This is our old Q&A Site. Please post any new questions and answers at

First, I am completely ignorant of all things wireshark, so please forgive me.

I have a windows 2003 that is slow when transferring files. I tested out another windows 2003 server that doesn't exhibit the same issue. Here is one difference I found in wirehsark that may be the cause, but I really have no idea if it is or how to fix.

Slow Server: 163 0.000185 SMB 105 Write AndX Response, FID: 0x800e, 16580 bytes

Fast Server: 1974 0.000000 SMB 105 Write AndX Response, FID: 0x4000, 65536 bytes

There are tons of these entries (I assume that thats the file being written over the network. The different of course is the byte size of 16580 vs 65536.

Thanks in advance and let me know if you need more information.

asked 05 Jul '11, 12:58

thebigdog123's gravatar image

accept rate: 0%

Found my own answer! SMB signing was enabled, causing the max buffer to be ignored and reset to the default of 16580. I disabled SMB signing, and the throughput virtually quadrupled!

permanent link

answered 06 Jul '11, 05:04

thebigdog123's gravatar image

accept rate: 0%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 05 Jul '11, 12:58

question was seen: 4,889 times

last updated: 06 Jul '11, 05:04

p​o​w​e​r​e​d by O​S​Q​A