[Samba] Another follow-up: smbstatus -p gives multiple identical lines

[Per Dalgas Jakobsen]

Not only correlated to SMB3, tried to force SMB2 but problem persist.

Are there really nobody here that knows smbstatus well enough to know 
what multiple identical process lines in smbstatus means? Memory and cpu 
usage for the process raise with the amount of identical lines.

~Per

On 2/3/23 18:10, Per Dalgas Jakobsen via samba wrote:
> It seems to be correlated to SMB3 only:
>
> Sequence:
> Client -> Samba: GetInfo Request FS_INFO/SMB2_FS_INFO_07
> Samba -> Client: GetInfo Response
> Client -> Samba: 55089→445 [ACK] Seq=29007 Ack=49714 Win=8190 Len=0
> Client -> Samba: Session Setup Request, NTLMSSP_NEGOTIATE
> Samba -> Client: Session Setup Response, Error: 
> STATUS_MORE_PROCESSING_REQUIRED, NTLMSSP_CHALLENGE
> Client -> Samba: Session Setup Request, NTLMSSP_AUTH, User: 
> DOMAIN/USER (samba is not part of domain)
> Samba -> Client: Session Setup Response (no text follows, package 
> length = 130)
> then some repetitions from NTLMSSP_NEGOTIATE
>
> However, I still do not know what smbstatus is trying to tell me with 
> the duplicated entries...
> The troublesome clients *do* seem to connect and seem to run OK 
> (connecting as "nobody").
> Clients running SMB2 has no problems, and are represented with one 
> entry only.
>
> Does this ring any bells here, and perhaps having a known fix at 
> version 4.x.y?
>
> ~Per
>
> On 01-02-2023 11:23, Per Dalgas Jakobsen via samba wrote:
>> I'm tracking down a problem that might be related to how some clients 
>> use our Samba server.
>> Running Samba 4.6 on an AIX 7.2 (yes, we know it is not the newest, 
>> but for now we want to diagnose the existing situation).
>>
>> Running "smbstatus -p" gives me multiple lines for some processes:
>> ---
>> 26804526 nobody       nobody       10.70.134.152 
>> (ipv4:10.10.134.152:64261)  SMB3_11           - -
>> 26804526 nobody       nobody       10.10.134.152 
>> (ipv4:10.10.134.152:64261)  SMB3_11           - -
>> 26804526 nobody       nobody       10.10.134.152 
>> (ipv4:10.10.134.152:64261)  SMB3_11           - -
>> 23921110 nobody       nobody       10.10.27.101 
>> (ipv4:10.10.27.101:49164)    SMB3_11           - -
>> 26804526 nobody       nobody       10.10.134.152 
>> (ipv4:10.10.134.152:64261)  SMB3_11           - -
>> 26804526 nobody       nobody       10.10.134.152 
>> (ipv4:10.10.134.152:64261)  SMB3_11           - -
>> 26804526 nobody       nobody       10.10.134.152 
>> (ipv4:10.10.134.152:64261)  SMB3_11           - -
>> ---
>>
>> A representative extract of
>> root>smbstatus -p | awk '{ print $5, $1 }' | sort | uniq -c | sort -n
>> gives:
>> ---
>>    1 (ipv4:10.10.107.101:50681) 13435622
>>    1 (ipv4:10.10.134.169:64346) 21168672
>>    1 (ipv4:10.10.18.106:54846) 16122292
>>    1 (ipv4:10.10.18.148:55037) 10224334
>>    6 (ipv4:10.10.100.45:57811) 19202612
>>   11 (ipv4:10.10.19.105:50521) 28181056
>>   82 (ipv4:10.10.18.102:58714) 23396860
>>  187 (ipv4:10.10.22.105:65346) 27132162
>>  214 (ipv4:10.10.19.108:52310) 37290358
>>  359 (ipv4:10.10.18.158:58427) 17892066
>>  466 (ipv4:10.10.17.103:60698) 22675718
>>  774 (ipv4:10.10.134.170:62843) 19530390
>>  800 (ipv4:10.10.19.166:52874) 10551728
>> 5985 (ipv4:10.10.27.101:49164) 23921110
>> 6019 (ipv4:10.10.134.160:50197) 20906548
>> 7704 (ipv4:10.10.134.152:64261) 26804526
>> ---
>>
>> If I read the manual it says:
>> -p|--processes
>>               print a list of smbd(8) processes and exit. Useful for  
>> scripting.
>>
>> How come that the same process (and ip:port) combination gives more 
>> than one output line in smbstatus? What does each line represent?
>> 7704 identical lines on process 26804526, what would that indicate?
>>
>> ~Per
>>
>>