How to capture packets when you need to solve nasty Mac OS X crediting problems

Richard Sharpe realrichardsharpe at
Fri Nov 30 16:20:13 UTC 2018

Hi folks,

I have had a frustrating time over the last couple of months trying to
track down a problem a company brought to me.

The problem was with Mac OS X only, and manifested itself as dropped
TCP connections during IO Verification and Benchmark tests, although
they also said customers were seeing the issue.

They said that messages like the following would appear in the Samba log:

[2018/10/02 09:22:29.926391,  0]
  smb2_validate_sequence_number: bad message_id 4047 (sequence id
4047) (granted = 8, low = 1999, range = 2048)

Captures taken from the clients also showed that Samba had stopped
handing out credits and eventually the Mac dropped the connection.
However, we were never able to get a capture without any dropped

In looking at the source it seemed obvious that the issue was
something Mac OS X was doing, but I could never get a complete

Then when I was in Vienna at Sharkfest Europe I became aware of the
Cubro EX2 series, so I purchased one (they had discounted it for the

I finally got to use it on the problem yesterday, and it captured
every packet for me. I had to use two laptops to sink the packets (one
for each direction) but that was OK.

They are great devices and well worth the money when you are looking
at difficult problems.

I have forwarded the evidence to Apple so we should see a fix for the
issue some time.

See for the details.

Richard Sharpe

More information about the samba-technical mailing list