Slashdot Mirror
Ask Slashdot: Managing Device-Upgrade Bandwidth Use?
First time accepted submitter wallydallas writes "I'm close to a solution, but I wonder how other people block their many devices and operating systems from updating in working hours. For example: I'm the IT guy who blocks iPads from updating when school is in session because we are in a rural location. 3mbps is the best WAN we can buy. Devices can update after hours just fine. We do this with our router (DDWRT) by blocking MESU.APPLE.COM. Many guests bring in Windows 7 laptops, and I want to welcome them, but not their updates. How can I block updates on Android Phones and Linux Laptops? I have a 4G device at home, and I'd like to apply the same tricks 24 hours a day so that I don't use up the bandwith from my vendor. And my many home visitors should have their updates blocked."
For Windows, you could try blocking the addresses listed in the Microsoft Knowledge Base article 818018.
If there are a lot of people that want to do the updates, AND you have the space, a cacheing service can ease the pain. The first time an update is done, the cache (proxy) saves the reply, then when someone else asks for the update, it is supplied locally rather than downloading it again.
Wasn't there billions of dollars spent by the government like 10 years ago to get every school connected with high speed internet?
Use PFsense and use the package squidguard(or dansguardian) and use the software downloads list.
http://www.pfsense.org/
install pfsense plus squid and block the update sites.
pfsense wan goes to the modem
pfsense lan goes to the access point.
There's no reason to avoid using your bandwidth when you can use QoS to deprioritize it so that they can still update any time the bandwidth is available. Most any linux router can do this with tc and iptables, or sometimes with less configurability through their GUI's.
At home you have control over the devices and can just disable them from automatically updating.
Since you're in such a remote area, your visitors very likely also have slow connections at home too. Why not cache the updates instead? You'll be contributing towards a safer, more secure internet.
The first person who downloads them would cause a drain on the network, but at least all future attempts would be served up from your cache. You could even have a spare machine downloading the updates overnight, pre-populating the cache for your visitors, to reduce the burden updates cause during the day.
I've used the instructions here with great success on Squid: http://wiki.squid-cache.org/SquidFaq/WindowsUpdate
Apparently Apple iOS updates can be cached too, e.g.: http://lkrms.org/caching-ios-updates-on-a-squid-proxy-server/
You can put snort on DDWRT. There are signatures that can be added and removed via script and cron. The signatures are able to block Microsoft Updates, normal and BITS, as well as specific services on iTunes.
Having to work for a living is the root of all evil.
Any particular reason you've singled out device updates? Seems like you'd be want to block or QoS all large or multi-range binary transfers. You should have a transparent caching proxy server in place (which is where you'll be able to inspect and block large transfers).
My Hello World is 512 bytes. But it's also a valid Fat12 boot sector, Fat12 file reader, and Pmode routine.
On our network, we have seen one Apple machine running at 20Mbps to the Internet for hours on end. I believe this is a cloud sync. Looking at QoS to throttle this, but the external IP addresses appear to be a disparate and unknown set, so will have to throttle the firewall -> LAN IP connection.
The real "Libtards" are the Libertarians!
If you block updates, windows particularly, then you'll have higher chances of infected systems that may be used for DDoS etc.
Blocking these types of downloads at a school I can understand, not a lot of schools have funding for high bandwidth connections.
At home that's another story, if you don't trust them, don't let them on. Why would you let them on your home network if you don't trust them. I consider letting them use my home network for phone and app updates be a good host. Overall my initial reaction to reading the question posed, was the thought that your are very much on the verge of being a control freak
I'm in Juneau Alaska. The only way in and out of town is via plane or boat ... we are WORSE than rural. ... As of noon today, we just got 100Mb ..... something is wrong there.
I strongly suggest you also block all the common advert servers such as doubleclick as they consume far more bandwidth than the updates do.
Do not look at laser with remaining good eye.
Mavericks Server has Caching Server 2, which I haven't personally used but their blurb for it sounds like exactly what you want, at least as far as Apple devices.
WRT is great for tinkering and home users, but good god, please don't put it in a production network. Get something like a SonicWALL or a FortiGate, learn to use it, and thank me later. QoS will get you nothing, there is no such thing as QoS on the internet. However, bandwidth management and throttling could help a lot. Before you can prioritize traffic you need to be able to identify it, and this is where life becomes much easier with a UTM appliance. You can prioritize by device type (MAC address), source, destination, protocol, or application. With application awareness you can easily see what is sucking up the most bandwidth, and it classifies all the traffic for you automagically based on signatures ran against deep packet inspection. A caching proxy, as mentioned in other posts, would help speed up the internet and reduce bandwidth consumption. Something like Squid would work here, or you could go the appliance route. Bonus, with a UTM device you also get IDS/IPS, botnet filtering, gateway antivirus, spam filtering, RBL filter, content filtering, application control, SSL VPN, wireless controller, and more. They cost money, but you will not find these features for free, and if you do it is going to be a nightmare to manage.
For Linux you will have to make rules for each distro. Ubuntu can be blocked with *.archive.ubuntu.com. Get the most popular distros covered, and you should be off pretty good.
Somebody else posted this suggestion, and it got promptly shot down (in typical Slashdot fashion) by people who know nothing about the subject...
For at least Apple and Microsoft products, you can install a caching server that will cache the first download of any given update and then deliver from the cache on subsequent updates.
This is not the same as a caching HTTP server. (That what was shot-down...) These are specific servers made available by Apple and Microsoft, and meant specifically for caching software updates.
In fact, I have the Apple server installed on my Mac Mini. (It comes bundled with Mavericks Server, which is now just an optional package that installs on top of OSX.) It caches both iOS and OSX updates. I did an Xcode update (>1GB) on my Macbook in 2 minutes flat.
