Ask Slashdot: Managing Device-Upgrade Bandwidth Use? 159
First time accepted submitter wallydallas writes "I'm close to a solution, but I wonder how other people block their many devices and operating systems from updating in working hours. For example: I'm the IT guy who blocks iPads from updating when school is in session because we are in a rural location. 3mbps is the best WAN we can buy. Devices can update after hours just fine. We do this with our router (DDWRT) by blocking MESU.APPLE.COM. Many guests bring in Windows 7 laptops, and I want to welcome them, but not their updates. How can I block updates on Android Phones and Linux Laptops? I have a 4G device at home, and I'd like to apply the same tricks 24 hours a day so that I don't use up the bandwith from my vendor. And my many home visitors should have their updates blocked."
For Windows (Score:5, Informative)
Re: (Score:2, Informative)
That is not a complete list. We setup our DNS to return 127.0.0.1 for all of those hostnames, and Microsoft still found a way to do a forced update to MSIE10 that broke all of the Dell desktops running Windows in our office. We had to reimage all of Dells to get them running again. We found the IP addr Microsoft was using for their abuse and blocked it, but then about four months later Microsoft found another way to do yet another forced update and breaking of our desktops. Again, we had to reimage to g
Re: (Score:1)
Re: For Windows (Score:1)
Gpedit.MSC works half way. Only on our win 7 pro desktops. Not on guest computers.
Re: For Windows (Score:1)
Blocking the domains in that KB article Is known to break windows update for us and others on this posting. Then we must re build our master image. Blocking apple iOS has no side effect.
It depends on your environment. (Score:2, Informative)
If there are a lot of people that want to do the updates, AND you have the space, a cacheing service can ease the pain. The first time an update is done, the cache (proxy) saves the reply, then when someone else asks for the update, it is supplied locally rather than downloading it again.
Re: (Score:2)
Re: (Score:2)
you cannot proxy https and about anything that uses authentication
You can't (easily) MiTM clients that you don't manage; but many, perhaps most, update mechanisms don't use SSL or authentication. It's assumed that ineligible users either have absolutely no interest, or (as in the case of pirates) are probably sophisticated enough that trying to keep them from scoring a copy somehow isn't worth the effort.
As for SSL, that's extra overhead, and the server is shovelling out the same set of patches to everyone and (on all remotely recent and non-insane update systems) the
Re: (Score:2)
Re: (Score:3)
So if a solution is not 100% perfect, it has to be thrown into trash can?
Of course. This is Slashdot - Where the edge use case wins, every time - Where perfect is the enemy of good.
3Mbps?!?? (Score:1)
Wasn't there billions of dollars spent by the government like 10 years ago to get every school connected with high speed internet?
Re:3Mbps?!?? (Score:5, Funny)
Re: (Score:3)
Hell, I still think the FCC counts it as high-speed even now in their broadband reports.
Re: (Score:2)
Hell, I still think the FCC counts it as high-speed even now in their broadband reports.
It is high speed, for a typical household of 3 people.
Hell; 1 Megabit per 10 students is high-speed.
1 Megabit per 20 students is NOT.
3 Megabits per 100 students is insanely crappy.
3 Megabits per 1000 students is a friggin joke.
Re: (Score:2)
Re: (Score:2)
And what for private schools? (Score:2)
Re: (Score:2)
I totally understand that they say "up to 5Mbs" on my consumer plan. But I use internet at all hours of the day, and can tell you I average above that at all times. So, while I have no legal retribution if they don't fulfill that (other than to just leave), I haven't had a problem with shared lines in the suburbs since Road Runner.
Re: (Score:2)
3Mbps isn't blazing fast, but it's not completely horrible (though I don't think it's quite fast enough for Netflix).
The problem is if you're trying to run an entire school on it, rather than a single person's apartment.
Re: (Score:2)
I watch Netflix on a 3Mbit connection with no problem. That said, I have a standard-def TV.
Re: (Score:2)
I have 1.5mb down DSL - its all I can get. Well, I can "get" 3 but I'm so far out at the end of the run it randomly disconnects 5 or 10 times a day and refuses to reconnect, requiring a power cycle of the "modem" (ISP provided) or router (and I've tried quite a few).
Re: (Score:2)
Should is the key word, I've seen some unbelievably crappy modems.
