SMB2 - Suddenly only small block sizes requested by client
Dear lovely community,
one of our clients has problems with his file transfers (from 50Mbit/s to 0,7Mbit/s), which suffer from suddenly decreasing block read sizes (from more than 1MB to 4kb) beginning in the middle of TCP stream graph. Only about 4 TCP errors before, nothing special here. Any idea why this happens?
Stream Graph and Packets
Can somebody read those SMB credit graphs? Maybe graphs, because maybe its related to that? Seems like client stops requesting credits, but why would a client do so?
SMB Credits
Windows 10 Client, Server 2016 in Azure Cloud.
I cannot upload pcap anonymously without erasing SMB payload. Tracewrangler would delete whole payload and this file then would be useless for you in terms of SMB analysis. But pictures should give you a good indication.
Thank you!