SMB Ioctl Response, Error: STATUS_NOT_FOUND

asked 2021-03-05 23:20:04 +0000

sonacanada
1 ●1 ●1 ●2

updated 2021-03-06 17:06:14 +0000

Hi,

I have an error "Ioctl Response, Error: STATUS_NOT_FOUND" and wish to know the reason.

Please note the share is indeed available, but users reported intermittent access issue. Looking at the logs, you can see the issue at the time when the user could not connect, but need to figure out the reason. Not sure if there are more details somewhere pointing me at something.

I read this from the SMB Header NT Status.

1151    18.928199   10.155.201.xx   10.155.10.xx    SMB2    256 Ioctl Request FSCTL_DFS_GET_REFERRALS, File: \INxxxxx\data\Shared\Mumbai\Training

1152    18.929438   10.155.10.xx    10.155.201.xx   SMB2    130 Ioctl Response, Error: STATUS_NOT_FOUND

answered 2021-03-07 16:36:32 +0000

Eddi

2379 ●8 ●48 ●59

File shares accessed by SMB, SMB2 or SMB3 can be replicated over multiple servers. The underlying shares are arranged in a name space. The Microsoft documentation on DFS discusses this topic in detail.

When accessing a share, the client tries to find out, if the share is available through DFS. This query is made using the Ioctl Request, that you have recorded. If the share is indeed part of a DFS name space the response includes all servers, that host the share. The client will then pick one of the servers and access the files as desired.

At least on Server 2008, the server will responds with STATUS_NOT_FOUND if the share is not DFS enabled. On other SMB2/3 implementations you might observe a response with an empty array in the out data section.

The short snippet from your trace file would only be troublesome if your share is DFS enabled.

Good luck

Eddi

edit flag offensive delete link

Comments

Hi Eddi,

Thank you for the details.

The issue is that we see this randomly and since we added some new 2019DCs to our 2012R2 DCs.

We have gone through many different checks and nothing obvious showed up.

Our last resource was Wireshark and we noticed the errors that we posted here.

This very particular share "\INxxxxx\data\Shared\Mumbai\Training" is not being replicated to other servers. in fact we have one out of many shares, that is being replicated to other sites.

So DFS\Namespace usage is applicable to all shares, however, DFSR (the replication side), is only applicable to one share.

Not sure if the above explanation along with the errors in the logs can give you a better view to assist further.

User do get this error randomly at a random time, we even disconnect 2019DCs at some point, but the issue still persists, sometimes no ...(more)

sonacanada ( 2021-03-08 16:33:01 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

SMB Ioctl Response, Error: STATUS_NOT_FOUND

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

SMB Ioctl Response, Error: STATUS_NOT_FOUND edit

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

SMB Ioctl Response, Error: STATUS_NOT_FOUND