Windows XP occasionally terminates network drive connections, sometimes causing program errors. This problem apparently started after upgrading from Samba 3.0.24 to Samba 3.0.25 or 3.0.25a. When this happens, Windows logs to the System event log an event with source NetBT, event ID 4322, with the following description:
NetBT failed to process a request because it encountered OutOfResources exception(s) in the last 1 hour.
Dragan Krnic reports, "One can reproduce this error anytime if one chooses a big enough file and copies it a second time before the first copy is done.
Samba 3.0.24 does not have this bug."
Wireshark packet capture available at http://www.jbc.edu/~josh/outofresources.pcap.gz. The error is at 11:23:49am, around packet 57737.
Created attachment 2825 [details]
Proposed patch for 3.0.25c
Please apply this onto 3.0.25b.
I think this is a duplicate of #4763 - but the trace in this bug was essential for the correct fix - thanks !
*** This bug has been marked as a duplicate of 4763 ***
Created attachment 2827 [details]
Replacement patch. One line was deleted by accident.
One line was deleted by accident. This should be the correct fix.
Created attachment 2828 [details]
tried to start a second copy of a file before the first copy was done
there were altogether 105 full 1-MB capture files and one smaller.
I've zipped the last 2
Are these new traces with the patch? Do you still see the problem?
In neither of the traces there is a notify packet or a tcp reset present, so this is not really enough of the traces you took.
I wrote in more detail in an "Additional Comments:" frame but
then I wanted to upload the net dumps and the original
comments werde lost.
The file I uploaded was still without Jeremy's patch.
It should have included the point when the second copy
caused the Event ID 4322.
I'm having some problems to make a new compile run.
smb and nmb start fine and the server can join the
existing domain, but I can't get any of the shares
to be mounted on an XP:
The configuration information could not be read
from the domain controller. No connection can be
established with the computer or the access is
If I type "\\theServer" in the Address: field of the
Explorer it waits some time and says "\\theServer"
cannot be found". But if I look at netstat, it shows
several dozens connections from the domain controller
to "theServer" at port 445 in state "TIME_WAIT".
Can you upload debug level 10 log and sniffs of the failed attempts?
Gladly, but at level 10 the log is 2.4 MB even after compression
I also have a zip of the wireshark capture which is almost 7 MB.
Can I send it to you volker ?
Or can you suggest where I can drop it.
According to webmaster of megaupload.com the samba logs are
posted to firstname.lastname@example.org and if you have a problem because of
the size you can use the following URL:
The wireshark capture files have gone the same way to Volker.
The URL is
Can't you just send them by mail? 2.4MB is not really large. Somehow my browser does not like this megaupload.com thing, I can't download those files.
Never mind, Volker, I found a way out of my problems.
I'll probably write a little (very little) How-To for
other newbies like me in similar situation:
how-to rebuild Samba using SuSE SPEC file
All the info is really there but it's scattered across
so many sites and directories. The how-to is meant to
be the glue - how you go about pasting together all
SuSE SPEC needs in order to work with new patches.
Question -- is this bug now really closed, or do you still have the problem?
Just a quick note to report, since I opened this bug, that we've been running this patch in production for two days now with no reported errors, when previously we had people seeing them daily. Thank you for the quick fix.
I can confirm that with the patches that Jeremy posted
the problem does not occur any more.