DSM-G600, DNS-3xx and NSA-220 Hack Forum

mushisushi · 2009-11-11 10:35:06

Hello,

Recently I noticed my DNS running really sluggish.. I tried to ssh into it and it takes forever to load. Transmission is also behaving similarly.

I thought it might be transmission again, but this time when I perform a top in ssh I noticed that the process 'smbd -d' is running at 86%.

Does anyone know what that is?

Thanks,

Mijzelf · 2009-11-11 17:10:50

That's your Samba server

mushisushi · 2009-11-11 18:14:04

Thanks!

Is it normal for it to be taking up so many resources? I don't have anything reading it when it was running at 86%

Mijzelf · 2009-11-11 22:46:02

No, that's not normal. When you are not accessing the box via Samba it should be about 0%. I suggest you to restart samba or reboot the box.

mushisushi · 2009-11-12 00:20:05

I did that, but again, it goes back up after a little while.

Not sure what's accessing it. Are there any commands to determine who is connected?

--EDIT--

Was monitoring the processes and even if i kill the smbd process, it comes back after 5-10 seconds running at 80-100%...

Any help would be great!

Last edited by mushisushi (2009-11-12 00:45:58)

mushisushi · 2009-11-12 01:16:40

Crap... i screwed something up now....

I click on "Reset Factory Defaults" in the DNS-323 setting and now I can't ssh in or telnet into the box. What should i do?

mushisushi · 2009-11-13 04:25:59

Alright, fixed my ssh but I'm still having issues. I've rebooted the box, reset
the settings and turned off transmission but samba is still running at 70+%.

Anyone have any ideas?

mushisushi · 2009-11-19 07:05:34

Can anyone please help.... Playing videos from the NAS to the computer lags too!!

Anyone?

I've reinstalled fun_plug, transmission, and reset the defaults on the NAS.... nothing works.. is this normal?

Mijzelf · 2009-11-19 11:27:00

- Have a look at your logfiles. /var/log/messages, /var/log/samba/*, ...
- netstat -a can show you if someting in your LAN is using samba.
- lsof | grep smbd (as root) can show you which files are opened by samba (including the used executable and libraryfiles).
- cd /tmp ; df . can tell you if the tmp directory is full, which can have strange side effects.

mushisushi · 2009-11-20 20:37:35

Mijzelf wrote:
- Have a look at your logfiles. /var/log/messages, /var/log/samba/*, ...
- netstat -a can show you if someting in your LAN is using samba.
- lsof | grep smbd (as root) can show you which files are opened by samba (including the used executable and libraryfiles).
- cd /tmp ; df . can tell you if the tmp directory is full, which can have strange side effects.

Thanks Mijzelf,

I've tried your suggestions without much success...

Through telnet I tried:

- Looking for the logs - No folder called /var/log/message and nothing in /var/log/samba

- When I did a netstat -a I get no results. The header of the table is displayed, but nothing is listed...

- When i do a lsof | grep smbd I get so many results that the I cannot actually see in console... Will this command work to send the output to a text file? lsof | grep smbd >> /mnt/HD_a2/lsof.txt

- Finally, I checked the tmp directory and it contained a few files. I tried deleting everything, then restarting samba and that didn't help.

Any other suggestions?

Mijzelf · 2009-11-21 15:47:32

It looks to me something is seriously wrong with your system. netstat -a *should* give output, but I don't know what could be able to prevent that.
lsof | grep smbd >> /mnt/HD_a2/lsof.txt should indeed dump it to a file. You can also use lsof | grep smbd | less to be able to scroll up and down.

mushisushi · 2009-11-23 04:57:09

Hum, looking at the lsof logs, it only shows multiple smbd processes accessing many different samba related files. The process with the 'nobody' users had a few different entries that I don't understand though:

smbd 3082 nobody 21u IPv4 50000 TCP Buta:445->192.168.0.193:49159 (ESTABLISHED)

(Buta) is the name of the device.

Is there some way for me to restore everything back to the way it was out of the box?

