First time here? Check out the FAQ!
THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
Ask Your Question
0

SMB Ioctl Response, Error: STATUS_NOT_FOUND

Hi,

I have an error "Ioctl Response, Error: STATUS_NOT_FOUND" and wish to know the reason.

Please note the share is indeed available, but users reported intermittent access issue. Looking at the logs, you can see the issue at the time when the user could not connect, but need to figure out the reason. Not sure if there are more details somewhere pointing me at something.

I read this from the SMB Header NT Status.

1151    18.928199   10.155.201.xx   10.155.10.xx    SMB2    256 Ioctl Request FSCTL_DFS_GET_REFERRALS, File: \INxxxxx\data\Shared\Mumbai\Training

1152    18.929438   10.155.10.xx    10.155.201.xx   SMB2    130 Ioctl Response, Error: STATUS_NOT_FOUND
sonacanada's avatar
1
sonacanada
asked 2021-03-05 23:20:04 +0000, updated 2021-03-06 17:06:14 +0000
edit flag offensive 0 remove flag close merge delete

Comments

add a comment see more comments

1 Answer

0

File shares accessed by SMB, SMB2 or SMB3 can be replicated over multiple servers. The underlying shares are arranged in a name space. The Microsoft documentation on DFS discusses this topic in detail.

When accessing a share, the client tries to find out, if the share is available through DFS. This query is made using the Ioctl Request, that you have recorded. If the share is indeed part of a DFS name space the response includes all servers, that host the share. The client will then pick one of the servers and access the files as desired.

At least on Server 2008, the server will responds with STATUS_NOT_FOUND if the share is not DFS enabled. On other SMB2/3 implementations you might observe a response with an empty array in the out data section.

The short snippet from your trace file would only be troublesome if your share is DFS enabled.

Good luck

Eddi

Eddi's avatar
2.4k
Eddi
answered 2021-03-07 16:36:32 +0000
edit flag offensive 0 remove flag delete link
more

Comments

Hi Eddi,

Thank you for the details.

The issue is that we see this randomly and since we added some new 2019DCs to our 2012R2 DCs.

We have gone through many different checks and nothing obvious showed up.

Our last resource was Wireshark and we noticed the errors that we posted here.

This very particular share "\INxxxxx\data\Shared\Mumbai\Training" is not being replicated to other servers. in fact we have one out of many shares, that is being replicated to other sites.

So DFS\Namespace usage is applicable to all shares, however, DFSR (the replication side), is only applicable to one share.

Not sure if the above explanation along with the errors in the logs can give you a better view to assist further.

User do get this error randomly at a random time, we even disconnect 2019DCs at some point, but the issue still persists, sometimes no ... (more)

sonacanada's avatar sonacanada (2021-03-08 16:33:01 +0000) edit
more
  • delete
add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer