“Simple TCP/IP Services” – Network Utilization

Background

My ISP has been charging us extra since they started metering our Network Usage.

A couple of weeks ago installed Glass-wire & Net Balancer.

Let us see how well they help us identify which hosts and processes are victimizing us.

 

Trouble Shooting

GlassWire

Image

Explanation

  1. Time Span
    • Weekly
      • Graph
        • Application :- Other
          • Download :- 26.4 Mb
          • Upload :- 30.1 GB
        • Microsoft One Drive
          • Download :- 20.7 Mb
          • Upload :- 284 MB
        • IIS Worker Process
          • Download :- 2.3 Mb
          • Upload :- 19 KB

 

Microsoft

Resource Monitor

Images

Image #1

Explanation
  1. Address
    • IP Address :- 71-47-51-11.res.bhn.net
      • 294KB
    • 153-46.vf.cgocable.ca
      • 204KB
    • ns2.teleturbo.net.br
      • 185 KB
    • r75-110-95-142.kntnccmtc01*suddenlink.net
      • 103 KB
    • 128.199.81.122
      • 42 KB
    • 109.95.233.71
      • 21 KB
    • 217-210-7-122-no149.tbcn.telia.com
      • 19 KB
    • ip-176-198-97-236.hsi05.unitymediagroup.de
      • 13 KB
  2. Listening Port
    • TCPSVCS.EXE
      • Port 19

 

Image #2

Explanation
  1. Processes with Network Activity
    • TCPSVCS.EXE
      • Send
        • 1.4 MB/sec
      • Receive
        • 375 Bytes/sec
  2. Listening Port
    • TCPSVCS.EXE
      • Port 7
      • Port 9
      • Port 13

NetBalancer

Image

Explanation

  1. TCPSVCS.EXE
    • Down Rate
      • 30.4 KB/sec
    • Up Rate
      • 767,6 KB/sec
    • Connections
      • 24
    • Downloaded
      • 14.0 MB
    • Uploaded
      • 318.3 MB
    • User
      • SYSTEM

 

Remediation

Microsoft

Services Applet

We will stop and disable the following services:

  1. Simple TCP/IP Services
    • simptcp
    • Supports the following TCP/IP services: Character Generator, Daytime, Discard, Echo, and Quote of Day
    • C:\Windows\System32\tcpsvcs.exe

Image

 

Netbios Over TCP/IP – Yea Or Nay

Background

Had an insomnia night last week.  And, so took to the laptop and wanted to troubleshoot an issue.

As part of that troubleshooting exercise I knew Network Traffic Pattern might be pertinent.

Wireshark

Network Traffic

Here is sample of some of what I noticed through capturing Network Traffic.

Image

 

Explanation

Noticed a lot of Name Resolution Traffic.

Inclusive of protocols that line up with Network Resolution issues are DNS & NBNS.

DNS stands for Domain Name Server and NBNS Stand for Netbios Name Server.

 

Netbios Name Server ( NBNS )

Though running Windows. it is no longer a Netbeui World.

Strictly TCP/IP.

Review Configuration

Let us review our Network Configuration on specific adapters.

As I am currently on wireless, let us focus on just the Wireless Adapter.

GUI

Here is how to do so through the GUI.

Wireless Network Connection 2

Advanced TCP/IP Settings – WINS
Image

 

Explanation

Currently, we are set to receive NetBIOS Settings from the DHCP Server; that appears to be the default MS Windows Setting.

 

Command Line Shell

And, here are a couple of options to do so via the Command Line Shell.

ipconfig

Script

ipconfig /all

Output

Explanation

NetBIOS over Tcpip is Enabled

WMI – Query – Win32_NetworkAdapterConfiguration

Script


set _hostname="."

set _propList="DHCP*,IPAddress,DefaultIPGateway,DNSDomainSuffixSearchOrder,DNSEnabledForWINSResolution,DNSServerSearchOrder,TcpipNetbiosOptions"

set _command="Get-WmiObject -Class Win32_NetworkAdapterConfiguration -Filter IPEnabled=TRUE -ComputerName %_hostname% | Select-Object -Property %_propList% "

powershell -Command %_command% 

Output

Explanation

  1. TcpipNetbiosOptions
    • 0
      • Default Setting; and we remember default settings is to get the setting from the DHCP Server

 

WMI – Set – Win32_NetworkAdapterConfiguration

Let us use wmic and pass along the nicconfig verb; calling the SetTcpipNetbios method and sending along argument 2.

