The following situation:

- Samba server, Ubuntu 2.6.17-10-server #2 SMP
- Windows XP/SP2 client
- Gigabit ethernet, one switch
- FTP read/write are fast (~35Megabyte/s) between client/server
- Samba share read (server to client trans) is equally fast

The problem:
- Samba share write (client to server trans) is ten times slower (~3Meg/s).

Now the kicker: When I run a
tcpdump -i eth1
on the server while transferring from client to server, it's FAST (~30Meg/s).

It gets even funnier: When I run instead
tcpdump -i eth1 > somefile.cap
the write is SLOW again!

How can this be? It doesn't make sense.

When I tcpdump to the screen, things look fine, but piping into a file, I get a lot of the following:

01:10:22.270453 IP 192.168.39.111.1200 > fileserver.netbios-ssn: . 107142000:107143460(1460) ack 89686 win 65178 NBT Session Packet:

Unknown packet type 0x6Data: (41 bytes)
[000] ED 63 98 AC 03 D6 70 14 13 1A AD 30 B8 C7 C1 BD \355c\230\254\003\326p\024 \023\032\2550\270\307\301\275
[010] 80 3E 1E B6 B2 6A 5F 68 1B 96 6E EC BB 5E 73 C3 \200>\036\266\262j_h \033\226n\354\273^s\303
[020] 07 CA 38 0E 1B 80 8A 68 5C \007\3128\016\033\200\212h \

any ideas?

thanks,
-Jan.

i think lots of windows radius authentication packets are 0x6 data long if that helps.
windows sends a huge amout of this kind of crap over the network.
samba must just be confused and ignoring some part of it it doesn't need but has to stop and process ?
just a guess.