2

I'm having some serious problems locating a slowdown, and I hope you could assist me with this.

We have an office network with ~50 clients and a main file server running Windows Server 2008 R2 Standard (SP1). For one specific client (Windows 7, SP1) accessing the network shares can become painfully slow at times, and this can only be fixed by restarting the computer. Now the problem is that we have switched out the actual computer and the problem still persists. The new computer is of the same make and model, but we have a number of those in the office and they have not experienced this problem.

Have also tried to change all the related network cables, as well as using different ports on the switch. I've also tried logging in as a different AD user to no avail.

I've ran WireShark on the client computer as well as my own for comparison and the SMB packets are 10-1000 times slower on the affected computer, however only while being sent to the file server. All SMB packets sent to the server (from my test computer as well as the affected one) have a bad header checksum, if that matters.

This is not my main area of expertise, and so am I am having a hard time parsing the WireShark log except by comparing it to a different one and seeing the differences in elapsed time between packets. Basically I'm not sure where to look for a problem cause, just the effects.

Below are statistics of the bytes-per-tick for the two computers, for some basic navigating around and copying a small (~100kb) file to the desktop from the network disk. Doing the same thing over FTP yields normal results for both computers.

http://www.kommunicera.se/public/bytes-per-tick.png

PCAP files are here (small) and here (big).

Note that the two dumps in pcap-2.zip are from the same computer, but one is when it's acting normal and one when it's experiencing slowdowns (dumps captured minutes apart).

Greg Askew
  • 35,880
  • 5
  • 54
  • 82
Anders Arpi
  • 121
  • 6
  • The "bad header checksum" is the effect of an [optimization feature of your client's nics](http://wiki.wireshark.org/TCP_Checksum_Verification), nothing to worry about. Could you upload the pcap(s) to some web space available to you or a one-click-hoster? – the-wabbit Feb 03 '12 at 10:41
  • I figured that wasn't the problem, good to know - thanks. Edited my question with link to pcap files for both normal and slow client. Thanks for taking the time! – Anders Arpi Feb 03 '12 at 10:45
  • I am somewhat confused about your affected-big-dump capture - the only transferred file I can find is the Jula fe-sv\Index03.swe.mtx towards the end of the capture. And this one is around 35K in size and transfers with about 2MB/s (although requested 2 times, as it seems). Could you do a larger file copy and dump this as well? – the-wabbit Feb 03 '12 at 13:06
  • Added a second link in the question. – Anders Arpi Feb 03 '12 at 13:33
  • try install another file sharing protocol like scp so you can get a baseline. I've had the same problems with smb in the past, we switch to nfs and never had any more problems. – The Unix Janitor Feb 03 '12 at 14:16
  • I still have difficulty seeing your problem - the "big" *slow-dump* shows decent transfer rates (around 12 MB/s for VirtualBox-4.1.8-75467-Win.exe) towards the end of the capture and a couple of small / partial file requests (too small or fragmented to notice any kind of performance impedement) at the beginning. Do you have any more details about where you did see the slowdown? – the-wabbit Feb 06 '12 at 11:02
  • Hello again, the slowdown is experienced in all aspects of using file shares - navigating, creating folders, moving files, copying files. Everything is a lot slower. – Anders Arpi Feb 06 '12 at 11:31
  • Apparently the problem can be (temporarily) fixed by restarting the NIC (disable / enable in the hardware manager). – Anders Arpi Feb 06 '12 at 12:22

1 Answers1

0

Figure I'd update this with the solution we ended up with.

For some reason the specific Broadcom NIC driver we had was causing this problem - all the computers affected had the same NIC and the same driver version. Updating to the latest driver solved the entire issue.

Anders Arpi
  • 121
  • 6