Extra traffic on a UNC-share

There’s such a problem : we have a Win32-application that should be launched from remote share resource (for instance, from locally mapped G: \\SERVER\SHARE) (BTW, doesn’t matter whether is it mapped or not – problem is the same)

In all possible (but the one described lower) environments, this application requires approx. 15 M of incoming local traffic to get loaded (measured through “netstat –e” before and after the launch)

But in the problem environment (client PC’s are Win2000-based, SERVER (where share resides) also)
It takes nearly 40 M to get loaded !!! And all the meg’s are get by “microsoft-ds” (445/TCP) and by this exact application (tested with “windump” and “filemon” tools)

If the share is on the other Win2K server – the problem is the same ! If the client is XP based – the problem is GONE ! (15M again)

It’s evidently issue of Win2000 and most possible – on client side [only].

Filemon logs give some info for analysis – along with the necessary 15M traffic, the problem sessions for some reason GET nearly TWICE th body of application from direct share (UNC) path, instead of using G: (like \\SERVER\SHARE\APPLIC.EXE)

If anyone has some ideas, how to handle this, I’d be quite appreciate to see those ideas !

Thanx !
LVL 1
62mkvAsked:
Who is Participating?
 
Leandro IaconoSenior Premier Field EngineerCommented:
Wow,

This is way too much for my few years of experience mate.
I do know Microsoft Windows XP has alot of major improvments concerning this type of situations so its logical that Windows XP would take less memory too boot up an application...

Regreatfully I don't have the knowledge or specific vocabulary to explain how this happens...

I heard it froma few profesors of mine, and all I know is that Windows XP is better than Windows 2000 ....

Maybe you should re post this up in the "programing" section of EE and ask them for a specific explanation ...

Well, Sorry I couldn't really fix you trouble mate.

Good luck!

UICE

BTW, be sure to post up any news on this matter....
0
 
Nirmal SharmaSolution ArchitectCommented:
Does this application use FQDN or NetBIOS names?
Does the problem presists only on Windows XP clients or Windows 2000?
Tell your network strcuture with hub and domain controllers setup.

Let me know.

Thanks, SP
0
 
62mkvAuthor Commented:
1. Application itself uses (as far as I understand) just "started-from" path, and grabs DLL's from that, I mean, its transparent for the Application itself... so I can't determine whether it's about FQDN's or NetBIOS, but most likely the latter -
see for example part of FileMon logs:
430      12:43:48      garant.exe:3952      FASTIO_QUERY_OPEN      \Belan\g6\apps\F1Shell.exe      FAILURE            
431      12:43:48      garant.exe:3952      IRP_MJ_CREATE      \Belan\g6\apps\F1Shell.exe      SUCCESS      Attributes: Any Options: Open       
432      12:43:48      garant.exe:3952      FASTIO_QUERY_BASIC_INFO      \Belan\g6\apps\F1Shell.exe      FAILURE            

(or I missed the point of question?)
ps1: I'm NOT a developer of this Application, and I have NO source code for it, I can only guess on its behaviour

2. As I stated above, the problem persists ONLY on Win2K clients and ONLY (as far as I know) in that organisation.
3. AS for the network structure I can't guess on it, but it's merely flat fomain structure withe single DC, and some Ethernet switches.
No routers, anything alike, all the PC's are in the same subnet
0
Keep up with what's happening at Experts Exchange!

Sign up to receive Decoded, a new monthly digest with product updates, feature release info, continuing education opportunities, and more.

 
Nirmal SharmaSolution ArchitectCommented:
I really can't find anything on query performed by application for name. I can understand you are not developer of this application. So to be more clear i want to know something.....Windows XP clients are trying to access an application at file server and then application path on server is \\SERVER\SHARE\application.exe. When they access application it takes atleast 40 minutes to load. Right? So what is the EXE size and memory on XP client machine? check the performance through Task Manager..

Let me know.
0
 
62mkvAuthor Commented:
a.... sorry for (unintentendedly) misinforming you.. "M" in my message is not a minute - it's megabyte ! (maybe I should mark it as "Mb")

Size of an application (EXE file) itself is about 8 Mb.

Here is a typical resumee of a filemon log spying an application launching on a WinXP (NORMAL) machine:

Amount of file Z:\APPS\F1SHELL.EXE = 102412
Amount of file Z:\apps\winNT\GblAdapter.dll = 5611520
Amount of file Z:\garant.ini = 51238
Amount of file Z:\apps\F1Shell.exe = 8150528
Amount of file Z:\apps\winnt\gbladapter.dll = 12288
Amount of file Z:\garant.exe = 1652736
Amount of file Z:\apps\f1shell.exe = 12288
Total amount: 15593010 bytes

And here is the same for a PROBLEM (Win2K clients in THAT ONLY organisation):

Amount of file Z:\apps\winNT\GblAdapter.dll = 8957952
Amount of file Z:\garant.ini = 55334
Amount of file \Belan\g6\apps\F1Shell.exe = 29442048
Amount of file Z:\apps\F1Shell.exe = 5655552
Amount of file Z:\garant.exe = 1661040
Total amount: 45771926 bytes

"Amount" is the sum of "IRP_MJ_READ" queries done by app main file, (you know FILEMON, I suppose ?)

