[Samba] smbclient 4.0.7 fails transfer with STATUS_INVALID_PARAMETER and SMB2 but not with NT1

[Tompkins, Michael]

We get STATUS_INVALID_PARAMETER failures when smbclient uses SMB2 but passes with NT1. We do get some success, but mostly failures.  It appears to happen after it transfers the PDF file.

These are the packets leading up to SMB2 failing after the transfer:

No.     Time                          Source                Destination           Protocol Length Info
    266 2015-04-09 08:30:43.688568000 10.5.12.227           10.6.161.184          TCP      1514   [TCP segment of a reassembled PDU]

No.     Time                          Source                Destination           Protocol Length Info
    267 2015-04-09 08:30:43.688696000 10.5.12.227           10.6.161.184          TCP      1514   [TCP segment of a reassembled PDU]

No.     Time                          Source                Destination           Protocol Length Info
    268 2015-04-09 08:30:43.688699000 10.5.12.227           10.6.161.184          SMB2     627    Write Request Len:72845 Off:0 File: scsmuser\Scan\DOC002.pdf

No.     Time                          Source                Destination           Protocol Length Info
    269 2015-04-09 08:30:43.688701000 10.6.161.184          10.5.12.227           TCP      66     445→35119 [ACK] Seq=1611 Ack=74211 Win=26704 Len=0 TSval=1545474022 TSecr=464076

No.     Time                          Source                Destination           Protocol Length Info
    270 2015-04-09 08:30:43.729116000 10.6.161.184          10.5.12.227           TCP      66     445→35119 [ACK] Seq=1611 Ack=74772 Win=26704 Len=0 TSval=1545474063 TSecr=464077

No.     Time                          Source                Destination           Protocol Length Info
    271 2015-04-09 08:30:43.758999000 10.6.161.184          10.5.12.227           SMB2     143    Write Response, Error: STATUS_INVALID_PARAMETER

This is happening at a remote site, and we are not able to recreate it here. Does anyone have any input as to why this may be happening. I do have a wireshark trace if you’d like.

Mike Tompkins