Hi Robert, The capture you posted unfortunately does not contain anything of worth looking at I think. Only 2 SMB packets. % tshark -r capture.pcap -Y 'smb||smb2' 1130 15.032933 150.108.64.56 → 150.108.68.23 SMB 144 Trans2 Request, QUERY_PATH_INFO, Query File All Info, Path: 1131 15.034786 150.108.68.23 → 150.108.64.56 SMB 204 Trans2 Response, QUERY_PATH_INFO Given your kernel log message I would expect seeing the reconnecting happen. I would wrap your backup script like so to get the right capture: capfile="$(date -Ihours)" tcpdump -w "$capfile" port 445 & cappid=$! sleep 2 .....<your script>.... sleep 2 kill -6 $cappid -- Aurélien Aptel / SUSE Labs Samba Team GPG: 1839 CB5F 9F5B FB9B AA97 8C99 03C8 A49B 521B D5D3 SUSE Linux GmbH, Maxfeldstraße 5, 90409 Nürnberg, Germany GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg) -- To unsubscribe from this list: send the line "unsubscribe linux-cifs" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html