Thanx again !
0
 
Leandro IaconoSenior Premier Field EngineerCommented:
Does this happen only with this file, or with other files/applications also on the w2k machines?
0
 
62mkvAuthor Commented:
Had no chance to test other applications..

Bypassed this problem by switching ON the "Automatic caching for documents" on a SERVER for SHARE, now clients are taking this app from local cache and experience NO slowdown on launching application...

so what should I do now ? The question itself is still VERY interesting for me...
What kind of test-app should I build, to get more understanding of the problem ?
0
 
Leandro IaconoSenior Premier Field EngineerCommented:
I would say this would be pretty hard to test or at least to give advice on what app to test it out with.

I really can't think of anything.

I assume that when you transfer a normal file, such as a .zip this type of thing doesn't happen.

If it only happens with remote execution of this file, then there has to be something else the w2k clients are requesting to be able to run the program succesfully.

Can't you call in the programer of this application to see what the program needs to be able to run. Maybe it's pulling it off of the server also. Some additional part of the application the clients are missing.

I have never really encountered such a problem, so as you might notice with the suggestions I am giving you I really do not know what to do in your case.

I would recomend getting in touch with the application developer in your case, and see what he has to say about it.

A debug perhaps?
0
 
62mkvAuthor Commented:
Yeah thanks..

In our case the developers are about 5000 miles away ... I tried to discuss all the above mentioned,  with them, but they also have no idea..

As for me, I think there's some kernel integrated pseudo-device driver (like antiviral software), which thoroughly examines launched applications, thus inspiring a huge traffic...

Pity that I didn't test the issue of running the same application locally and measuring requests by Filemon..
0
 
Leandro IaconoSenior Premier Field EngineerCommented:
Sorry to hear you couldn't get things sorted out.

Perhaps you could set up 2 clean win2k pcs outside the domain/workgroup and test out the application.

That would give a good indication if its something related explicitly to win2k kernel ... or to something else which we can't identify.

How about capturing packets and analyzing the packets? maybe send the packet log to the developer via email and ask for their opnion?

Or post up the log here for someone opinion. Some other expert with more experience than me ...

Ohh well mate, sorry I couldn't get things sorted for ya.

Cheers
0
 
62mkvAuthor Commented:
As for the Win2K, in all other possible configurations (we have thousands of clients) where Win2K is installed on client-sides, everything works fine..

So it's not kernel-issue, (except maybe some (KBxxxxx) update gives such an effect)..

As for the packet log - I know only of Windump (it dumps only the headers), and of Network Monitor, but it's builtin only on W2K Server, and I exactly won't have access to server-side

I mean I need some tool to perform such Packet-Capture on Win2K Pro clients, reliable and freeware or shareware.. If anyone knows may be I'll do that analysis and together we shall add some new knowledge to our experts !
0
 
Leandro IaconoSenior Premier Field EngineerCommented:
I am aware that depending on the windows 2000 version the level of network capture Network Monitor allows.

Simple version is shipped with w2k Server.
Full version, which is the version you need in this case ships with W2k SMS
http://img.cmpnet.com/nc/906/graphics/simple.gif

"The Network Monitor component that ships with Microsoft® Windows Server 2003 family operating systems can capture frames that are sent to or from the computer on which Network Monitor is installed. If you want to capture frames that are sent to or from a remote computer, you must use the Network Monitor component that ships with Microsoft Systems Management Server, which can capture frames sent to or from any computer on which the Network Monitor driver is installed. For more information on Systems Management Server, go to the Microsoft Web site. "

In your case if you would want to use network monitor:

Install and Configure Network Monitor:
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/ServerHelp/2f29d398-4021-4da1-aae5-b05fd7770a63.mspx

What Network Monitor Captures (How Netowork Monitor Works):
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/ServerHelp/e927e4aa-76c1-479f-af4c-5f849892eaa9.mspx

You could also use netmon from command prompt. The above links are to install the application on the server and monitor from the server. Unless you have w2k SMS than you won't be able to capture ...

But you might probably be able to copy netmon.exe and install the Network Monitor driver on the pro client and run netmon.exe from there ...