Remember 2 mean Netbeui disabled.

Please pass along the right index, as well.

Each NIC Card has an index and it is displayed when one queries the Network Configuration.

Script

REM - Use NetBIOS setting from the DHCP server
set _netBiosSettingDHCPServer=0

REM - Enable NetBIOS over TCP/IP
set _netbiosSettingEnabled=1    

REM - Disable NetBIOS over TCP/IP
set _netbiosSettingDisabled=2  

set _hostname="."
set _index=15

wmic nicconfig where index=%_index% call SetTcpipNetbios %_netbiosSettingEnabled%

Image

 

Confirmed Change

GUI
Image

Console
Image – ipconfig /all

Wireshark – Take 2

Network Traffic

Went back to Wireshark and took another trace.

Image

Explanation

Noticed a slew of NBNS Traffic targeted at our DNS Server.

BTW, our local DNS Server are set for “Recursion Desired“.

That way they can forward unresolved Name Resolution traffic to our ISP…Which will be most of the requests we get.

 

Remediation

Connected to each of our internal DNS Servers and disabled Netbeui Name Resolution on the NIC Cards, as well.

 

Windows DHCP

If we had a Windows DHCP Server, would have disabled that option on the DHCP Scope, as well.

 

Wireless Access Point ( WAP )

I doubt that our Wireless Access Point supports DHCP and so will skip that step for now.

 

References

  1. Client Configuration
    • Script
      • HOW TO DISABLE NETBIOS VIA COMMAND LINE ON WINDOWS
        Link
      • Configuring NetBIOS over TCP/IP
        Link
    • Tim Dunn
      • Tim Dunn – Is NetBIOS over TCP/IP Enabled?
        Posted On :- 2011-June-29th
        Link
    • Scripting Guy
      • Use PowerShell to Identify Your Real Network Adapter
        Posted On :- 2011-Oct-7th
        Link
    • T.dejesus
      • Simple powershell help
        Posted On :- 2014-April-14th
        Link
    • Dan Stolts, ITProGuru
      • Using PowerShell to Get or Set NetworkAdapterConfiguration-View and Change Network Settings Including DHCP, DNS, IP Address and More (Dynamic AND Static) Step-By-Step
        Link
    • Q/A
      • Slow Cross-Domain login to StoreFront site
        Link
    • Visual
      • Jim Boyce
        • Get IT Done: Improve network performance by disabling NetBIOS over TCP/IP
          Published On : -2002-Nov-5th
          Link
  2. Server Configuration
    • How to disable NetBIOS over TCP/IP by using DHCP server options
      Link

 

NetBalancer – v5.2 – Windows Server 2003

Background

Confessionally, I am stuck on MS Windows 2003 on my Lab computers.

I like it and it works well.

Just like that other guy who stayed on Windows XP.

 

ISP

Paying Me

Either way my ISP is being letting me know that I only have 2 months grace.

And, after this last month, they will be charging me every time I go over my allotted Network.

 

ISP Help

Tried to get them to help me to locate which server, what type of traffic, and which hosts I was talking to.

But, 3rd level support, kept asking me to just go up to next tier.

And, also less I forget, wanted me to get off my router and get on theirs.

 

Tools for Computer Network Monitoring

MS Windows 2008 comes with a nice Resource Monitor tool that allows one to monitor Network Usage at the individual process level.

Again, unfortunately, MS Windows 2003 does not come with Resource Monitor.

 

Networking Monitoring for Windows 2003

Thankfully found NetBalancer by SeriousBit.

 

 

NetBalancer

Download List

Here is the download list for NetBalancer from here.

 

Version

v5.2.1

Unfortunately, for MS Windows 2003, I have to use v5.2.1.

 

Downloaded & Installed

Downloaded & Installed it.

