DFS Protocol Details

[Michael B Allen]

On Wed, 17 Aug 2005 12:05:24 -0500
"Gerald (Jerry) Carter" <jerry at samba.org> wrote:
> > I'm seeing some DFS behavior that I cannot explain. Instead 
> > of the usual try > PATH_NOT_COVERED > referral > try w/ new
> > target style protocol, captures show that the clients already
> > know the target is in DFS. At first I thought operators simply
> > were not capturing the PATH_NOT_COVERED part
> > but now I think there must be some additional protocol. 
> > Does anyone know how these clients populate their DFS mappings?
> > What am I missing here?
> 
> Are you sure the client is not just caching the information?
> There's some dfs management rpcs, but I haven't looked at
> those.  It's possible I suppose that the clients could also
> get the dfs topology from AD.

I know clients cache DFS mappings (until the machine is rebooted
actually). And certainly that is happening in this case. But I'm
not convinced the client is initially populating the mappings from a
PATH_NOT_COVERED condition. I think there are two "flavors" of DFS. Here's
a few notes about the second "mystery" flavor:

o the share that clients try to access is reported as NOT "InDfs"
o from looking at captures it seems clients can try to query the share
  for a referral but this fails with "No such device" and
o afterwhich clients can try to access the share as normal and succeed
  (meaning it started out thinking the share was InDfs, got an error, and
  then tried to simply access it as if it was not InDfs and it worked).
o a capture was provided to me for which the operator actually created a
  test DFS share specifically to capture accessing it for the first time
  (I don't know if he actually started the capture before creating the
  DFS share tho)
o AD integration has been considerd but the admin who supplied the
  capture claims he's not seeing that (I can't confirm as I don't have
  a lot of experience with AD communication)

The capture has quite a bit of stuff in it so I'm not clear what's going
on. I'll have to look at it much closer. Let me know if you want to look
at the capture and I'll ask the guy if it's ok to fwd it to you.

Thanks,
Mike