[cifs-protocol] CIFS connection is getting reset

Wed May 22 00:21:33 MDT 2013

Hi,

We are experiencing strange behavior with CIFS server.

CIFS server is dropping connection after serving data repeatedly.

CIFS server is sending FIN/RST packet from CIFS server.

There are two requests CIFS server is getting from client
<1> QUERY_INFO  , QUERY_PATH_INFO  [ls command]
<2> WRITE_ANDX

After receiving ANDX requests,  it servers QUERY_PATH_INFO and then it
sends FIN and RST packet to client.  This behaviour gets repeated. As for
every request from cifs client, connection is getting setup after RST, it
takes time to get data on cifs client. Like command execution of ls is very
slow. It takes 10-15 seconds to get output of ls .

SMB signing is off on server.

Tcpdump while doing communication is  as follows:
============================================================
280 145.554664 10.2.1.128 10.2.47.4 SMB 117 Negotiate Protocol Request

281 145.554757 10.2.47.4 10.2.1.128 TCP 66 [TCP Window Update] microsoft-ds
> 37580 [ACK] Seq=1 Ack=1 Win=1049792 Len=0 TSval=2945122452 TSecr=678854387

282 145.555039 10.2.47.4 10.2.1.128 SMB 258 Negotiate Protocol Response

283 145.555044 10.2.1.128 10.2.47.4 TCP 66 37580 > microsoft-ds [ACK]
Seq=52 Ack=193 Win=7168 Len=0 TSval=678854387 TSecr=2945122452

284 145.555077 10.2.1.128 10.2.47.4 SMB 302 Session Setup AndX Request,
NTLMSSP_NEGOTIATE

285 145.556114 10.2.47.4 10.2.1.128 SMB 334 Session Setup AndX Response,
NTLMSSP_CHALLENGE, Error: STATUS_MORE_PROCESSING_REQUIRED

286 145.556155 10.2.1.128 10.2.47.4 SMB 556 Session Setup AndX Request,
NTLMSSP_AUTH, User: PAYCHEX\_EASA_P

287 145.561173 10.2.47.4 10.2.1.128 TCP 66 microsoft-ds > 37580 [ACK]
Seq=461 Ack=778 Win=1049792 Len=0 TSval=2945122453 TSecr=678854388

288 145.607085 10.2.47.4 10.2.1.128 SMB 152 Session Setup AndX Response

289 145.607111 10.2.1.128 10.2.47.4 SMB 164 Tree Connect AndX Request,
Path: \\10.2.47.4\kazindex

290 145.608136 10.2.47.4 10.2.1.128 SMB 132 Tree Connect AndX Response

291 145.608250 10.2.1.128 10.2.47.4 SMB 296 NT Create AndX Request, FID:
0x0001, Path:
\application\customize\db\data\base\10819\pg_internal.init.9135

292 145.609163 10.2.47.4 10.2.1.128 SMB 173 NT Create AndX Response, FID:
0x0001

293 145.609168 10.2.1.128 10.2.47.4 SMB 166 Tree Connect AndX Request,
Path: \\10.2.47.4\holder

294 145.609944 10.2.47.4 10.2.1.128 SMB 132 Tree Connect AndX Response

295 145.610053 10.2.1.128 10.2.47.4 SMB 154 Trans2 Request, FIND_FIRST2,
Pattern: \*

296 145.610319 10.2.1.128 10.2.47.4 SMB 1514 Trans2 Request,
QUERY_PATH_INFO, Query File All Info, Path:
\sideline\fs_1073872904\search\index_0\Groupings

297 145.610524 10.2.47.4 10.2.1.128 TCP 66 microsoft-ds > 37580 [ACK]
Seq=786 Ack=2742 Win=1048320 Len=0 TSval=2945122457 TSecr=678854442

298 145.610536 10.2.1.128 10.2.47.4 TCP 4410 [TCP segment of a reassembled
PDU]

299 145.610719 10.2.47.4 10.2.1.128 TCP 66 microsoft-ds > 37580 [ACK]
Seq=786 Ack=5638 Win=1048320 Len=0 TSval=2945122457 TSecr=678854443

300 145.610725 10.2.1.128 10.2.47.4 TCP 4410 [TCP segment of a reassembled
PDU]

301 145.610744 10.2.47.4 10.2.1.128 TCP 66 microsoft-ds > 37580 [ACK]
Seq=786 Ack=7086 Win=1049792 Len=0 TSval=2945122457 TSecr=678854443

