Slashdot stories can be listened to in audio form via an RSS feed, as read by our own robotic overlord.

 



Forgot your password?
typodupeerror
Networking Software Upgrades IT

Ask Slashdot: Managing Device-Upgrade Bandwidth Use? 159

Posted by timothy
from the selective-enforcement dept.
First time accepted submitter wallydallas writes "I'm close to a solution, but I wonder how other people block their many devices and operating systems from updating in working hours. For example: I'm the IT guy who blocks iPads from updating when school is in session because we are in a rural location. 3mbps is the best WAN we can buy. Devices can update after hours just fine. We do this with our router (DDWRT) by blocking MESU.APPLE.COM. Many guests bring in Windows 7 laptops, and I want to welcome them, but not their updates. How can I block updates on Android Phones and Linux Laptops? I have a 4G device at home, and I'd like to apply the same tricks 24 hours a day so that I don't use up the bandwith from my vendor. And my many home visitors should have their updates blocked."
This discussion has been archived. No new comments can be posted.

Ask Slashdot: Managing Device-Upgrade Bandwidth Use?

Comments Filter:
  • For Windows (Score:5, Informative)

    by jones_supa (887896) on Thursday December 19, 2013 @06:10PM (#45741465)
    For Windows, you could try blocking the addresses listed in the Microsoft Knowledge Base article 818018 [microsoft.com].
    • Re: (Score:2, Informative)

      by Anonymous Coward

      That is not a complete list. We setup our DNS to return 127.0.0.1 for all of those hostnames, and Microsoft still found a way to do a forced update to MSIE10 that broke all of the Dell desktops running Windows in our office. We had to reimage all of Dells to get them running again. We found the IP addr Microsoft was using for their abuse and blocked it, but then about four months later Microsoft found another way to do yet another forced update and breaking of our desktops. Again, we had to reimage to g

    • Blocking the domains in that KB article Is known to break windows update for us and others on this posting. Then we must re build our master image. Blocking apple iOS has no side effect.

  • by Anonymous Coward

    If there are a lot of people that want to do the updates, AND you have the space, a cacheing service can ease the pain. The first time an update is done, the cache (proxy) saves the reply, then when someone else asks for the update, it is supplied locally rather than downloading it again.

  • by Anonymous Coward

    Wasn't there billions of dollars spent by the government like 10 years ago to get every school connected with high speed internet?

    • by The_Wilschon (782534) on Thursday December 19, 2013 @06:23PM (#45741603) Homepage
      Wasn't 3 Mbps "high-speed" ten years ago?
      • by lactose99 (71132)

        Hell, I still think the FCC counts it as high-speed even now in their broadband reports.

        • by mysidia (191772)

          Hell, I still think the FCC counts it as high-speed even now in their broadband reports.

          It is high speed, for a typical household of 3 people.

          Hell; 1 Megabit per 10 students is high-speed.

          1 Megabit per 20 students is NOT.

          3 Megabits per 100 students is insanely crappy.

          3 Megabits per 1000 students is a friggin joke.

        • by Bengie (1121981)
          FCC considers broadband in general as "high speed" and has a speed requirement to be considered "broadband". In this case, "high speed" just means faster than dial-up.
      • by Grishnakh (216268)

        3Mbps isn't blazing fast, but it's not completely horrible (though I don't think it's quite fast enough for Netflix).

        The problem is if you're trying to run an entire school on it, rather than a single person's apartment.

        • I watch Netflix on a 3Mbit connection with no problem. That said, I have a standard-def TV.

          • by i.r.id10t (595143)

            I have 1.5mb down DSL - its all I can get. Well, I can "get" 3 but I'm so far out at the end of the run it randomly disconnects 5 or 10 times a day and refuses to reconnect, requiring a power cycle of the "modem" (ISP provided) or router (and I've tried quite a few).

          • We don't qualify for e rate as we are private. Non profit for disabled. We shopped but best deal in rural spot is t1 at $600 a month. Netflix tests OK now when no guest devices on our lan. I can't ban win laptops nor ban android phones of staff and students.

        • Here at home we can't get any better here without shelling out 10k for a fiber run and 400/month or more for the link after, so we are stuck with crapy AT&T 3Mbps dsl. Netflix actually works fine surprisingly. Initial start on a video will be a bit blocky but it clears up quickly. Quality on other video sources varies wildly, so the service provider's technology clearly makes a big difference. Youtube is decent but has a long buffer time, videos from Aol's news or Fox news will hardly even play and take
      • by Albanach (527650)

        3mb isn't a lot for a school, especially where there might be a need for streaming video. It would be pretty straightforward to add another connection or two and do some load balancing. Combining that with the QoS suggestion others have made might make the whole network a lot nicer to use.
         

