We have a 10Mb pdf file which when opened from the samba file server where it is saved, around 400Mb of data is sucked from the samba server to the windows acrobat reader client. We have looked at the data using wireshark and seen nothing unusual, just the typical smb protocol occasionally and a lot of data on port 445. When we copy the file to the desktop and open it, no data is transferred from the samba server. The file can not be browsed in until the data transfer between server and client is completed. This apparently occurs only when using adobe reader. I have tested using Foxit secure pdf reader and this data transfer does not happen. There is no discernable difference when viewing the file in acrobat reader or foxit reader.
The pdf has been scanned for viruses, none were found.
This is happening only with this particular file, no other files are generating anything unusual. Does anyone have any idea what this might be? I can't make the file available as it has confidential information.
Update 07/12/2011 - detailed analysis with Solaris truss on the samba processes did not reveal any accesses to any other files.