Ask Slashdot: Managing Device-Upgrade Bandwidth Use?

First time accepted submitter wallydallas writes "I'm close to a solution, but I wonder how other people block their many devices and operating systems from updating in working hours. For example: I'm the IT guy who blocks iPads from updating when school is in session because we are in a rural location. 3mbps is the best WAN we can buy. Devices can update after hours just fine. We do this with our router (DDWRT) by blocking MESU.APPLE.COM. Many guests bring in Windows 7 laptops, and I want to welcome them, but not their updates. How can I block updates on Android Phones and Linux Laptops? I have a 4G device at home, and I'd like to apply the same tricks 24 hours a day so that I don't use up the bandwith from my vendor. And my many home visitors should have their updates blocked."

Comments

For Windows

[jones_supa]

For Windows, you could try blocking the addresses listed in the Microsoft Knowledge Base article 818018.

Re:For Windows

[Anonymous Coward]

That is not a complete list. We setup our DNS to return 127.0.0.1 for all of those hostnames, and Microsoft still found a way to do a forced update to MSIE10 that broke all of the Dell desktops running Windows in our office. We had to reimage all of Dells to get them running again. We found the IP addr Microsoft was using for their abuse and blocked it, but then about four months later Microsoft found another way to do yet another forced update and breaking of our desktops. Again, we had to reimage to get the systems to boot.

Again, that list is not complete. If you block just those, Microsoft will still find a way to break your systems.

It depends on your environment.

[Anonymous Coward]

If there are a lot of people that want to do the updates, AND you have the space, a cacheing service can ease the pain. The first time an update is done, the cache (proxy) saves the reply, then when someone else asks for the update, it is supplied locally rather than downloading it again.

Pfsense

[bhenson]

Use PFsense and use the package squidguard(or dansguardian) and use the software downloads list.

pfSense

[Anonymous Coward]

http://www.pfsense.org/

install pfsense plus squid and block the update sites.

pfsense wan goes to the modem
pfsense lan goes to the access point.

Consider caching instead

[nemesisrocks]

Since you're in such a remote area, your visitors very likely also have slow connections at home too. Why not cache the updates instead? You'll be contributing towards a safer, more secure internet.

The first person who downloads them would cause a drain on the network, but at least all future attempts would be served up from your cache. You could even have a spare machine downloading the updates overnight, pre-populating the cache for your visitors, to reduce the burden updates cause during the day.

I've used the instructions here with great success on Squid: http://wiki.squid-cache.org/SquidFaq/WindowsUpdate

Apparently Apple iOS updates can be cached too, e.g.: http://lkrms.org/caching-ios-updates-on-a-squid-proxy-server/

Why just device updates?

[ChaseTec]

Any particular reason you've singled out device updates? Seems like you'd be want to block or QoS all large or multi-range binary transfers. You should have a transparent caching proxy server in place (which is where you'll be able to inspect and block large transfers).

Ditch the WRT

[kroby]

WRT is great for tinkering and home users, but good god, please don't put it in a production network. Get something like a SonicWALL or a FortiGate, learn to use it, and thank me later. QoS will get you nothing, there is no such thing as QoS on the internet. However, bandwidth management and throttling could help a lot. Before you can prioritize traffic you need to be able to identify it, and this is where life becomes much easier with a UTM appliance. You can prioritize by device type (MAC address), source, destination, protocol, or application. With application awareness you can easily see what is sucking up the most bandwidth, and it classifies all the traffic for you automagically based on signatures ran against deep packet inspection. A caching proxy, as mentioned in other posts, would help speed up the internet and reduce bandwidth consumption. Something like Squid would work here, or you could go the appliance route. Bonus, with a UTM device you also get IDS/IPS, botnet filtering, gateway antivirus, spam filtering, RBL filter, content filtering, application control, SSL VPN, wireless controller, and more. They cost money, but you will not find these features for free, and if you do it is going to be a nightmare to manage.

Re:Don't block it, QoS it.

[Port-0]

I did IT work for a private university for 14 years, I managed bandwidth by blocking certain protocols to various networks and hosts until Naptster, and the following peer to peer protocols, after a couple of years trying to manage bandwidth by blocking protocols, sites, advertising, etc. I gave up on that. Ultimately all of that damages the user's experience, and increased my work load. It puts the IT guy in the position of chasing the users behaviors, always responding to the latest fire and worse it put the IT guy in the position of determining what is important to the users, which it turns out is different to each class of user. So next I tried using one of the many products that allow the IT guy to create classes of users, and classify traffic, apply rules by class, build QoS rules based on all classes. Turns out this is the same nightmare with a prettier UI. I ultimately found the Net Equalizer (netequalizer.com) it is an elegant solution at a fraction of the cost. If you want to be the network nazi and control who uses what protocol, this isn't for you. But if you want to forget about bandwidth problems, this is it. It took about an hour to read the manual, play with options and plug it in, then I only touched it when we increased our bandwidth beyond its capacity a few years later. I don't work for the company or anything like that. It is just one device I bought that performed way beyond my expectations. Their web site has all the info about what it does and how. I would encourage everyone check this out if you have less bandwidth than you feel you need.