 

Usage

 

DNS

System Traffic

Image

Explanation
  1. Please review Current, Average, Maximum, Total
    • Broken down by Download & Upload
  2. Process Name
    • svchost.exe

 

Process Info

Image

 

Explanation
  1. Name : dns.exe
  2. Version :- 5.2.3790.4957 (srv03_sp2_gdr)
  3. File Creation Time :- 1/30/2012 4:39:57 AM
  4. Company :- Microsoft Corporation
  5. Started at : 4/2/2017 9:00:11 PM
  6. Parent :- services.exe ( 488 )

Connections

Image

Explanation
  1. TCP
    • We are listening on one of the Ports
  2. UDP
    • We have several UDP ports are just waiting to be used

 

TroubleShooting

Stats

Count Number of Ports assigned to DNS

Code

netstat -anb | find /I "dns.exe"  /c


netstat -anb | find /I "dns.exe"  /c

Output

Configuration

How many DNS Ports are we configured for

Code

dnscmd /Info /SocketPoolSize

Output

 

Summary

It does not seem that the DNS Server is the source of our network hog.

Windows Update – Patching SQL Server 2005 Express

Background

This is the second in a series of posts in which I will try to journal some of the steps we took to address a busy hard drive.

In the previous post we spoke about how we configured svchost.exe to run on separate processes and thus we are better positioned to identify which specific services are driving I/O.

Inclusive in the services identified are Windows Management and Windows Updates.

 

Windows Update

Once we saw that Windows Update was one of the main drivers we tried to see which updates was causing the problem.

To launch the Automatic Updates we clicked on the icon on the right bottom panel.

 

Microsoft SQL Server 2005 Express Edition Service Pack 4 ( KB2463322 ) AND Microsoft SQL Server 2005 Express Edition Toolkit Service Pack 4 ( KB2463322 )

Screen Shot

Outline

The screens that we encountered are:

  1. How do you want to install updates
  2. Choose Updates to install
  3. The updates are being installed
  4. Some updates could not be installed

How do you want to install the updates

Image
Initial Screen

HowDoYouWantToInstallUpdates_20170319_0230AM

 

Post Selection Screen

HowDoYouWantToInstallUpdates_20170319_0231AM

Textual

We chose “Custom Install (Advanced )” to gain better insight as to what is being installed are have more control as to which ones we can opt out of.

Choose Updates to install

Image

ChooseUpdatesToInstall_20170318_0232AM

 

Textual

Here are the updates

  1. Microsoft SQL Server 2005 Express Edition Service Pack 4 (KB2463332)
  2. Microsoft SQL Server 2005 Express Edition Toolkit Service Pack 4 (KB2463332)

 

The updates are being installed

Image

TheUpdatesAreBeingInstalled_20170319_0235AM

 

Textual

Here are the first of two updates are being applied

 

The updates are being installed ( Post First Patch )

Image

TheUpdatesAreBeingInstalled_20170319_0237AM

 

Textual

Unfortunately, the first patch failed.

And, the second patch is now being applied.

 

Some updates could not be installed.

Image

SomeUpdatesCouldNotBeInstalled_20170319_0238AM

 

Textual

Here both updates failed.

 

TroubleShooting

The troubleshooting steps available to us are the following:

  1. Check Event Viewer
  2. Check Windows Update log files
    • c:\windows\WindowsUpdate.log

 

c:\windows\WindowsUpdate.log

Here are some sample entries from c:\windows\windowsUpdate.log

Entries – 2017-03-19 3:54

 

Follow Up

Opted Out

Opted out SP4

ScreenShot

Choose updates to install
Image

ChooseUpdatesToInstall

 

Textual

Unchecked both packages.

 

Hide Updates
Image

DontNotofyNeAboutTheseUpdatesAgain

 

Textual

Here we are opting out of this release not just for now, but for always.

 

Summary

A number of years ago all the cool kids wore a tee shirt that read “Got tired of patch Tuesday, went Googling”.

It is not that bad for us, we will just go the manual install path.

svchost – High IO on MS Windows 2003

 

What is svchost.exe?

Wikipedia
Link

svchost.exe (Service Host, or SvcHost) is a system process that hosts multiple Windows services in the Windows NT family of operating systems.
Svchost is essential in the implementation of so-called shared service processes, where a number of services can share a process in order to reduce resource consumption

 

Issue

Hard-drive stays busy.

