Long Delays in DFS Namespace Referral Requests

Discussion:

(too old to reply)

tstumpf

2009-07-29 21:52:44 UTC

I have been having this trouble for a while now, and I have an open
case with Microsoft support to work on this issue, but so far, we have
not been able to solve this.

When accessing a DFS namespace share, if the share has not been
accessed recently (within the referal cache timeout period) there will
be a long 20+ second delay from the time you try to open the share to
when the contents of the share are displayed on the screen.

We have done some extensive network traffic capturing, and we have
found that there is a delay of about 20 seconds from the DFS Referral
Request to the DFS Referral Response, with very little else happening
between. Below is a sample of the packet capture. -- You will see
that the DFS Referral Request is at time-offset 5.593750, but there is
no DFS Referral Response until time offset 26.796875

Has anyone else seen this, or have any good suggestions where to look
for clues to this problem?

Thanks for your help...
Tim S.

14 0.656250 {SMB:4, TCP:3, IPv4:2} X.X.70.164 X.X.64.133 SMB SMB:R;
Transact2, Query Path Info - NT Status: System - Error, Code = (599)
STATUS_PATH_NOT_COVERED
17 0.812500 {TCP:3, IPv4:2} X.X.64.133 X.X.70.164 TCP
TCP:Flags=...A...., SrcPort=2176, DstPort=Microsoft-DS(445),
PayloadLen=0, Seq=309205136, Ack=2417774680, Win=64041
71 5.578125 {TCP:3, IPv4:2} X.X.70.164 X.X.64.133 SMB SMB:R;
Transact2, Unhandled Transact2 Subcommand; Warning: May not parse
correctly when Transaction2 request is missing
75 5.578125 {SMB:18, TCP:3, IPv4:2} X.X.64.133 X.X.70.164 DFS DFS:Get
DFS Referral Request, FileName: \gf\shares\Administration\Data\,
MaxReferralLevel: 4
88 5.593750 {SMB:23, TCP:3, IPv4:2} X.X.64.133 X.X.70.164 SMB SMB:C;
Transact2, Query Path Info, Query File Basic Info, Pattern = \gf
\shares
89 5.593750 {TCP:3, IPv4:2} X.X.70.164 X.X.64.133 TCP
TCP:Flags=...A...., SrcPort=Microsoft-DS(445), DstPort=2176,
PayloadLen=0, Seq=2417774976, Ack=309205374, Win=64834
90 5.593750 {SMB:23, TCP:3, IPv4:2} X.X.70.164 X.X.64.133 SMB SMB:R;
Transact2, Query Path Info, Query File Basic Info
91 5.593750 {SMB:24, TCP:3, IPv4:2} X.X.64.133 X.X.70.164 SMB SMB:C;
Transact2, Find First2, Both Directory Info (NT), Pattern = \gf\shares
\Administration
92 5.593750 {SMB:24, TCP:3, IPv4:2} X.X.70.164 X.X.64.133 SMB SMB:R;
Transact2, Find First2, Both Directory Info (NT)
93 5.593750 {SMB:25, TCP:3, IPv4:2} X.X.64.133 X.X.70.164 SMB SMB:C;
Transact2, Query Path Info, Query File Basic Info, Pattern = \gf\shares
\Administration
94 5.593750 {SMB:25, TCP:3, IPv4:2} X.X.70.164 X.X.64.133 SMB SMB:R;
Transact2, Query Path Info, Query File Basic Info
95 5.593750 {SMB:26, TCP:3, IPv4:2} X.X.64.133 X.X.70.164 SMB SMB:C;
Transact2, Find First2, Both Directory Info (NT), Pattern = \gf\shares
\Administration\Data
96 5.593750 {SMB:26, TCP:3, IPv4:2} X.X.70.164 X.X.64.133 SMB SMB:R;
Transact2, Find First2, Both Directory Info (NT)
101 5.718750 {TCP:3, IPv4:2} X.X.64.133 X.X.70.164 TCP
TCP:Flags=...A...., SrcPort=2176, DstPort=Microsoft-DS(445),
PayloadLen=0, Seq=309205786, Ack=2417775556, Win=64512
588 26.796875 {SMB:18, TCP:3, IPv4:2} X.X.70.164 X.X.64.133 DFS
DFS:Get DFS Referral Response, NumberOfReferrals: 1 VersionNumber: 4
593 26.953125 {TCP:3, IPv4:2} X.X.64.133 X.X.70.164 TCP
TCP:Flags=...A...., SrcPort=2176, DstPort=Microsoft-DS(445),
PayloadLen=0, Seq=309205786, Ack=2417775852, Win=64216
594 27.046875 {TCP:3, IPv4:2} X.X.64.133 X.X.70.164 SMB SMB:C; Nt
Cancel
595 27.046875 {TCP:3, IPv4:2} X.X.70.164 X.X.64.133 SMB SMB:R; Nt
Transact, Unknown NT Transaction Function - NT Status: System - Error,
Code = (288) STATUS_CANCELLED
596 27.046875 {SMB:108, TCP:3, IPv4:2} X.X.64.133 X.X.70.164 SMB
SMB:C; Close, FID = 0xC00A
597 27.046875 {SMB:108, TCP:3, IPv4:2} X.X.70.164 X.X.64.133 SMB
SMB:R; Close, FID = 0xC00A
599 27.156250 {TCP:3, IPv4:2} X.X.64.133 X.X.70.164 TCP
TCP:Flags=...A...., SrcPort=2176, DstPort=Microsoft-DS(445),
PayloadLen=0, Seq=309205871, Ack=2417775930, Win=64138

