Poor Samba read perfomrnace across a DMZ

[James D. Bennett]

Hello, we are running Samba 2.2.8a on an HP-UX 11i server and have encountered a strange performance problem.
Going to/from Samba shares to a machine in our internal network, a 100MB file takes < 1 minute to transfer. Receiving the same file from a machine on the DMZ to the Samba share, takes < 1 minute. Sending the file from the Samba share to a machine on the DMZ takes > 30 minutes.
The same file from a Win2k file server to the DMZ works fine both ways (< 1 minute for reads and writes). Our network guys have checked the port settings, etc. and found no anomalies.
Does anyone have any suggestions? Thanks in advance.

[Steven E. Protter]

Latest version of CIFS/9000

http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/displayProductInfo.pl?productNumber=B8725AA

Includes performance tweaks.

lanadmin -x 0

Replace the zero with the actual number of the lan (from lanscan).

Duplex should be what you expect.

Hard code the duplex and speed settings in /etc/rc.config.d/hpbtlanconf if you suspect you are not getting proper duplex or if any of the network hardware is made by Cisco.

Insist on explicit port settings on your switch, avoid auto negotiate unless your NIC is 1000 BaseT

Make sure you are getting proper throughput.

Do some performance data collection witht the attached scripts and look for bottlenecks. Run the transfers while doing the data collection.

Watch the network,disk and cpu with glance while doing the transfers.

General performance tuning.
http://www2.itrc.hp.com/service/cki/search.do?category=c0&docType=Security&docType=Patch&docType=EngineerNotes&docType=BugReports&docType=Hardware&docType=ReferenceMaterials&docType=ThirdParty&searchString=UPERFKBAN00000726&search.y=8&search.x=28&mode=id&admit=-1335382922+1058558917419+28353475&searchCrit=allwords

UPERFKBAN00000726

traceroute from outside and in, look for what IP addresses are taking too long. Could be a router IOS issue.

Consider a 1000 BaseT NIC if bottlenecks are found.

That all being said, I'm not sure I believe what your network guys say, but it never hurts to check out the system first.

SEP