Unoffical empeg BBS

Quick Links: Empeg FAQ | RioCar.Org | Hijack | BigDisk Builder | jEmplode | emphatic
Repairs: Repairs

Page 1 of 2 1 2 >
Topic Options
#36979 - 23/08/2001 11:55 OT: Drive Image 4.0
tanstaafl.
carpal tunnel

Registered: 08/07/1999
Posts: 5539
Loc: Ajijic, Mexico
My apology for being Off Topic here, although I guess the question could be peripherally related to the empeg...

I recently upgraded my home PC with a pair of 7200 RPM Western Digital 40GB hard drives, with the idea of using one for my data and programs, the other for backup. (My MP3 collection had pretty well filled my old 15 GB hard drive.)

I figured Powerquest's Drive Image 4.0 would make a nice backup program -- I would just copy the whole partition from C: to D:, and if my C: drive cratered, all I had to do was swap the jumpers and make the D: drive the C: drive, and I would be right back in business without having to reinstall Windows and all my software.

That part of it works -- I can use either drive as Master, boot from either one.

The problem is that Drive Image takes a great deal longer than I had expected to copy my 15GB partition from C: to D:. I was expecting to take about 15--30 minutes; in fact it is taking more than two hours. This is with all the advanced options set to maximize speed: SMART turned on, file structure checking and surface checking turned off.

I haven't had the patience to sit and watch the screen for two hours... but it seems to spend about the first hour (or more?) in a phase vaguely described as "Verifying Destination". When the actual copying finally begins, the status bar tells me it is running at about 300 MB per minute. (yes, per minute!)

Does anyone have experience with Drive Image? Can you tell me whether these times are typical, or am I doing something wrong or perhaps have a hardware problem? I would have thought a drive to drive copy across a 66 MHz bus (I think that's what it is) would go pretty fast. The processor is a 500MHz AMD K6-2. There is 128 MB of RAM.

Does anyone have experience with Symantec's "Ghost", which I understand does things similar to Drive Image?

Should I instead set my system up so that C: and D: are just mirrored all the time? How do I do that -- is that a software thing or hardware?

tanstaafl.

"There Ain't No Such Thing As A Free Lunch"
_________________________
"There Ain't No Such Thing As A Free Lunch"

Top
#36980 - 23/08/2001 12:01 Re: OT: Drive Image 4.0 [Re: tanstaafl.]
jwtadmin
enthusiast

Registered: 05/09/2000
Posts: 210
Loc: Ipswich, MA
If you are using windows 2K pro you can set up disk mirroring. I suspect that this will also be available in XP home as well.

As far as Ghost is concerned, I use it all the time at work. I just cloned a 36 GB drive in 15 min. It only had about 5 gig of data but still that's pretty good!

John

_________________________
___ John Turner "It's easier to ask for forgiveness than to ask for permission"

Top
#36981 - 23/08/2001 12:10 Re: OT: Drive Image 4.0 [Re: jwtadmin]
tfabris
carpal tunnel

Registered: 20/12/1999
Posts: 31563
Loc: Seattle, WA
The speed you mentioned for Ghost sounds about right. I'm surprised DriveImage didn't do the same for Doug.

Question, Doug:

What is the controller-layout for the drives? Maybe they will work faster if they're on different controllers instead of master/slave on the same controller?

Or maybe it's just the opposite: if you have one of the drives on a controller with a slaved CD-ROM disc, the hard disk will only operate at the CD-ROM's maximum data rate. Maybe you need to move them to the same controller?

Finally, DriveImage is meant for creating a data-compressed image of a hard disk. I don't know about its partition-to-partition copying abilities. For that, one usually uses PowerQuest's "Partition Magic", not DriveImage. Maybe that's the problem-- the wrong tool for the job?

___________
Tony Fabris
_________________________
Tony Fabris

Top
#36982 - 23/08/2001 12:48 Re: OT: Drive Image 4.0 [Re: tfabris]
cwillenbrock
enthusiast

Registered: 30/12/2000
Posts: 249
Loc: Dover, NJ
Or better yet, PowerQuest's DriveCopy instead of DriveImage. Partition Magic is great, though I don't think this is it's best use. DriveCopy is better suited for this, I would think.

