Performance of JPG horrible after recent security updates?

Hello -

I have a small network, 100MB switched, with 4 nodes. The server is
Win2003EE, clients are XP Pro.

A couple/three week's ago, when browsing a folder of JPG images, performance
was zippy. Now, it takes 30 seconds or more for a single JPG image to come
up (image size averages about 1.4MB). During this time, nothing unusual on
the server in terms of memory, CPU, or disk. And, network utilization stays
under 5%.

The same files shared peer-to-peer between the two XP Pro boxes is extremely
fast (same as before). The same files accessed directly on the Windows 2003
console from it's own directory is extremely fast. It is only when the files
are accessed from XP to 2003, and only recently that this started. I used
Network Monitor to capture packets, and didn't see anything obvious (though I
admittedly am not an expert at reading packet captures).

Did a recent security patch change TCP Window Size parameters or anything
similar to cause this performance degradation?

I have seen other reported problems on the Internet reporting JPG
performance is slow. I believe it has nothing to do with JPG's themselves.
However, the way that XP caches thumbnails and things causes a lot of data
transfer over the network (more than say, streaming same-size MP3 files). My
belief is this is a networking issue, independent of file type. But I could
be wrong.

Thanks in advance,

/John Alexander
john at backbaytech dot com
or via newsgroup. Thanks.

In news:903A6CAD-9CDC-4D88-A018-(E-Mail Removed),
John Alexander <(E-Mail Removed)> stated, which I
commented on below:
> Hello -
>
> I have a small network, 100MB switched, with 4 nodes. The server is
> Win2003EE, clients are XP Pro.
>
> A couple/three week's ago, when browsing a folder of JPG images,
> performance was zippy. Now, it takes 30 seconds or more for a single
> JPG image to come up (image size averages about 1.4MB). During this
> time, nothing unusual on the server in terms of memory, CPU, or disk.
> And, network utilization stays under 5%.
>
> The same files shared peer-to-peer between the two XP Pro boxes is
> extremely fast (same as before). The same files accessed directly on
> the Windows 2003 console from it's own directory is extremely fast.
> It is only when the files are accessed from XP to 2003, and only
> recently that this started. I used Network Monitor to capture
> packets, and didn't see anything obvious (though I admittedly am not
> an expert at reading packet captures).
>
> Did a recent security patch change TCP Window Size parameters or
> anything similar to cause this performance degradation?
>
> I have seen other reported problems on the Internet reporting JPG
> performance is slow. I believe it has nothing to do with JPG's
> themselves. However, the way that XP caches thumbnails and things
> causes a lot of data transfer over the network (more than say,
> streaming same-size MP3 files). My belief is this is a networking
> issue, independent of file type. But I could be wrong.
>
> Thanks in advance,
>
> /John Alexander
> john at backbaytech dot com
> or via newsgroup. Thanks.

Is this happening on all XP machines?
What was recently installed/altered on the server?
Any Event ID errors on either the clients or server?
Bad port or wire?

See if these help:
You experience slow file server performance and delays occur when you work
with files that are located on a file server
http://support.microsoft.com/?kbid=822219&SD=tech

321098 - Slow network performance occurs if you copy files to a Windows 2000
domain controller:
http://support.microsoft.com/default...b;EN-US;321098

321169 - Slow SMB performance when you copy files from Windows XP to a
Windows 2000 domain controller:
http://support.microsoft.com/default...b;EN-US;321169


--
Ace

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

If you are having difficulty in reading or finding responses to your post,
instead of the website you are using, if I may suggest to use OEx (Outlook
Express or any other newsreader of your choosing), and configure a newsgroup
account, pointing to news.microsoft.com. This is a direct link into the
Microsoft Public Newsgroups, and it is FREE and DOES NOT require a Usenet
account with your ISP. With OEx, you can easily find your post, track
threads, cross-post, and sort by date, poster's name, watched threads or
subject.

