Dig deep into the sources of the Linux kernel, there is documentation on CIFS - both in source and text. E.g. http://www.mjmwired.net/kernel/Documentation/filesystems/cifs.txt
If you want to study the behaviour of e.g. the CIFS protocol, you may be able to test it with the unix command "dd". Mount any remote file-system via CIFS, e.g. into /media/remote
. Change into this folder
cd /media/remoteNow create a file with some random stuff (e.g. from the kernel's random pool):
dd if=/dev/urandom of=test.bin bs=4M count=5In this example, you should see some 20MB of traffic. Then create another smaller file, somewhere on your machine, say, your home-folder:
dd if=/dev/urandom of=~/test_chunk.bin bs=4M count=1The interesting thing is what happens, if you attempt to write the chunk into a specific position of the remote test file:
dd if=~/test_chunk.bin of=test.bin bs=4M count=1 seek=3 conv=notruncActually, this should only change block #4 out of 5 in the target file. I guess you can adjust the block size ... I did this with 4 MB blocks. But it should help to understand what happens on the network.