302 145.610749 10.2.1.128 10.2.47.4 TCP 2962 [TCP segment of a reassembled
PDU]

303 145.610901 10.2.47.4 10.2.1.128 TCP 66 microsoft-ds > 37580 [ACK]
Seq=786 Ack=9982 Win=1046848 Len=0 TSval=2945122457 TSecr=678854443

304 145.610905 10.2.1.128 10.2.47.4 TCP 2962 [TCP segment of a reassembled
PDU]

305 145.610907 10.2.1.128 10.2.47.4 SMB 1094 Write AndX Request, FID:
0x0001, 16128 bytes at offset 0  [FID: 0x0001
(\application\customize\db\data\base\10819\pg_internal.init.9135)]

306 145.610951 10.2.47.4 10.2.1.128 TCP 66 microsoft-ds > 37580 [ACK]
Seq=786 Ack=12878 Win=1043968 Len=0 TSval=2945122457 TSecr=678854443

307 145.610959 10.2.47.4 10.2.1.128 TCP 66 microsoft-ds > 37580 [ACK]
Seq=786 Ack=14326 Win=1049792 Len=0 TSval=2945122457 TSecr=678854443

308 145.611075 10.2.47.4 10.2.1.128 TCP 1514 [TCP segment of a reassembled
PDU]

309 145.611080 10.2.47.4 10.2.1.128 TCP 1514 [TCP segment of a reassembled
PDU]

310 145.611082 10.2.47.4 10.2.1.128 SMB 422 Trans2 Response, FIND_FIRST2,
Files: . .. cd sideline search cdlinks Testing Murphy export files .kazeon
.fsid cache Razo, Victor duplication restoresymtable.hdr db Direct
Processing 7114

311 145.611087 10.2.1.128 10.2.47.4 TCP 66 37580 > microsoft-ds [ACK]
Seq=18250 Ack=3682 Win=13824 Len=0 TSval=678854443 TSecr=2945122457

312 145.611163 10.2.47.4 10.2.1.128 SMB 202 Trans2 Response, QUERY_PATH_INFO

313 145.611168 10.2.47.4 10.2.1.128 TCP 66 microsoft-ds > 37580 [ACK]
Seq=4174 Ack=17222 Win=1046848 Len=0 TSval=2945122457 TSecr=678854443

314 145.611171 10.2.47.4 10.2.1.128 TCP 66 microsoft-ds > 37580 [ACK]
Seq=4174 Ack=18250 Win=1049536 Len=0 TSval=2945122457 TSecr=678854443

315 145.611172 10.2.1.128 10.2.47.4 TCP 66 37580 > microsoft-ds [ACK]
Seq=18250 Ack=4174 Win=19968 Len=0 TSval=678854443 TSecr=2945122457

316 145.611243 10.2.1.128 10.2.47.4 TCP 138 [TCP segment of a reassembled
PDU]

317 145.611589 10.2.47.4 10.2.1.128 TCP 66 microsoft-ds > 37580 [FIN, ACK]
Seq=4174 Ack=18322 Win=1049792 Len=0 TSval=2945122458 TSecr=678854443

318 145.651538 10.2.1.128 10.2.47.4 TCP 66 37580 > microsoft-ds [ACK]
Seq=18322 Ack=4175 Win=19968 Len=0 TSval=678854484 TSecr=2945122458

319 157.333117 10.2.1.128 10.2.47.4 TCP 144 [TCP segment of a reassembled
PDU]

320 157.333264 10.2.47.4 10.2.1.128 TCP 60 microsoft-ds > 37580 [RST]
Seq=4175 Win=0 Len=0

..............
341 213.077932 10.2.1.128 10.2.47.4 TCP 74 39921 > microsoft-ds [SYN] Seq=0
Win=5840 Len=0 MSS=1460 SACK_PERM=1 TSval=678921910 TSecr=0 WS=512

342 213.078113 10.2.47.4 10.2.1.128 TCP 74 microsoft-ds > 39921 [SYN, ACK]
Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 WS=64 SACK_PERM=1 TSval=1263214265
TSecr=678921910

343 213.078124 10.2.1.128 10.2.47.4 TCP 66 39921 > microsoft-ds [ACK] Seq=1
Ack=1 Win=6144 Len=0 TSval=678921910 TSecr=1263214265

344 213.078162 10.2.1.128 10.2.47.4 SMB 117 Negotiate Protocol Request
==============================================================

Thanks,
Rahul
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.samba.org/pipermail/cifs-protocol/attachments/20130522/2f3223cd/attachment-0001.html>