Skip to content

January 22, 2009

Windows Network Performance in File Shares – What lies beneath when you move your mouse

by Joe Kuan

NetworkingWhen users experience a slow down in Windows File Share, often the usual suspect is the speed (bandwidth & high latency) or high volume of network traffic, but is it really?

As this is the first article in the series of investigating what goes on beneath Windows File Shares, I’m trying not to go down into protocol details. I must emphasise that this article is not to provide a solution. Neither it is stating this is the only cause for poor network performance. In fact, this may be one of the behaviours that increases the network traffic.

Most of the actions in navigating file shares are opening/displaying folders content and browsing the directory content by scrolling or moving the mouse. Let’s study their behaviours in terms of network performance.

Experiment Setup

This is how the experiment is conducted. A Windows XP Pro machine (client) connects to a hub which is then connected to the main network accessible to the file shares also running with Windows XP Pro. Another PC is running with tethereal connecting to the same hub to capture packets. Alternatively, you can run any sniffer programs on the client machine or use port mirroring instead of a hub. Whatever suits you best.

The reason we use tethereal instead of the more popular choice, tcpdump, is that it constantly displays the number of captured packets, so we can instantly observe how many packets are passing by. Later on, you will see why this feature is important in this experiment.

In order to avoid capturing unwanted packets, we run tethereal with the following parameters:
tethereal -w /tmp/cifs_dump ‘(host <ip> and port 445)’

ip is the IP address of the windows client machine. Port 445 is for CIFS, protocol for Windows Networking. The protocol has a long history and it takes more than few articles for introduction. However, more information can be found in Samba, document, MSDN website and technical books.

Experiment 1A – My Computer, View Option, Details.

The way we run experiments is first to turn on all the details for browsing a directory (select View -> Details). This will significantly increase the file shares traffics. Then adjust the setting step by step and see the impact is.

To switch on all the details, select My go to View -> Choose Details… and check all the attributes.
Go to Tools -> Folder Options … -> View, click on ‘Apply to All Folders’. Close all the windows to make sure the changes are applied and open a new window. 


Open the file share directory and watch the number of packets on tethereal increases. The capture process is stopped when the number stops increasing.


Perform the same experiment again with the details switching back to the default setting (Name, Size, Type and Date Modified). The whole experiment is repeated 3 times to make sure the test data are roughly the same. The file share directory contains 74 subdirectories and 84 files.

Experiment No. of packets Capture File Size in kbytes
1 42 (15217) 27 (3043)
2 43 (15687) 27 (3138)
3 42 (15691) 27 (3138)

The first column is the total number of packets and the second is the capture file size. In each cell, there are two values, the first value is details with default settings, the next value inside the bracket represents with “full details” setting on.

Now we can see how much difference that it makes and of course hardly any users will consider it necessary to have such a high level of details. Nonetheless, this shows us the magnitude of network traffic for high level details. The typical ratio of traffic volume is about 116 times more when the full setting is applied. In terms of packets, this is 373 times more. This volume of traffic may depend on various numbers of files and directories. We shall investigate the relationship in the future and also what actions are occurring inside these CIFS packets.

Experiment 1B – View Option, List.

Switch from Details to List in View menu option, click ‘Apply to All Folders’. Starts tethereal and open the same folder in the previous experiment. The number of packets remains the same.

The result from using List view show the same number of packets as the Details view with default details setting.

Experiment 2A – Folder tooltip on

The next experiment is to investigate the impact of folders tooltips and network packets. Make sure the folder tooltip is switched on. Open a file share directory, then start tethereal and observe the packets capture.

Move the mouse cursor over the top of the first directory name and scroll down the list like browsing a directory.


We observe that the number of captured packets increases. It is no surprise that the Window client retrieves information from the file share for the folders’ tooltip as the pointer is moved. I notice several interesting behaviours:

  1. When the mouse is moved over the files, no packets are transmitted.
  2. The rate of packets transmission increases when the mouse is moved vigorously over the folders.
  3. The tooltip information doesn’t seem to store locally when scrolling past the directories and scrolling back. However, the number of packets from tethereal still increases.

Typically, it takes a average of 3318 packets, roughly 802 kbytes of data to scroll from top to bottom. Of course, the result is highly dependent on speed and direction of the mouse movement, as well as the number of folders.

So if the folder tooltip option is off, then there should not be any network traffic when the mouse pointer is on top of a folder. Right?

Experiment 2B – Folders tooltip off

This brings us to the next experiment. Switches off the folders tooltip, click ‘Apply to All Folders’ and close all the windows. Starting from a new window, open the same directory and repeat the same process. As expected, there is no tooltip displayed on folders. However, tethereal still reports packets travelling down the link!!! This is illustrated by the tethereal packet number increasing in response to the mouse movement.


This suggests that folders tooltip option has no impact on minimizing network traffic. The Window clients are simply not displaying the tooltips.


The volume of network traffic for displaying a folder content can be varied greatly. We have also examined other view options. The worst are Thumbnails and Details with all attributes. However, Tile, Icon, List and Details with default settings all consume the lowest traffic.

Hovering the mouse pointer on top of directory names and icons can induce network traffic, even though the folder tooltip is off. If this worries you, you can either

  1. scroll down the list with the mouse pointer away from the Name and icon columns.
  2. use the right hand scrollbar to move the directory content.

Readers may argue that the network traffic generated by mouse movements is low volume. This is true for small offices. However in an environment with many users and long distances, some delay may be caused. Remember, the file share server responses to almost every request packet.

In the next article, I will discuss the content of these capture files.

I work for iTrinegy and here are my other technical blogs


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

Note: HTML is allowed. Your email address will never be published.

Subscribe to comments

%d bloggers like this: