Slow File Transfer from Server to Domain Members

[theharmonyguy]

OK, I spent most of the day troubleshooting this one, and I'm at a loss... did some searches on Yahoo and here and didn't find anything, so thought I'd see if anyone had any ideas.

Basic problem: Transferring files or even file info from server shares is measurably slow on domain clients. Copying a 10MB folder takes around 6.5 minutes, and it takes at least 10 seconds clicking "Properties" for the window to show, even on smaller files.

The hitch: This only happens with domain members. I took my laptop, which is on another domain, and connected to a server share by UNC path in Explore (used administrator login), and I was able to copy a 28MB file in four seconds flat.

The background: The network had been running fine, but recently the client switched to a new ISP, so the router configuration changed and we were forced to move to a new network number (from 192.168.100.x to 192.168.10.x; and yes, we do have to keep the new network number, as we're using the ISP's router - long story, take my word for it). Apparently somewhere in the reconfiguration something changed... the new network number may be totally unrelated (my laptop was on DHCP with the new network), but fyi.

Partial list of things I've done so far:
- Checked the registry (on the server and clients) for instances of the old network number.
- Checked netstat -a for instances of the old network number.
- Disabled software firewalls on client machines.
- Checked Norton AV configuration.
- Recreated shares.
- Rebooted computers, including server.
- Restarted DNS, WINS, etc.
- Check settings on DHCP, RRAS, etc.
- Checked event logs.
- Dug through group policies and domain security policy.
- Disabled SMB signing.

You get the idea. Anything obvious has probably been tried.

Oh, and a few more things... I ran Wireshark on a client that was having slow transfers, and noticed a few things. First, I saw tons of SMB traffic - lots of QUERY_FILE_INFO packets back and forth when I clicked a file. The traffic seemed redundant... never figured out what was causing it. Also, several times I saw a ton of TCP Retransmission traffic when transferring a file. Initially I'd think there's a bad connection, but 1) my laptop works fine, and 2) a colleague tried hooking the server and a test client into a tested standalone switch and still had trouble (checked cables too).

This one has me stumped. I'm thinking something relating to authentication/security or SMB, but I don't know what.

Other details: Dell server, W2K3, don't have the service pack right in front of me. Client are WinXP Pro and Vista Business. Cisco router acts as gateway, Dell server acts as DHCP, DNS, WINS, and AD server. Domain setup. Clients, server, and router connected to tested switches.

Any ideas?

 

[LWComputingMVP]

I'd see what Filemon and Regmon can find...

 

[Roadki11]

Id disable WINS unless you really need it which i doubt, and flush dns. Ohh and did you reconfigure dns for the new subnet?



RoadKi11

"This apparent fear reaction is typical, rather than try to solve technical problems technically, policy solutions are often chosen." - Fred Cohen

 

[LWComputingMVP]

If you use exchange and have multiple subnets, you need wins. That shouldn't be slowing things down anyway.

 

[skialta]

Speed/duplex should be verified as well all the way around, workstation, server, switch, etc.

 

[technome]

Theharmonyguy, you have done your homework....

" First, I saw tons of SMB traffic - lots of QUERY_FILE_INFO packets back and forth when I clicked a file."

Sure sounds like an SMB issue, though unless you have a Windows 2000 machines in the mix, turning off SMB signing should not have an affect on throughput (unless a misconfig). Have you double checked it is disable completely on affected server/wks. It like the Domain member are not embracing the SMB (disabled) settings.

"- Checked the registry (on the server and clients) for instances of the old network number." good move

Can't see it being DNS,DHCP, Wins etc, as you are able to copy files. Agree with lwcomputing, WINS is not an issue.

Drawing at straws...
For the hell of it, Pathping between the affected machines to see if packets are dropped.

You might try resetting the TCP stack.

If managed switches, check for errors on ports. Any switch configuration changes lately?

Interesting issue to me, aggravation for you

You could try over on the Minasi forum, there are a couple of MVPs who likely hit this issue

http://web2.minasi.com/forum/forum.asp?FORUM_ID=5

........................................
Chernobyl disaster..a must see pictorial

http://www.kiddofspeed.com/default.htm

 

[TheLad]

As already suggested, I would start with checking the speed/duplex settings first as it is an easy item to tick off the list. Speed/duplex mismatches can cause the symptoms you describe and can easily be overlooked.

Ensure your server and its switch ports are both forced to the same speed/duplex. For example, a switch port forced to 100Mb Full Duplex and a server left at Auto Negotiate will result in a mismatch because the negotiation will only end up at Half Duplex.

It may also be worth performing some trace routes to see if the internal traffic is flowing as required and not being routed via your ISP

--------------------------------------
"Insert funny comment in here!"
--------------------------------------

 

[andetech]

It appears that I am having the same problem as you (theharmonyguy) described in your initial post. I tried the same things as you did in your list, but am still having the same problem. A file that should take 60 seconds takes about 60 minutes to copy from the server to a workstation.

Did you ever figure out what the problem was?

 

[itsp1965]

Besides the other excellent suggestions, I have silly question; are you copying using Windows explorer or are you doing this from a command line. Try using robocopy to see if you get a better response