I've used DriveCopy, and unfortunately I don't remember how long of a process it is.

--Chris Willenbrock
MK2 | 12GB | Queue Registration # 2 (really!)
_________________________
- Chris Orig. Empeg Queue position 2

Top
#36983 - 23/08/2001 13:54 Re: OT: Drive Image 4.0 [Re: tfabris]
tanstaafl.
carpal tunnel

Registered: 08/07/1999
Posts: 5539
Loc: Ajijic, Mexico
What is the controller-layout for the drives?

I am pretty sure that the two 40GB drives share a common controller (they are on the same cable) and that the CD-ROM drive is on the same controller as the floppy drive.

Finally, DriveImage is meant for creating a data-compressed image of a hard disk

Actually, unless I am misinterpreting the instruction manual, data compression is optional (and slower), and the default is to make an exact byte for byte copy from one drive to another. (The program will also make a copy of a partition to the same drive.)

...partition-to-partition copying abilities. For that, one usually uses PowerQuest's "Partition Magic.

Really? I thought that Partition Magic was what you used for resizing existing partitions without losing the data in the partitions, not copying/creating new ones, but I have never actually used that program so don't know for sure.

I guess the test will be to go to DOS mode and as an experiment use XCOPY /S/E/ to copy the drive and see how long that takes, just as a comparison.

I am expecting my copy of "Ghost" to arrive any day now ($13.15 on ebay!) so I'll soon see if that runs any faster.

As long as we are off topic... here's another. My internet service at work (cable modem) for the past several days has been very flaky -- It runs slower and slower until (for example) bbs messages here take as much as 2--3 minutes to display, and finally stops. Our chief engineer then goes up and reboots something (can you reboot a router?) and everything is fine again for a few minutes and then it starts slowing down again. This cycle takes about an hour, perhaps two hours to run. He thought it was a bad router, replaced it, problem still remains. Any ideas?

tanstaafl.




"There Ain't No Such Thing As A Free Lunch"
_________________________
"There Ain't No Such Thing As A Free Lunch"

Top
#36984 - 23/08/2001 14:08 Re: OT: Drive Image 4.0 [Re: tanstaafl.]
tfabris
carpal tunnel

Registered: 20/12/1999
Posts: 31563
Loc: Seattle, WA
the CD-ROM drive is on the same controller as the floppy drive

Unlikely, as most floppy drives aren't IDE devices and get their own unique connector on the motherboard. Usually, the CD-ROM is on one of the IDE connectors. Unless you have a SCSI CD-ROM...

I thought that Partition Magic was what you used for resizing existing partitions without losing the data in the partitions, not copying/creating new ones, but I have never actually used that program so don't know for sure.

It does both, and more.

I guess the test will be to go to DOS mode and as an experiment use XCOPY /S/E/ to copy the drive and see how long that takes, just as a comparison.

As long as you only use it as a test. Don't use this method long-term, expecting to make a run-able operating system on the other drive. There's more to it than just copying the files. You'll lose certain stuff in the copy that'll break the Windows installation on the second drive.

(can you reboot a router?)

Yes. They are computers, too.

He thought it was a bad router, replaced it, problem still remains. Any ideas?

If he replaced it with the same brand of router, he should also check to make sure he's got the latest firmware for that router.

It could be some other component in the chain. Is there a separate firewall or proxy server in the mix? Our DSL modem here at work sometimes goes down and I have to reboot it.

___________
Tony Fabris
_________________________
Tony Fabris

Top
#36985 - 23/08/2001 14:40 Re: OT: Drive Image 4.0 [Re: tanstaafl.]
drakino
carpal tunnel

Registered: 08/06/1999
Posts: 7868
He thought it was a bad router, replaced it, problem still remains. Any ideas?