Not sure how? It's easy:
How to Configure OEx for Internet News
http://support.microsoft.com/?id=171164

Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT, MVP
Microsoft MVP - Windows Server Directory Services
Microsoft Certified Trainer
Assimilation Imminent. Resistance is Futile.
Infinite Diversities in Infinite Combinations.
=================================

Thanks for your reply. Replies inline:

"Ace Fekay [MVP]" wrote:

> Is this happening on all XP machines?
Yes - all 3 XP machines experiencing the same symptoms.

> What was recently installed/altered on the server?
Other than the standard security packs, not much. The only other thing is I
did install an additional physical hard disk drive in the server. But, I
don't believe that is related. I did check PIO mode on all devices, and all
are Ultra DMA Mode 5 (except the newest drive which is Mode 6). Copying the
files to a new share on the new drive and sharing it exhibited the same
symptoms on the clients.

> Any Event ID errors on either the clients or server?
Nothing unusual.

> Bad port or wire?
I tried moving to a different hub, and had the same symptoms. This was
working fine 3 weeks ago. I have not (yet) swapped out cables, but can try
that. Would I see any particular errors in my network monitor trace?

>
> See if these help:
> You experience slow file server performance and delays occur when you work
> with files that are located on a file server
> http://support.microsoft.com/?kbid=822219&SD=tech

Saw that -- I don't run any of the software mentioned. No kernel mode
filters.

>
> 321098 - Slow network performance occurs if you copy files to a Windows 2000
> domain controller:
> http://support.microsoft.com/default...b;EN-US;321098

Not running 2000 -- running 2003.

>
> 321169 - Slow SMB performance when you copy files from Windows XP to a
> Windows 2000 domain controller:
> http://support.microsoft.com/default...b;EN-US;321169

Not running 2000 -- running 2003.

I'm quite baffled. It doesn't help that with the holidays and all, I've got
no time to troubleshoot :-S. Will try swapping cables and some more thorough
checks of hub/port combinations if I can later.

I also noticed that the NIC driver is a bit old on the server (10/1/2002,
version 5.396.530.2001 from Microsoft). I wonder if the vendor-provided NIC
driver was replaced with a generic, poor-performing, MS driver during a
recent update? I'll try to update this driver and let you know. The NIC is
a Realtek RTL8139 PCI Fast Ethernet adapter.

Thanks again,

Inline...

In news:72F9CCB3-A9CD-4AB9-B9A1-(E-Mail Removed),
John Alexander <(E-Mail Removed)> stated, which I
commented on below:
>
>> What was recently installed/altered on the server?
> Other than the standard security packs, not much. The only other
> thing is I did install an additional physical hard disk drive in the
> server. But, I don't believe that is related. I did check PIO mode
> on all devices, and all are Ultra DMA Mode 5 (except the newest drive
> which is Mode 6). Copying the files to a new share on the new drive
> and sharing it exhibited the same symptoms on the clients.

I don't think that would be a factor, unless you are getting any hardware
issues. I assume the drive is defragged.

>
>> Any Event ID errors on either the clients or server?
> Nothing unusual.
>
>> Bad port or wire?
> I tried moving to a different hub, and had the same symptoms. This
> was working fine 3 weeks ago. I have not (yet) swapped out cables,
> but can try that. Would I see any particular errors in my network
> monitor trace?

Pings would show up with intermittent time-outs. Traces would show retries.

>
>>
>> See if these help:
>> You experience slow file server performance and delays occur when
>> you work with files that are located on a file server
>> http://support.microsoft.com/?kbid=822219&SD=tech
>
> Saw that -- I don't run any of the software mentioned. No kernel mode
> filters.
>
>>
>> 321098 - Slow network performance occurs if you copy files to a
>> Windows 2000 domain controller:
>> http://support.microsoft.com/default...b;EN-US;321098
>
> Not running 2000 -- running 2003.

The article applies to 2003 as well. Check it out.

>
>>
>> 321169 - Slow SMB performance when you copy files from Windows XP to
>> a Windows 2000 domain controller:
>> http://support.microsoft.com/default...b;EN-US;321169
>
> Not running 2000 -- running 2003.