Managing Network Monitor from the command line:
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/ServerHelp/aa5fd9d7-c5a1-4626-9d20-7bb6add92a66.mspx

Also worth looking at even though you don't have the problems with Windows XP. You could maybe run the same program on W2K:

Network Monitor Capture Utility:
http://www.microsoft.com/resources/documentation/Windows/XP/all/reskit/en-us/prmb_tol_szuy.asp?frame=true

How to Capture Network Traffic with Network Monitor:
http://support.microsoft.com/kb/148942/en-us


Network Monitor Full info....

Network Monitor (technet):
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/ServerHelp/ad2b59d1-0fb8-45e3-9055-a5aeba8817a9.mspx

You then also have many program that I personally have never used .. but:

Accurate Network Monitor 1.31
http://www.programmersheaven.com/zone16/cat1073/38644.htm

Network monitoring tools:
http://www.netmon.org/tools.htm

I guess a simple search on the internet could popup many "sniffers" which is what you need.

Good luck mate.
0
 
Leandro IaconoSenior Premier Field EngineerCommented:
I really don't know if the ...

"But you might probably be able to copy netmon.exe and install the Network Monitor driver on the pro client and run netmon.exe from there ..."

... will work out though ... :*(

Quote:

"Windows 2000 Server includes a version of Network Monitor that allows you to capture traffic coming to or going from the local computer. This version of Netmon is not available with Windows 2000 Professional."
http://www.microsoft.com/resources/documentation/Windows/2000/server/reskit/en-us/prork/prch_cnn_wkrp.asp?frame=true

But its still a ".exe" you could give it a try. You could also maybe use the one shiped with XP Pro on the w2k clients ...
0
 
62mkvAuthor Commented:
Thanks for really detailed list..
About netcap.exe - I couldn't locate one on WinXP Pro. and on the URL you provided, there's no way to get it. May be someone can help it ?

Where to get this tool ?
0
 
Leandro IaconoSenior Premier Field EngineerCommented:
Download here:

Windows XP Service Pack 2 Support Tools:
Netcap.exe is included inside the pack. But once again, I cannot garantee that it will work on win2k ...
http://www.microsoft.com/downloads/details.aspx?FamilyID=49ae8576-9bb9-4126-9761-ba8011fabf38&displaylang=en

"System Requirements for Windows XP Service Pack 2 Support Tools:
Supported Operating Systems: Windows XP
5 MB of free disk space
Windows XP Service Pack 2 "

Heres more info on netcap:

NetCap Syntax:
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/TechRef/b7131e53-9312-42e1-ba0b-79a9cfa23efb.mspx

Netcap Examples:
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/TechRef/9e5943e4-8f6e-4b06-bfed-c16dbf89c676.mspx

Browsing the web maybe this utility could help you out instead of netcap.exe - I would still try out netcap.exe though, just in case ...

WinPcap: the Free Packet Capture Library for Windows:
http://winpcap.polito.it/
http://www.mirrors.wiretapped.net/security/packet-capture/winpcap/

Cheers, and good luck mate ...
0
 
Leandro IaconoSenior Premier Field EngineerCommented:
Ok, I tested everything out. You cannot install Windows XP Support tools on Windows 2000, but I did manage to extract netcap.exe and netdiag.exe from the pack ...

I added them to a zip file and hosted it up on http://yousendit.com

http://s23.yousendit.com/d.aspx?id=0UF5I8GZSMXDW1P94F4E2T9560

I tested the netcap.exe on windows 2000 and it works great. It installs the network adapter driver and then asks you for the syntax ...

I hope this can help you out mate...

Cheers.

UICE
0
 
62mkvAuthor Commented:
Thanx a lot ! I've dnld the tools ..

I'll try it out !
0
 
62mkvAuthor Commented:
I've run netcap.exe on my XP machine, it generates some .cap files

Is it possible to view these files somehow (I mean not as a plain file, but as a queue of packets) ?

I guess, Win2k server's Network Monitor would help, but I have no option to install it for now..

If anyone knows.. it'd be cool
0
 
62mkvAuthor Commented:
Well, seems that our problems are MORE than I thought...