      • by snobody (990539)
        That's nothing. Back in 2004, I was working for a school district in Michigan and almost all of the K-12 buildings were on token ring. We were always just one lightning strike away from having a building offline for the rest of the school year. We used to surf ebay looking for old replacement parts to buy and keep, just in case. Of course, now I'm sure they've probably upgraded to 10 megabit ethernet hubs. :)
    • by mysidia (191772)

      Wasn't there billions of dollars spent by the government like 10 years ago to get every school connected with high speed internet?

      Discounted telecommunication services available to schools under E-Rate.

      For every 1000 students; there should be 100 Megabits.

      This is like saying.... for our school lunch program; the budget we have allocated, only allows us to buy 10 pounds of meat. All 10000 of you will just have to share it.

      By the way; if any of you are hungry because you skipped breakfast: we're g

  • Pfsense (Score:5, Informative)

    by bhenson (1231744) on Thursday December 19, 2013 @06:15PM (#45741513) Homepage Journal
    Use PFsense and use the package squidguard(or dansguardian) and use the software downloads list.
  • pfSense (Score:4, Informative)

    by Anonymous Coward on Thursday December 19, 2013 @06:15PM (#45741519)

    http://www.pfsense.org/

    install pfsense plus squid and block the update sites.

    pfsense wan goes to the modem
    pfsense lan goes to the access point.

  • by phizi0n (1237812) on Thursday December 19, 2013 @06:22PM (#45741599)

    There's no reason to avoid using your bandwidth when you can use QoS to deprioritize it so that they can still update any time the bandwidth is available. Most any linux router can do this with tc and iptables, or sometimes with less configurability through their GUI's.

    At home you have control over the devices and can just disable them from automatically updating.

    • He's paying per MB downloaded . . . it costs him money for them to download their patches using his bandwidth, even if nothing else is going on.
      • by fisted (2295862)
        Then why is he fine with people updating after hours?
        • by msobkow (48369)

          He's dealing with two locations: his home, where he pays for bandwidth, and his work, where the concern is peak hour traffic.

          • by Desler (1608317)

            No, you're actually confusing what they said.

            I'm the IT guy who blocks iPads from updating when school is in session because we are in a rural location. 3mbps is the best WAN we can buy. Devices can update after hours just fine.

            The person you responded to was correct in saying that his post said they were allowed to update devices after hours. The part about his own devices at home was a completely separate part of the post.

        • by Zocalo (252965)
          The article doesn't actually mention costs at all, so I don't think that's an issue so much as people soaking up the scarce bandwidth when others are trying use the connection for its primary intended purpose; schoolwork. If it were a problem, then I'd have expected the question to have included asking for advice on caching proxies and such like to save bandwidth. If there's no cap, then QoS would be a good part of a solution for this as it lets you make maximum use of your circuit, while avoiding degradi
      • He\she only talked about bandwidth, not traffic limitations.
        BTW, how effective can QoS really be? I'm a little bit skeptical.
        • by ewieling (90662)
          <blockquote>BTW, how effective can QoS really be? I'm a little bit skeptical.</blockquote>

          You can only QoS the transmits. To do it correctly, you must do QoS on both ends of the circuit. You can do some "poorman's QoS" by putting it on the transmit side of your router, but that only helps with TCP, not UDP and relies on TCP's throttling.
          • by Cramer (69040)

            Actually, the router does transmit... to the inside interface. With a bit of buffering, or dropping traffic -- but as it's already crossed the link, you don't want to have to receive it again -- it is entirely possible to rate limit traffic in both directions. Knowing *what* to rate limit is the issue. If he knew what sites were "update" sites, he'd just block them entirely.

            • by Agripa (139780)

              While it is true that receiving the data again across a slow link is inefficient, dropping packets is the only universal way to signal IP congestion. (ECN) Explicit Congestion Notification can signal congestion at the IP level without dropping packets but of course few devices implement it or perhaps even go out of their way to ignore it in the quest for individual performance at the cost of degrading the network for all other devices.

              http://en.wikipedia.org/wiki/Explicit_Congestion_Notification [wikipedia.org]

              Traffic sha

      • by tlhIngan (30335)

        He's paying per MB downloaded . . . it costs him money for them to download their patches using his bandwidth, even if nothing else is going on.

