we have a very strange effect:
On a Check Point Appliance 23900 with VSX R80.30, we have trouble with a CIFS/SMBv2 (Server Message Block protocol) session through which multiple (concurrent?) transfers are being sent within a single TCP-445 connect.
While debugging, we noticed a strange effect: When we turn on tcpdump on the gateway within the VS environment on one interface (toward which the traffic is directed), two things happen:
- The performance of the throughput increased by about 50%
- Our problem disappears.
What does tcpdump on the gateway, that may lead to this behavior? By knowing that we would have a lead on the eoot cause of the problem.
P.S. The problem is that the concurrent transfer of five files fails. First we see (in a tcpdump on the client) a dramatic increase of the TCP ACK RTT (up to 40s) and after some time, the transfer is aborted. This is not necessarily a firewall problem, but it is strange that the problem does not occur when we run a tcpdump while testing.
- SMBv2 is used
- Effect does not depend on which interface it is run
- Multi-queuing is active on the affected system
- All relevant interfaces are bonds.