Why would server suddenly reject SMB requests over NetBT?

On Friday we replaced all the cables in our server room and we come back
today and realize that our 'scan to file' function on our Canon copiers is no
longer working.

If you are not familiar with 'scan to file', you simply have the copier scan
a document and then it sends it to a preconfigured shared folder.

So anyway, after much troubleshooting, we decide to analyze packets and
realize that our server is declining the session request from the copier.

So I setup a share on a different server and had the copier send the scanned
file to that share and it worked fine.

Any ideas?

 

Here is a zip file that contains screenshots of the request and declined
request packet and a .cap file that contains the entire 10 packets. (open in
network monitor)

http://home.comcast.net/~devrybackup/session.zip

 

Here is a zip file with screenshots of packets and .cap file that you can
open in network monitor to view all packets.

http://home.comcast.net/~devrybackup/session.zip

 

Hello Jim

Good day..

I have went through the netmon traces and found the following observations

Observation 1 :
============

In the packet 10 , i see that canon sends a NBT Session Request message ,
this happens after successful 3 ways TCP handshake and falls to the NBT
protocol for file transfer using SMB protocol.

In the packet 11 , i see 2 major observations, TCP is sending AP....F ,
which means that STORE1 is telling that there are no more data from sender,
and in the NBT parameters , i see that caller name is not present ( session
service error ).

This behavior will occur if client port has stopped responding , and in your
scenario there is no Reset or retransmission of packets, hence the TCP
communication was smooth.

Another problem would be the client side application which opens the port is
closing without establishing the connection, u might re-install the
application and test it.



Questions
=======
1) Is there an applicatino on the client side ( STORE1 ) ?
2) Is there any working client ? so that i can compare the netmon trace of
failure and success client ?


Regards,
sainath , SMB KID


This behavior occurs