=0 TSval=678854443 TSecr=2945122457 > > 316 145.611243 10.2.1.128 10.2.47.4 TCP 138 [TCP segment of a reassembled > PDU] > > 317 145.611589 10.2.47.4 10.2.1.128 TCP 66 microsoft-ds > 37580 [FIN, ACK] > Seq=4174 Ack=18322 Win=1049792 Len=0 TSval=2945122458 TSecr=678854443 > > 318 145.651538 10.2.1.128 10.2.47.4 TCP 66 37580 > microsoft-ds [ACK] > Seq=18322 Ack=4175 Win=19968 Len=0 TSval=678854484 TSecr=2945122458 > > 319 157.333117 10.2.1.128 10.2.47.4 TCP 144 [TCP segment of a reassembled > PDU] > > 320 157.333264 10.2.47.4 10.2.1.128 TCP 60 microsoft-ds > 37580 [RST] > Seq=4175 Win=0 Len=0 > > .............. > 341 213.077932 10.2.1.128 10.2.47.4 TCP 74 39921 > microsoft-ds [SYN] Seq=0 > Win=5840 Len=0 MSS=1460 SACK_PERM=1 TSval=678921910 TSecr=0 WS=512 > > 342 213.078113 10.2.47.4 10.2.1.128 TCP 74 microsoft-ds > 39921 [SYN, ACK] > Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 WS=64 SACK_PERM=1 TSval=1263214265 > TSecr=678921910 > > 343 213.078124 10.2.1.128 10.2.47.4 TCP 66 39921 > microsoft-ds [ACK] Seq=1 > Ack=1 Win=6144 Len=0 TSval=678921910 TSecr=1263214265 > > 344 213.078162 10.2.1.128 10.2.47.4 SMB 117 Negotiate Protocol Request > ==============================================================
You don't tell us which CIFS server you are running. There are different ways to figure these things out depending on whether it is Samba or Windows etc. -- Regards, Richard Sharpe (何以解憂？唯有杜康。--曹操) _______________________________________________ cifs-protocol mailing list [email protected] https://lists.samba.org/mailman/listinfo/cifs-protocol
