none
SMB2 : Random reads after writes to a remote share RRS feed

  • Question

  • Operation :Copy a file from Vista SP1 to a Win2k8/Win2k3 remote share using drag and drop from explorer
    Observed :  Multiple random reads of the file after the write operation.
    What is the reason for the same?



    • Edited by Dakshina Tuesday, August 26, 2008 11:44 AM Adding OS details
    Tuesday, August 26, 2008 11:02 AM

Answers

  • Daksina,
    You have a similar question posted in the Office Binary File Open Spec forum.

    As Sebastian pointed out this forum is for developers building applications using the Open Specs. But I wanted to point out a few things that may put you on the right track.

    Depending on which version of WIndows you are using for the client it is fairly common for reads to occur on a file after write. And it is common to have multiple reads at the same time. The source of these reads are usually one of 2 things. First, depending on the anti-virus / anti-malware solution you have installed these applications usually scan new files or updates to files for infections. The second source of reads is the creation of thumbnails or previews on documents and files. If you have Explorer open it could also be refreshing its view of the folder / files.

    That is the most likely source of additional reads after writes. Does that sound likely in your situation?

    We may want to move this thread to another forum if additional follow-up is needed.

    Steve Smegner
    Application Development Consulting Group

    Wednesday, August 27, 2008 7:59 PM

All replies

  • Hi Dakshina,

    I need a little bit more insight about your question in order to be able to either answer it or to route you in the correct direction.

    Are you developing a tool to interoperate with Windows through SMB / SMB2 or do you have this as a "troubleshooting" like question?


    Thanks for your inquire!

    Regards,

    SEBASTIAN CANEVARI - MSFT SEE Protocol Documentation Team
    Tuesday, August 26, 2008 5:00 PM
  • Hi,
    I am not developing a tool.This is more of a troubleshooting question.Please see the attached trace snapshot.
    After the write is over,there are still reads of the file happening.The file size is 100k.
    Why is it done ?
    --Dakshina

    Attached below are network monitor traces

    118    4.273437        192.168.12.32    192.168.11.31    SMB2    SMB2: R  WRITE (0x9), 0x10000 bytes written, Mid = 248
    125    4.280273        192.168.12.32    192.168.11.31    SMB2    SMB2: R  WRITE (0x9), 0x9000 byte
    s written, Mid = 249
    127    4.280273        192.168.11.31    192.168.12.32    SMB2    SMB2: C  SET INFORMATION (0x11), FID=0xFFFFFFFF00000069, InformationClass=FileBasicInformation (4), Mid = 250
    128    4.379883        192.168.12.32    192.168.11.31    SMB2    SMB2: R  SET INFORMATION (0x11), Mid = 250
    129    4.379883        192.168.11.31    192.168.12.32    SMB2    SMB2: C  CREATE (0x5), Name=F100K.8DFADBD4200805250031TTTFNT7TT.{10E39A49-4531-4496-A08E-842D4C440D20}@#129, Context=DHnQ, Context=MxAc, Context=QFid, Mid = 251
    130    4.480469        192.168.12.32    192.168.11.31    SMB2    SMB2: R , Mid = 251 - NT Status: Unknown Facility - Error, Code = (193) Unhandled status code
    131    4.481445        192.168.11.31    192.168.12.32    SMB2    SMB2: C  READ (0x8), FID=0xFFFFFFFF00000069, 0x100 bytes from offset 0 (0x0), Mid = 252
    132    4.581055        192.168.12.32    192.168.11.31    SMB2    SMB2: R  READ (0x8), 0x100 bytes read, Mid = 252
    133    4.581055        192.168.11.31    192.168.12.32    SMB2    SMB2: C  READ (0x8), FID=0xFFFFFFFF00000069, 0x100 bytes from offset 512 (0x200), Mid = 253
    134    4.680664        192.168.12.32    192.168.11.31    SMB2    SMB2: R  READ (0x8), 0x100 bytes read, Mid = 253
    135    4.680664        192.168.11.31    192.168.12.32    SMB2    SMB2: C  READ (0x8), FID=0xFFFFFFFF00000069, 0x200 bytes from offset 101888 (0x18E00), Mid = 254
    138    4.780273        192.168.12.32    192.168.11.31    SMB2    SMB2: R  READ (0x8), 0x200 bytes read, Mid = 254
    139    4.781250        192.168.11.31    192.168.12.32    SMB2    SMB2: C  READ (0x8), FID=0xFFFFFFFF00000069, 0x100 bytes from offset 101426 (0x18C32), Mid = 255
    140    4.880859        192.168.12.32    192.168.11.31    SMB2    SMB2: R  READ (0x8), 0x100 bytes read, Mid = 255
    141    4.880859        192.168.11.31    192.168.12.32    SMB2    SMB2: C  READ (0x8), FID=0xFFFFFFFF00000069, 0x100 bytes from offset 1099 (0x44B), Mid = 256
    142    4.980469        192.168.12.32    192.168.11.31    SMB2    SMB2: R  READ (0x8), 0x100 bytes read, Mid = 256

    143    4.980469        192.168.11.31    192.168.12.32    SMB2    SMB2: C  READ (0x8), FID=0xFFFFFFFF00000069, 0x100 bytes from offset 94461 (0x170FD), Mid = 257
    144    5.080078        192.168.12.32    192.168.11.31    SMB2    SMB2: R  READ (0x8), 0x100 bytes read, Mid = 257
    145    5.081055        192.168.11.31    192.168.12.32    SMB2    SMB2: C  READ (0x8), FID=0xFFFFFFFF00000069, 0x100 bytes from offset 93400 (0x16CD8), Mid = 258
    146    5.180664        192.168.12.32    192.168.11.31    SMB2    SMB2: R  READ (0x8), 0x100 bytes read, Mid = 258
    147    5.180664        192.168.11.31    192.168.12.32    SMB2    SMB2: C  READ (0x8), FID=0xFFFFFFFF00000069, 0x100 bytes from offset 96256 (0x17800), Mid = 259
    151    5.280273        192.168.12.32    192.168.11.31    SMB2    SMB2: R  READ (0x8), 0x100 bytes read, Mid = 259
    152    5.280273        192.168.11.31    192.168.12.32    SMB2    SMB2: C  READ (0x8), FID=0xFFFFFFFF00000069, 0x100 bytes from offset 101589 (0x18CD5), Mid = 260
    153    5.380859        192.168.12.32    192.168.11.31    SMB2    SMB2: R  READ (0x8), 0x100 bytes read, Mid = 260

    • Edited by Dakshina Wednesday, August 27, 2008 5:09 AM Removed some trace messages
    Wednesday, August 27, 2008 5:03 AM
  • Daksina,
    You have a similar question posted in the Office Binary File Open Spec forum.

    As Sebastian pointed out this forum is for developers building applications using the Open Specs. But I wanted to point out a few things that may put you on the right track.

    Depending on which version of WIndows you are using for the client it is fairly common for reads to occur on a file after write. And it is common to have multiple reads at the same time. The source of these reads are usually one of 2 things. First, depending on the anti-virus / anti-malware solution you have installed these applications usually scan new files or updates to files for infections. The second source of reads is the creation of thumbnails or previews on documents and files. If you have Explorer open it could also be refreshing its view of the folder / files.

    That is the most likely source of additional reads after writes. Does that sound likely in your situation?

    We may want to move this thread to another forum if additional follow-up is needed.

    Steve Smegner
    Application Development Consulting Group

    Wednesday, August 27, 2008 7:59 PM
  • Thanks for the reply Steve.
    --Dakshina
    Thursday, August 28, 2008 10:13 AM