Mijzelf · 2009-11-23 10:45:05

mushisushi wrote:
smbd 3082 nobody 21u IPv4 50000 TCP Buta:445->192.168.0.193:49159 (ESTABLISHED)

So 192.168.0.193 has a connection with samba. Maybe an auto-networkconnection on the box which you use to collect this data?

Is there some way for me to restore everything back to the way it was out of the box?

Yes. Rename or delete fun_plug, reboot the box. Then you can delete /ffp (but it's not necessary, ffp without fun_plug is just data). Then use the 'Reset to factory defaults' in tab Tools in the webinterface, or press the reset button for 15 seconds and reboot.

mushisushi · 2009-11-24 18:18:51

Thanks Mijzelf,

I just realized that that was the IP of the current computer I was using...

I'm wondering if it's possibly an issue with my windows 7 trying to access the box or index it or something that's causing this. I'll have to try connecting to the box with another machine to see if smbd is pinned..

skydreamer · 2009-11-25 02:11:35

Network virus?

mushisushi · 2009-11-25 05:53:05

Humm... I don't want to say it's impossible.. but it is a new system.

I'll try downloading avast to see if it detects anything.

Mijzelf · 2009-11-25 10:40:19

Just download a Linux LiveCD, and boot your box from it. Then you can exclude W7.

mushisushi · 2009-12-05 08:59:58

Alright, i've determined it is a problem with my windows 7 machine. When it is off, i used my wife's computer and checked the processes and it is sitting at 0%.

Now, anyone have any suggestions? I've turned off windows indexing service. Are there any other services that would cause this?

Mijzelf · 2009-12-05 12:48:03

Maybe this one?

KyleK · 2009-12-05 18:31:16

Maybe Windows is indexing whatever files you have laying on the NAS? (Media files, for example, if you added folders on the NAS to Windows Media Centers library).

Check in Windows if the SearchIndexer is running while smbd is showing high CPU usage.

mushisushi · 2009-12-05 22:27:01

Mijzelf wrote:
Maybe this one?

The thread is addressing issues with accessing samba servers, which I don't have, but I did give it a try and that didn't do anything.

KyleK wrote:
Maybe Windows is indexing whatever files you have laying on the NAS? (Media files, for example, if you added folders on the NAS to Windows Media Centers library).

Check in Windows if the SearchIndexer is running while smbd is showing high CPU usage.

WindowsSearch services, WMP library search, and offline files were all disabled, with no luck.

Thanks for your help guys, I really appreciate this.

Anyways, found out that it is using a random port each time. I've used tcpdump to get some information about it, but not sure how to read it.

Last edited by mushisushi (2009-12-05 22:47:09)

Mijzelf · 2009-12-05 22:51:31

mushisushi wrote:
Mijzelf wrote:
Maybe this one?
The thread is addressing issues with accessing samba servers, which I don't have

Your NAS *is* a Samba server.

I know that the access is on port: 49160... Anyway to determine what is using that port?

Do you mean that the NAS runs a service on port 49160, or has the W7 pc a port 49160 connected to the NAS?
In the first case you can use the command (on the NAS)

Code:

su
netstat -lp | grep 49160

to find the service which uses this port.
On the Windows side netstat can be used to, but you'll have to use different parameters. Try netstat /?

mushisushi · 2009-12-08 06:33:34

Problem NOT Solved!

Turns out I disabled the 'Client for Microsoft Networks' which in turn turned off the microsoft-ds service so it stopped pinging the SAN drive.

At least I have isolated the problem to how windows 7 is accessing the SAN

Last edited by mushisushi (2009-12-08 08:26:36)

mushisushi · 2009-12-09 02:56:26

Alright, found the problem! finally!

So the problem boils down to the shared printer. I have a Brother HL-1435 laser printer attached to the DNS323. When I add the device to my windows 7 machine, immediately the network meter spikes and the DNS323 locks up (80% cpu on smbd).

