[Samba] What's "NT Trans Response : STATUS_CANCELLED", and why does it take so long?

[Jeremy Allison]

On Mon, Sep 22, 2008 at 09:37:13AM +1200, David Young wrote:
> Hi folks,
>
> I have a samba 3.0.25b server running on Centos 4.6. My users complain  
> of intermittent responsiveness issues, but I haven't been able to  
> identify the problem. I've done some traffic dumps with tethereal, and  
> have run them through Wireshark's "Service Response Time" report. I've  
> identified several packets identified like this:
>
> "SMB	NT Trans Response, FID: 0x2c1e, NT NOTIFY, Error: STATUS_CANCELLED"
>
> What I'm unsure about is this line in the SMB Header:
>
> "Time from request: 458.719370000 seconds"
>
> Can anybody explain to me what this "NT Notify" packet is saying, and  
> whether a large time-from-request is to be expected?

An NT Notify packet is a requests notification when a directory
is changed. Hence it can be a long time from when the packet is
sent to when the notify replies (if it ever does).

The unresponsiveness is not to do with this packet. Try upgrading
to 3.2.4 - there have been so many changes since 3.0.25b it isn't
funny :-).

Jeremy.