Windows 2008 R2 SMB / CIFS Logging to diagnose Brother MFC Network Scanning

Posted by Steven Potter on Server Fault See other posts from Server Fault or by Steven Potter
Published on 2012-07-09T16:19:06Z Indexed on 2012/07/09 21:18 UTC
Read the original article Hit count: 327

I am attempting to setup network scanning on a brother MFC-9970CDW printer. According to the Brother documentation, the printer is setup to connect to any CIFS network share. I applied all of the appropriate setting in the printer however I get a "sending error" when I try to scan a document.

When I look at the logs of the 2008 R2 server that I am attempting to connect to; I can see in the security log where the printer successfully authenticates, however nothing else is logged.

I would assume that immediately after the authentication, the printer is making a CIFS request and some sort of error is occurring, however I can't seem to find any way to log this information to find out what is going on. Is it possible to get Windows 2008 to log SMB/CIFS traffic?


I installed Microsoft netmon and captured the packets associated with the transaction:

510 3:04:28 PM 7/9/2012 34.4277743  System    SMB SMB:C; Negotiate, Dialect = NT LM 0.12  {SMBOverTCP:30, TCP:29, IPv4:22}
511 3:04:28 PM 7/9/2012 34.4281246  System   SMB SMB:R; Negotiate, Dialect is NT LM 0.12 (#0), SpnegoToken (   {SMBOverTCP:30, TCP:29, IPv4:22}
519 3:04:29 PM 7/9/2012 34.8986214  System    SMB SMB:C; Session Setup Andx, NTLM NEGOTIATE MESSAGE   {SMBOverTCP:30, TCP:29, IPv4:22}
520 3:04:29 PM 7/9/2012 34.8989310  System   SMB SMB:R; Session Setup Andx, NTLM CHALLENGE MESSAGE - NT Status: System - Error, Code = (22) STATUS_MORE_PROCESSING_REQUIRED  {SMBOverTCP:30, TCP:29, IPv4:22}
522 3:04:29 PM 7/9/2012 34.9022870  System    SMB SMB:C; Session Setup Andx, NTLM AUTHENTICATE MESSAGEVersion:v2, Domain: CORP, User: PRINTSUPOFF, Workstation: BRN001BA9AD1FE6   {SMBOverTCP:30, TCP:29, IPv4:22}
523 3:04:29 PM 7/9/2012 34.9032421  System   SMB SMB:R; Session Setup Andx   {SMBOverTCP:30, TCP:29, IPv4:22}
525 3:04:29 PM 7/9/2012 34.9051855  System    SMB SMB:C; Tree Connect Andx, Path = \\\IPC$, Service = ?????   {SMBOverTCP:30, TCP:29, IPv4:22}
526 3:04:29 PM 7/9/2012 34.9053083  System   SMB SMB:R; Tree Connect Andx, Service = IPC {SMBOverTCP:30, TCP:29, IPv4:22}
528 3:04:29 PM 7/9/2012 34.9073573  System    DFSC    DFSC:Get DFS Referral Request, FileName: \\\NSCFILES, MaxReferralLevel: 3   {SMB:33, SMBOverTCP:30, TCP:29, IPv4:22}
529 3:04:29 PM 7/9/2012 34.9152042  System   SMB SMB:R; Transact2, Get Dfs Referral - NT Status: System - Error, Code = (549) STATUS_NOT_FOUND   {SMB:33, SMBOverTCP:30, TCP:29, IPv4:22}
531 3:04:29 PM 7/9/2012 34.9169738  System    SMB SMB:C; Tree Disconnect  {SMBOverTCP:30, TCP:29, IPv4:22}
532 3:04:29 PM 7/9/2012 34.9170688  System   SMB SMB:R; Tree Disconnect  {SMBOverTCP:30, TCP:29, IPv4:22}

As you can see, the DFS referral fails and the transaction is shut down. I can't see any reason for the DFS referral to fail. The only reference I can find online is:

Anyone have any ideas for a solution?

© Server Fault or respective owner

Related posts about windows-server-2008

Related posts about windows-server-2008-r2