track network issues via packet sniffer

[mcz]

Hi everybody,

for security reasons, we have put our backup repository (CIFS share) behind a firewall (fortigate 60D with latest firmware) and we only allow access from the veeam server to the repository. We are using this configuration since some month. Everything works fine but from time to time the backup jobs will fail intermittently with the message:

Unerwarteter Netzwerkfehler Failed to write data to the file

I have already opened a ticket some month ago and we tried to optimize some connection settings but in the end it didn't help (we also got some other issues and then I reverted to the old config). If we use our repository without firewall, we won't have any problems. So far so good, I know that the issue isn't related to veeam but I would like to know what's going on. I would like to check if e.g. the firewall resets the tcp connection. The problem is if you try to sniff the traffic via wireshark, it won't work as it should because of the huge amount of data transferred in between. For this reason, I would like to only capture the tcp/smb headers without data to reduce the amount of data.

Does anybody know how to achieve this using wireshark? Is there probably any other tool availably which is able act this way?

Thanks for your help!

[foggy]

Hi Michael, just to check, are you positive you've enabled access to the repository for all your proxy servers?

[mcz]

Hi foggy,

thanks for your reply! Yes, I every proxy has access to the repository and if the job fails, it will fail after some data has been written. So the initial connection is always successful but after a while, during the job, it will fail with the mentioned error message.

[foggy]

Understood. Then deeper investigation is required, so please continue working with your support engineer.

[PTide]

Hi,

For this reason, I would like to only capture the tcp/smb headers without data to reduce the amount of data.

FYI: In Wireshark you should go to "Capture" - "Options" and set filter to something like "tcp and port 139 or port 445 and ip" to filter out all traffic except SMB, and use "Limit each packet to" option.

Thanks