# Collect both ends of an SMB failure before interpreting retransmissions

> Which evidence should be collected before investigating an SMB connection failure?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260908-087-collect-both-ends-of-an-smb-failure-before-interpreting-retransmissions/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-08T18:15:44+00:00
- Modified: 2026-09-08T18:20:22+00:00
- Last reviewed by DSE: 2026-09-08
- Resource type: Guide
- DSE priority: Information
- Topics: IT, Networks & Infrastructure
- Reading time: 1 minutes

## What you need to know

Which evidence should be collected before investigating an SMB connection failure?

## Potentially affected

Administrators diagnosing SMB client-to-server communication failures.

## DSE recommendation

Prepare one coordinated collection window covering both endpoints.

## Article

## Source facts

Microsoft recommends collecting network traces at both the SMB client and server before troubleshooting. Its guidance emphasizes consistent SMB terminology so that collection and analysis refer to the same operations. A sequence of five retransmissions followed by a TCP reset may indicate lost connectivity or an SMB service that stopped responding. Microsoft presents these as possible explanations, not a unique diagnosis. [Microsoft documentation](https://learn.microsoft.com/en-us/windows-server/storage/file-server/Troubleshoot/troubleshooting-smb).

## Applicability

Define the failed file operation, client, server, share name, and observed time. Review whether the issue can be reproduced safely, and arrange appropriate handling for any sensitive information present in the captured traffic.

## DSE recommendation

Prepare one coordinated collection window covering both endpoints. Record the exact reproduction steps and the result the user expected. Ask the network and file-service owners to agree on the timestamps and operation identifiers they will use when comparing captures and logs.

## Verification

Confirm that both captures contain the same attempted operation before drawing a conclusion. Compare connection establishment, requests, responses, retransmissions, and termination. Preserve alternative explanations until the endpoint and network evidence distinguishes them; record a missing capture or uncertain time alignment as a collection limitation.

## Official references

[Microsoft Learn: Advanced Troubleshooting Server Message Block (SMB)](https://learn.microsoft.com/en-us/windows-server/storage/file-server/Troubleshoot/troubleshooting-smb). Source reviewed September 8, 2026.

## Primary reference

- Name: Advanced Troubleshooting Server Message Block (SMB)
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/windows-server/storage/file-server/Troubleshoot/troubleshooting-smb
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Collect both ends of an SMB failure before interpreting retransmissions,” DSE Security, https://update.dsesecurity.com/updates/dse-20260908-087-collect-both-ends-of-an-smb-failure-before-interpreting-retransmissions/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.