[Samba] What controls the Read AndX Request byte size?

[Steven Cardinal]

On 9/29/06, Jeremy Allison <jra at samba.org> wrote:
>
> On Fri, Sep 29, 2006 at 08:45:08AM -0400, Steven Cardinal wrote:
> > In trying to track down some performance issues, I'm finding with
> Ethereal
> > that, when I launch an application from my Windows server, the SMB Read
> AndX
> > Request packets have Min Count, Max Count Low, and Remaining all at 512
> > bytes. When launching the same application on the same client from a
> Win2000
> > share, these requests are coming in much larger sizes (4096 and 32768
> were
> > both observed). This is making a huge difference in the launch speed of
> the
> > application (an in-house VB app).
> >
> > My question is, what smb.conf or kernel parameters could be influencing
> the
> > 512 byte read request? I tried setting various socket options in
> > smb.confand haven't seen a change. I am running Suse
> > 10.0 with their 3.0.20b samba packages (except we recompiled to include
> > idmap_rid).
>
> Looks like Windows has decided you're on a WAN link, not a
> LAN link. I'd check MSDN on the web for registry settings
> affecting this. (Can't remember them offhand).
>
> Jeremy.
>

Thanks Jeremy. Since posting, I've continued to run some more network traces
and have found some odd results.

If I run another program, for instance the VNC viewer or a compiled perl
program we have, request sizes vary but are typically high (4096, 32968,
etc). Thus performance is high. If I run any of our VB apps (VB 6) it uses
512 bytes. If I run one of our VB.Net (2.0) apps, it starts with varying and
large byte sizes, but once it starts reading dlls from the drive, it reverts
to 512!

So, it appears that if I use an app written in a Microsoft language it
intentionally goes slower? That seems too 'conspiracy theory' for me, but
it's all I can see right now. As I type this I tried using Word (installed
locally) to open a 1.5 Mb document on the samba server. Once I get a FID
(I'm assuming that's kind of a file handle), all of the read requests are
512 until maybe the last couple of packets (I'm not a pro at debugging SMB
packets) which jump to 4096.

Could some MS library be using server info (announce version, perhaps) to
determine if this is a true Windows system or not? I could certainly try
changing the announce version, but would that break anything? This is a
production box, so i'm loathe to make too crazy of a change without knowing
the ramifications.

I did see a posting recently about a similar problem with ARCView that
related to kernel oplocks and level2 oplocks. Since this is Linux, I tried
disabling the kernel oplocks and have tried oplocks on the share both on and
off with no change.
Thanks
Steve