        Except he's fine with them updating after hours, when the demand on the connection is far lower.

        Basically, he doesn't want updates to bog down the internet link during school hours and making everyone's experience slow and annoying (especially Apple updates - want a good speed test? Apple seems to push the bits out). But after hours when the link is idle, update aw

      • He's paying per MB downloaded

        You made that up. He didn't say that.

    • There's no reason to avoid using your bandwidth when you can use QoS

      You seem to forget that many ISPs sport bandwidth caps, which is a misnomer; they're actually limiting the amount of data transferred during a given timeframe. QoS doesn't stop a fat bill from showing up the next month showing you used up 1.5TB on an account purchased at a 200GB level.

    • by AmiMoJo (196126) *

      QoS can only do so much when a number of clients are trying to use a slow connection at the same time because it can only control outgoing packets. Incoming packets are queued at the ISP and sent to the modem at its maximum speed in the order they arrived. Worse still many servers cheat and ignore tcp/ip rate limiting.

      • by Agripa (139780)

        Traffic shaping on the incoming side is still effective though even given that it has to drop packets that have already been sent over the most expensive part of the link. Dropping packets is the one sure fire way to signal to the transmitter that it should stop sending so quickly and while the server can ignore ECN, it cannot ignore dropped packets.

        If the incoming aggregate flow rate is kept below the level of the slowest link which is almost always the customer's link, then the intervening buffers will t

    • Re: (Score:3, Informative)

      by Port-0 (301613)

      I did IT work for a private university for 14 years, I managed bandwidth by blocking certain protocols to various networks and hosts until Naptster, and the following peer to peer protocols, after a couple of years trying to manage bandwidth by blocking protocols, sites, advertising, etc. I gave up on that. Ultimately all of that damages the user's experience, and increased my work load. It puts the IT guy in the position of chasing the users behaviors, always responding to the latest fire and worse it p

      • Re: (Score:2, Insightful)

        by Anonymous Coward

        I don't work for the company or anything like that.

        Really? Because in your entire post, while you praised the device (Service? Software?) plenty, you never actually said what it does.

        • by Agripa (139780)

          You could have found articles discussing their product in a modicum of time that are prominently linked on the first page of their web site and gotten your answer undiluted.

          Summary:

          It implements stream based flow control while evaluating the behavior of each stream and penalizing the misbehaving ones.

      • The feature of Net Equalizer that lets you limit the number of active connections per client works well in limiting P2P traffic. But in other situations, just getting more bandwidth ends up making people happier and costs about the same as trying to limit it, if you include manpower. In an educational situation, Net Equalizer worked well for us. In a business setting, you should be able to mandate that users not do certain things, if management will back you up.

        Another way to do this is to have more than

      • Thanks port 0. I will look in to that. Great reflections . I agree.

  • by nemesisrocks (1464705) on Thursday December 19, 2013 @06:31PM (#45741685) Homepage

    Since you're in such a remote area, your visitors very likely also have slow connections at home too. Why not cache the updates instead? You'll be contributing towards a safer, more secure internet.

    The first person who downloads them would cause a drain on the network, but at least all future attempts would be served up from your cache. You could even have a spare machine downloading the updates overnight, pre-populating the cache for your visitors, to reduce the burden updates cause during the day.

    I've used the instructions here with great success on Squid: http://wiki.squid-cache.org/SquidFaq/WindowsUpdate [squid-cache.org]

    Apparently Apple iOS updates can be cached too, e.g.: http://lkrms.org/caching-ios-updates-on-a-squid-proxy-server/ [lkrms.org]

    • by Enry (630)

      Between this and QoS it should take care of the problem.

    • by Sez Zero (586611)
      Caching helped me a bunch. We have a little Mac mini and I turned on Caching service on OS X server. Works great for software updates, App Store purchases, for local Mac and iOS devices. It works much better since iOS 7, keeping those iPhones in check.
    • by mysidia (191772)

      Since you're in such a remote area, your visitors very likely also have slow connections at home too. Why not cache the updates instead? You'll be contributing towards a safer, more secure internet.

      Not only that.... but malware can suck up your bandwidth just as fast, or faster than updates; the consequences of failing to update can over time be adverse to your own network's performance.

    • I used to use Squid for caching Windows Updates and it sped things up about 1000% percent.

      I would recommend using something like Ntop to figure out where your bandwidth is actually being consumed and target that for caching.