What brand router is it? Certain ones are having issues with the Code Red worm, and that could be causing it. (Cable modem networks are still getting hit hard, I have 3990 attacks logged on my server on @home, compaired with 2823 attacks on the logo site (and the logo site has 5 ips, so thats an average of 565 per IP there))


Top
#36986 - 23/08/2001 16:42 Re: OT: Drive Image 4.0 [Re: cwillenbrock]
jimhogan
carpal tunnel

Registered: 06/10/1999
Posts: 2591
Loc: Seattle, WA, U.S.A.
I have used Partition Magic since about version 2 and think Powerquest has a great product in PM. Like you say, it is not their product for disk cloning/imaging. Since I had a good experience with PM, I bought a fairly early version of Drive Image, but was very disappointed. It failed repeatedly. As a result I bought Ghost (just the "personal edition") and have used this many times with good results. I make image file snapshots of my company laptop so I can restore to an earlier state if things get hosed up, and I have used Ghost many times in conjunction with PM to migrate to larger drives and for "Cheap RAID" -- basically cloning a drive to a backup every so often (boot the machine from a floppy with Ghost PE and clone. I think even half-full 45GB drives took less than an hour).

I'd hope that the newer version of Powerquest's Drive Image/Copy are much improved.

Related to a recent Off-topic topic of recovering a RAID 0 config, I'd comment that I would not trust anything critical to the now-common on-board RAID solutions, even in RAID 1 or 0+1 configurations. Promise, High Point, etc. are all primarily software RAID that depends on drivers read from the configured disks; if the relevant file systems and drivers get messed up, it seems that you run the risk of hosed RAID config. Likewise, I'm not sure I'd I'd put a critical NT/2000 system partition on software mirrored drives.

Not too many IDE hardware-only RAID solutions around. I have had great results with a DMA33-capable Arco Duplidisk for my Linux file server, but the Arco Duplidisk 2 (UDMA66-capable) I installed in a desktop had big problems (now documented by Arco but not yet fixed) with the Via chipset on that Tyan S1834D. 3ware has an IDE RAID controller series (Escalade?) that is in hardware, but the unit requires a PCI slot which Arco does not. Promise now has a (looks like hardware-only) followup to the FastTrak 100 called the SuperTrak 100 but it is over $300USD and also wants a PCI slot. The Arcos are ~$225-$250 and only need a connection to the IDE controller. For now, I am using just Cheap RAID on my desktop while I wait to see if Arco resolves the Via compatibility issue.

(Now, back to the topic!)

Jim

_________________________
Jim


'Tis the exceptional fellow who lies awake at night thinking of his successes.

Top
#36987 - 23/08/2001 17:50 Re: OT: Drive Image 4.0 [Re: tanstaafl.]
muzza
Pooh-Bah

Registered: 21/07/1999
Posts: 1765
Loc: Brisbane, Queensland, Australi...
I'm not flaming or complaining.

would it be an idea to have an Off Topic forum for HW/software issues like this and the Raid OT mentioned?
We do have a good community of genuine helpful people and maybe there is a place to deal with these non-rio/empeg issues.

Paul/Tony?

Murray 06000047
Just increasing my post count
_________________________
-- Murray I What part of 'no' don't you understand? Is it the 'N', or the 'Zero'?

Top
#36988 - 23/08/2001 21:25 Re: OT: Drive Image 4.0 [Re: tanstaafl.]
Terminator
old hand

Registered: 12/01/2000
Posts: 1079
Loc: Dallas, TX
It sounds like this might meet your needs. It should be on the drive image disk.

http://www.powerquest.com/driveimage/datakeeper.html

http://www.zdnet.com/zdhelp/stories/main/0,5594,2701196-1,00.html

Sean


Top
#36989 - 24/08/2001 03:58 Re: OT: Drive Image 4.0 [Re: Terminator]
smu
old hand

Registered: 30/07/2000
Posts: 879
Loc: Germany (Ruhrgebiet)
Hi.

I used DataKeeper for quite some time now, and repeatedly had problems with it.
First of all, it does _not_ keep a RAID like image, but keeps track of the files that get modified by your applications (and you can also make it do snapshots on request). It does keep a certain (configurable) number of older versions of your files, so I would compare it more to a automized revision control system (without the possibility to mark and comment certain versions) than to a RAID system.
The problems I had with it where numerous though: It was the verified cause of some system hangs, kept keeping copies of files I didn't want it to keep,....
To make a long story short: I wouldn't recommend DataKeeper for backup purposes. It is nice though if you want the ability to step back some file versions when doing excessive editing.

cu,
sven

cu,
sven

proud MkII owner (12GB blue/green/smoked, was #080000113 is #090001010)
_________________________
proud owner of MkII 40GB & MkIIa 60GB both lit by God and HiJacked by Lord

Top
#36990 - 24/08/2001 04:42 Re: OT: Drive Image 4.0 [Re: tanstaafl.]
edwin
member

Registered: 26/09/2000
Posts: 194
Loc: Druten, The Netherlands
My suggestions:

1] Use Partition Magic Pro for resizing, converting and moving partitions (on the same disk);
2] Use Ghost (pref. Enterprise 6.5) for cloning;
3] Use a Promise Fasttrak controller for cheap mirroring.

