samba - Sep 2008 - What's "NT Trans Response : STATUS_CANCELLED", and why does it take so long?

Hi folks,

I have a samba 3.0.25b server running on Centos 4.6. My users complain  
of intermittent responsiveness issues, but I haven't been able to  
identify the problem. I've done some traffic dumps with tethereal, and  
have run them through Wireshark's "Service Response Time" report.
I've
identified several packets identified like this:

"SMB	NT Trans Response, FID: 0x2c1e, NT NOTIFY, Error:
STATUS_CANCELLED"

What I'm unsure about is this line in the SMB Header:

"Time from request: 458.719370000 seconds"

Can anybody explain to me what this "NT Notify" packet is saying, and
whether a large time-from-request is to be expected?

Thanks!
- David

On Mon, Sep 22, 2008 at 09:37:13AM +1200, David Young
wrote:
> Hi folks,
>
> I have a samba 3.0.25b server running on Centos 4.6. My users complain  
> of intermittent responsiveness issues, but I haven't been able to  
> identify the problem. I've done some traffic dumps with tethereal, and
> have run them through Wireshark's "Service Response Time"
report. I've
> identified several packets identified like this:
>
> "SMB	NT Trans Response, FID: 0x2c1e, NT NOTIFY, Error:
STATUS_CANCELLED"
>
> What I'm unsure about is this line in the SMB Header:
>
> "Time from request: 458.719370000 seconds"
>
> Can anybody explain to me what this "NT Notify" packet is saying,
and
> whether a large time-from-request is to be expected?
An NT Notify packet is a requests notification when a directory
is changed. Hence it can be a long time from when the packet is
sent to when the notify replies (if it ever does).

The unresponsiveness is not to do with this packet. Try upgrading
to 3.2.4 - there have been so many changes since 3.0.25b it isn't
funny :-).

Jeremy.