      Much like freeing up space on disks, you can waste time trying to figure out every little thing, or you can target the biggest files and get the most results.

      The only down-side of Squid caching is that it can't work with https:

  • You can put snort on DDWRT. There are signatures that can be added and removed via script and cron. The signatures are able to block Microsoft Updates, normal and BITS, as well as specific services on iTunes.

  • by ChaseTec (447725) <chase@osdev.org> on Thursday December 19, 2013 @06:41PM (#45741749) Homepage

    Any particular reason you've singled out device updates? Seems like you'd be want to block or QoS all large or multi-range binary transfers. You should have a transparent caching proxy server in place (which is where you'll be able to inspect and block large transfers).

    • by forkazoo (138186)

      Well, if he has identified it as taking up a large amount of the available bandwidth, then it certainly makes sense to consider it a target for reductions. Perhaps more importantly, users tend not to care about updates like that. A user actively downloading a file from some source is probably more important than some automated process the user doesn't care about, and can be deferred until the user gets home without them noticing anything.

      That said, I've been saying for a while that there needs to be some

      • My Android phone lets me set software updates and podcast downloads to only happen over wifi, under the assumption that cellular data is expensive, but wifi data is unlimited. But, if I connect to a Mifi access point connected to a cellular connection, my phone currently has no way to discover that it is actually using (limited) cellular data.

        If the version of Android on your phone is anything like the version of Android on my Nexus 7 tablet, you can manually mark a specific SSID as metered. Try Settings > Data usage > Overflow menu (the three dot colon) > Mobile hotspots.

  • by whoever57 (658626) on Thursday December 19, 2013 @06:42PM (#45741765) Journal
    On our network, we have seen one Apple machine running at 20Mbps to the Internet for hours on end. I believe this is a cloud sync. Looking at QoS to throttle this, but the external IP addresses appear to be a disparate and unknown set, so will have to throttle the firewall -> LAN IP connection.
  • If you block updates, windows particularly, then you'll have higher chances of infected systems that may be used for DDoS etc.

    • Eh. You're stretching it a bit. I think those machines will soon enough find some other time or other network to get the updates in. The update check interval for Windows is 20 hours anyway.
      • by mysidia (191772)

        There's a chance they might not connect to any other network; or might not connect when updates are "allowed" --- especially machines on site.

        There may be machines regularly used only on that network, and not connected to a network at other times.

        So there is some level of increase in risk, regardless

  • by Anonymous Coward

    Blocking these types of downloads at a school I can understand, not a lot of schools have funding for high bandwidth connections.

    At home that's another story, if you don't trust them, don't let them on. Why would you let them on your home network if you don't trust them. I consider letting them use my home network for phone and app updates be a good host. Overall my initial reaction to reading the question posed, was the thought that your are very much on the verge of being a control freak

  • by Anonymous Coward

    I'm in Juneau Alaska. The only way in and out of town is via plane or boat ... we are WORSE than rural. ... As of noon today, we just got 100Mb ..... something is wrong there.

    • by PopeRatzo (965947)

      I'm in Juneau Alaska. The only way in and out of town is via plane or boat ... we are WORSE than rural. ... As of noon today, we just got 100Mb ..... something is wrong there.

      100Mb? But we're talking about network connections, not the size of your flash drives.

  • Wide scale blocking. (Score:4, Interesting)

    by Lumpy (12016) on Thursday December 19, 2013 @07:44PM (#45742163) Homepage

    I strongly suggest you also block all the common advert servers such as doubleclick as they consume far more bandwidth than the updates do.

  • by LMariachi (86077) on Thursday December 19, 2013 @07:44PM (#45742167) Journal

    Mavericks Server has Caching Server 2, which I haven't personally used but their blurb [apple.com] for it sounds like exactly what you want, at least as far as Apple devices.

    • by Anonymous Coward

      Caching Server 2 works great for OTA updates and Apps to iOS , so long as you have 1 pipe out to the internet.

      It won't help you 6->7 because 6 doesn't know it exists.

      If you disable "local networks only" anything inside your private LAN (as opposed to just the subnet the caching server is on) will use it, including iTunes on desktops.

      Its pretty neat all in all - pretty much any Mac capable of running Mavericks sitting in a wiring closet or machine room somewhere can do this readily.