Looks like that it's not a network issue.. Even started locally, this application grabs 2,5 times more traffic on Win2K machines in THAT organisation than on my WinXP (and other normal situations)

Here are the resumee of FILEMON log file on that application launch :
1) on My WinXp machine:
Amount of file C:\WUTEMP\ima54.tmp = 455680
Amount of file C:\Kir_docs\!BAD\g6\apps\F1Shell.exe = 5790768
Amount of file C:\WUTEMP\ima51.tmp = 118016
Amount of file C:\$Mft = 16384
Amount of file C:\WINDOWS\System32\shell32.dll = 48
Amount of file C:\WINDOWS\system32\shell32.dll = 48
Amount of file C:\Kir_docs\!BAD\g6\garant.ini = 6335
Amount of file C:\WUTEMP\ima4F.tmp = 118016
Amount of file C:\WUTEMP\ima52.tmp = 455680
Amount of file C:\WUTEMP\ima53.tmp = 455680
Amount of file C:\Kir_docs\!BAD\g6\apps\winNT\GblAdapter.dll = 5611520
Amount of file C:\WUTEMP\ima50.tmp = 118016
Total amount: 13146191 bytes

2) on PROBLEM Win2k machine:
Amount of file C:\g6\apps\F1Shell.exe = 29622272
Amount of file C:\DOCUME~1\Belan\LOCALS~1\Temp\ima9C.tmp = 455680
Amount of file C:\$Bitmap = 4096
Amount of file C:\DOCUME~1\Belan\LOCALS~1\Temp\ima9D.tmp = 455680
Amount of file C:\DOCUME~1\Belan\LOCALS~1\Temp\ima9A.tmp = 118016
Amount of file C:\g6\garant.ini = 12222
Amount of file C:\DOCUME~1\Belan\LOCALS~1\Temp\ima9E.tmp = 455680
Amount of file C:\DOCUME~1\Belan\LOCALS~1\Temp\ima9B.tmp = 118016
Amount of file C:\WINNT\System32\shell32.dll = 12
Amount of file C:\WINNT\system32\shell32.dll = 12
Amount of file C:\DOCUME~1\Belan\LOCALS~1\Temp\ima99.tmp = 118016
Total amount: 31359702 bytes

The problem is in the amount of application main file, apps\F1Shell.exe, opened by application on launch - on normal machines 5 Megs and on problem - 30 Megs !

How to handle this ??
0
 
Leandro IaconoSenior Premier Field EngineerCommented:
"Netcap provides capture abilities only from a command prompt; to open the resulting capture (.cap) files, you must use the full Network Monitor interface."

http://support.microsoft.com/kb/310875/en-us

As for the problem about the application, I am afraid I can't think of any way to troubleshoot this type of error ... You would have to contact the application manafactuer, or perhaps re-post this issue for further troubleshooting amongst other fellow Experts ...

I fear that other than suggesting to install latest updates, maybe .NET Framework pack also (which is the only thing I can think of) I cannopt suggest anything else.

Why Windows 2000 would require more of the application to open unlike Windows XP is, honestly, a mistery to me ...

WinXp machine:
Amount of file C:\WUTEMP\ima4F.tmp = 118016
Amount of file C:\WUTEMP\ima50.tmp = 118016
Amount of file C:\WUTEMP\ima51.tmp = 118016
Amount of file C:\WUTEMP\ima52.tmp = 455680
Amount of file C:\WUTEMP\ima53.tmp = 455680
Amount of file C:\WUTEMP\ima54.tmp = 455680
Amount of file C:\WINDOWS\System32\shell32.dll = 48
Amount of file C:\WINDOWS\system32\shell32.dll = 48
Amount of file C:\Kir_docs\!BAD\g6\garant.ini = 6335
Amount of file C:\Kir_docs\!BAD\g6\apps\F1Shell.exe = 5790768
Amount of file C:\Kir_docs\!BAD\g6\apps\winNT\GblAdapter.dll = 5611520
Amount of file C:\$Mft = 16384

Win2k machine:
Amount of file C:\DOCUME~1\Belan\LOCALS~1\Temp\ima9A.tmp = 118016
Amount of file C:\DOCUME~1\Belan\LOCALS~1\Temp\ima9B.tmp = 118016
Amount of file C:\DOCUME~1\Belan\LOCALS~1\Temp\ima99.tmp = 118016
Amount of file C:\DOCUME~1\Belan\LOCALS~1\Temp\ima9C.tmp = 455680
Amount of file C:\DOCUME~1\Belan\LOCALS~1\Temp\ima9D.tmp = 455680
Amount of file C:\DOCUME~1\Belan\LOCALS~1\Temp\ima9E.tmp = 455680
Amount of file C:\WINNT\System32\shell32.dll = 12
Amount of file C:\WINNT\system32\shell32.dll = 12
Amount of file C:\g6\garant.ini = 12222
Amount of file C:\g6\apps\F1Shell.exe = 29622272
Amount of file C:\$Bitmap = 4096

If I would have to guess, maybe it has something to do with GblAdapter.dll
0
 
62mkvAuthor Commented:
Thanks for the advices !
I've discussed this issue with the application developers, they say that "They cannot effect the way that windows caches application parts"

So the answer could be in details of application launch and caching mechanisms, but I cannot imagine where to read about this...
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.