[Samba] lockups with windows 2000 client, every 15 minutes or so

[Daniel Resare]

I have just entered the wonderful world of windows filesharing at my 
small home LAN and I'm experiencing the following problem: When I 
continually listen to ogg files in Windows 2000 Server from a samba 
server the music locks up every 15 minutes or so. Everything in the 
windows gui suffers from terrible preformance until i get to disconnect 
the share from the samba server, then everything starts to work ok 
again. When I then try to "map network drive" again the connection fails 
with the informative message.

Since I'm used to being able to solve my problems by myself, I tried to 
debug the problems. First some reality check things:

- When I reboot the windows client into XP everything works without problems
- I can not detect any IP connectivity problems between the Windows 2000 
client and the samba server, i'm running ssh connections between the boxes.
- I have tried running samba on two different linux boxes with Red Hat 
7.3 (kernel 2.4.18-24.8.0) and Red Hat 8.1beta (kernel 2.4.20-2.21) 
respectively, both with the problem described above. (Exact samba 
versions: samba-2.2.7-1.7.3 and samba-2.2.7a-5.)
- I have also tried samba-3.0alpha2 with no luck
- I have tried with the ususal security = user, and with the samba 
server configured as PDC
- I have replaced the switch between the computers with an old 10 mbit/s 
hub, no change
- There are no firewall configurations or packet filters on the linux 
machines. AFAIK that's true for the Windows 2000 client also.

Now to the interesting part. When playing around with 'nbtstat' in 
Windows 2000, i found out that the windows computer fails to resolve the 
name of the samba server after it has locked up. After a couple of 
minutes, the name resolving starts working again. The network seems to 
be in two states, one broken (where windows can not find the share or 
transfer any data to my ogg player) and one working. The network alters 
between these two states every 15 minutes or so.

The minimal testcase that I use is to resolve the hostname of the samba 
server (ulysses) with the command 'nbtstat -a ulysses' in the Windows 
command line. When the network is in "working state", i get a copule of 
replies to that question in about 0.1 seconds. When the network is 
broken, I get "Host not found" after a short timeout (perhaps 3 seconds).

Looking at the network activity in ethereal when issuing the nbtstat 
command I find that in broken state the server doesn't answer to the 
"NBNS Name query NBSTAT ULYSSES<00>" packet. The client sends 3 packets 
to the server but none gets answered. Samba doesn't print a single line 
in the logfiles at log level = 10 as a response to the recieved packets 
on UDP/137.

This leaves me with two alternatives. 1) nmbd gets the packet but drops 
it for some reason, 2) the kernel doesn't deliver the packet to nmbd for 
some reason. The ethereal dumps makes it quite clear that UDP packets 
are sent by the client, transferred over the ethernet and recieved by 
the server. So, where do they go?

I hope that anyone can bring some light into this matter, or at least 
give me some input on where I can continue to look when debugging.

cheers
/noa