?
Solved

Extra traffic on a UNC-share

Posted on 2005-04-13
21
Medium Priority
?
954 Views
Last Modified: 2012-08-14
There’s such a problem : we have a Win32-application that should be launched from remote share resource (for instance, from locally mapped G: \\SERVER\SHARE) (BTW, doesn’t matter whether is it mapped or not – problem is the same)

In all possible (but the one described lower) environments, this application requires approx. 15 M of incoming local traffic to get loaded (measured through “netstat –e” before and after the launch)

But in the problem environment (client PC’s are Win2000-based, SERVER (where share resides) also)
It takes nearly 40 M to get loaded !!! And all the meg’s are get by “microsoft-ds” (445/TCP) and by this exact application (tested with “windump” and “filemon” tools)

If the share is on the other Win2K server – the problem is the same ! If the client is XP based – the problem is GONE ! (15M again)

It’s evidently issue of Win2000 and most possible – on client side [only].

Filemon logs give some info for analysis – along with the necessary 15M traffic, the problem sessions for some reason GET nearly TWICE th body of application from direct share (UNC) path, instead of using G: (like \\SERVER\SHARE\APPLIC.EXE)

If anyone has some ideas, how to handle this, I’d be quite appreciate to see those ideas !

Thanx !
0
Comment
Question by:62mkv
  • 10
  • 9
  • 2
21 Comments
 
LVL 35

Expert Comment

by:Nirmal Sharma
ID: 13770620
Does this application use FQDN or NetBIOS names?
Does the problem presists only on Windows XP clients or Windows 2000?
Tell your network strcuture with hub and domain controllers setup.

Let me know.

Thanks, SP
0
 
LVL 1

Author Comment

by:62mkv
ID: 13770962
1. Application itself uses (as far as I understand) just "started-from" path, and grabs DLL's from that, I mean, its transparent for the Application itself... so I can't determine whether it's about FQDN's or NetBIOS, but most likely the latter -
see for example part of FileMon logs:
430      12:43:48      garant.exe:3952      FASTIO_QUERY_OPEN      \Belan\g6\apps\F1Shell.exe      FAILURE            
431      12:43:48      garant.exe:3952      IRP_MJ_CREATE      \Belan\g6\apps\F1Shell.exe      SUCCESS      Attributes: Any Options: Open       
432      12:43:48      garant.exe:3952      FASTIO_QUERY_BASIC_INFO      \Belan\g6\apps\F1Shell.exe      FAILURE            

(or I missed the point of question?)
ps1: I'm NOT a developer of this Application, and I have NO source code for it, I can only guess on its behaviour

2. As I stated above, the problem persists ONLY on Win2K clients and ONLY (as far as I know) in that organisation.
3. AS for the network structure I can't guess on it, but it's merely flat fomain structure withe single DC, and some Ethernet switches.
No routers, anything alike, all the PC's are in the same subnet
0
 
LVL 35

Expert Comment

by:Nirmal Sharma
ID: 13771606
I really can't find anything on query performed by application for name. I can understand you are not developer of this application. So to be more clear i want to know something.....Windows XP clients are trying to access an application at file server and then application path on server is \\SERVER\SHARE\application.exe. When they access application it takes atleast 40 minutes to load. Right? So what is the EXE size and memory on XP client machine? check the performance through Task Manager..

Let me know.
0
Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

 
LVL 1

Author Comment

by:62mkv
ID: 13778459
a.... sorry for (unintentendedly) misinforming you.. "M" in my message is not a minute - it's megabyte ! (maybe I should mark it as "Mb")

Size of an application (EXE file) itself is about 8 Mb.

