NBSS Session Keep Alive >< NBSS Conintuation Message
Hi all, I'm currently looking at an issue with delays in opening a network folder. The share is located on a Unix Tru64 server that runs ASU to emulate a Win NT4 environment. As client I'm using Win 7 Pro x86 When I open some folders they open at a normal speed. Some folders however take 29 seconds to open. I've taken a trace using netmon and am seeing the following: 47 14:49:05 12/04/2011 20.9317053 System 10.100.19.41 172.21.1.16 SMB SMB:C; Transact2, Query Path Info, Query File Basic Info, Pattern = {SMB:19, NbtSS:3, TCP:2, IPv4:1} 48 14:49:05 12/04/2011 20.9334475 System 172.21.1.16 10.100.19.41 SMB SMB:R; Transact2, Query Path Info, Query File Basic Info {SMB:19, NbtSS:3, TCP:2, IPv4:1} 49 14:49:05 12/04/2011 20.9336358 System 10.100.19.41 172.21.1.16 SMB SMB:C; Transact2, Query Path Info, Query File Standard Info, Pattern = {SMB:20, NbtSS:3, TCP:2, IPv4:1} 50 14:49:05 12/04/2011 20.9355407 System 172.21.1.16 10.100.19.41 SMB SMB:R; Transact2, Query Path Info, Query File Standard Info {SMB:20, NbtSS:3, TCP:2, IPv4:1} 51 14:49:05 12/04/2011 21.1408638 System 10.100.19.41 172.21.1.16 TCP TCP:Flags=...A...., SrcPort=49393, DstPort=NETBIOS Session Service(139), PayloadLen=0, Seq=3808604062, Ack=69933319, Win=63438 {TCP:2, IPv4:1} 52 14:49:06 12/04/2011 21.7190275 System 10.100.19.41 172.21.1.16 NbtSS NbtSS:SESSION KEEP ALIVE, Length =0 {NbtSS:3, TCP:2, IPv4:1} 53 14:49:06 12/04/2011 21.7208822 System 172.21.1.16 10.100.19.41 SMB SMB:R; Transact2, Query Path Info - Server Error, (1) Non-specific error code {SMB:20, NbtSS:3, TCP:2, IPv4:1} 54 14:49:06 12/04/2011 21.9377553 System 10.100.19.41 172.21.1.16 TCP TCP:Flags=...A...., SrcPort=49393, DstPort=NETBIOS Session Service(139), PayloadLen=0, Seq=3808604066, Ack=69933358, Win=63399 {TCP:2, IPv4:1} 55 14:49:35 12/04/2011 50.9774929 System 172.21.1.16 10.100.19.41 SMB SMB:R; Nt Create Andx, FID = 0x024D (\decentraal_programmatuur@#45) {SMB:18, NbtSS:3, TCP:2, IPv4:1} 56 14:49:35 12/04/2011 50.9777066 System 10.100.19.41 172.21.1.16 SMB SMB:C; Nt Transact, NT_TRANSACT_NOTIFY_CHANGE, FID = 0x024D (\decentraal_programmatuur@#45) {SMB:18, NbtSS:3, TCP:2, IPv4:1} 57 14:49:35 12/04/2011 51.1708035 System 172.21.1.16 10.100.19.41 TCP TCP:Flags=...A...., SrcPort=NETBIOS Session Service(139), DstPort=49393, PayloadLen=0, Seq=69933465, Ack=3808604154, Win=65535 {TCP:2, IPv4:1} 58 14:49:35 12/04/2011 51.1713055 System 10.100.19.41 172.21.1.16 SMB SMB:C; Transact2, Find First2, Both Directory Info (NT), Pattern = \decentraal_programmatuur\* {SMB:21, NbtSS:3, TCP:2, IPv4:1} 59 14:49:35 12/04/2011 51.1726400 System 172.21.1.16 10.100.19.41 SMB SMB:R; Transact2, Find First2, Both Directory Info (NT) {SMB:21, NbtSS:3, TCP:2, IPv4:1} at line 52, the client sends a NBSS KeepAlive message at line 53, the server responds that it doesn't "understand" the message from the client at line 54, the client ACK's the servers error response Then there is a 29second delay before the server resumes the connection and offers me the requested folder. I ran the same test with a Windows XP and there the delay isn't seen on the same folder. I also ran a trace and there I saw that XP doesn't send a keepalive.. How can I disable the sending of such a keepalive packet? At this moment I'm thinking that this is causing the delay.. I've found also some articles from others that KeepAlive might cause connection resets.. Many thanks for any information, thoughts Filip
April 14th, 2011 8:32am

Hi Filip, Thanks for the post! For accessing a network folder in WindowsNT4 eviroment from a Windows 7 machine. I recommend you change the following local security policy setting. 1. Click Start, input secpol.msc in the search box. Press Enter key. 2. Local Policies - Security Options 3. On the right-pane, double-click "Network Security: LAN Manager authentication level" ,select "Send LM & NTLM - use NTLMv2 session security if negotiated", Apply the setting. Meanwhile, go to the Control Panel - Network and Internet - Network and Sharing Center - Advanced sharing settings. Under File sharing connections, select "Enable file sharing for devices that use 40- or 56-bit encryption". Save changes. After the above steps, check if the issue persists. Regards, MiyaThis posting is provided "AS IS" with no warranties, and confers no rights. | Please remember to click "Mark as Answer" on the post that helps you, and to click "Unmark as Answer" if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
Free Windows Admin Tool Kit Click here and download it now
April 16th, 2011 2:08am

Hello Miya, Many thanks for you reply! I just implemented your settings and tried to acces the folder again. The delays haven't disappeared unfortunately. In the mean time, I also implemented a registry key to stop sending the Session KeepAlive messages: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBT\Parameters] "SessionKeepAlive"=dword:ffffffff Unfortunately this didn't help either. Further more I also disabled SMB 2.1 to rule out that there might be some incompatibility issue. Can you think of anything else? Many thanks again Regards, Filip
April 16th, 2011 3:20am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics