i5/OS Netserver performance

[Tom.VanLooy at lisis.be]

> So in this case, you would need to compare the same operation
> from a client against a Windows server and Netserver and see
> where the network traffic differs (or starts to diverge).

When I access a Samba server (3.0.22-11-SUSE-CODE10) on Linux (test 
machine).
Everything goes over port 139. It starts with a classic TCP handshake.
I have exactly the same behaviour when I connect to a Windows 2003 server.

When I access a Netserver on i5/OS (v5r4). It starts with some 
communication on port 111.
First sends a [SYN] to port 111. The server responds several times with 
[RST][ACK].
Which means the port is closed, nmap confirms this :-)

Then it connects to port 445 and 139, the server accepts both connection.
  - Next the client sends a [RST] to port 139.
    It does this a few times and at the end I see a session request.
  - On port 445 the client negotiates the protocol which looks like:
    "PC NETWORK PROGRAM1.0 LANMAN1.0 Windows for Workgroups 3.1a LM1 2X002 
LANMAN2.1 NTLM 0.12"
    Next it sends a session request but the server replies with "access 
denied".
    This also happens several times, and at the end the server responds 
with "tree accept".
    Next I see a lot of replies "operation not supported" as response to 
"path \spoolss and path \wkssvc".

Compared to the Linux trace the 445 traffic (i5/OS) seems compable to the 
139 traffic (Linux), only Linux has less errors.
One thing more thing about the (small file) download itself:
  - Linux sends packets of size 1514
  - i5/OS sends packets of size 1506

>From IBM's standpoint, I understand that they point to the Microsoft 
client.
Because, I can't see in the traces why it connects to different ports in 
the first place.
Maybe Jeremy or Volker can comment on that?

Kind regards,

Tom