Re: 3Mbps?!?? (Score:1)
We don't qualify for e rate as we are private. Non profit for disabled. We shopped but best deal in rural spot is t1 at $600 a month. Netflix tests OK now when no guest devices on our lan. I can't ban win laptops nor ban android phones of staff and students.
Re: (Score:2)
Re: (Score:2)
3mb isn't a lot for a school, especially where there might be a need for streaming video. It would be pretty straightforward to add another connection or two and do some load balancing. Combining that with the QoS suggestion others have made might make the whole network a lot nicer to use.
Re: (Score:1)
Re: (Score:2)
Of course any company will always focus on their profit above all else, that's the sole reason they exist.
Re: (Score:2)
Wasn't there billions of dollars spent by the government like 10 years ago to get every school connected with high speed internet?
Discounted telecommunication services available to schools under E-Rate.
For every 1000 students; there should be 100 Megabits.
This is like saying.... for our school lunch program; the budget we have allocated, only allows us to buy 10 pounds of meat. All 10000 of you will just have to share it.
By the way; if any of you are hungry because you skipped breakfast: we're g
Re: (Score:2)
If you happen to be in range of an existing tower.
Re:3Mbps?!?? (Score:4, Interesting)
They are good for 30 miles - if there is a clear path.
This is not just line of sight - but slightly more than this - the path cannot go just past obstacles.
http://www.proxim.com/products/knowledge-center/calculations/calculations-fresnel-clearance-zone [proxim.com]
For a 30 mile link, the fresnel zone reaches 100 feet in the middle of the link - if anything is in this zone, then the signal will be severely affected.
Add to this the limitation of sight due to a non-flat horizon - 150 feet towers are needed just to get minimum line of sight.
For flat land with trees up to 30 feet in places in the middle, for example, that adds up to a total of (100/2)+30+150 =
230 feet towers.
If one end is at altitude - you still may need a significant tower in order to clear the fresnel zone.
slow down partner (Score:1)
you're making a lot of assumptions about the fresnel zone without knowing the frequency the equipment is operating on.
Re: (Score:2)
Quite - I arbitrarily assumed 2.4GHz.
Re: (Score:2)
Re: (Score:1)
Reading the post, I immediately said, "not the best you can buy, just the best you're willing to pay for."
Re: (Score:2)
Reading the post, I immediately said, "not the best you can buy, just the best you're willing to pay for."
Yeah.... use of freebie or low-end consumer-grade broadband services in a large scale instruction environment.
If your school spends more in a month on toilet paper; or getting the grounds mowed or floors cleaned, in costs, than on your internet connection, then you are doing it wrong.
it may not be available (Score:1)
There are lots of small towns that simply don't have access to real high-speed links. I just checked, and there are towns in my province (canadian prairies) that only have 1.5 mbps connectivity and most of the smaller places max out at 5mbps. Most of these places you'd be better off with a 4G mobile hotspot for each classroom.
Re: (Score:3)
I just checked, and there are towns in my province (canadian prairies) that only have 1.5 mbps connectivity and most of the smaller places max out at 5mbps.
Virtually... in any town; small or not, there is plenty of fiber and other Telecommunications infrastructure. The telephone company essentially needs large digital trunks, just to deliver basic phone service.
If there are providers delivering 1.5 and 5 megabit connections to residents then they Do have high-speed links in the area --- the provider h
Re: 3Mbps?!?? (Score:1)
We are not incompetent. Even when we load balance with a Cisco dual wan router the updates from devices slam us. Read the many more details I have added.
Pfsense (Score:5, Informative)
pfSense (Score:4, Informative)
http://www.pfsense.org/
install pfsense plus squid and block the update sites.
pfsense wan goes to the modem
pfsense lan goes to the access point.
Don't block it, QoS it. (Score:5, Interesting)
There's no reason to avoid using your bandwidth when you can use QoS to deprioritize it so that they can still update any time the bandwidth is available. Most any linux router can do this with tc and iptables, or sometimes with less configurability through their GUI's.
At home you have control over the devices and can just disable them from automatically updating.
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
He's dealing with two locations: his home, where he pays for bandwidth, and his work, where the concern is peak hour traffic.
Re: (Score:1)
No, you're actually confusing what they said.
I'm the IT guy who blocks iPads from updating when school is in session because we are in a rural location. 3mbps is the best WAN we can buy. Devices can update after hours just fine.
The person you responded to was correct in saying that his post said they were allowed to update devices after hours. The part about his own devices at home was a completely separate part of the post.
