[Samba] Windows SMB2 client doing excessive, inefficient SMB2 Find (and other) requests

[Ralph Böhme]

Andreas,

On Thu, Aug 24, 2017 at 03:37:07PM +0200, awl1 via samba wrote:
> Before I follow your advice to move this whole issue/topic to the
> samba-technical alias and start over there with a clean description of the
> scenario and the findings, I have two simple questions:
> 
> 1) I plan to use a new, reproducible test scenario with 2000 random small
> files with a file length between 1 and 2048 bytes, created along the lines
> of the following:
> 
> for i in $(seq -f "%04g" 1 2000) ; do
>   length=`shuf -i 1-2048 -n 1`
>   head -c $length < /dev/urandom > file${i}.rnd
> done

This is overly complicated for this I guess, a simple touch file$i should do it.

> in order to make test data non-confidential (unfortunately, my previous test
> files/packet traces were confidential). Do you agree that the above
> procedure is fine to create the test scenario?
> 
> 2) What about confidential data from SMB/SMB2 sessions (i.e. Samba
> usernames/passwords)? What do I meed to do to filter all information from
> Wireshark traces that points to users and passwords?

Passwords are not send over the wire, the user name is as are IP addresses. Use
a test user and setup VMs is a private test network if you care.

> More specifically, would filtering all SMB2 "SessionSetup" request and
> response packets from Wireshark traces be sufficient to do so? What about
> machine names/IP addresses from my LAN? Any other such IP addresses/machine
> names contained in any packets other than (obviously) those of my particular
> SMB2 client and Samba server (and Windows SMB2 server to compare)?

For the trace it's okay if it starts with the reproducer without session setup. 

If you can send a brief description of the issue alongside the traces to
samba-technical, I can try to get this to the right people.

Cheerio!
-slow