Here is a typical resumee of a filemon log spying an application launching on a WinXP (NORMAL) machine:

Amount of file Z:\APPS\F1SHELL.EXE = 102412
Amount of file Z:\apps\winNT\GblAdapter.dll = 5611520
Amount of file Z:\garant.ini = 51238
Amount of file Z:\apps\F1Shell.exe = 8150528
Amount of file Z:\apps\winnt\gbladapter.dll = 12288
Amount of file Z:\garant.exe = 1652736
Amount of file Z:\apps\f1shell.exe = 12288
Total amount: 15593010 bytes

And here is the same for a PROBLEM (Win2K clients in THAT ONLY organisation):

Amount of file Z:\apps\winNT\GblAdapter.dll = 8957952
Amount of file Z:\garant.ini = 55334
Amount of file \Belan\g6\apps\F1Shell.exe = 29442048
Amount of file Z:\apps\F1Shell.exe = 5655552
Amount of file Z:\garant.exe = 1661040
Total amount: 45771926 bytes

"Amount" is the sum of "IRP_MJ_READ" queries done by app main file, (you know FILEMON, I suppose ?)

Thanx again !
0
 
LVL 8

Expert Comment

by:Leandro Iacono
ID: 13778507
Does this happen only with this file, or with other files/applications also on the w2k machines?
0
 
LVL 1

Author Comment

by:62mkv
ID: 13789089
Had no chance to test other applications..

Bypassed this problem by switching ON the "Automatic caching for documents" on a SERVER for SHARE, now clients are taking this app from local cache and experience NO slowdown on launching application...

so what should I do now ? The question itself is still VERY interesting for me...
What kind of test-app should I build, to get more understanding of the problem ?
0
 
LVL 8

Expert Comment

by:Leandro Iacono
ID: 13793805
I would say this would be pretty hard to test or at least to give advice on what app to test it out with.

I really can't think of anything.

I assume that when you transfer a normal file, such as a .zip this type of thing doesn't happen.

If it only happens with remote execution of this file, then there has to be something else the w2k clients are requesting to be able to run the program succesfully.

Can't you call in the programer of this application to see what the program needs to be able to run. Maybe it's pulling it off of the server also. Some additional part of the application the clients are missing.

I have never really encountered such a problem, so as you might notice with the suggestions I am giving you I really do not know what to do in your case.

I would recomend getting in touch with the application developer in your case, and see what he has to say about it.

A debug perhaps?
0
 
LVL 1

Author Comment

by:62mkv
ID: 13814110
Yeah thanks..

In our case the developers are about 5000 miles away ... I tried to discuss all the above mentioned,  with them, but they also have no idea..

As for me, I think there's some kernel integrated pseudo-device driver (like antiviral software), which thoroughly examines launched applications, thus inspiring a huge traffic...

Pity that I didn't test the issue of running the same application locally and measuring requests by Filemon..
0
 
LVL 8

Expert Comment

by:Leandro Iacono
ID: 13820334
Sorry to hear you couldn't get things sorted out.

Perhaps you could set up 2 clean win2k pcs outside the domain/workgroup and test out the application.

That would give a good indication if its something related explicitly to win2k kernel ... or to something else which we can't identify.

How about capturing packets and analyzing the packets? maybe send the packet log to the developer via email and ask for their opnion?

Or post up the log here for someone opinion. Some other expert with more experience than me ...

Ohh well mate, sorry I couldn't get things sorted for ya.

Cheers
0
 
LVL 1

Author Comment

by:62mkv
ID: 13821532
As for the Win2K, in all other possible configurations (we have thousands of clients) where Win2K is installed on client-sides, everything works fine..

So it's not kernel-issue, (except maybe some (KBxxxxx) update gives such an effect)..

As for the packet log - I know only of Windump (it dumps only the headers), and of Network Monitor, but it's builtin only on W2K Server, and I exactly won't have access to server-side

I mean I need some tool to perform such Packet-Capture on Win2K Pro clients, reliable and freeware or shareware.. If anyone knows may be I'll do that analysis and together we shall add some new knowledge to our experts !
0
 
LVL 8

Expert Comment

by:Leandro Iacono
ID: 13828805
I am aware that depending on the windows 2000 version the level of network capture Network Monitor allows.