Indicator

Task Manager

Image

Explanation

  1. Top IO Usage
    • svchost.exe
      • Process ID is 920
      • User name is System

SysInternals

Explanation

  1. Top IO Usage
    • svchost.exe
      • Process ID is 920
      • User name is System

TroubleShooting

Process Management

Tasklist

List all services running under svchost.exe

Tasklist – List all processes running under svchost.exe

Script

tasklist /svc /fi "imagename eq svchost.exe"

Output

Explanation
  1. We are focused on PID = 920

Process Explorer

Tasklist – Dig deeper into process svchost.exe = 920

Services

Own Process

In a nice Server Fault QA post, Peter Mortensen suggested that one could separate out the services into their own process and thus gain clearer understanding of each service resource uptake.

To do one will have to change the service configuration.

Here is the specific QA:

How to find memory usage of individual Windows services?
Link

Run as distinct Process

Syntax

SC Config Servicename Type= own

Run as shared Process

Syntax

SC Config Servicename Type= share;

Run as distinct Process

Sample Code

rem  1. "Automatic Updates"
SC Config wuauserv Type= own

rem  2. "COM+ Event System"
SC Config EventSystem Type= own

rem  3. "Computer Browser"
SC Config Browser Type= own

rem  4. "Cryptographic Services"
SC Config CryptSvc Type= own

rem  5. "Distributed Link Tracking"
SC Config TrkWks Type= own

rem  6. "Help and Support"
SC Config helpsvc Type= own

rem  7. "Logical Disk Manager"
SC Config dmserver Type= own

rem  8. "Network Connections"
SC Config Netman Type= own

rem  9. "Network Location Awareness"
SC Config NLA Type= own

rem 10. "Remote Access Connection Manager"
SC Config RasMan Type= own

rem 11. "Secondary Logon"
SC Config seclogon Type= own

rem 12. "Server"
SC Config lanmanserver Type= own

rem 13. "Shell Hardware Detection"
SC Config ShellHWDetection Type= own

rem 14. "System Event Notification"
SC Config SENS Type= own

rem 15. "System Restore Service"
SC Config srservice Type= own

rem 16. "Task Scheduler"
SC Config Schedule Type= own

rem 17. "Telephony"
SC Config TapiSrv Type= own

rem 18. "Terminal Services"
SC Config TermService Type= own

rem 19. "Themes"
SC Config Themes Type= own

rem 20. "Windows Audio"
SC Config AudioSrv Type= own

rem 21. "Windows Firewall/Internet Connection Sharing (ICS)"
SC Config SharedAccess Type= own

rem 22. "Windows Management Instrumentation"
SC Config winmgmt Type= own

rem 23. "Wireless Configuration"
SC Config WZCSVC Type= own

rem 24. "Workstation"
SC Config lanmanworkstation Type= own

rem End.

 

Remediation

Once we ran the code to start all the aforementioned svchost.exe services in their own process space, restarted the machine.

SysInternals – Process Explorer

Took the SysInternal’s Process Explorer, arranged based on IO, and noticed that WMI is the culprit.

Images

svchost.exe – Services

Here are the services that are using our cited svchost.exe process.

Services

Took to Control Panel, services applet to stop that service and see if it things slow down.

Dependent Services

Reviewed Dependent Services

And, I really will rather than not stop the local system firewall service.  And, start to wonder why so busy anyways.

But, all that will wait another post as it is Saturday and I have errands to run.

Dedicated

Dedicated to Peter as in Mortensen.

 

References

  1. How to find memory usage of individual Windows services?
    Link
  2. How do I discover which process is making my hard drive go crazy? (need disk io equivalent of task manager’s cpu % column)
    Link
  3. YongRhee ( MSFT )
    • How to troubleshoot Service Host (svchost.exe) related problems?
      Link

Are you running on SSD – Dell – Latitude E7270 ?

Background

Recently we ran into a performance issue and wanted to compare our in-house environment against the Vendor’s Original implementation environment.

 

Is it Storage?

From what we observed our query was eating up a lot of tempdb storage and so quickly zeroed in how tempdb is configured.

