Slow Network - Wireshark Results - STATUS_FILE_IS_A_DIRECTORY

asked 2019-02-20 13:50:17 +0000

bitchilly gravatar image

A client was recently complaining of slow network speeds.

I ran Wireshark and it seem the network is being overwhelmed by SMB2 instances;

Client IP > Server IP - SMB2 - Create Request File:

Follwed by

Server IP > Client IP - SMB2 - Create Response, ERROR : STATUS_FILE_IS_A_DIRECTORY


There are literally hundreds of these per minute, per user which is completely overwhelming the network.

After a bit of investigation they seem to be linked to having mapped drives, as soon as I disconnect the mapped drives the errors stop.

The user doesn't even have to be doing anything, you can log in and just leave the machine alone but it continues to spam these errors, the errors seem to be one per mapped drive, if they have 8 mapped drives they get 8 errors, 2 mapped drives they get 2 errors etc etc.

I have clients that are Windows 7 and Windows 10 so it doesn't seem to be linked to a particular OS.

So far I've tried;

Ensuring Windows Server up to date Mapping drives based off FQDN and IP Mapping drives from different drives on the server (C: and D Trying a test mapped drive which is a completely empty folder and is open to all users Mapping the drives via GPO and Logon Script and Manually Removing the AntiVirus Disabling Firewall Running CHKDSK on all server drives Running virus and malware scans on server Logging into client machines as administrator Moving client machine into an OU with no active group policies

None of these things have changed anything at all

I've attached the Wireshark results from both the create request and then the error.

Does anyone have any idea what I'm dealing with?


edit retag flag offensive close merge delete


It would appear I can't add attachments and pasting my results are very poorly formatted.

If anyone think they can help I can email the files.


bitchilly gravatar imagebitchilly ( 2019-02-20 13:52:06 +0000 )edit

Put the file on a public share somewhere and then update your question with a link to the file.

grahamb gravatar imagegrahamb ( 2019-02-20 13:55:16 +0000 )edit
bitchilly gravatar imagebitchilly ( 2019-02-20 14:01:07 +0000 )edit

Have done, sorry, wasn't thinking!

bitchilly gravatar imagebitchilly ( 2019-02-20 14:01:32 +0000 )edit

@bitchilly, Please don't post comments as "answers". I've moved them to the correct place. Answers are for actual answers to the question.

grahamb gravatar imagegrahamb ( 2019-02-20 14:05:07 +0000 )edit