Excessive network/smb traffic

[Iandoug]

Hi

In recent times I've developed a problem with excessive network traffic between this box and my NAS boxes.

I have three FreeNas boxes (nas1, nas2, nas3), the first two are on 9.10 and nas3 on 9.3.

From a cold boot, the network will be quiet, then after some time (10-15 minutes) suddenly SMB will have a constant stream of traffic up and down to nas1 and/or nas2.

Screenshot below from EtherApe shows traffic overnight. I was asleep and not accessing the NAS, nor was anything else. Etherape says it is MS-DIRECTOR traffic.

The traffic runs for some time (tens of minutes or more) then just as suddenly stops for a while.

I have folders on the NAS boxes as mounts-at-boot on this box.

Stopping SMB on this box does not stop the traffic. But stopping SMB on nas1 or nas2 immediately kills it.

I tried looking with Wireshark but all I see is lots of small SYN and ACK packets, not sure how to see what is actually getting sent.

I installed ntop and drilled down, it claims the traffic is 100% SMB and 100% FTP (layer 7 traffic) which makes no sense to me at all.

At this point I'm assuming there is some screwup in the configs of SMB on nas1 and nas2 (since FreeNas seems to have changed how it handles CIFS/SMB betweeen 9.3 and 9.10).

Does anyone have any suggestions as to where to look to fix this?

Screenshot is also here: http://imgur.com/a/qvzXu

Thanks, Ian

 

[c32767a]

So you're seeing spikes in SMB traffic between a client and the NASs when there is no human using the client?
Without detailed protocol decodes it's impossible to know what's actually going on. I sincerely doubt it's anything on the NAS side.

Raw speculation: I'd look on the client for scheduled processes like indexing, virus scanning, touching the shared disks. Since the SMB mount isn't established after a reboot until the user logs in, this might explain what you're observing.

Aside from curiosity, is it really a big issue?