 | 1 | initial version |
For me this looks like a application issue caused by a Riverbed Steelhead:
The capture (I inspected tcp.stream==426) shows no issue up to the TCP layer. Everything is acknowledged fine. There is only problems at the application layer.
The capture looks like it has been taken at the client site (10.254.164.X). The Ethernet source MAC is a Riverbed device. When you take the capture at the server (10.254.188.133) site, chances are pretty high you spot the Riverbed Steelhead also with specific TCP option in use.
=> Check with your Network team if a Riverbed Steelhead is involved in the data flow and if it is running the latest RIOS version. I know of some issues with SMB3 traffic with older versions.
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