Same as above, applies to 2003 as well. Signed packets can slow it down
enough to notice a difference, especially with 2003. Disable SMB signing and
see if it helps.


>
> I'm quite baffled. It doesn't help that with the holidays and all,
> I've got no time to troubleshoot :-S. Will try swapping cables and
> some more thorough checks of hub/port combinations if I can later.
>
> I also noticed that the NIC driver is a bit old on the server
> (10/1/2002, version 5.396.530.2001 from Microsoft). I wonder if the
> vendor-provided NIC driver was replaced with a generic,
> poor-performing, MS driver during a recent update? I'll try to
> update this driver and let you know. The NIC is a Realtek RTL8139
> PCI Fast Ethernet adapter.

That can be a factor too. Try putting the original driver in. You can use
roll-back.

>
> Thanks again,

No prob. Between either SMB signing and/or the NIC driver, I think we're
getting closer. Don't rule out the wire either.

Ace

> Don't rule out the wire either.
>
> Ace

Doh!!

Why a Cat5 cable would decide to go bad after several years of service is
beyond me, but that was the ticket. I thought only things with moving parts
were likely to degrade and break over time? I guess moving electrons count?

Now that I've updated drivers, disabled SMB signing, and disabled
opportunistic locks, I'm not sure if I should return these things back to the
way they were or not. But, swapping out the cable seemed to do the trick.
Odd, since I wasn't getting any retries or timeouts on ping or traceroute --
so I would not have suspected a bad cable. Process of elimination, though,
and that finally did it.

Ace, thanks so much. I've been in this business for far too long. I'm
reminded of a similar troubleshooting exercise about 10 year's ago. Long
story short, the problem was a very basic one and I had completely overlooked
it. When a good friend started leading my down a very methodical path of
troubleshooting, at first I resisted thinking "I know what I'm doing...", but
I humored him, and the problem was discovered and solved very quickly. This
exercise was very similar. At first I ruled out your suggestion of the
cable, thinking, "I know what I'm doing..." But, you were spot on, and your
messages are very much appreciated.

Thanks a million.

In news:A19E87AC-9E25-4638-ABF8-(E-Mail Removed),
John Alexander <(E-Mail Removed)> stated, which I
commented on below:
>> Don't rule out the wire either.
>>
>> Ace
>
> Doh!!
>
> Why a Cat5 cable would decide to go bad after several years of
> service is beyond me, but that was the ticket. I thought only things
> with moving parts were likely to degrade and break over time? I
> guess moving electrons count?
>
> Now that I've updated drivers, disabled SMB signing, and disabled
> opportunistic locks, I'm not sure if I should return these things
> back to the way they were or not. But, swapping out the cable seemed
> to do the trick. Odd, since I wasn't getting any retries or timeouts
> on ping or traceroute -- so I would not have suspected a bad cable.
> Process of elimination, though, and that finally did it.
>
> Ace, thanks so much. I've been in this business for far too long.
> I'm reminded of a similar troubleshooting exercise about 10 year's
> ago. Long story short, the problem was a very basic one and I had
> completely overlooked it. When a good friend started leading my down
> a very methodical path of troubleshooting, at first I resisted
> thinking "I know what I'm doing...", but I humored him, and the
> problem was discovered and solved very quickly. This exercise was
> very similar. At first I ruled out your suggestion of the cable,
> thinking, "I know what I'm doing..." But, you were spot on, and your
> messages are very much appreciated.
>
> Thanks a million.

Only trying to be humble, but I've seen this over and over again in the
past. I remember one guy in the first training center I worked at as a
trainer explain to me how NT4's DFS service had much to be desired because
it doesn't work correctly. I had it running in an evironment before that so
I couldn't figure out what he was talking about. After playing around with
it for two weeks, I finally thought let me just change the stupid wire, and
lo and behold the sucker started working perfectly!! That was 10 years ago,
and I've never forgotten it.

Glad I was helpful to figure it out. As for the settings, that is up to you
at this point. The SMB signing only increases security and since it wasn't a
problem prior to this, I would actually set it back, it;s only a policy
setting!

Good luck John!!!

Ace