These are change notification messages to Explorer to tell it that
something has changed and it needs to refresh. They should occur
when, for example, a new file is created. Explorer requests such
notifications. When you shut down Explorer it stops requesting
these notifications and hence you stop seeing the traffic.


On 04/13/10 06:19 AM, Kasper Bræmer-Jensen wrote:

First post here, but I've been lurking zfs-discuss the past 3 months.

I'm having a very strange problem with one of my CIFS shares. Other shares are working just perfectly. When I browse my share from a Windows XP (x64, latest SP and updates), i instantly see some very odd traffic that starts pretty much instantly. As soon as I close down Explorer or goes to another share, the traffic stops and everything works fine again.

I see around 5-10Mbit of traffic, and thousands (~10K/second) of tiny small packets are transmitted back and forth, for every workstation/client. This is generating a lot of interrupts on the fileserver, raising the load, all for no obvious reason.

When I first saw this happening, I thought it could be some kind of indexing thing going on, or generating some media preview of the data on the server, or similar. But after looking at packets (and considering the huge amount of packets getting transferred), I think it might be some kind of CIFS bug.

A quick video of what's happening is here:

and a dump of some of the packets, grabbed on the Windows client ( <>) is here:

The server is an OpenSolaris (snv_133) with "zfs set sharesmb=on pool/fs" set.

Any ideas on what I could do about this? This started happening out of nowhere, from day to day, and it's somewhat a deal-breaker for us, for running OpenSolaris. Currently, with ~8-10 users browsing shares, I see around 100K interrupts per second on the server.

kind regards,

cifs-discuss mailing list

cifs-discuss mailing list

Reply via email to