Simple version is shipped with w2k Server.
Full version, which is the version you need in this case ships with W2k SMS
http://img.cmpnet.com/nc/906/graphics/simple.gif

"The Network Monitor component that ships with Microsoft® Windows Server 2003 family operating systems can capture frames that are sent to or from the computer on which Network Monitor is installed. If you want to capture frames that are sent to or from a remote computer, you must use the Network Monitor component that ships with Microsoft Systems Management Server, which can capture frames sent to or from any computer on which the Network Monitor driver is installed. For more information on Systems Management Server, go to the Microsoft Web site. "

In your case if you would want to use network monitor:

Install and Configure Network Monitor:
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/ServerHelp/2f29d398-4021-4da1-aae5-b05fd7770a63.mspx

What Network Monitor Captures (How Netowork Monitor Works):
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/ServerHelp/e927e4aa-76c1-479f-af4c-5f849892eaa9.mspx

You could also use netmon from command prompt. The above links are to install the application on the server and monitor from the server. Unless you have w2k SMS than you won't be able to capture ...

But you might probably be able to copy netmon.exe and install the Network Monitor driver on the pro client and run netmon.exe from there ...

Managing Network Monitor from the command line:
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/ServerHelp/aa5fd9d7-c5a1-4626-9d20-7bb6add92a66.mspx

Also worth looking at even though you don't have the problems with Windows XP. You could maybe run the same program on W2K:

Network Monitor Capture Utility:
http://www.microsoft.com/resources/documentation/Windows/XP/all/reskit/en-us/prmb_tol_szuy.asp?frame=true

How to Capture Network Traffic with Network Monitor:
http://support.microsoft.com/kb/148942/en-us


Network Monitor Full info....

Network Monitor (technet):
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/ServerHelp/ad2b59d1-0fb8-45e3-9055-a5aeba8817a9.mspx

You then also have many program that I personally have never used .. but:

Accurate Network Monitor 1.31
http://www.programmersheaven.com/zone16/cat1073/38644.htm

Network monitoring tools:
http://www.netmon.org/tools.htm

I guess a simple search on the internet could popup many "sniffers" which is what you need.

Good luck mate.
0
 
LVL 8

Expert Comment

by:Leandro Iacono
ID: 13828835
I really don't know if the ...

"But you might probably be able to copy netmon.exe and install the Network Monitor driver on the pro client and run netmon.exe from there ..."

... will work out though ... :*(

Quote:

"Windows 2000 Server includes a version of Network Monitor that allows you to capture traffic coming to or going from the local computer. This version of Netmon is not available with Windows 2000 Professional."
http://www.microsoft.com/resources/documentation/Windows/2000/server/reskit/en-us/prork/prch_cnn_wkrp.asp?frame=true

But its still a ".exe" you could give it a try. You could also maybe use the one shiped with XP Pro on the w2k clients ...
0
 
LVL 1

Author Comment

by:62mkv
ID: 13840857
Thanks for really detailed list..
About netcap.exe - I couldn't locate one on WinXP Pro. and on the URL you provided, there's no way to get it. May be someone can help it ?

Where to get this tool ?
0
 
LVL 8

Expert Comment

by:Leandro Iacono
ID: 13847280
Download here:

Windows XP Service Pack 2 Support Tools:
Netcap.exe is included inside the pack. But once again, I cannot garantee that it will work on win2k ...
http://www.microsoft.com/downloads/details.aspx?FamilyID=49ae8576-9bb9-4126-9761-ba8011fabf38&displaylang=en

"System Requirements for Windows XP Service Pack 2 Support Tools:
Supported Operating Systems: Windows XP
5 MB of free disk space
Windows XP Service Pack 2 "

Heres more info on netcap:

NetCap Syntax:
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/TechRef/b7131e53-9312-42e1-ba0b-79a9cfa23efb.mspx

Netcap Examples:
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/TechRef/9e5943e4-8f6e-4b06-bfed-c16dbf89c676.mspx

Browsing the web maybe this utility could help you out instead of netcap.exe - I would still try out netcap.exe though, just in case ...

WinPcap: the Free Packet Capture Library for Windows:
http://winpcap.polito.it/
http://www.mirrors.wiretapped.net/security/packet-capture/winpcap/

Cheers, and good luck mate ...
0
 
LVL 8

Expert Comment

by:Leandro Iacono
ID: 13847307
Ok, I tested everything out. You cannot install Windows XP Support tools on Windows 2000, but I did manage to extract netcap.exe and netdiag.exe from the pack ...

