Slashdot Mirror
Ask Slashdot: Managing Device-Upgrade Bandwidth Use?
First time accepted submitter wallydallas writes "I'm close to a solution, but I wonder how other people block their many devices and operating systems from updating in working hours. For example: I'm the IT guy who blocks iPads from updating when school is in session because we are in a rural location. 3mbps is the best WAN we can buy. Devices can update after hours just fine. We do this with our router (DDWRT) by blocking MESU.APPLE.COM. Many guests bring in Windows 7 laptops, and I want to welcome them, but not their updates. How can I block updates on Android Phones and Linux Laptops? I have a 4G device at home, and I'd like to apply the same tricks 24 hours a day so that I don't use up the bandwith from my vendor. And my many home visitors should have their updates blocked."
For Windows, you could try blocking the addresses listed in the Microsoft Knowledge Base article 818018.
If there are a lot of people that want to do the updates, AND you have the space, a cacheing service can ease the pain. The first time an update is done, the cache (proxy) saves the reply, then when someone else asks for the update, it is supplied locally rather than downloading it again.
Wasn't there billions of dollars spent by the government like 10 years ago to get every school connected with high speed internet?
Use PFsense and use the package squidguard(or dansguardian) and use the software downloads list.
http://www.pfsense.org/
install pfsense plus squid and block the update sites.
pfsense wan goes to the modem
pfsense lan goes to the access point.
http://www.squid-cache.org/Doc/config/acl/
acl aclname time [day-abbrevs] [h1:m1-h2:m2]
# [fast]
# day-abbrevs:
# S - Sunday
# M - Monday
# T - Tuesday
# W - Wednesday
# H - Thursday
# F - Friday
# A - Saturday
# h1:m1 must be less than h2:m2
Exercise for the reader
Create different time acls and block & allowed based on them
cheers
There's no reason to avoid using your bandwidth when you can use QoS to deprioritize it so that they can still update any time the bandwidth is available. Most any linux router can do this with tc and iptables, or sometimes with less configurability through their GUI's.
At home you have control over the devices and can just disable them from automatically updating.
If someone is at school shouldn't they be learning rather that doing something on their phone?
suggest you enable logging on the proxy/router, monitor for addresses/ip related to updates and block them. You'll want to block application updates like Adobe, etc also I would presume.
Since you're in such a remote area, your visitors very likely also have slow connections at home too. Why not cache the updates instead? You'll be contributing towards a safer, more secure internet.
The first person who downloads them would cause a drain on the network, but at least all future attempts would be served up from your cache. You could even have a spare machine downloading the updates overnight, pre-populating the cache for your visitors, to reduce the burden updates cause during the day.
I've used the instructions here with great success on Squid: http://wiki.squid-cache.org/SquidFaq/WindowsUpdate
Apparently Apple iOS updates can be cached too, e.g.: http://lkrms.org/caching-ios-updates-on-a-squid-proxy-server/
Back in dialup days some providers let you "bond" 2, 3, or even dozen(s?) of modems together.
Ask your ISP if they have that capability with the existing lines.
If not, consider adding a satellite connection and QOS bulk incoming data through that pipe.
Captha: obsolete
You can put snort on DDWRT. There are signatures that can be added and removed via script and cron. The signatures are able to block Microsoft Updates, normal and BITS, as well as specific services on iTunes.
Having to work for a living is the root of all evil.
Any particular reason you've singled out device updates? Seems like you'd be want to block or QoS all large or multi-range binary transfers. You should have a transparent caching proxy server in place (which is where you'll be able to inspect and block large transfers).
My Hello World is 512 bytes. But it's also a valid Fat12 boot sector, Fat12 file reader, and Pmode routine.
On our network, we have seen one Apple machine running at 20Mbps to the Internet for hours on end. I believe this is a cloud sync. Looking at QoS to throttle this, but the external IP addresses appear to be a disparate and unknown set, so will have to throttle the firewall -> LAN IP connection.
The real "Libtards" are the Libertarians!
https://www.paloaltonetworks.com/products/platforms/firewalls/pa-200/overview.html
This will do everything you could ever think of for control on your WAN link
Get a demo in your environment for few weeks.
Other vendors have similar products.
If you block updates, windows particularly, then you'll have higher chances of infected systems that may be used for DDoS etc.
Blocking these types of downloads at a school I can understand, not a lot of schools have funding for high bandwidth connections.
At home that's another story, if you don't trust them, don't let them on. Why would you let them on your home network if you don't trust them. I consider letting them use my home network for phone and app updates be a good host. Overall my initial reaction to reading the question posed, was the thought that your are very much on the verge of being a control freak
shape them using QOS. Updates are important.
I'm in Juneau Alaska. The only way in and out of town is via plane or boat ... we are WORSE than rural. ... As of noon today, we just got 100Mb ..... something is wrong there.
The caching service in OS X Mavericks server will take care if this for iOS and OS X.
I strongly suggest you also block all the common advert servers such as doubleclick as they consume far more bandwidth than the updates do.
