This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Network Threat Protection causing SMB to timeout on all endpoints

Hi,

We are having issues where Sophos Network Threat Protection (NTP) is causing all Windows SMB file transfers to time out, all other network traffic seems unaffected. If the NTP feature is disabled in the local endpoint settings GUI the issue still occurs, however if the Windows service relating to SophosNtpService.exe is stopped the issue immediately goes away and network file access is normal. If the Windows service is started again manually or via a reboot the issue still doesn't come back in the limited testing so far.

Versions are: Intercept X 2022.1.1.22 (core agent 2022.2.1.9).

I don't have a ticket just yet as i'm waiting on our support portal account to get approved
Thanks for any help

This thread was automatically locked due to age.

0 FormerMember over 2 years ago

how are you doing the file transfers? through a mounted drive? Program? Web browser?
Cancel
Vote Up 0 Vote Down

Cancel
0 SpiderSocks over 2 years ago in reply to FormerMember

Tested with UNC path, and whatever Windows uses for folder redirection as this fails upon login
Cancel
Vote Up 0 Vote Down

Cancel
0 FormerMember over 2 years ago in reply to SpiderSocks

that's a strange scenario. since you're finding that the service needs to be stopped - that tells me there is an issue with the hook it puts into the network stack.

Do you have a packet capture of the file access attempts with the issue happening and without it happening?
Cancel
Vote Up 0 Vote Down

Cancel
0 SpiderSocks over 2 years ago in reply to FormerMember

I got a capture of it happening and submitted it to support , I wasn't able to get a sensible capture file size when the issue is not happening as the attachments uploads were limited to 25MB. I'm a little weary of posting a giant packet capture on public forums though! If you wish to look internally my case ID is 05639710
Cancel
Vote Up 0 Vote Down

Cancel
0 FormerMember over 2 years ago in reply to SpiderSocks

Since you have a support case going - I will let them investigate it.
Cancel
Vote Up 0 Vote Down

Cancel
0 Dan Jenkin over 2 years ago

Did you get a solution to this as we have exactly the same issue?
Cancel
Vote Up 0 Vote Down

Cancel