[cifs-protocol] CIFS connection is getting reset

Richard Sharpe realrichardsharpe at gmail.com
Wed May 22 00:29:38 MDT 2013


On Tue, May 21, 2013 at 11:21 PM, Rahul Katariya
<katariya.rahul at gmail.com> wrote:
> Hi,
>
> We are experiencing strange behavior with CIFS server.
>
> CIFS server is dropping connection after serving data repeatedly.
>
> CIFS server is sending FIN/RST packet from CIFS server.
>
> There are two requests CIFS server is getting from client
> <1> QUERY_INFO  , QUERY_PATH_INFO  [ls command]
> <2> WRITE_ANDX
>
> After receiving ANDX requests,  it servers QUERY_PATH_INFO and then it sends
> FIN and RST packet to client.  This behaviour gets repeated. As for every
> request from cifs client, connection is getting setup after RST, it takes
> time to get data on cifs client. Like command execution of ls is very slow.
> It takes 10-15 seconds to get output of ls .
>
>
> SMB signing is off on server.
>
> Tcpdump while doing communication is  as follows:
> ============================================================
> 280 145.554664 10.2.1.128 10.2.47.4 SMB 117 Negotiate Protocol Request
>
> 281 145.554757 10.2.47.4 10.2.1.128 TCP 66 [TCP Window Update] microsoft-ds
>> 37580 [ACK] Seq=1 Ack=1 Win=1049792 Len=0 TSval=2945122452 TSecr=678854387
>
> 282 145.555039 10.2.47.4 10.2.1.128 SMB 258 Negotiate Protocol Response
>
> 283 145.555044 10.2.1.128 10.2.47.4 TCP 66 37580 > microsoft-ds [ACK] Seq=52
> Ack=193 Win=7168 Len=0 TSval=678854387 TSecr=2945122452
>
> 284 145.555077 10.2.1.128 10.2.47.4 SMB 302 Session Setup AndX Request,
> NTLMSSP_NEGOTIATE
>
> 285 145.556114 10.2.47.4 10.2.1.128 SMB 334 Session Setup AndX Response,
> NTLMSSP_CHALLENGE, Error: STATUS_MORE_PROCESSING_REQUIRED
>
> 286 145.556155 10.2.1.128 10.2.47.4 SMB 556 Session Setup AndX Request,
> NTLMSSP_AUTH, User: PAYCHEX\_EASA_P
>
> 287 145.561173 10.2.47.4 10.2.1.128 TCP 66 microsoft-ds > 37580 [ACK]
> Seq=461 Ack=778 Win=1049792 Len=0 TSval=2945122453 TSecr=678854388
>
> 288 145.607085 10.2.47.4 10.2.1.128 SMB 152 Session Setup AndX Response
>
> 289 145.607111 10.2.1.128 10.2.47.4 SMB 164 Tree Connect AndX Request, Path:
> \\10.2.47.4\kazindex
>
> 290 145.608136 10.2.47.4 10.2.1.128 SMB 132 Tree Connect AndX Response
>
> 291 145.608250 10.2.1.128 10.2.47.4 SMB 296 NT Create AndX Request, FID:
> 0x0001, Path:
> \application\customize\db\data\base\10819\pg_internal.init.9135
>
> 292 145.609163 10.2.47.4 10.2.1.128 SMB 173 NT Create AndX Response, FID:
> 0x0001
>
> 293 145.609168 10.2.1.128 10.2.47.4 SMB 166 Tree Connect AndX Request, Path:
> \\10.2.47.4\holder
>
> 294 145.609944 10.2.47.4 10.2.1.128 SMB 132 Tree Connect AndX Response
>
> 295 145.610053 10.2.1.128 10.2.47.4 SMB 154 Trans2 Request, FIND_FIRST2,
> Pattern: \*
>
> 296 145.610319 10.2.1.128 10.2.47.4 SMB 1514 Trans2 Request,
> QUERY_PATH_INFO, Query File All Info, Path:
> \sideline\fs_1073872904\search\index_0\Groupings
>
> 297 145.610524 10.2.47.4 10.2.1.128 TCP 66 microsoft-ds > 37580 [ACK]
> Seq=786 Ack=2742 Win=1048320 Len=0 TSval=2945122457 TSecr=678854442
>
> 298 145.610536 10.2.1.128 10.2.47.4 TCP 4410 [TCP segment of a reassembled
> PDU]
>
> 299 145.610719 10.2.47.4 10.2.1.128 TCP 66 microsoft-ds > 37580 [ACK]
> Seq=786 Ack=5638 Win=1048320 Len=0 TSval=2945122457 TSecr=678854443
>
> 300 145.610725 10.2.1.128 10.2.47.4 TCP 4410 [TCP segment of a reassembled
> PDU]
>
> 301 145.610744 10.2.47.4 10.2.1.128 TCP 66 microsoft-ds > 37580 [ACK]
