[Samba] Follow-up: smbstatus -p gives multiple identical lines

[Per Dalgas Jakobsen]

It seems to be correlated to SMB3 only:

Sequence:
Client -> Samba: GetInfo Request FS_INFO/SMB2_FS_INFO_07
Samba -> Client: GetInfo Response
Client -> Samba: 55089→445 [ACK] Seq=29007 Ack=49714 Win=8190 Len=0
Client -> Samba: Session Setup Request, NTLMSSP_NEGOTIATE
Samba -> Client: Session Setup Response, Error: 
STATUS_MORE_PROCESSING_REQUIRED, NTLMSSP_CHALLENGE
Client -> Samba: Session Setup Request, NTLMSSP_AUTH, User: DOMAIN/USER 
(samba is not part of domain)
Samba -> Client: Session Setup Response (no text follows, package length 
= 130)
then some repetitions from NTLMSSP_NEGOTIATE

However, I still do not know what smbstatus is trying to tell me with 
the duplicated entries...
The troublesome clients *do* seem to connect and seem to run OK 
(connecting as "nobody").
Clients running SMB2 has no problems, and are represented with one entry 
only.

Does this ring any bells here, and perhaps having a known fix at version 
4.x.y?

~Per

On 01-02-2023 11:23, Per Dalgas Jakobsen via samba wrote:
> I'm tracking down a problem that might be related to how some clients 
> use our Samba server.
> Running Samba 4.6 on an AIX 7.2 (yes, we know it is not the newest, 
> but for now we want to diagnose the existing situation).
>
> Running "smbstatus -p" gives me multiple lines for some processes:
> ---
> 26804526 nobody       nobody       10.70.134.152 
> (ipv4:10.10.134.152:64261)  SMB3_11           - -
> 26804526 nobody       nobody       10.10.134.152 
> (ipv4:10.10.134.152:64261)  SMB3_11           - -
> 26804526 nobody       nobody       10.10.134.152 
> (ipv4:10.10.134.152:64261)  SMB3_11           - -
> 23921110 nobody       nobody       10.10.27.101 
> (ipv4:10.10.27.101:49164)    SMB3_11           - -
> 26804526 nobody       nobody       10.10.134.152 
> (ipv4:10.10.134.152:64261)  SMB3_11           - -
> 26804526 nobody       nobody       10.10.134.152 
> (ipv4:10.10.134.152:64261)  SMB3_11           - -
> 26804526 nobody       nobody       10.10.134.152 
> (ipv4:10.10.134.152:64261)  SMB3_11           - -
> ---
>
> A representative extract of
> root>smbstatus -p | awk '{ print $5, $1 }' | sort | uniq -c | sort -n
> gives:
> ---
>    1 (ipv4:10.10.107.101:50681) 13435622
>    1 (ipv4:10.10.134.169:64346) 21168672
>    1 (ipv4:10.10.18.106:54846) 16122292
>    1 (ipv4:10.10.18.148:55037) 10224334
>    6 (ipv4:10.10.100.45:57811) 19202612
>   11 (ipv4:10.10.19.105:50521) 28181056
>   82 (ipv4:10.10.18.102:58714) 23396860
>  187 (ipv4:10.10.22.105:65346) 27132162
>  214 (ipv4:10.10.19.108:52310) 37290358
>  359 (ipv4:10.10.18.158:58427) 17892066
>  466 (ipv4:10.10.17.103:60698) 22675718
>  774 (ipv4:10.10.134.170:62843) 19530390
>  800 (ipv4:10.10.19.166:52874) 10551728
> 5985 (ipv4:10.10.27.101:49164) 23921110
> 6019 (ipv4:10.10.134.160:50197) 20906548
> 7704 (ipv4:10.10.134.152:64261) 26804526
> ---
>
> If I read the manual it says:
> -p|--processes
>               print a list of smbd(8) processes and exit. Useful for  
> scripting.
>
> How come that the same process (and ip:port) combination gives more 
> than one output line in smbstatus? What does each line represent?
> 7704 identical lines on process 26804526, what would that indicate?
>
> ~Per
>
>