Bug 4796 - Windows XP client giving OutOfResources NetBT exceptions
Summary: Windows XP client giving OutOfResources NetBT exceptions
Status: RESOLVED DUPLICATE of bug 4763
Alias: None
Product: Samba 3.0
Classification: Unclassified
Component: File Services (show other bugs)
Version: 3.0.25b
Hardware: x86 Windows XP
: P3 normal
Target Milestone: none
Assignee: Samba Bugzilla Account
QA Contact: Samba QA Contact
Depends on:
Reported: 2007-07-17 15:32 UTC by Josh Kelley
Modified: 2007-07-22 07:59 UTC (History)
1 user (show)

See Also:

Proposed patch for 3.0.25c (4.04 KB, patch)
2007-07-17 18:30 UTC, Jeremy Allison
no flags Details
Correct patch. (3.86 KB, patch)
2007-07-17 19:00 UTC, Jeremy Allison
no flags Details
tried to start a second copy of a file before the first copy was done (24.39 KB, application/octet-stream)
2007-07-18 08:33 UTC, Dragan Krnic
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Josh Kelley 2007-07-17 15:32:36 UTC
Windows XP occasionally terminates network drive connections, sometimes causing program errors.  This problem apparently started after upgrading from Samba 3.0.24 to Samba 3.0.25 or 3.0.25a.  When this happens, Windows logs to the System event log an event with source NetBT, event ID 4322, with the following description:

NetBT failed to process a request because it encountered OutOfResources exception(s) in the last 1 hour.

Dragan Krnic reports, "One can reproduce this error anytime if one chooses a big enough file and copies it a second time before the first copy is done.
Samba 3.0.24 does not have this bug."
Comment 1 Josh Kelley 2007-07-17 16:06:11 UTC
Wireshark packet capture available at http://www.jbc.edu/~josh/outofresources.pcap.gz.  The error is at 11:23:49am, around packet 57737.
Comment 2 Jeremy Allison 2007-07-17 18:30:28 UTC
Created attachment 2825 [details]
Proposed patch for 3.0.25c

Please apply this onto 3.0.25b.
Comment 3 Jeremy Allison 2007-07-17 18:31:19 UTC
I think this is a duplicate of #4763 - but the trace in this bug was essential for the correct fix - thanks !

*** This bug has been marked as a duplicate of 4763 ***
Comment 4 Jeremy Allison 2007-07-17 19:00:12 UTC
Created attachment 2827 [details]
Correct patch.

Replacement patch. One line was deleted by accident.

One line was deleted by accident. This should be the correct fix.
Comment 5 Dragan Krnic 2007-07-18 08:33:14 UTC
Created attachment 2828 [details]
tried to start a second copy of a file before the first copy was done

there were altogether 105 full 1-MB capture files and one smaller.
I've zipped the last 2
Comment 6 Volker Lendecke 2007-07-18 08:42:51 UTC
Are these new traces with the patch? Do you still see the problem?

In neither of the traces there is a notify packet or a tcp reset present, so this is not really enough of the traces you took.

Comment 7 Dragan Krnic 2007-07-19 10:35:46 UTC
I wrote in more detail in an "Additional Comments:" frame but
then I wanted to upload the net dumps and the original
comments werde lost.

The file I uploaded was still without Jeremy's patch.
It should have included the point when the second copy 
caused the Event ID 4322.

I'm having some problems to make a new compile run.
smb and nmb start fine and the server can join the
existing domain, but I can't get any of the shares
to be mounted on an XP: 

   The configuration information could not be read
   from the domain controller. No connection can be
   established with the computer or the access is

If I type "\\theServer" in the Address: field of the
Explorer it waits some time and says "\\theServer"
cannot be found". But if I look at netstat, it shows
several dozens connections from the domain controller
to "theServer" at port 445 in state "TIME_WAIT". 
What's wrong?
Comment 8 Volker Lendecke 2007-07-19 11:44:18 UTC
Can you upload debug level 10 log and sniffs of the failed attempts?
Comment 9 Dragan Krnic 2007-07-19 15:06:06 UTC
Gladly, but at level 10 the log is 2.4 MB even after compression
with bzip2.

I also have a zip of the wireshark capture which is almost 7 MB.

Can I send it to you volker ?
Or can you suggest where I can drop it.
Comment 10 Dragan Krnic 2007-07-19 15:09:15 UTC
Oh, wait.
According to webmaster of megaupload.com the samba logs are
posted to vl@samba.org and if you have a problem because of
the size you can use the following URL:
Comment 11 Dragan Krnic 2007-07-19 15:20:14 UTC
The wireshark capture files have gone the same way to Volker.
The URL is
Comment 12 Volker Lendecke 2007-07-20 01:38:25 UTC
Can't you just send them by mail? 2.4MB is not really large. Somehow my browser does not like this megaupload.com thing, I can't download those files.

Comment 13 Dragan Krnic 2007-07-20 04:26:34 UTC
Never mind, Volker, I found a way out of my problems.

I'll probably write a little (very little) How-To for
other newbies like me in similar situation: 

   how-to rebuild Samba using SuSE SPEC file

All the info is really there but it's scattered across
so many sites and directories. The how-to is meant to
be the glue - how you go about pasting together all
SuSE SPEC needs in order to work with new patches.
Comment 14 Volker Lendecke 2007-07-20 04:30:36 UTC
Question -- is this bug now really closed, or do you still have the problem?

Comment 15 Josh Kelley 2007-07-20 16:11:35 UTC
Just a quick note to report, since I opened this bug, that we've been running this patch in production for two days now with no reported errors, when previously we had people seeing them daily.  Thank you for the quick fix.
Comment 16 Dragan Krnic 2007-07-22 07:59:24 UTC
I can confirm that with the patches that Jeremy posted
the problem does not occur any more.