Configuration of Tempdb

  1. Does the number of tempdb files match the number of processor cores
  2. Are the tempdb files sized equally and do they have the same growth pattern
  3. Is Instant File Initialization ( IFI ) enabled for the service account that SQL is running under

 

Hardware Itself

The other concern is whether our hardware has the neccesary IOPS

What type of Storage

And, so bring ups the question what type of storage do we have?

  1. Is it Local Disk
    • Mechanic rotating disk
    • SSD
  2. Is it Network Storage
    • Are we running SAN
    • Do we have sufficient memory ( PAM )

 

Self

Wanted to document the steps that needs to be taken by the vendor to document their storage.

And, so tried to try things out on my laptop as I prepared those steps.

 

Device Manager

Ran “Device Manager

Image

devicemanager_20170302_0923am

Textual

NVMe CX2-8B256-Q11 NV SCSI Disk Device

 

Explanation

The Device name “NVMe CX2-8B256-Q11 NV SCSI Disk Device” does not tell me whether it is an SSD Drive or not.

 

Google

Let us google on the device name and we found matches

Image

google-nvme-cx2-8b256-q11-nv

Textual

  1. CX2 NVMe Series – Liteon SSD
    Link
  2. LITEONIT Solid State Drive Firmware Driver Details | Dell US
    Link

 

Explanation

From Google we can see that the top matches suggests that we have an SSD Drive.

 

Dell

The computer is a Dell, let us go to it’s support site and see if it helps us identify the Storage type.

Dell Support is available here.

Steps

  1. Launched Internet Explorer
  2. Enter the URL for Dell Support
  3. On Dell’s Support Site
    • Installed Dell System Detect
    • Dell’s tool detected that our system is Latitude E7270
    • Once our computer is detected access the “System configuration” Tab
    • The Part number is “SSDR, 256G, P34, 80S3, SAMSUNG, PM951

Image

Do you want to install this application?

applicationinstall

Accept Terms and Conditions

dellsystemdetect

Installation

dellsystemdetect-accepttermsandconditions

Support for Latitude E7270

supportforlatitudee7270

 

Part Number

solidstatedrive

 

Summary

From Dell’s support site, we detected that our storage is :

SSDR, 256G, P34, 80S3, SAMSUNG, PM951

Vendor :- Samsung
Size :- 256 GB

Skype – High I/O

Background

Noticed my computer running high I/O.

And, so launched Task Manager to try to determine cause.

 

Task Manager

ScreenShot

Here is a screenshot from a few minutes ago.

taskmanager_processes_20170219_0408pm

Measuring

The items we want to measure are I/O Reads and I/O Writes as they show us the number of I/Os that are occurring.

We do want to stay watching for a bit to gauge how frequently they are being updated and at what rate.

And, later consider I/O Read Bytes and I/O Write Bytes.

 

Processes Identified

Here are the processes identified:

  1. svchost.exe
  2. Skype.exe
  3. sqlservr.exe
  4. System
  5. csrss.exe
  6. jusched.exe

 

Skype.exe

Why?

I know that I am not running Skype and so what is with it running high I/O

 

System Configuration Utility ( msconfig.exe )

Launch msconfig.exe to see if skype is configured to auto-start.

Looked for it under the “Services” and “Startup” Tab.

Tab – Startup

Tab – Startup – Current

tab-system-20170218-0817pm

Explanation

  1. Found Skype

Tab – Startup – Disabled

Disabled Skype as a Startup Item

tab-system-20170218-0818pm

 

Desktop – Status Bar

Access the Skype icon from the Desktop Status Bar.

statusbar-skype

And, chose the Quit option.

 

Skype Configuration

Btw, we could have disabled Skype from auto-starting through the Skype Interface, itself.

To do so, please launch Skype and log in.

Tools – Options

Please access the Options via the menu item Tools\ Options.

Tools – Options – General Settings

Start Skype When I Start Windows – Checked

We want to stay on the General Settings Tab.

And, focus in on “Start Skype when I start Windows“.

skypeoptions-20170219-0424pm

 

Start Skype When I Start Windows – Unchecked

skypeoptions-20170219-0426pm