Collect both ends of an SMB failure before interpreting retransmissions

Source facts

Microsoft recommends collecting network traces at both the SMB client and server before troubleshooting. Its guidance emphasizes consistent SMB terminology so that collection and analysis refer to the same operations. A sequence of five retransmissions followed by a TCP reset may indicate lost connectivity or an SMB service that stopped responding. Microsoft presents these as possible explanations, not a unique diagnosis. Microsoft documentation.

Applicability

Define the failed file operation, client, server, share name, and observed time. Review whether the issue can be reproduced safely, and arrange appropriate handling for any sensitive information present in the captured traffic.

DSE recommendation

Prepare one coordinated collection window covering both endpoints. Record the exact reproduction steps and the result the user expected. Ask the network and file-service owners to agree on the timestamps and operation identifiers they will use when comparing captures and logs.

Verification

Confirm that both captures contain the same attempted operation before drawing a conclusion. Compare connection establishment, requests, responses, retransmissions, and termination. Preserve alternative explanations until the endpoint and network evidence distinguishes them; record a missing capture or uncertain time alignment as a collection limitation.

Official references

Microsoft Learn: Advanced Troubleshooting Server Message Block (SMB). Source reviewed September 8, 2026.