> Seq=786 Ack=7086 Win=1049792 Len=0 TSval=2945122457 TSecr=678854443
>
> 302 145.610749 10.2.1.128 10.2.47.4 TCP 2962 [TCP segment of a reassembled
> PDU]
>
> 303 145.610901 10.2.47.4 10.2.1.128 TCP 66 microsoft-ds > 37580 [ACK]
> Seq=786 Ack=9982 Win=1046848 Len=0 TSval=2945122457 TSecr=678854443
>
> 304 145.610905 10.2.1.128 10.2.47.4 TCP 2962 [TCP segment of a reassembled
> PDU]
>
> 305 145.610907 10.2.1.128 10.2.47.4 SMB 1094 Write AndX Request, FID:
> 0x0001, 16128 bytes at offset 0  [FID: 0x0001
> (\application\customize\db\data\base\10819\pg_internal.init.9135)]
>
> 306 145.610951 10.2.47.4 10.2.1.128 TCP 66 microsoft-ds > 37580 [ACK]
> Seq=786 Ack=12878 Win=1043968 Len=0 TSval=2945122457 TSecr=678854443
>
> 307 145.610959 10.2.47.4 10.2.1.128 TCP 66 microsoft-ds > 37580 [ACK]
> Seq=786 Ack=14326 Win=1049792 Len=0 TSval=2945122457 TSecr=678854443
>
> 308 145.611075 10.2.47.4 10.2.1.128 TCP 1514 [TCP segment of a reassembled
> PDU]
>
> 309 145.611080 10.2.47.4 10.2.1.128 TCP 1514 [TCP segment of a reassembled
> PDU]
>
> 310 145.611082 10.2.47.4 10.2.1.128 SMB 422 Trans2 Response, FIND_FIRST2,
> Files: . .. cd sideline search cdlinks Testing Murphy export files .kazeon
> .fsid cache Razo, Victor duplication restoresymtable.hdr db Direct
> Processing 7114
>
> 311 145.611087 10.2.1.128 10.2.47.4 TCP 66 37580 > microsoft-ds [ACK]
> Seq=18250 Ack=3682 Win=13824 Len=0 TSval=678854443 TSecr=2945122457
>
> 312 145.611163 10.2.47.4 10.2.1.128 SMB 202 Trans2 Response, QUERY_PATH_INFO
>
> 313 145.611168 10.2.47.4 10.2.1.128 TCP 66 microsoft-ds > 37580 [ACK]
> Seq=4174 Ack=17222 Win=1046848 Len=0 TSval=2945122457 TSecr=678854443
>
> 314 145.611171 10.2.47.4 10.2.1.128 TCP 66 microsoft-ds > 37580 [ACK]
> Seq=4174 Ack=18250 Win=1049536 Len=0 TSval=2945122457 TSecr=678854443
>
> 315 145.611172 10.2.1.128 10.2.47.4 TCP 66 37580 > microsoft-ds [ACK]
> Seq=18250 Ack=4174 Win=19968 Len=0 TSval=678854443 TSecr=2945122457
>
> 316 145.611243 10.2.1.128 10.2.47.4 TCP 138 [TCP segment of a reassembled
> PDU]
>
> 317 145.611589 10.2.47.4 10.2.1.128 TCP 66 microsoft-ds > 37580 [FIN, ACK]
> Seq=4174 Ack=18322 Win=1049792 Len=0 TSval=2945122458 TSecr=678854443
>
> 318 145.651538 10.2.1.128 10.2.47.4 TCP 66 37580 > microsoft-ds [ACK]
> Seq=18322 Ack=4175 Win=19968 Len=0 TSval=678854484 TSecr=2945122458
>
> 319 157.333117 10.2.1.128 10.2.47.4 TCP 144 [TCP segment of a reassembled
> PDU]
>
> 320 157.333264 10.2.47.4 10.2.1.128 TCP 60 microsoft-ds > 37580 [RST]
> Seq=4175 Win=0 Len=0
>
> ..............
> 341 213.077932 10.2.1.128 10.2.47.4 TCP 74 39921 > microsoft-ds [SYN] Seq=0
> Win=5840 Len=0 MSS=1460 SACK_PERM=1 TSval=678921910 TSecr=0 WS=512
>
> 342 213.078113 10.2.47.4 10.2.1.128 TCP 74 microsoft-ds > 39921 [SYN, ACK]
> Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 WS=64 SACK_PERM=1 TSval=1263214265
> TSecr=678921910
>
> 343 213.078124 10.2.1.128 10.2.47.4 TCP 66 39921 > microsoft-ds [ACK] Seq=1
> Ack=1 Win=6144 Len=0 TSval=678921910 TSecr=1263214265
>
> 344 213.078162 10.2.1.128 10.2.47.4 SMB 117 Negotiate Protocol Request
> ==============================================================

You don't tell us which CIFS server you are running. There are
different ways to figure these things out depending on whether it is
Samba or Windows etc.

-- 
Regards,
Richard Sharpe
(何以解憂?唯有杜康。--曹操)


More information about the cifs-protocol mailing list