Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

Hi Chad

Hopefully the answer is not too late.

When investigating SMB response times, SMB Notify is usually not a problem. "Notify" is the servers way to tell the client "Hey, that directory you are looking at has changed".

When you open an Explorer window you want to see changes to the directory content. The client tells the server "Hey, Notify me when something happens with this directory". 40 seconds later an other applications adds a new file to the directory. That's when the Notify messages comes in with a matching response time.

Hope that helps, happy sniffing