Slashdot Mirror
Microsoft Windows Update and Network Bandwidth?
Brett Glass asks: "As we reviewed the cache statistics for our small ISP today, we noted that the traffic generated by Microsoft's Windows Update feature constituted 45% -- no, that's not a misprint -- of our total throughput. Because so many computers on the Internet run Windows, this massive resource drain occurs whenever Microsoft announces major security holes (as it did this week). The traffic could be greatly reduced, and service to users much improved, if the updates were cacheable at the ISP. But Microsoft has set up the service in such a way that the data can't be cached. (It's digitally signed, so inserting Trojans into the cache is virtually impossible; in any event, no more of an issue than intercepting the data stream.) Are others out there seeing the same pattern? How might Microsoft be convinced to make its updates cacheable, so as not to waste unthinkable amounts of bandwidth?"
I can only speak from what I've seen in our offices, but squid (running in transparent proxy mode) very definitely caches content from Windows Update... I set it up about six month ago and remeber being really surprised (because I think I very reasonably expected it not to).
Here at Berkeley all of the Windowsupdates come from an internal server instead of externally. That way they control who gets the updates and when.
You can download the updates individually, and there is probably a way to have them downloaded to the server automatically. All you have to do is convince the users to download them from you and install them manually. Can you block traffic from the autoupdate applet? I bet that would significantly reduce traffic, at the cost of insecure customers.
What about running an internal WU server and changing the DNS entry at the local level to a local server? You'd have to keep the catalog of updates stocked and refreshed constantly, for multiple OS's, so I don't know how cost effective it might be.
-Ryan
AUWYHSTOT (Acronyms are Useless When You Have to Spell Them Out Too)
The good news about Apple's updates are that they can be downloaded from the web and stored on the local network, or you can direct Software Update to download the update to your desktop.
This makes it easy to share with others who might not have the bandwidth to download these freakin' things.
Another option is to use a systems management package (LANDesk, ZENworks, SMS, etc.) to build the packages and deploy them while only using your internal network bandwidth (once you've downloaded the hotfixes anyway).
Of course, the two options above are really meant for company networks, but even those can help reduce the bandwidth used for more important things.
First step is to download the patches/update manually and save them elsewhere accessable to all users:
- Windows 2000 users, please visit the
Windows 2000 Downloads site.
- Windows NT 4.0 users, please visit the
Microsoft Download Center.
- Windows 98 users, please visit the
Windows 98 Downloads site.
- Windows 95 users, please visit the
Windows 95 Downloads site.
Second, we found that users would rather use windowsupdate.microsoft.com then to go to our patches/update repository, that make sense. You could forbid your users from accessing windowsupdate.microsoft.com, but it might have a problem, as some update might actually request windowsupdate.microsoft.com during installation.Therefore, we limit the priority of traffic in/out of windowsupdate.microsoft.com. Eventually we lower the prior of entire microsoft.com because that's really necessary. Users could access to windowsupdate.microsoft.com on their own as usual - if they don't mind holding up their machines for a couple of days.
This works great. Larger and bigger patches are stored locally for users, while they could still access to windowsupdate for smaller patches/fixes. Our bandwidth load lessen(to a certain degree, we still can't solve that 5-15% Netbios traffic jam
Hope this help.
Not being a windows user, how big are the windows updates and how often do they come?
Since Microsoft release patches via Windows Update so frequently, they are usually fairly small. 1MB-5MB downloads are frequent, with the occasional 10MB+ one every now and then. There are updates practically every few days, so having a Windows Update Server running will negate the expense of everyone having to download redundant files.
Some help about storing Windows Update files for later can be found here.
Ladies, form queue here -->
...download the updates yourself and either push them to the users through something like SMS, or have a program check the registry in the login script. It is fairly simple.
If it's a big problem, just block off windowsupdate and redirect them to your own page. You could implement a simple scan using something like HFNetChk. It's command line and works well.
Hey, look at it this way.. at least your users are updating! That puts them above 90% of the users out there.
so can the ones on windows update
either you can build your own windows update server or at the very least download the individual updates and store them just as files
and you can even build them into an iso image, my win2k cd has sp3 built into it so whenever I build a new machine it's already there, and you can do that with most of the updates
are you thinking with both brain cells here?
.NET" to solve all your worries.
the red hat updates are cacheable yet individually gpg-signed. they are also freely distributable by anyone. you can set up a red hat satellite proxy server for your organization. you can download once straight from red hat's FTP server (the URLs are conveniently listed in the emails) and push them to each machine. there are probably 50 different ways you can write perl scripts to fix the problem.
seriously, this is a difference between FREE SOFTWARE and VENDOR LOCK-IN. Even Brett Glass can understand what FREE means in this context.
Microsoft probably knows EXACTLY how much of a pain this is and will happily SELL you some overpriced "Windows Update Proxy Server Professional 2000
In the meantime, you should be aware that all the major service packs for Microsoft products can be downloaded as stand-alone executables. Also, the IE download page includes some critical updates. Make your own "cache" on the network, and let everybody get their updates from there.
Just checked the stats for the past 24 hours (from a Squid cache). This time, *.windowsupdate.com generated 56.11% of the traffic, with a hit rate of only 2.37%. In short, Microsoft is eating (and expending!) huge amounts of bandwidth, and almost none of what is being transmitted can be cached. What a waste.
Ahem.... Red Hat updates are cacheable. But the percentage of Linux users on our network is in the single digits. Most users run Windows.
Why don't you subscribe to or at least take a look the ISP-Caching mailing list?
Of course, if you use Microsoft's Software Update Service, then it's basically like running your own Windows Update server...and it's a free addon to Win2K servers. Client side is very similar to the Automatic Updates feature introduced in 2000 SP3 (or XP SP1)...but instead of checking MS's server it checks your own. Admins have control over what updates will be applied.
There are also 3rd party tools like HFNetChk Pro (with a free Lite version, but it has major limitations as far as rollouts are concerned) and UpdateExpert. They basically simplify mass scanning and rollout to many machines.
Of course, for ISP's the only thing I can think of would be to just download the files and host on a website...then educate your customers.
How about trying something like this.
buy?? Windows Update Services is free, mate. Install it on your server, set the clients up via GPO, and off it goes, saves bandwidth and admin time by the bucketload.
Actually, it does exist and it is called SUS. It is free (if you already own a win2k server license).
Let me just say, SUS sucks ass.
Microsoft's systems of GPO's makes it pretty useless -- you need to set GPO's for hosts to use your SUS servers, so if your domain has any divergence from the stock GPO's there is a good chance it isn't going to work and it will be impossible to debug in less than a month.
I believe there was a giant thread about it on focus-ms.
-- DrZaius - Minister of Sciences and Protector of the Faith