This would improve performance for your own updates, and would also permit you to offer updates to guests with little overhead, if you so choose.
Linux is more difficult, as there are quite a number of distributions with different update schemes. But I have to assume that a similar solution is available in most to all cases.
a) "school" now includes "internet" (unlike when I was a child and we learned from books)
b) devices do this shit entirely on their own with zero user interaction.
you're making a lot of assumptions about the fresnel zone without knowing the frequency the equipment is operating on.
My own personal solution to this problem is to phase out every and each program, OS and everything other that downloads upgrades without owner's intervention, and there would be a really serious need in order to leave such a program, with specific traffic shaping crafted specifically for it. You understand what I mean.
Also, when I was a sysadmin I just installed a very complicated firewall (ipfw on FreeBSD) that limited speed of every separate group of users so the bandwidth hog would affect his own group only. And the sniffer was installed so that I could see the update sources and limit them accordingly.
Seriously, I know this is /. but If you get a girlfriend this letting your visitors use you internet is a moot point.
I just checked, and there are towns in my province (canadian prairies) that only have 1.5 mbps connectivity and most of the smaller places max out at 5mbps.
Virtually... in any town; small or not, there is plenty of fiber and other Telecommunications infrastructure. The telephone company essentially needs large digital trunks, just to deliver basic phone service.
If there are providers delivering 1.5 and 5 megabit connections to residents then they Do have high-speed links in the area --- the provider has to have access to some high speed links in the first place in order to be able to offer 5 megabit connections in the first place....
If significant bandwidth is available over wireless 4G, then again there must be nearby 4G towers in range of the area area that also must have access to high-speed links.
I'm not buying "the infrastructure is not there" argument, for those areas.
Now: it may be unavailable for political reasons, or the school not willing to spend more than a few $100 a month for a 100 megabit private circuit to an IP transit provider.
On any Mac in your office, running 10.8 (Mountain Lion) or 10.9 (Mavericks) purchase (for $20 or so), download and install the OS X Server app.
Turn on the Caching service. Problem solved for Apple devices.
The server then registers itself with Apple, they see the registration coming from your IP, so when further devices from that IP address request a software update, these machines are pointed to your internal Caching server. Then, when a device (or a Mac) tries to download an update or purchase something from the App store, it will come from the persistent cache in preference to the WAN.
Specialist Mac support for creative pros, Melbourne
Use iptables rules in the router to allow/disallow traffic at some hours of day, see this. You can totally block the traffic, or QoS it to oblivion on hot hours and increase it traffic later (join the iptables rules by hours to set the classid and then apply different QoS to then)
Finally, a caching transparent proxy might help, specially if everyone uses the same sites... it helps the normal browsing (by caching images, css, js, etc) and the updates (local copy if already downloaded). You just need a old computer with some HD and you are done.
For harder to filter services, you can usually block DNS for then... but if you allow it for some time, it might be cached by the clients on peak hours and still work.
Of course, if you control the clients, you can also configure most of then to only download off hours
Finally, you can be a BOFH, permit only allowed traffic and block the rest... or redirect it to some backdoor installer and enjoy the chaos generated
Higuita
I totally understand that they say "up to 5Mbs" on my consumer plan. But I use internet at all hours of the day, and can tell you I average above that at all times. So, while I have no legal retribution if they don't fulfill that (other than to just leave), I haven't had a problem with shared lines in the suburbs since Road Runner.
The feature of Net Equalizer that lets you limit the number of active connections per client works well in limiting P2P traffic. But in other situations, just getting more bandwidth ends up making people happier and costs about the same as trying to limit it, if you include manpower. In an educational situation, Net Equalizer worked well for us. In a business setting, you should be able to mandate that users not do certain things, if management will back you up.
Another way to do this is to have more than one Internet connection and either route some protocols, users or servers over different connections. For example, it can work well to route ports 80 and 443 traffic over one connection and everything else over a second connection.
Competition Good, Monopoly Bad.
Also only serve your guests tap water so as not to use up your bottle water supply? Feed them only leftovers so not to tap into your personal food storage? Only let them watch TV on the small TV in the bedroom so you don't eat up electricity from the big screen??? Make them sit in the cold and dark by refusing to turn on the lights and heat, y'know, cause that shit costs money?
Geez, remind me never to be an invited guest over to your house. You sound like a real winner.
Our students are all disabled. 50 of them. Many speech and text assist I've apps.
Amen. Think of airplane mode. Guest device limiting its own lan consumption on all apps with one switch the user can find.
Apparently, private schools don't qualify for e-rate. Or should the private school relocate next door to a public school?
Some students finish their assignments before the bell or finish eating before the end of lunch hour. Some students even live in school-associated dormitories; this is most common for university undergraduates, but some K-12 schools are boarding schools.
My Android phone lets me set software updates and podcast downloads to only happen over wifi, under the assumption that cellular data is expensive, but wifi data is unlimited. But, if I connect to a Mifi access point connected to a cellular connection, my phone currently has no way to discover that it is actually using (limited) cellular data.
If the version of Android on your phone is anything like the version of Android on my Nexus 7 tablet, you can manually mark a specific SSID as metered. Try Settings > Data usage > Overflow menu (the three dot colon) > Mobile hotspots.
the os manufacturers need to have a network etiquette setting which disables updating at specific locations
Android makes a distinction between metered and unmetered SSIDs. Go to Settings > Data Usage > Overflow menu > Mobile hotspots. Windows 8 does something similar, but only for Windows Store apps as far as I know.
And their backhaul is 5Mbps, from which they have sold 1.5Mb links to 1500 people....