Unexpexted SMB read requests after writing or copying files on an SMB-Share


  • We have some strange behaviour with our fileservers using SMB2. We searched many hours (!) for a solution and tried many things without an visible effort.

    Server: Windows 2008 R2 Enterprise, File Service Role

    Client: Windows 7 Enterprise x64

    Procedure: On the client we copy a File from the share on the server to the same share on the server. With Wireshark we log the network traffic:

    1. On Windows Explorer we start to copy a file (100 - 500 KB)
    2. In Wireshark we see some Read Requests to read the file (2-7 with ~60000 bytes per request, as excepted)
    3. We see some Write Requests to write the new file (2-7 with ~60000 bytes per request, as expected)
    4. The Windows Explorer quits the copy Dialog and shows the file as copied.
    5. In Wireshark we see realy a lot (>500-1000) Read Requests with very short Length (beginning at 4096 bytes decreasing to some single bytes)

    Issue: In the time between the Windows Explorer shows the copied File and the small read requests aren't finished, the Application (e.g. Word) shows that the file is opened by 'another user'. On the server in Share and Storage Managament the file is shown as opened by the same user who make the copy before. Depending on the circumstances (Network load, VPN on or off, Location, etc.) this means a delay of 10-20 Seconds until the user can open the file to work with it.

    Efforts: As said before we already tried many things:

    • Same behaviour with Server 2008, 2003
    • Same behaviour with an old XP x32 and Win 7 x32 Clients
    • Same behaviour directly connected the client to the server (without any network components between the server and client)
    • Changed the network drivers
    • Physical and Virtual machines
    Can anyone help us - we are realy at the end of our wisdom...

    Monday, November 11, 2013 9:08 PM

All replies

  • Hi,

    I'm thinking if it related to indexing so have a try to stop indexing on target volume and see if issue still exists. 

    Or maybe antivirus program could also cause similar issues. 

    If you have any feedback on our support, please send to

    Wednesday, November 13, 2013 8:42 AM
  • Thank you for your reply.

    We try to disable Windows Search, Antivirus and many other processes and services - without any visible improvement.

    Here a Picutre of the Wireshark recording from the milliseconds after the successful copy process. The Read Respons begins a few milliseconds later and then there are hunderds of Requests and Responses in the same manner:

    Thursday, November 14, 2013 10:31 AM
  • Hello I have the same problem. Do you got a solution?


    Wednesday, May 28, 2014 11:15 AM