Ask Your Question
0

need help to understand trace Issue with SMB File Access Slowness from Windows 10 Client

asked 2019-05-30 21:57:39 +0000

None
edit retag flag offensive close merge delete

Comments

So what is the issue and where is the trace? Without that, we can't give you any help.

Guy Harris gravatar imageGuy Harris ( 2019-05-31 01:01:10 +0000 )edit

Hi Guy,

Thanks for prompt response. Please find the link for trace - https://drive.google.com/file/d/1BYqu...

Rishi Raval gravatar imageRishi Raval ( 2019-06-04 15:07:36 +0000 )edit

A little bit hard to tell. Because you have taken the capture on a local machine with offloading functions enabled and there is also no tcp handshake inside the trace. But it seems you have packet loss and combined with an estmated RTT > 10ms could it be the root cause of your issue.

Christian_R gravatar imageChristian_R ( 2019-06-04 19:34:28 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted
0

answered 2019-06-05 08:04:43 +0000

Paulus gravatar image

Hi Guy,

I can agree with Christian re Offloading functionality.

ran the following Display Filter to "ip.addr==10.50.3.53 && ip.addr==10.50.78.91" to display all the SMB traffic. When I enable the Expert Information, we can see a high volume of Duplicate ACK's and Out-of-Order Segments. Not sure if this could also be a possible cause?

From a Win10 perspective, what version are you using (there are various Win10 Builds). When I analysed the SMB2 Response Time, we could see 170x Reads, 46x Create's, 43x Close's, 16x GetInfo to name a few. Also, ensure you have the appropriate SMB features installed (e.g. remove SMB1).

Are you able to perform the same test on another PC to test the extent of the issue.

Hope this info is helpful.

edit flag offensive delete link more

Comments

Found the following SMB 2 Errors:

Info

Create Response File: delta.pvt\\***\\Clients;Find Response;Find Response, Error: STATUS_NO_MORE_FILES
Ioctl Response, Error: STATUS_FILE_CLOSED
Create Response File: ***\\Draft;Ioctl Response, Error: STATUS_NOT_A_REPARSE_POINT
Create Response File: ***\\Draft;Find Response;Find Response, Error: STATUS_NO_MORE_FILES
Create Response File:***\Draft;Ioctl Response, Error: STATUS_NOT_A_REPARSE_POINT
Create Response File: ***\\Draft;Find Response;Find Response, Error: STATUS_NO_MORE_FILES
Read ResponseCreate Response File: ***\\Draft;Ioctl Response, Error: STATUS_NOT_A_REPARSE_POINT
Ioctl Response, Error: STATUS_FILE_CLOSED
Create Response File: ***;Find Response;Find Response, Error: STATUS_NO_MORE_FILES
Find Response;Find Response, Error: STATUS_NO_MORE_FILES
Find Response;Find Response, Error: STATUS_NO_MORE_FILES [TCP segment of a reassembled PDU]
Find Response;Find Response, Error: STATUS_NO_MORE_FILES
Create Response File: ***\\Draft;Find Response;Find Response, Error: STATUS_NO_MORE_FILES
Create Response, Error: STATUS_OBJECT_PATH_NOT_FOUND
[TCP Previous segment not captured] Notify Response, Error: STATUS_PENDING
Notify Response, Error: STATUS_PENDING
Find Response;Find Response, Error: STATUS_NO_MORE_FILES
Create Response, Error: STATUS_OBJECT_NAME_NOT_FOUND
Create Response, Error: STATUS_OBJECT_NAME_NOT_FOUND
Find Response;Find Response ...
(more)
Paulus gravatar imagePaulus ( 2019-06-05 08:10:51 +0000 )edit

Edited the comment above: Anonymized it a little bit.

Christian_R gravatar imageChristian_R ( 2019-06-05 19:47:30 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2019-05-30 21:57:39 +0000

Seen: 61 times

Last updated: Jun 05