Weird SMB Error

[MouseAT]

I've just had a problem with one of our laptops. I was asked to look at it yesturday as it kept losing its connection to network shares - it'd tell you it was working offline, and all the mapped drives would appear to be empty. If you try to reconnect, it'll connect, syncronize, and then immediately disconnect again.

 

I was getting the following errors appearing in the security log:

 

Event Type: Warning

Event Source: MRxSmb

Event Category: None

Event ID: 3019

Date: 13/03/2006

Time: 09:18:01

User: N/A

Computer: TEACHER-LT-AL

Description:

The redirector failed to determine the connection type.

 

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Data:

0000: 00 00 00 00 04 00 4e 00 ......N.

0008: 00 00 00 00 cb 0b 00 80 ....Ë..€

0010: 00 00 00 00 84 01 00 c0 ....„..À

0018: 00 00 00 00 00 00 00 00 ........

0020: 00 00 00 00 00 00 00 00 ........

 

I found a reference to a windows update resolving this error, so I've applied the latest updates, and the message has now disappeared from the logs. The problem with the shares is still there, however.

 

I can safely ping the server, and can browse the web fine, so TCP/IP is obviously working. Any ideas before I completely re-image the machine?

[MrDylan]

Have you looked through the suggestions on this page?

 

http://www.eventid.net/display.asp?eventid=3019&eventno=149&source=MRxSmb&phase=1

[DMcCoy]

There is a fix for this, I'll see if I can find it

[DMcCoy]

KB884020 File is WindowsXP-KB884020-x86-enu.exe

[MouseAT]

I already applied that fix. After doing so, the errors in the event log disappeared, but I still can't hold a connection open longer than around 10-20 seconds.

[DMcCoy]

Have you tried turning offline folders off and removing all the mapped drives? Try creating a new profile for the user too.

[Ric_]

What kind of laptop is it?

 

I take it you tried re-installing the NIC drivers? If it is a DELL with it's 'customised' Intel drivers, scoot off to Intel and get the ones that work properly!

 

I take it you have also checked the wiring of the network patch and socket - a loose connection would cause it to connect and disconnect and would also confuse it as to the connection speed/type.

[MouseAT]

It's a Samsung V25 laptop. I've not done anything to the NIC drivers yet - I might try that tomorrow. For the most part, networking seems to be OK - it'll ping the servers, authenticate and browse the web without problems. It's only file sharing over SMB that seems to be causing problems.

[CyberNerd]

can you telnet out to remote smb ports (139,445 IIRC) ?

It might give a hint as to whether its the laptops SMB client or a tcp/ip error -

 

I had an almost similar problem with a windows 2000 server a while back - it wouldn't make outbound connections to certain services for some reason - but it would ping ok, and web was ok. reapplied service packs and it was ok in the end.

[ajbritton]

I get these weird MRXSMB 3019 errors as well. IIRC, it's something to do with using remote desktop.

[MouseAT]

I've tried re-installing network drivers, and have just tried doing a full repair on Windows XP. I've got one last trick to try with the network card drivers before I give up and completely re-install Windows.

 

If you've got any more ideas, I'm still listening.

[MouseAT]

I just grabbed the original driver CD and reinstalled the network card drivers using the installer, rather than just removing the driver from device manager and allowing Windows to reinstall it automatically. It seems to be working now (touch wood).

 

Thanks to everyone for your help. I'll let you know if there are any more problems.

[MouseAT]

OK, the problem is still there on that laptop (Samsung V-25), and one of the Dell Lattitude 110L machines has just started doing the same thing. No references to the MRXSMB errors this time.

 

Erm... help?

[Geoff]

This happens when the machine tries to connect to itself via localhost (127.0.0.1) using MS networking. It can't determine the speed of the connection and throws these SMB errors. You can safely ignore these.

[MouseAT]

Sorry, maybe I wasn't very clear. The Samsung laptop developed the MRXSMB errors in the log and kept disconnecting from shares on one of our servers. Since patching, I've still got the disconnects, but the MRXSMB errors in the event log are gone. I originally assumed they were related, as the problem only relates to file sharing, but they now appear to be separate problems.

 

In any case, I've now got two laptops (one Dell, one Samsung) giving me problems. They connect, synchronise, then disconnect again. If you attempt to reconect, they'll synchronise again, and disconnect immediately afterwards. It's causing no end of problems as these laptops cannot access our shared common drives.

 

Forget the MRXSMB errors for now - it's the disconnection's I'm concerned about. Anyone seen this before?

[Geoff]

Is the windows firewall enabled?

 

What sort of nic do these laptops have? make/model?

[MouseAT]

The Samsung is listed as having an Intel Pro/100 VE network card in device manager. The Dell machines also have Intel NICs IIRC, but I can't remember which model - I've not got one of those machines to hand.

 

Windows firewall is enabled on all machines.

[Geoff]

Disable TCP checksum offloading.

[mac_shinobi]

Research the event id and you should find something along the lines of this :

 

http://www.monitorware.com/en/events/details.php?details_id=2657