Samba-Bug 5684 -- nmbd fills disk space

tridge at tridge at
Wed Aug 13 03:08:53 GMT 2008

Hi Volker,

 > Can you take a look at the patch I uploaded to samba-bug 5684? With nmbd
 > fills the disk with unexpected.tdb due to a change in tdb. I am not sure if
 > my fix is valid, i.e. if the change you made with dde9f3f006 serves more
 > than "just" a performance optimization.

I can't immediately see any problems with the patch, but we should
check that it doesn't lead to fragmentation problems again.

I think however that the bug report (5684) shows that we have a major
problem with unexpected.tdb. That database should be used only very
rarely. Why is it getting so many packets? 

The purpose of unexpected.tdb is to catch replies that are sent back
by buggy MS servers that always reply to port 137 even when a request
comes from another port. That means it should not get any more packets
than requests we are making from our machine from non-137 ports. If
the database is filling as fast as this bug suggests then it means we
are not filtering what packets go into unexpected.tdb correctly.

Looking at the places we call unexpected_packet(), I think we are
capturing far more packets than we should. There is only any point in
capturing packets to this db if there is some chance that this could
be a packet that matches a request that some process on this machine
sent out. That means for example that we should never put packets in
unexpected.tdb if:

  - they are marked as broadcast packets 
  - they are not marked as being a reply

Do you have a copy of an unexpected.tdb when you saw this bug? If so,
can you look at the packets it contains and see what they are? I bet
they are packets we should never have been putting in there.

Currently the callers of unexpected_packet() seem to be cases where we
just don't know what a packet is for, so we throw it in
unexpected.tdb. That is not the right approach. We need to filter the
packets, and make sure we only put in ones that make sense.

Cheers, Tridge

More information about the samba-technical mailing list