I added them to a zip file and hosted it up on http://yousendit.com

http://s23.yousendit.com/d.aspx?id=0UF5I8GZSMXDW1P94F4E2T9560

I tested the netcap.exe on windows 2000 and it works great. It installs the network adapter driver and then asks you for the syntax ...

I hope this can help you out mate...

Cheers.

UICE
0
 
LVL 1

Author Comment

by:62mkv
ID: 13856886
Thanx a lot ! I've dnld the tools ..

I'll try it out !
0
 
LVL 1

Author Comment

by:62mkv
ID: 13857049
I've run netcap.exe on my XP machine, it generates some .cap files

Is it possible to view these files somehow (I mean not as a plain file, but as a queue of packets) ?

I guess, Win2k server's Network Monitor would help, but I have no option to install it for now..

If anyone knows.. it'd be cool
0
 
LVL 1

Author Comment

by:62mkv
ID: 13857251
Well, seems that our problems are MORE than I thought...

Looks like that it's not a network issue.. Even started locally, this application grabs 2,5 times more traffic on Win2K machines in THAT organisation than on my WinXP (and other normal situations)

Here are the resumee of FILEMON log file on that application launch :
1) on My WinXp machine:
Amount of file C:\WUTEMP\ima54.tmp = 455680
Amount of file C:\Kir_docs\!BAD\g6\apps\F1Shell.exe = 5790768
Amount of file C:\WUTEMP\ima51.tmp = 118016
Amount of file C:\$Mft = 16384
Amount of file C:\WINDOWS\System32\shell32.dll = 48
Amount of file C:\WINDOWS\system32\shell32.dll = 48
Amount of file C:\Kir_docs\!BAD\g6\garant.ini = 6335
Amount of file C:\WUTEMP\ima4F.tmp = 118016
Amount of file C:\WUTEMP\ima52.tmp = 455680
Amount of file C:\WUTEMP\ima53.tmp = 455680
Amount of file C:\Kir_docs\!BAD\g6\apps\winNT\GblAdapter.dll = 5611520
Amount of file C:\WUTEMP\ima50.tmp = 118016
Total amount: 13146191 bytes

2) on PROBLEM Win2k machine:
Amount of file C:\g6\apps\F1Shell.exe = 29622272
Amount of file C:\DOCUME~1\Belan\LOCALS~1\Temp\ima9C.tmp = 455680
Amount of file C:\$Bitmap = 4096
Amount of file C:\DOCUME~1\Belan\LOCALS~1\Temp\ima9D.tmp = 455680
Amount of file C:\DOCUME~1\Belan\LOCALS~1\Temp\ima9A.tmp = 118016
Amount of file C:\g6\garant.ini = 12222
Amount of file C:\DOCUME~1\Belan\LOCALS~1\Temp\ima9E.tmp = 455680
Amount of file C:\DOCUME~1\Belan\LOCALS~1\Temp\ima9B.tmp = 118016
Amount of file C:\WINNT\System32\shell32.dll = 12
Amount of file C:\WINNT\system32\shell32.dll = 12
Amount of file C:\DOCUME~1\Belan\LOCALS~1\Temp\ima99.tmp = 118016
Total amount: 31359702 bytes

The problem is in the amount of application main file, apps\F1Shell.exe, opened by application on launch - on normal machines 5 Megs and on problem - 30 Megs !

How to handle this ??
0
 
LVL 8

Expert Comment

by:Leandro Iacono
ID: 13872287
"Netcap provides capture abilities only from a command prompt; to open the resulting capture (.cap) files, you must use the full Network Monitor interface."

http://support.microsoft.com/kb/310875/en-us

As for the problem about the application, I am afraid I can't think of any way to troubleshoot this type of error ... You would have to contact the application manafactuer, or perhaps re-post this issue for further troubleshooting amongst other fellow Experts ...