Re: (Score:2)
Re: (Score:2)
BTW, how effective can QoS really be? I'm a little bit skeptical.
Re: (Score:2)
You can only QoS the transmits. To do it correctly, you must do QoS on both ends of the circuit. You can do some "poorman's QoS" by putting it on the transmit side of your router, but that only helps with TCP, not UDP and relies on TCP's throttling.
Re: (Score:1)
Actually, the router does transmit... to the inside interface. With a bit of buffering, or dropping traffic -- but as it's already crossed the link, you don't want to have to receive it again -- it is entirely possible to rate limit traffic in both directions. Knowing *what* to rate limit is the issue. If he knew what sites were "update" sites, he'd just block them entirely.
Re: (Score:2)
While it is true that receiving the data again across a slow link is inefficient, dropping packets is the only universal way to signal IP congestion. (ECN) Explicit Congestion Notification can signal congestion at the IP level without dropping packets but of course few devices implement it or perhaps even go out of their way to ignore it in the quest for individual performance at the cost of degrading the network for all other devices.
http://en.wikipedia.org/wiki/Explicit_Congestion_Notification [wikipedia.org]
Traffic sha
Re: (Score:2)
Except he's fine with them updating after hours, when the demand on the connection is far lower.
Basically, he doesn't want updates to bog down the internet link during school hours and making everyone's experience slow and annoying (especially Apple updates - want a good speed test? Apple seems to push the bits out). But after hours when the link is idle, update aw
Re: (Score:2)
He's paying per MB downloaded
You made that up. He didn't say that.
Re: (Score:2)
There's no reason to avoid using your bandwidth when you can use QoS
You seem to forget that many ISPs sport bandwidth caps, which is a misnomer; they're actually limiting the amount of data transferred during a given timeframe. QoS doesn't stop a fat bill from showing up the next month showing you used up 1.5TB on an account purchased at a 200GB level.
Re: (Score:2)
QoS can only do so much when a number of clients are trying to use a slow connection at the same time because it can only control outgoing packets. Incoming packets are queued at the ISP and sent to the modem at its maximum speed in the order they arrived. Worse still many servers cheat and ignore tcp/ip rate limiting.
Re: (Score:2)
Traffic shaping on the incoming side is still effective though even given that it has to drop packets that have already been sent over the most expensive part of the link. Dropping packets is the one sure fire way to signal to the transmitter that it should stop sending so quickly and while the server can ignore ECN, it cannot ignore dropped packets.
If the incoming aggregate flow rate is kept below the level of the slowest link which is almost always the customer's link, then the intervening buffers will t
Re: (Score:3, Informative)
I did IT work for a private university for 14 years, I managed bandwidth by blocking certain protocols to various networks and hosts until Naptster, and the following peer to peer protocols, after a couple of years trying to manage bandwidth by blocking protocols, sites, advertising, etc. I gave up on that. Ultimately all of that damages the user's experience, and increased my work load. It puts the IT guy in the position of chasing the users behaviors, always responding to the latest fire and worse it p
Re: (Score:2, Insightful)
I don't work for the company or anything like that.
Really? Because in your entire post, while you praised the device (Service? Software?) plenty, you never actually said what it does.
Re: (Score:2)
You could have found articles discussing their product in a modicum of time that are prominently linked on the first page of their web site and gotten your answer undiluted.
Summary:
It implements stream based flow control while evaluating the behavior of each stream and penalizing the misbehaving ones.
I've seen QoS work well in a few situations... (Score:2)
The feature of Net Equalizer that lets you limit the number of active connections per client works well in limiting P2P traffic. But in other situations, just getting more bandwidth ends up making people happier and costs about the same as trying to limit it, if you include manpower. In an educational situation, Net Equalizer worked well for us. In a business setting, you should be able to mandate that users not do certain things, if management will back you up.
Another way to do this is to have more than
Re: Don't block it, QoS it. (Score:1)
Thanks port 0. I will look in to that. Great reflections . I agree.
Consider caching instead (Score:5, Informative)
Since you're in such a remote area, your visitors very likely also have slow connections at home too. Why not cache the updates instead? You'll be contributing towards a safer, more secure internet.
The first person who downloads them would cause a drain on the network, but at least all future attempts would be served up from your cache. You could even have a spare machine downloading the updates overnight, pre-populating the cache for your visitors, to reduce the burden updates cause during the day.
