Showing results for 
Show  only  | Search instead for 
Did you mean: 

DNA - Node Sending Delay in SMB Operation


We are observing a slow SMB Read behavior. Trace has been taken from both sides but Server side trace becomes more accurate as it clearly shows the Node Sending delay of 88%. Thread Analysis also display SMB Read File as slow operation. While SMB Write File seems be quicker. SMB packet sizes are 32K and it is utilizing SMB2 protocol where Client is WS2008R2 and Server is WS2012R2.

Can someone advise what could be limiting factor for slowing down SMB Reads ?






@Gary Kaiser

Hi Keshav, could you share the trace in question? There is an attach file button when you create/edit a comment.

not allowing to upload item more than 1 mb. Capture is of 10mb

Please email it to me and I'll upload for you. I think I could have a larger file upload limit.

Ok, I just sent

Done - don't know why, but I've managed to upload it without problems.


Thanks, looking for suggestion on this questions.


I think the problem lies with your client's TCP window - take a look at the Time Plot for TCP Window Size in both directions. The client clearly allows a real small window of 260 bytes.

You may consider trying to perform a similar test for other clients reading from the same server. I don't think you can manually set a preferred TCP Window Size on a machine, it is determined automatically in Windows.

Tomasz, thanks for your response.

The trace I have given you is from Server side, Clients are connected over a VPN link to data center. and I have seen similar behavior tested from multiple clients. SMB Read becomes slow while SMB write is faster.

Also which version of DNA you are using, I have and DNA console installed but doent see this TCP Window size limitation. Both direction TCP scales up simultaneously. See in picture.cusersksinghdesktoptcpw.png

I'm using 12.4.5. I've removed noise threads - see screenshot attached. Remember: try to focus on your isolated transactions, otherwise analysis is difficult.


Just a question - Why Server is showing sending delay in POV because of Client's small TCP window. Is it always relational like this ?

TCP window is not something may get change by self because we tested some time before, Server sending delay was not at all. Don't you think that It might be an issue with Server side Network interfaces which are unsalable to transmit large payload and sending them in small chunks. Thus Client TCP window expands as much as payload is received frpm server ?

It may
sound tricky, but yes – client proposes their TCP window and server sends data
according to the limits decided on by the client’s OS, so you can see a large
server sending time (which would also be client receiving time, but that goes
without saying).

I’m not an
expert on this, so I cannot advise you here. I guess it may depend on the
network errors – TCP window goes small if there are retransmission requests
early in a transaction. I don’t think newer Windows releases (7 or later) allow
manual tweaks of TCP window, but I know very little of such algorithms of
setting TCP window.