I fear that other than suggesting to install latest updates, maybe .NET Framework pack also (which is the only thing I can think of) I cannopt suggest anything else.

Why Windows 2000 would require more of the application to open unlike Windows XP is, honestly, a mistery to me ...

WinXp machine:
Amount of file C:\WUTEMP\ima4F.tmp = 118016
Amount of file C:\WUTEMP\ima50.tmp = 118016
Amount of file C:\WUTEMP\ima51.tmp = 118016
Amount of file C:\WUTEMP\ima52.tmp = 455680
Amount of file C:\WUTEMP\ima53.tmp = 455680
Amount of file C:\WUTEMP\ima54.tmp = 455680
Amount of file C:\WINDOWS\System32\shell32.dll = 48
Amount of file C:\WINDOWS\system32\shell32.dll = 48
Amount of file C:\Kir_docs\!BAD\g6\garant.ini = 6335
Amount of file C:\Kir_docs\!BAD\g6\apps\F1Shell.exe = 5790768
Amount of file C:\Kir_docs\!BAD\g6\apps\winNT\GblAdapter.dll = 5611520
Amount of file C:\$Mft = 16384

Win2k machine:
Amount of file C:\DOCUME~1\Belan\LOCALS~1\Temp\ima9A.tmp = 118016
Amount of file C:\DOCUME~1\Belan\LOCALS~1\Temp\ima9B.tmp = 118016
Amount of file C:\DOCUME~1\Belan\LOCALS~1\Temp\ima99.tmp = 118016
Amount of file C:\DOCUME~1\Belan\LOCALS~1\Temp\ima9C.tmp = 455680
Amount of file C:\DOCUME~1\Belan\LOCALS~1\Temp\ima9D.tmp = 455680
Amount of file C:\DOCUME~1\Belan\LOCALS~1\Temp\ima9E.tmp = 455680
Amount of file C:\WINNT\System32\shell32.dll = 12
Amount of file C:\WINNT\system32\shell32.dll = 12
Amount of file C:\g6\garant.ini = 12222
Amount of file C:\g6\apps\F1Shell.exe = 29622272
Amount of file C:\$Bitmap = 4096

If I would have to guess, maybe it has something to do with GblAdapter.dll
0
 
LVL 1

Author Comment

by:62mkv
ID: 13891612
Thanks for the advices !
I've discussed this issue with the application developers, they say that "They cannot effect the way that windows caches application parts"

So the answer could be in details of application launch and caching mechanisms, but I cannot imagine where to read about this...
0
 
LVL 8

Accepted Solution

by:
Leandro Iacono earned 500 total points
ID: 13898877
Wow,

This is way too much for my few years of experience mate.
I do know Microsoft Windows XP has alot of major improvments concerning this type of situations so its logical that Windows XP would take less memory too boot up an application...

Regreatfully I don't have the knowledge or specific vocabulary to explain how this happens...

I heard it froma few profesors of mine, and all I know is that Windows XP is better than Windows 2000 ....

Maybe you should re post this up in the "programing" section of EE and ask them for a specific explanation ...

Well, Sorry I couldn't really fix you trouble mate.

Good luck!

UICE

BTW, be sure to post up any news on this matter....
0

Featured Post

[Webinar On Demand] Database Backup and Recovery

Does your company store data on premises, off site, in the cloud, or a combination of these? If you answered “yes”, you need a data backup recovery plan that fits each and every platform. Watch now as as Percona teaches us how to build agile data backup recovery plan.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
This article explains how to use the rsync command to create backups and sync data across hosts. Rsync is a very useful command that is often used to copy data, make backups, migrate hosts, and bridge the gap between site staging and production envi…
Look below the covers at a subform control , and the form that is inside it. Explore properties and see how easy it is to aggregate, get statistics, and synchronize results for your data. A Microsoft Access subform is used to show relevant calcul…
With just a little bit of  SQL and VBA, many doors open to cool things like synchronize a list box to display data relevant to other information on a form.  If you have never written code or looked at an SQL statement before, no problem! ...  give i…
Suggested Courses

609 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question