This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

SMB vs NBSS, swapping 2 identical APs and getting different output.

0

Hello,

First of all, thanks in advance for all of your expert opinions.

I am attempting to get a better understanding of expected behavior during a file transfer, and whether what I am seeing is normal or abnormal. I have two packet captures between a WLC and Windows Laptop where we are doing a file transfer to test qos changes on the network. During one file transfer I am seeing the process happen through SMB packets, which I understand to be expected behavior. When I switch out the Access Point with another identical Access Point I am instead getting "NBSS 1485 Continuation Messages." The problem with this is that it appears that the "NBSS 1485 Continuation Messages" has a DSCP value of EF instead of the expected data traffic default of 0. This, in turn, could mean that data traffic is being transferred at the highest priority level, which could interfere with our Voip devices.

I see from one of the prior posts regarding NBSS that this possibly "means that the "previous segment" wasn't captured because it didn't make it to the machine running Wireshark, i.e. a packet got lost in transit."

Also stated within that post was "Wireshark couldn't reassemble the message (NetBIOS Session Service, "NBSS", over TCP - port 139 - which is used to transport SMB in older systems such as OS/2) because the chunk was missing, but it inferred from port 139 that it's NBSS, so it assumed it was a continuation of an earlier message as it didn't begin with an SMB header. It probably was a continuation, but there was a piece missing before it."

Is the DSCP marking of "NBSS 1485 Continuation Messages" an expected behavior designed to prioritize the re transmission of lost packets that can create conflicts on a network utilizing qos? Are the NBSS packets in fact transmitting at DSCP EF? Do our device prioritize using SMB to transfer files and then defer to NBSS as a fall-back which then is prioritized at DSCP EF?

Anything you can do to assist my understanding of NBSS and SMB would be appreciated. Thank you all for your time.

asked 09 Jul '17, 19:50

AlphaHertz's gravatar image

AlphaHertz
6112
accept rate: 0%