I've used the instructions here with great success on Squid: http://wiki.squid-cache.org/SquidFaq/WindowsUpdate [squid-cache.org]
Apparently Apple iOS updates can be cached too, e.g.: http://lkrms.org/caching-ios-updates-on-a-squid-proxy-server/ [lkrms.org]
Re: (Score:2)
Between this and QoS it should take care of the problem.
Re: (Score:2)
Re: (Score:3)
Since you're in such a remote area, your visitors very likely also have slow connections at home too. Why not cache the updates instead? You'll be contributing towards a safer, more secure internet.
Not only that.... but malware can suck up your bandwidth just as fast, or faster than updates; the consequences of failing to update can over time be adverse to your own network's performance.
Re: (Score:2)
I used to use Squid for caching Windows Updates and it sped things up about 1000% percent.
I would recommend using something like Ntop to figure out where your bandwidth is actually being consumed and target that for caching.
Much like freeing up space on disks, you can waste time trying to figure out every little thing, or you can target the biggest files and get the most results.
The only down-side of Squid caching is that it can't work with https:
DPI. deep packet inspection (Score:2)
You can put snort on DDWRT. There are signatures that can be added and removed via script and cron. The signatures are able to block Microsoft Updates, normal and BITS, as well as specific services on iTunes.
Re: DPI. deep packet inspection (Score:1)
Nice. Thanks. Will try.
Why just device updates? (Score:4, Informative)
Any particular reason you've singled out device updates? Seems like you'd be want to block or QoS all large or multi-range binary transfers. You should have a transparent caching proxy server in place (which is where you'll be able to inspect and block large transfers).
Re: (Score:2)
Well, if he has identified it as taking up a large amount of the available bandwidth, then it certainly makes sense to consider it a target for reductions. Perhaps more importantly, users tend not to care about updates like that. A user actively downloading a file from some source is probably more important than some automated process the user doesn't care about, and can be deferred until the user gets home without them noticing anything.
That said, I've been saying for a while that there needs to be some
Marking an SSID as metered on Android (Score:2)
My Android phone lets me set software updates and podcast downloads to only happen over wifi, under the assumption that cellular data is expensive, but wifi data is unlimited. But, if I connect to a Mifi access point connected to a cellular connection, my phone currently has no way to discover that it is actually using (limited) cellular data.
If the version of Android on your phone is anything like the version of Android on my Nexus 7 tablet, you can manually mark a specific SSID as metered. Try Settings > Data usage > Overflow menu (the three dot colon) > Mobile hotspots.
It's not the updates, it's the cloud sync (Score:3)
Re: (Score:2)
Unintended consequences (Score:2)
If you block updates, windows particularly, then you'll have higher chances of infected systems that may be used for DDoS etc.
Re: (Score:2)
Re: (Score:2)
There's a chance they might not connect to any other network; or might not connect when updates are "allowed" --- especially machines on site.
There may be machines regularly used only on that network, and not connected to a network at other times.
So there is some level of increase in risk, regardless
Why do you let them on your home network? (Score:1)
Blocking these types of downloads at a school I can understand, not a lot of schools have funding for high bandwidth connections.
At home that's another story, if you don't trust them, don't let them on. Why would you let them on your home network if you don't trust them. I consider letting them use my home network for phone and app updates be a good host. Overall my initial reaction to reading the question posed, was the thought that your are very much on the verge of being a control freak
what? (Score:1)
I'm in Juneau Alaska. The only way in and out of town is via plane or boat ... we are WORSE than rural. ... As of noon today, we just got 100Mb ..... something is wrong there.
Re: (Score:2)
100Mb? But we're talking about network connections, not the size of your flash drives.
Wide scale blocking. (Score:4, Interesting)
I strongly suggest you also block all the common advert servers such as doubleclick as they consume far more bandwidth than the updates do.
Re: Wide scale blocking. (Score:1)
Good idea.
Local update server (Score:3)
Mavericks Server has Caching Server 2, which I haven't personally used but their blurb [apple.com] for it sounds like exactly what you want, at least as far as Apple devices.
Re: (Score:1)
Caching Server 2 works great for OTA updates and Apps to iOS , so long as you have 1 pipe out to the internet.
It won't help you 6->7 because 6 doesn't know it exists.