IT Staff

2009-07-30 03:46:41 UTC

Permalink

So the purpose of this thread is to find out "how to shorten or speed up the
referal " ?

i will also check with ms how this can be done

Post by tstumpf
I have been having this trouble for a while now, and I have an open
case with Microsoft support to work on this issue, but so far, we have
not been able to solve this.
When accessing a DFS namespace share, if the share has not been
accessed recently (within the referal cache timeout period) there will
be a long 20+ second delay from the time you try to open the share to
when the contents of the share are displayed on the screen.
We have done some extensive network traffic capturing, and we have
found that there is a delay of about 20 seconds from the DFS Referral
Request to the DFS Referral Response, with very little else happening
between. Below is a sample of the packet capture. -- You will see
that the DFS Referral Request is at time-offset 5.593750, but there is
no DFS Referral Response until time offset 26.796875
Has anyone else seen this, or have any good suggestions where to look
for clues to this problem?
Thanks for your help...
Tim S.
14 0.656250 {SMB:4, TCP:3, IPv4:2} X.X.70.164 X.X.64.133 SMB SMB:R;
Transact2, Query Path Info - NT Status: System - Error, Code = (599)
STATUS_PATH_NOT_COVERED
17 0.812500 {TCP:3, IPv4:2} X.X.64.133 X.X.70.164 TCP
TCP:Flags=...A...., SrcPort=2176, DstPort=Microsoft-DS(445),
PayloadLen=0, Seq=309205136, Ack=2417774680, Win=64041
71 5.578125 {TCP:3, IPv4:2} X.X.70.164 X.X.64.133 SMB SMB:R;
Transact2, Unhandled Transact2 Subcommand; Warning: May not parse
correctly when Transaction2 request is missing
75 5.578125 {SMB:18, TCP:3, IPv4:2} X.X.64.133 X.X.70.164 DFS DFS:Get
DFS Referral Request, FileName: \gf\shares\Administration\Data\,
MaxReferralLevel: 4
88 5.593750 {SMB:23, TCP:3, IPv4:2} X.X.64.133 X.X.70.164 SMB SMB:C;
Transact2, Query Path Info, Query File Basic Info, Pattern = \gf
\shares
89 5.593750 {TCP:3, IPv4:2} X.X.70.164 X.X.64.133 TCP
TCP:Flags=...A...., SrcPort=Microsoft-DS(445), DstPort=2176,
PayloadLen=0, Seq=2417774976, Ack=309205374, Win=64834
90 5.593750 {SMB:23, TCP:3, IPv4:2} X.X.70.164 X.X.64.133 SMB SMB:R;
Transact2, Query Path Info, Query File Basic Info
91 5.593750 {SMB:24, TCP:3, IPv4:2} X.X.64.133 X.X.70.164 SMB SMB:C;
Transact2, Find First2, Both Directory Info (NT), Pattern = \gf\shares
\Administration
92 5.593750 {SMB:24, TCP:3, IPv4:2} X.X.70.164 X.X.64.133 SMB SMB:R;