Do not look at laser with remaining good eye.
Mavericks Server has Caching Server 2, which I haven't personally used but their blurb for it sounds like exactly what you want, at least as far as Apple devices.
OS X Server has Caching Service to alleviate this exact problem.
Install the OS X Server package on any Mac running the latest OS X and turn on Caching Service. Then any iOS devices and Macs on the same subnet will automatically download updates from the Caching Service if available. Basically zero configuration and it takes care of a bunch of devices for you.
WRT is great for tinkering and home users, but good god, please don't put it in a production network. Get something like a SonicWALL or a FortiGate, learn to use it, and thank me later. QoS will get you nothing, there is no such thing as QoS on the internet. However, bandwidth management and throttling could help a lot. Before you can prioritize traffic you need to be able to identify it, and this is where life becomes much easier with a UTM appliance. You can prioritize by device type (MAC address), source, destination, protocol, or application. With application awareness you can easily see what is sucking up the most bandwidth, and it classifies all the traffic for you automagically based on signatures ran against deep packet inspection. A caching proxy, as mentioned in other posts, would help speed up the internet and reduce bandwidth consumption. Something like Squid would work here, or you could go the appliance route. Bonus, with a UTM device you also get IDS/IPS, botnet filtering, gateway antivirus, spam filtering, RBL filter, content filtering, application control, SSL VPN, wireless controller, and more. They cost money, but you will not find these features for free, and if you do it is going to be a nightmare to manage.
For Linux you will have to make rules for each distro. Ubuntu can be blocked with *.archive.ubuntu.com. Get the most popular distros covered, and you should be off pretty good.
Somebody else posted this suggestion, and it got promptly shot down (in typical Slashdot fashion) by people who know nothing about the subject...
For at least Apple and Microsoft products, you can install a caching server that will cache the first download of any given update and then deliver from the cache on subsequent updates.
This is not the same as a caching HTTP server. (That what was shot-down...) These are specific servers made available by Apple and Microsoft, and meant specifically for caching software updates.
In fact, I have the Apple server installed on my Mac Mini. (It comes bundled with Mavericks Server, which is now just an optional package that installs on top of OSX.) It caches both iOS and OSX updates. I did an Xcode update (>1GB) on my Macbook in 2 minutes flat.
This would improve performance for your own updates, and would also permit you to offer updates to guests with little overhead, if you so choose.
Linux is more difficult, as there are quite a number of distributions with different update schemes. But I have to assume that a similar solution is available in most to all cases.
you're making a lot of assumptions about the fresnel zone without knowing the frequency the equipment is operating on.
After months of wrangling with linux routers then pfsense I found a quan wan router by tp-link for £30. Whilst I rarely use more than one wan on it but the timed fallbacks and routing policies are exactly what you need. A squid cache (forward port 80 on cache box to save having to set clients) helps but also maybe a samba share with common stuff. The router is dirt cheap considering the time you can lose on (although amazing) pfsense and the cache/share will run on any old crap - I often pick a client that will be on alot to serve these functions.
Mainly, good luck
- a sysadmin for a school with a 2mbps (notice lower case) for 40 pcs.
My own personal solution to this problem is to phase out every and each program, OS and everything other that downloads upgrades without owner's intervention, and there would be a really serious need in order to leave such a program, with specific traffic shaping crafted specifically for it. You understand what I mean.
Also, when I was a sysadmin I just installed a very complicated firewall (ipfw on FreeBSD) that limited speed of every separate group of users so the bandwidth hog would affect his own group only. And the sniffer was installed so that I could see the update sources and limit them accordingly.
Pretty simple - just leverage application controls and apply best-effort QoS that's guaranteed no bandwidth.
Sounds like your user base might face even grimmer WAN circumstances wherever they are head after hours. I like suggestions involving pfSense: though that is just one of many open and closed source solutions that could help you accomplish this.
However, perhaps there are some old hard drives that could be salvaged so as to cache these popular update files.
You'd win long term because:
*your network population is patched
*you may be able to cache other popular resources, like WikiPedia, better utilizing the limited WAN connectivity
*you will tax the router less as it will divert once rather than block time after time
*you teach good equipment maintenance (thanks to Apple and MS people have come to fear the updates they so desperately need)
Seriously, I know this is /. but If you get a girlfriend this letting your visitors use you internet is a moot point.
There are lots of small towns that simply don't have access to real high-speed links. I just checked, and there are towns in my province (canadian prairies) that only have 1.5 mbps connectivity and most of the smaller places max out at 5mbps. Most of these places you'd be better off with a 4G mobile hotspot for each classroom.
Many different distro's.
Many of them use different update systems and different servers and different ports, etc.
In some systems updates happen automatically. In some - don't. Best is to tell owner, they will typically know how to switch off auto update.
You can check out most popular distros and based on that block their servers. But even then, it ain't gonna be a silver bullet, since servers also change from time to time.
You prolly better off with block all unknown outgoing ports and just let traffic. But even then, good chance some of those servers may also listen on port 80, for specifically reason of blocking their native ports.
