Here's the thing... I have a very slow file copy performance from Windows XP clients to Windows 2008R2 servers. Here are the facts: Windows XP to Windows 2K3: Fast Windows XP to Windows 2K8: Very Slow Windows 7 to Windows (any): Fast

Despite the fact that the obvious solution would be to upgrade to Windows 7, well, we have 900 desktops so it's not an option in the short time.

I have tried everything: Disabling SMB2.0, disabling security signatures, changing the TCP Window size, disabling the W2K8 auto tuning, upgraded the drivers, etc.

We eliminated the network; both the server and the client are connected to the same core switch (no hops, no routers, same VLAN).

Upon monitoring the network with a packet capture utility, we see that the SMB packets being exchanged between the W2K8 and the XP machines are very small packets (256 bytes); despite the fact that the MTUs are properly set (1500) and there is no fragmentation whatsoever. In fact, those SMB packets show, on the IP datagram, that the window is 65535 or close.

The same trace, made using the same application but instead of using a W2K8 share uses a Windows XP share (and that goes FAST) shows SMB packets of 4096 bytes. I can post the traces if necessary.

So, why does XP->W2K8 negotiation arrange for 24-bytes SMB payload, whereas the XP->XP negotiation arranges for 4096 SMB packets?

Any ideas? I am running short of those...

  • 900 clients machines on one switch you say? – SpacemanSpiff Oct 13 '12 at 1:21
  • LONG SHOT --- There are some rumblings in the Google-verse that DNS could have something to do with it, because of how XP resolves non-FQ names. Try putting an entry in the XP system hosts file for the server and see if it has an impact. Also try \\server.domain\share. – tomjedrz Oct 13 '12 at 2:09
  • post the caps somewhere please so we can look and draw our own conclusions. Preferably caps containing everything from connection setup to connection teardown. – the-wabbit Oct 13 '12 at 8:08
  • Thanks all! Spaceman, no, the 900 are not in one switch :) Tomjedrs, DNS has been double checked, and in fact the communication has been successfully established (no problem finding the other machines). Syneticon-dj, I will post the captures. – Pablo Oct 13 '12 at 20:19
  • I am not familiar with the site. How do I upload a file with the captures? – Pablo Oct 13 '12 at 20:23


Opportunistic locks were disabled. This prevented the read-ahead cache to work, and the exchanged SMB packets were very small.

Upon enabling opportunistic locks, we see SMB packets of 4096 bytes (4K) which is the size of an NTFS block.

All is good now.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.