If you disable "local networks only" anything inside your private LAN (as opposed to just the subnet the caching server is on) will use it, including iTunes on desktops.
Its pretty neat all in all - pretty much any Mac capable of running Mavericks sitting in a wiring closet or machine room somewhere can do this readily.
Ditch the WRT (Score:4, Informative)
Re: (Score:1)
To be fair, L7/application/protocol filtering can be done with netfilter/iptables, and ddwrt does allow some access to that capability.. Most of the rest of your featurelist can be done with a single x86 machine running a router distribution. For a 3Mbit line, cisco/sonicwall et al are way overkill.
Re: (Score:2)
Linux (Score:2)
Re: (Score:2)
Only if they update from the default mirror. There are thousands of mirrors for each distro ranging from universities to ISP's and non-profit organizations. Good luck blocking those.
What you *may* have luck with is providing a local mirror for the major distros (say Ubuntu, Fedora and Mint), then advertise it to the students with the incentive that being a local mirror it will be WAY faster. Blocking people only makes them more determined, give them a better solution and they may just solve the problem for
Caching Servers (Score:2)
Somebody else posted this suggestion, and it got promptly shot down (in typical Slashdot fashion) by people who know nothing about the subject...
For at least Apple and Microsoft products, you can install a caching server that will cache the first download of any given update and then deliver from the cache on subsequent updates.
This is not the same as a caching HTTP server. (That what was shot-down...) These are specific servers made available by Apple and Microsoft, and meant specifically for caching softw
Re: (Score:2)
If this guy has EES licensing I can't see why they wouldn't use it
Re: Caching Servers (Score:1)
We don't want to setup a ms server with WUS service. May be our only hope. Leaves us no other choice.
In Soviet Russia, Windows phases out YOU! (Score:2)
My own personal solution to this problem is to phase out every and each program, OS and everything other that downloads upgrades without owner's intervention, and there would be a really serious need in order to leave such a program, with specific traffic shaping crafted specifically for it. You understand what I mean.
Also, when I was a sysadmin I just installed a very complicated firewall (ipfw on FreeBSD) that limited speed of every separate group of users so the bandwidth hog would affect his own group o
Girlfriend ? (Score:1)
Seriously, I know this is /. but If you get a girlfriend this letting your visitors use you internet is a moot point.
Apple Caching Service (Score:2)
On any Mac in your office, running 10.8 (Mountain Lion) or 10.9 (Mavericks) purchase (for $20 or so), download and install the OS X Server app.
Turn on the Caching service. Problem solved for Apple devices.
The server then registers itself with Apple, they see the registration coming from your IP, so when further devices from that IP address request a software update, these machines are pointed to your internal Caching server. Then, when a device (or a Mac) tries to download an update or purchase something fr
the BOFH way (Score:2)
Use iptables rules in the router to allow/disallow traffic at some hours of day, see this [cyberciti.biz]. You can totally block the traffic, or QoS [mikebabcock.me] it to oblivion on hot hours and increase it traffic later (join the iptables rules by hours to set the classid and then apply different QoS to then)
Finally, a caching transparent proxy might help, specially if everyone uses the same sites... it helps the normal browsing (by caching images, css, js, etc) and the updates (local copy if already downloaded). You just need a old co
Do you... (Score:2)
Also only serve your guests tap water so as not to use up your bottle water supply? Feed them only leftovers so not to tap into your personal food storage? Only let them watch TV on the small TV in the bedroom so you don't eat up electricity from the big screen??? Make them sit in the cold and dark by refusing to turn on the lights and heat, y'know, cause that shit costs money?
Geez, remind me never to be an invited guest over to your house. You sound like a real winner.
Re: (Score:1)
a) "school" now includes "internet" (unlike when I was a child and we learned from books)
b) devices do this shit entirely on their own with zero user interaction.
Re: why give them wifi? (Score:1)
Our students are all disabled. 50 of them. Many speech and text assist I've apps.
Re: (Score:2)
Re: Public network etiquette? (Score:1)
Amen. Think of airplane mode. Guest device limiting its own lan consumption on all apps with one switch the user can find.
OS distinguishes metered and unmetered SSIDs (Score:2)
the os manufacturers need to have a network etiquette setting which disables updating at specific locations
Android makes a distinction between metered and unmetered SSIDs. Go to Settings > Data Usage > Overflow menu > Mobile hotspots. Windows 8 does something similar, but only for Windows Store apps as far as I know.