On any Mac in your office, running 10.8 (Mountain Lion) or 10.9 (Mavericks) purchase (for $20 or so), download and install the OS X Server app.
Turn on the Caching service. Problem solved for Apple devices.
The server then registers itself with Apple, they see the registration coming from your IP, so when further devices from that IP address request a software update, these machines are pointed to your internal Caching server. Then, when a device (or a Mac) tries to download an update or purchase something from the App store, it will come from the persistent cache in preference to the WAN.
Specialist Mac support for creative pros, Melbourne
I always thought this is one of those things where the os manufacturers need to have a network etiquette setting which disables updating at specific locations. I cringe every time I see some nut job trying to update his/her device over a conference wifi.
Use iptables rules in the router to allow/disallow traffic at some hours of day, see this. You can totally block the traffic, or QoS it to oblivion on hot hours and increase it traffic later (join the iptables rules by hours to set the classid and then apply different QoS to then)
Finally, a caching transparent proxy might help, specially if everyone uses the same sites... it helps the normal browsing (by caching images, css, js, etc) and the updates (local copy if already downloaded). You just need a old computer with some HD and you are done.
For harder to filter services, you can usually block DNS for then... but if you allow it for some time, it might be cached by the clients on peak hours and still work.
Of course, if you control the clients, you can also configure most of then to only download off hours
Finally, you can be a BOFH, permit only allowed traffic and block the rest... or redirect it to some backdoor installer and enjoy the chaos generated
Higuita
The standard solution most enterprises use, usually working with a firewall and blocking list e.g. websense, is to simply allow just about everything, and restrict it as it comes down. There's no way you'll be able to compile a list of every possible update or every possible device, and unless you have purchased a high end router, or have hacked your own or setup a router box via linux, you probably won't even have enough storage to create rules for all those apps.
The way I do it is like this:
Completely unrestricted. When I know people are coming over, I'll throw up wireshark or avayashark and monitor the traffic, finding the urls for the updates people might try to pull down, then block them, or severely limit the QoS on them. I'd also suggest, like another poster, that you start caching your ms/apple updates and host them locally, your friends with crappy internet will love you for that.
Using linux you could create some iptables rules to set those urls to only work at off peak hours (times when your friends probably are at home in bed).
I'd avoid trying to block everything from the start, and only restrict on a needs basis, monitor your traffic and block or redirect accordingly. Using redirection and local caching, you can have your friends update from your local cache, but completely transparently to them. Of course, certain apps and updates require some type of authentication so you might not be able to cache those updates.
Another, simple option, is to block stuff at the protocol / port level. This won't work for everything, but it's a hell of a lot easier than blocking every site on the internet.
You could also setup a guest network, with severe limitations, only allow certain pages, nothing else. My guest network lets you hit google, facebook, and a few other common sites, mostly webmail. Microsoft is blocked entirely.
You mean you could pay $40 more a month and, if the bandwidth was available, you would be allowed to use some of it. "Up to" is the key phrase.
The feature of Net Equalizer that lets you limit the number of active connections per client works well in limiting P2P traffic. But in other situations, just getting more bandwidth ends up making people happier and costs about the same as trying to limit it, if you include manpower. In an educational situation, Net Equalizer worked well for us. In a business setting, you should be able to mandate that users not do certain things, if management will back you up.
Another way to do this is to have more than one Internet connection and either route some protocols, users or servers over different connections. For example, it can work well to route ports 80 and 443 traffic over one connection and everything else over a second connection.
Competition Good, Monopoly Bad.
Also only serve your guests tap water so as not to use up your bottle water supply? Feed them only leftovers so not to tap into your personal food storage? Only let them watch TV on the small TV in the bedroom so you don't eat up electricity from the big screen??? Make them sit in the cold and dark by refusing to turn on the lights and heat, y'know, cause that shit costs money?
Geez, remind me never to be an invited guest over to your house. You sound like a real winner.
It might not be a general-purpose proxy, but for anything that downloads updates over http (and can have a proxy defined) it's simple and effective. Extra goodness if you update a lot of Debian/Ubuntu-based machines. I have one Raspberry Pi with just an SD card serving updates for about a dozen machines at home and it's much more reliable than squid.
Apparently, private schools don't qualify for e-rate. Or should the private school relocate next door to a public school?
My Android phone lets me set software updates and podcast downloads to only happen over wifi, under the assumption that cellular data is expensive, but wifi data is unlimited. But, if I connect to a Mifi access point connected to a cellular connection, my phone currently has no way to discover that it is actually using (limited) cellular data.
If the version of Android on your phone is anything like the version of Android on my Nexus 7 tablet, you can manually mark a specific SSID as metered. Try Settings > Data usage > Overflow menu (the three dot colon) > Mobile hotspots.
the os manufacturers need to have a network etiquette setting which disables updating at specific locations
Android makes a distinction between metered and unmetered SSIDs. Go to Settings > Data Usage > Overflow menu > Mobile hotspots. Windows 8 does something similar, but only for Windows Store apps as far as I know.