samba - Apr 2015 - smbclient 4.0.7 fails transfer with STATUS_INVALID_PARAMETER and SMB2 but not with NT1

We get STATUS_INVALID_PARAMETER failures when smbclient uses SMB2 but passes
with NT1. We do get some success, but mostly failures.  It appears to happen
after it transfers the PDF file.

These are the packets leading up to SMB2 failing after the transfer:

No.     Time                          Source                Destination         
Protocol Length Info
    266 2015-04-09 08:30:43.688568000 10.5.12.227           10.6.161.184        
TCP      1514   [TCP segment of a reassembled PDU]

No.     Time                          Source                Destination         
Protocol Length Info
    267 2015-04-09 08:30:43.688696000 10.5.12.227           10.6.161.184        
TCP      1514   [TCP segment of a reassembled PDU]

No.     Time                          Source                Destination         
Protocol Length Info
    268 2015-04-09 08:30:43.688699000 10.5.12.227           10.6.161.184        
SMB2     627    Write Request Len:72845 Off:0 File: scsmuser\Scan\DOC002.pdf

No.     Time                          Source                Destination         
Protocol Length Info
    269 2015-04-09 08:30:43.688701000 10.6.161.184          10.5.12.227         
TCP      66     445???35119 [ACK] Seq=1611 Ack=74211 Win=26704 Len=0
TSval=1545474022 TSecr=464076

No.     Time                          Source                Destination         
Protocol Length Info
    270 2015-04-09 08:30:43.729116000 10.6.161.184          10.5.12.227         
TCP      66     445???35119 [ACK] Seq=1611 Ack=74772 Win=26704 Len=0
TSval=1545474063 TSecr=464077

No.     Time                          Source                Destination         
Protocol Length Info
    271 2015-04-09 08:30:43.758999000 10.6.161.184          10.5.12.227         
SMB2     143    Write Response, Error: STATUS_INVALID_PARAMETER

This is happening at a remote site, and we are not able to recreate it here.
Does anyone have any input as to why this may be happening. I do have a
wireshark trace if you?d like.

Mike Tompkins

On Fri, Apr 10, 2015 at 06:15:34PM +0000, Tompkins, Michael
wrote:
> We get STATUS_INVALID_PARAMETER failures when smbclient uses SMB2 but
passes with NT1. We do get some success, but mostly failures.  It appears to
happen after it transfers the PDF file.
> 
> These are the packets leading up to SMB2 failing after the transfer:
> 
> No.     Time                          Source                Destination    
Protocol Length Info
>     266 2015-04-09 08:30:43.688568000 10.5.12.227           10.6.161.184   
TCP      1514   [TCP segment of a reassembled PDU]
> 
> No.     Time                          Source                Destination    
Protocol Length Info
>     267 2015-04-09 08:30:43.688696000 10.5.12.227           10.6.161.184   
TCP      1514   [TCP segment of a reassembled PDU]
> 
> No.     Time                          Source                Destination    
Protocol Length Info
>     268 2015-04-09 08:30:43.688699000 10.5.12.227           10.6.161.184   
SMB2     627    Write Request Len:72845 Off:0 File: scsmuser\Scan\DOC002.pdf
> 
> No.     Time                          Source                Destination    
Protocol Length Info
>     269 2015-04-09 08:30:43.688701000 10.6.161.184          10.5.12.227    
TCP      66     445???35119 [ACK] Seq=1611 Ack=74211 Win=26704 Len=0
TSval=1545474022 TSecr=464076
> 
> No.     Time                          Source                Destination    
Protocol Length Info
>     270 2015-04-09 08:30:43.729116000 10.6.161.184          10.5.12.227    
TCP      66     445???35119 [ACK] Seq=1611 Ack=74772 Win=26704 Len=0
TSval=1545474063 TSecr=464077
> 
> No.     Time                          Source                Destination    
Protocol Length Info
>     271 2015-04-09 08:30:43.758999000 10.6.161.184          10.5.12.227    
SMB2     143    Write Response, Error: STATUS_INVALID_PARAMETER
> 
> This is happening at a remote site, and we are not able to recreate it
here. Does anyone have any input as to why this may be happening. I do have a
wireshark trace if you?d like.
Mike, we're going to need a wireshark capture
of this I'm afraid. If the remote site can get
one, then log a bug and upload it so we can take
a look.

Cheers,

Jeremy.