Transact2, Find First2, Both Directory Info (NT)
93 5.593750 {SMB:25, TCP:3, IPv4:2} X.X.64.133 X.X.70.164 SMB SMB:C;
Transact2, Query Path Info, Query File Basic Info, Pattern = \gf\shares
\Administration
94 5.593750 {SMB:25, TCP:3, IPv4:2} X.X.70.164 X.X.64.133 SMB SMB:R;
Transact2, Query Path Info, Query File Basic Info
95 5.593750 {SMB:26, TCP:3, IPv4:2} X.X.64.133 X.X.70.164 SMB SMB:C;
Transact2, Find First2, Both Directory Info (NT), Pattern = \gf\shares
\Administration\Data
96 5.593750 {SMB:26, TCP:3, IPv4:2} X.X.70.164 X.X.64.133 SMB SMB:R;
Transact2, Find First2, Both Directory Info (NT)
101 5.718750 {TCP:3, IPv4:2} X.X.64.133 X.X.70.164 TCP
TCP:Flags=...A...., SrcPort=2176, DstPort=Microsoft-DS(445),
PayloadLen=0, Seq=309205786, Ack=2417775556, Win=64512
588 26.796875 {SMB:18, TCP:3, IPv4:2} X.X.70.164 X.X.64.133 DFS
DFS:Get DFS Referral Response, NumberOfReferrals: 1 VersionNumber: 4
593 26.953125 {TCP:3, IPv4:2} X.X.64.133 X.X.70.164 TCP
TCP:Flags=...A...., SrcPort=2176, DstPort=Microsoft-DS(445),
PayloadLen=0, Seq=309205786, Ack=2417775852, Win=64216
594 27.046875 {TCP:3, IPv4:2} X.X.64.133 X.X.70.164 SMB SMB:C; Nt
Cancel
595 27.046875 {TCP:3, IPv4:2} X.X.70.164 X.X.64.133 SMB SMB:R; Nt
Transact, Unknown NT Transaction Function - NT Status: System - Error,
Code = (288) STATUS_CANCELLED
596 27.046875 {SMB:108, TCP:3, IPv4:2} X.X.64.133 X.X.70.164 SMB
SMB:C; Close, FID = 0xC00A
597 27.046875 {SMB:108, TCP:3, IPv4:2} X.X.70.164 X.X.64.133 SMB
SMB:R; Close, FID = 0xC00A
599 27.156250 {TCP:3, IPv4:2} X.X.64.133 X.X.70.164 TCP
TCP:Flags=...A...., SrcPort=2176, DstPort=Microsoft-DS(445),
PayloadLen=0, Seq=309205871, Ack=2417775930, Win=64138

tstumpf

2009-07-30 17:03:47 UTC

Permalink

Post by IT Staff
So the purpose of this thread is to find out "how to shorten or speed up the
referal " ?
i will also check with ms how this can be done

- Show quoted text -

Yes, kind-of. The problem is that our referrals for the past couple
of years of using DFS namespaces have been very quick - like less than
a second. But a couple weeks ago, it started taking over 20 seconds
for the initial referral. We have gone through our change logs and
could not attribute it to a logged change to the file servers or to
AD. We thought it might be a DNS issue, but we do not see anything
wrong in DNS, and there are no other DNS related name resolution
issues.

I appreciate any thougts or suggestions that you can offer.

Tim S.