Revision history [back]

Unfortunately the screenshot shows only one side of the communication (client to server).

I understand from your question that the "freezes" affect every client at the same time. Unfortunately your screenshot only shows traffic from the server to the client. Since the timestamps in the screenshot don't match your question we hardly give any comment. You have tagged the question DFS, but didn't give further information in the question. We get back DFS later.

Only one server affected?

You didn't mentioned it, but I assume that no other servers in that network segment are affected. If the freezes affect other servers as well I suggest to check the network topology (flapping interfaces, problems in the spanning tree, routing, maybe a load balancer ...).

Catastrophic events mentioned in the event logs?

Assuming that the symptoms only occur on one server I suggest to take a look at the server itself. Start by examining the event logs. Application and system event logs are the first, but take your time to browse through the other event logs as well.

• Do you see anything indicating hardware problems? Disk and controller errors are logged to the system event log.
• Do you experience blue screens? If yes you would find the files C:\Windows\Memory.dmp and more files in C:\Windows\Minidump. Fix all hardware- and driver problems before spending too much time on other topics.

Check the network configuration

My next recommendation is a look at the network interface:

• Do you have a flapping network interface? Double check with the log file / console of the servers access switch.
• If the server uses multiple network interfaces: Does the teaming configuration for the server match the configuration for the switch?

Basic checks

Next take a look at the server itself:

• Do you have problems with "flapping devices" on the server? Say, an external device (thumb drive, tape etc.) is reported as plugged in and removed? If yes, the server might be busy handling these events and cannot respond to the clients.
• Do you have a run-away process that is hogging the CPU?

Steady network?

If you want to continue troubleshooting from the network side I suggest to take a trace file from the server side. I would recommend to use a SPAN port to capture the traffic. Do not install Wireshark on the server. Take a look at the network capture playbook for detailed instructions: https://blog.packet-foo.com/2016/10/the-network-capture-playbook-part-1-ethernet-basics/

DFS The question is tagged "DFS". Unfortunately we don't get any details.

DFS clients will query the server if a share is mounted through DFS. If yes, the client will ask for the servers that host this share. The client might switch to another, better suited server to share the load.

The client can also switch to another DFS server later. The user wouldn't notice anything. Again, time outs can occur if the connection another server fails. The client side trace should show the failed connection attempts. This should not affect all clients at the same time.

DFS "abuse"

DFS is great for a certain type of data. It is less useful for large files or large directories that are frequently changed. Imagine 100 clients frequently appending data to 100 different files on a DFS share: The servers would soon be busy replicating these changes to the other DFS servers.

Please check the namespace configuration with your server administrators. The replication should be visible in a trace take on the server side. You might see RPC (File Replication Service) in the mix.

Trace file, please

If at all possible, please share the trace file. Working from screenshots is cumbersome at best.

Good luck

Eddi