  • Ditch the WRT (Score:4, Informative)

    by kroby (1391819) on Thursday December 19, 2013 @08:04PM (#45742269)
    WRT is great for tinkering and home users, but good god, please don't put it in a production network. Get something like a SonicWALL or a FortiGate, learn to use it, and thank me later. QoS will get you nothing, there is no such thing as QoS on the internet. However, bandwidth management and throttling could help a lot. Before you can prioritize traffic you need to be able to identify it, and this is where life becomes much easier with a UTM appliance. You can prioritize by device type (MAC address), source, destination, protocol, or application. With application awareness you can easily see what is sucking up the most bandwidth, and it classifies all the traffic for you automagically based on signatures ran against deep packet inspection. A caching proxy, as mentioned in other posts, would help speed up the internet and reduce bandwidth consumption. Something like Squid would work here, or you could go the appliance route. Bonus, with a UTM device you also get IDS/IPS, botnet filtering, gateway antivirus, spam filtering, RBL filter, content filtering, application control, SSL VPN, wireless controller, and more. They cost money, but you will not find these features for free, and if you do it is going to be a nightmare to manage.
    • by epyT-R (613989)

      To be fair, L7/application/protocol filtering can be done with netfilter/iptables, and ddwrt does allow some access to that capability.. Most of the rest of your featurelist can be done with a single x86 machine running a router distribution. For a 3Mbit line, cisco/sonicwall et al are way overkill.

  • For Linux you will have to make rules for each distro. Ubuntu can be blocked with *.archive.ubuntu.com. Get the most popular distros covered, and you should be off pretty good.
    • Only if they update from the default mirror. There are thousands of mirrors for each distro ranging from universities to ISP's and non-profit organizations. Good luck blocking those.

      What you *may* have luck with is providing a local mirror for the major distros (say Ubuntu, Fedora and Mint), then advertise it to the students with the incentive that being a local mirror it will be WAY faster. Blocking people only makes them more determined, give them a better solution and they may just solve the problem for

  • Somebody else posted this suggestion, and it got promptly shot down (in typical Slashdot fashion) by people who know nothing about the subject...

    For at least Apple and Microsoft products, you can install a caching server that will cache the first download of any given update and then deliver from the cache on subsequent updates.

    This is not the same as a caching HTTP server. (That what was shot-down...) These are specific servers made available by Apple and Microsoft, and meant specifically for caching softw

    • For Windows it's WSUS. It's a component of any Server OS, but I wouldn't like to run it on anything that ordinarily has any kind of workload. It's quite resource intensive.

      If this guy has EES licensing I can't see why they wouldn't use it
  • My own personal solution to this problem is to phase out every and each program, OS and everything other that downloads upgrades without owner's intervention, and there would be a really serious need in order to leave such a program, with specific traffic shaping crafted specifically for it. You understand what I mean.

    Also, when I was a sysadmin I just installed a very complicated firewall (ipfw on FreeBSD) that limited speed of every separate group of users so the bandwidth hog would affect his own group o

  • by Anonymous Coward

    Seriously, I know this is /. but If you get a girlfriend this letting your visitors use you internet is a moot point.

  • On any Mac in your office, running 10.8 (Mountain Lion) or 10.9 (Mavericks) purchase (for $20 or so), download and install the OS X Server app.
    Turn on the Caching service. Problem solved for Apple devices.

    The server then registers itself with Apple, they see the registration coming from your IP, so when further devices from that IP address request a software update, these machines are pointed to your internal Caching server. Then, when a device (or a Mac) tries to download an update or purchase something fr

  • Use iptables rules in the router to allow/disallow traffic at some hours of day, see this [cyberciti.biz]. You can totally block the traffic, or QoS [mikebabcock.me] it to oblivion on hot hours and increase it traffic later (join the iptables rules by hours to set the classid and then apply different QoS to then)

    Finally, a caching transparent proxy might help, specially if everyone uses the same sites... it helps the normal browsing (by caching images, css, js, etc) and the updates (local copy if already downloaded). You just need a old co

  • Also only serve your guests tap water so as not to use up your bottle water supply? Feed them only leftovers so not to tap into your personal food storage? Only let them watch TV on the small TV in the bedroom so you don't eat up electricity from the big screen??? Make them sit in the cold and dark by refusing to turn on the lights and heat, y'know, cause that shit costs money?

    Geez, remind me never to be an invited guest over to your house. You sound like a real winner.

"'Tis true, 'tis pity, and pity 'tis 'tis true." -- Poloniouius, in Willie the Shake's _Hamlet, Prince of Darkness_

Working...