[cifs-protocol] Two Windows 7 machines running same command, with different operations

[Stephen Martin]

Hi,

I am trying to track down a performance issue we are having with some of
our workstations. It would appeart that some of our Windows 7 machines
access SMB files differently and I believe this may be the cause of the
performance issues

I have run the following command on two Windows 7 Pro fully patched
machines.

`copy /y \\server\Company\ztemp\test.txt .`

To copy a simple file from our file server to the local workstation. 
When inpsecting the traffic from the two machines

FAST Workstation

`copy /y \\server\Company\ztemp\test.txt .`

===========================================================================
SMB Service Response Time Statistics -
wireshark_8E5C274B-424D-4C1D-8A02-6D5D33193E92_20170324114148_a06252:
Index  Procedure  Calls  Min SRT (s)  Max SRT (s)  Avg SRT (s)  Sum SRT (s)
---------------------------------------------------------------------------
SMB Commands              
Close                                4      2     0.000340    
0.000451     0.000396     0.000791
Negotiate Protocol                 114      1     0.000738    
0.000738     0.000738     0.000738
NT Create AndX                     162      2     0.000789    
0.000941     0.000865     0.001730
Read AndX                           46      2     0.000344    
0.000362     0.000353     0.000706
Session Setup AndX                 115      1     0.001846    
0.001846     0.001846     0.001846
Tree Connect AndX                  117      1     0.000359    
0.000359     0.000359     0.000359
Transaction2 Sub-Commands 
QUERY_FILE_INFO                      7      6     0.000237    
0.000311     0.000273     0.001638
QUERY_FS_INFO                        3      1     0.000404    
0.000404     0.000404     0.000404
QUERY_PATH_INFO                      5      4     0.000361    
0.000763     0.000507     0.002029
NT Transaction Sub-Commands
NT IOCTL                             2      1     0.000225    
0.000225     0.000225     0.000225
---------------------------------------------------------------------------


SLOW Workstaton


`copy /y \\server\Company\ztemp\test.txt .`
===========================================================================
SMB Service Response Time Statistics -
wireshark_BFB0F41F-0E59-43FB-899A-547688F0A586_20170324114431_a03948:
Index  Procedure  Calls  Min SRT (s)  Max SRT (s)  Avg SRT (s)  Sum SRT (s)
---------------------------------------------------------------------------
SMB Commands              
Close                                4      7     0.000310    
0.000653     0.000382     0.002671
NT Create AndX                     162      7     0.000313    
0.003960     0.000951     0.006654
Read AndX                           46      2     0.000345    
0.000357     0.000351     0.000702
Tree Connect AndX                  117      1     0.000512    
0.000512     0.000512     0.000512
Transaction2 Sub-Commands 
FIND_FIRST2                          1      5     0.000348    
0.000385     0.000367     0.001835
GET_DFS_REFERRAL                    16      1     0.005608    
0.005608     0.005608     0.005608
QUERY_FILE_INFO                      7     10     0.000342    
0.000461     0.000382     0.003818
QUERY_FS_INFO                        3      1     0.000343    
0.000343     0.000343     0.000343
QUERY_PATH_INFO                      5      4     0.000351    
0.000409     0.000372     0.001489
NT Transaction Sub-Commands
NT IOCTL                             2      1     0.000352    
0.000352     0.000352     0.000352
---------------------------------------------------------------------------

Notice how the slow workstation does a lot more operations for the same
copy, It seems to use
FIND_FIRST2 where as the quick machine will not.

Can anybody understand what is going on here, shoudn't these two
machines do the same thing for the same command?

This is the basic test with one file, when I run the machine though
prodcution application the fast one will do maybe 150 operations and the
slow 6000, on the same test.

Cheers.

Steve.