Sidebar to Apple OS X SMB issues across VPN

[David Collier-Brown]

Christopher R. Hertel wrote:
> Dave,
> 
> The continuation messages occur whenever the SMB message is larger than 
> the MTU on the link.  It's the TCP/IP stack that breaks the large SMB down 
> into smaller chunks for transmission.

	Huh, fooled me!
	I assumed NBSS meant netbios-something,
	not normal TCP fragmentation of an SMB packet.

	It's consistent with what snoop says, alas....

344   0.01750 192.168.2.24 -> 192.168.0.2  SMB C Code=0x32 Name=SMBtrans2 Findfirst File=\* Error=0 
345   0.00204  192.168.0.2 -> 192.168.2.24 SMB R Code=0x32 Name=SMBtrans2 Error=0 
346   0.00001  192.168.0.2 -> 192.168.2.24 NBT Type=Unknown Length=1376
347   0.00000  192.168.0.2 -> 192.168.2.24 NBT Type=Unknown Length=1376
348   0.00000  192.168.0.2 -> 192.168.2.24 NBT Type=Unknown Length=1376
349   0.00000  192.168.0.2 -> 192.168.2.24 NBT Type=Unknown Length=1376
350   0.00001  192.168.0.2 -> 192.168.2.24 NBT Type=Unknown Length=1288
351   0.02966 192.168.2.24 -> 192.168.0.2  NBT C port=3366 
352   0.00004  192.168.0.2 -> 192.168.2.24 NBT Type=SESSION MESSAGE Length=1376
353   0.00001  192.168.0.2 -> 192.168.2.24 NBT Type=SESSION MESSAGE Length=1376
354   0.02602 192.168.2.24 -> 192.168.0.2  NBT C port=3366 
355   0.00004  192.168.0.2 -> 192.168.2.24 NBT Type=Unknown Length=1376
356   0.00000  192.168.0.2 -> 192.168.2.24 NBT Type=SESSION MESSAGE Length=1376
357   0.00879 192.168.2.24 -> 192.168.0.2  NBT C port=3366 
358   0.01590 192.168.2.24 -> 192.168.0.2  NBT C port=3366 
359   0.00215 192.168.2.24 -> 192.168.0.2  NBT C port=3366 
360   0.00002  192.168.0.2 -> 192.168.2.24 NBT Type=Unknown Length=1376
361   0.17574 192.168.2.24 -> 192.168.0.2  NBT C port=3366 
362   1.27509 192.168.2.24 -> 192.168.0.2  SMB C Code=0x4 Name=SMBclose FileID=0x15f9 Error=0 

	Bother, it means I can't reliably parse continuations
	with a single-threaded nawk. I probably need to do an
	ethereal extension/plugin to pull out latency/response 
	time/throughput/TPS from a SMB stream.

	Oh well, I can still handle most cases...

--dave

-- 
David Collier-Brown,      | Always do right. This will gratify
Sun Microsystems, Toronto | some people and astonish the rest
davecb at canada.sun.com     |                      -- Mark Twain
(416) 263-5733 (x65733)   |