SMB troubleshooting

I have a very weird problem with SMB shares, never have experienced this.
From some branch offices, Windows 10 users cannot access shares on Windows 2012 servers. But Windows 7 users don't have issue on accessing shares.
If the testing is done from another branch office, both Windows 7 and 10 users dont' have issue on accessing shares.
It seems it's obvious it's network issue, but as the same test is done while all ports open temporary in firewall, windows 10 users can't access the shares from the branch to the file server. We have man-in-the-middle device, Riverbed, but as I confirmed with the Riverbed maintainer, SMB Optimization is turned off.  

I ran wireshark for analyzing, but it doesn't show much. The only thing shows is, the user side 'reset' session right after 3 way handshakes.

I drilled down SMB signing matters, it's not the issue, just to rule out it.
Both client and servers are set as singing allowed, but not required. In fact, Windows 10 users in the branch where the file servers are located, have no same issue accessing shares.

Is there any tool other than Wireshark which can analyze and troubleshoot SMB traffic in detail?
It seems network issue, but can't pinpoint the issue.
Sungpill HanAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Zaheer IqbalTechnical Assurance & ImplementationCommented:
Do you use any WAN optimisation at all ?
Zaheer IqbalTechnical Assurance & ImplementationCommented:
Sorry missed that I would turn off your riverbeds and test again.
Zaheer IqbalTechnical Assurance & ImplementationCommented:
Have see this issue with Riverbeds before.
Active Protection takes the fight to cryptojacking

While there were several headline-grabbing ransomware attacks during in 2017, another big threat started appearing at the same time that didn’t get the same coverage – illicit cryptomining.

Sungpill HanAuthor Commented:
When you say, turn off? does it mean that there are more than only SMB Optimization?
We can't turn off the device, it's company security policy.
What in Riverbed did you find causes the issue?
Zaheer IqbalTechnical Assurance & ImplementationCommented:
Its been a while since I have started a new Job, it was definatley optimisation. I think we turned off optimisation at the central location ie DC and the issue was fixed. Eventually Riverbeds were removed from the network altogether after major line upgrades.
Sungpill HanAuthor Commented:
Disabling SMB Optimization didn't do.
a.PNG

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Sungpill HanAuthor Commented:
It seems like our Riverbed firmware is outdated, doesn't recognize SMB 3.11 for Windows 10.
The SMB Optimization option for SMB 3 is missing.

I can't confirm if this causes the issue, but will come back and post for other viewers in future.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows 10

From novice to tech pro — start learning today.