Anyone having issues with Windows 7 and printer sharing with the DNS 323?

dashrendar · 2010-03-24 17:53:36

mushisushi wrote:
Alright, found the problem! finally!

So the problem boils down to the shared printer. I have a Brother HL-1435 laser printer attached to the DNS323. When I add the device to my windows 7 machine, immediately the network meter spikes and the DNS323 locks up (80% cpu on smbd).

Anyone having issues with Windows 7 and printer sharing with the DNS 323?

I'm having the exact same problem with Windows 7 64-bit Ultimate. I noticed the network activity LED flashing rapidly on the DNS-323. It was also coinciding with COMODO firewall having both green and red lines constantly on. I checked COMODO and it showed the System process connecting to my DNS-323 IP address, and transferring ~1 GB of data back and forth.

I decided to check the processes on the DNS-323. The SMBD process was between 70-80%. At the time, I had recently connected my Brother HL-1450 to the DNS-323 but didn't notice the lights.

The second I removed the printer from Windows 7, the flashing stopped and the smbd process went to 0. When add the printer, the flashing comes back.

For information, I was using the Vista x64 driver for my printer because they didn't have a Windows 7 x64 driver. I didn't have any problems printing using this driver through the DNS-323 though. It's just the constant flashing and the data transfer between the DNS-323 and my Windows 7 machine that's troublesome.

Were you able to fix your issue eventually? Has anyone else encountered this?

I heard that there is a newer version of Samba (http://dns323.kood.org/forum/viewtopic.php?id=5441) that fixes issues with Windows 7 x64. I wonder if that's worth trying.

Last edited by dashrendar (2010-03-24 17:53:58)

DSM-G600, DNS-3xx and NSA-220 Hack Forum

Announcement

#1 2009-11-11 10:35:06

'smbd -d' running at 86%

#2 2009-11-11 17:10:50

Re: 'smbd -d' running at 86%

#3 2009-11-11 18:14:04

Re: 'smbd -d' running at 86%

#4 2009-11-11 22:46:02

Re: 'smbd -d' running at 86%

#5 2009-11-12 00:20:05

Re: 'smbd -d' running at 86%

#6 2009-11-12 01:16:40

Re: 'smbd -d' running at 86%

#7 2009-11-13 04:25:59

Re: 'smbd -d' running at 86%

#8 2009-11-19 07:05:34

Re: 'smbd -d' running at 86%

#9 2009-11-19 11:27:00

Re: 'smbd -d' running at 86%

#10 2009-11-20 20:37:35

Re: 'smbd -d' running at 86%

Mijzelf wrote:

#11 2009-11-21 15:47:32

Re: 'smbd -d' running at 86%

#12 2009-11-23 04:57:09

Re: 'smbd -d' running at 86%

#13 2009-11-23 10:45:05

Re: 'smbd -d' running at 86%

mushisushi wrote:

#14 2009-11-24 18:18:51

Re: 'smbd -d' running at 86%

#15 2009-11-25 02:11:35

Re: 'smbd -d' running at 86%

#16 2009-11-25 05:53:05

Re: 'smbd -d' running at 86%

#17 2009-11-25 10:40:19

Re: 'smbd -d' running at 86%

#18 2009-12-05 08:59:58

Re: 'smbd -d' running at 86%

#19 2009-12-05 12:48:03

Re: 'smbd -d' running at 86%

#20 2009-12-05 18:31:16

Re: 'smbd -d' running at 86%

#21 2009-12-05 22:27:01

Re: 'smbd -d' running at 86%

Mijzelf wrote:

KyleK wrote:

#22 2009-12-05 22:51:31

Re: 'smbd -d' running at 86%

mushisushi wrote:

Mijzelf wrote:

Code:

#23 2009-12-08 06:33:34

Re: 'smbd -d' running at 86%

#24 2009-12-09 02:56:26

Re: 'smbd -d' running at 86%

#25 2010-03-24 17:53:36

Re: 'smbd -d' running at 86%

mushisushi wrote:

Board footer