none
Excel SMB Read Block Size

    Question

  • Hi.

     I have a client XP SP3 machine that is accessing an Excel 2003 file over the WAN. The Excel file is hosted on a standard share on a Windows 2003 server and the client is mapped to that share.  This particular Excel file contains links to many other Excel files and it turns out that somewhere in the vicinity of 100MB of data is ultimately transferred to the client during the opening of the file.  The access to this file is quite slow. When I look at the packets in Wireshark I see that the size of the SMB read requests from the client to the server vary widely. At times they are 64k and things move along quite quickly with a high amount of unacknowledged in flight tcp data. At other times it reads 4k, 8k, or 16k at a time. It even goes to 512 bytes at times. However the TCP receive window for the client remains at 32767 basically the entire time and the window for the server is at 64k. Most of the time there is only about 4k unacknowledged tcp data outstanding. 

    Any ideas on what could be influencing SMB to request such a low (but variable) read size while the tcp receive window size remains constant and well above what Excel is requesting as far as SMB block size goes? Any insight would be much appreciated.     Thanks much for any consideration, F
    Wednesday, April 27, 2011 4:21 PM

Answers

  • Nice question! I would also be interested in getting the answer.

    By the way, do you get the SMB_COM_READ_ANDX message after the SMB_COM_NT_CREATE_ANDX? Seems like the server does not return CAP_LARGE_READX?

    My guess is that it goes to 512 bytes because the sector size is 512 bytes so that all transaction buffers are multiples of 512 bytes limited by 64K bytes.

    As far as I understand it, each transaction is first negotiated. Additionally, it a chained transaction, transmission is made mod(512).

    I may be completely incorrect here.

    Well, interesting!


    Well this is the world we live in And these are the hands we're given...
    Wednesday, April 27, 2011 5:40 PM

All replies

  • Nice question! I would also be interested in getting the answer.

    By the way, do you get the SMB_COM_READ_ANDX message after the SMB_COM_NT_CREATE_ANDX? Seems like the server does not return CAP_LARGE_READX?

    My guess is that it goes to 512 bytes because the sector size is 512 bytes so that all transaction buffers are multiples of 512 bytes limited by 64K bytes.

    As far as I understand it, each transaction is first negotiated. Additionally, it a chained transaction, transmission is made mod(512).

    I may be completely incorrect here.

    Well, interesting!


    Well this is the world we live in And these are the hands we're given...
    Wednesday, April 27, 2011 5:40 PM
  • I'm having the exact same issue, but mine just started in July and it seemed to be about the same time as the MS Office patch came through the Microsoft Update. It is taking up to 6 minutes to open an Excel Spreadsheet over the network. At first I thought it was because it was on an XP machine. I moved the file to a Server 2003 share and got the same result. I've also been using Wireshark to capture the transfer events but have only managed to remove most of my hair from scratching my head. Any progress?
    Wednesday, August 10, 2011 7:39 PM