Regarding point 1: used it for many years and it has never failed!
Regarding point 2: tried Drive Image, it's crap. Ghost can do cloning over USB, SCSI, parallel and network as well. I use it constantly over 100Mbps Ethernet at work. Even store your image on a (bootable) CD-R(W) directly!
Regarding point 3: evaluated Fasttrak66 Pro (including fastswap bays). Limited to U-ATA/66, but it is HARDWARE RAID 0, 1, 1+0.

John Turner (jwtadmin) is very wrong on his point that Windows 2000 Pro can do mirroring... It CANNOT do that, not even any form of RAID! As you can read in the help Mirrored and RAID-5 volumes are available only on computers running Windows 2000 Server. You can, however, use a computer running Windows 2000 Professional to create mirrored and RAID-5 volumes on a remote computer running Windows 2000 Server.

Yesterday I backed up my laptop over 100Mbps switched Ethernet to Ghost's Multicast Server. 11Gb took 42'11" WOW!

Edwin de Vaan
mk2 rev.7 # 080000263 (queue 1232) 6+20Gb blue/red
_________________________
[white]ญญ______________[/white]
Edwin de Vaan aka FLaSHmAStER

Top
#36991 - 24/08/2001 08:21 Re: OT: Drive Image 4.0 [Re: edwin]
jimhogan
carpal tunnel

Registered: 06/10/1999
Posts: 2591
Loc: Seattle, WA, U.S.A.
Edwin: "My suggestions [...]"

Well, interesting to see that Powerquest wasn't ever able to fix Drive Image. PartitionMagic was/is so good I figured they had to be smart enough to get it right.

When you mentioned "network" under Ghost, that made me look at the current product specs. They got rid of the "Enterprise"/"Personal" versioning scheme that meant that you used to have to spend big $$$ for Enterprise version to Ghost over a network. Excellent. Upgrade time.

On the hardware/software RAID issue, my working definition of "hardware RAID" is that the relevant calculations are performed on the RAID controller itself (it doesn't pass them back and forth through the CPU/drivers before writing to the array) and that, being hardware, it is not necessarily OS-dependent (such that you can bootstrap the controller and create RAID array/stripes before you even install the OS). By those criteria, I don't think the FastTrak series of products qualifies as "hardware"; Promise product literature makes the distinction that the SuperTrak series of products are "hardware" (promise!) and you certainly pay more as a result; no experience with these on my part.

Anandtech has a decent review of IDE RAID options here: http://www.anandtech.com/storage/showdoc.html?i=1491

Whatever its faults (Via chipset problems) and limitations (RAID 1-only) I'm surprised they didn't cover the Arco products, but a lot of times that just means they couldn't get a review unit.

Jim

_________________________
Jim


'Tis the exceptional fellow who lies awake at night thinking of his successes.

Top
#36992 - 24/08/2001 09:19 Re: OT: Drive Image 4.0 [Re: jimhogan]
tfabris
carpal tunnel

Registered: 20/12/1999
Posts: 31563
Loc: Seattle, WA
Well, interesting to see that Powerquest wasn't ever able to fix Drive Image

Funny, I've been using DriveImage here at work for years and never had any speed or reliability problems with it.

I use it to keep backups of "clean" OS installs for testing. For instance, I keep DriveImage and a bunch of images on drive D, and I've created little batch files that will wipe drive C and put a fresh OS on it in minutes. This lets me bop back and forth between 95, 98, SE, NT4, 2K, etc., and do testing of my software install routines on fresh systems.

I've never had the slightest trouble with it, either creating or restoring images.

___________
Tony Fabris
_________________________
Tony Fabris

Top
#36993 - 24/08/2001 11:18 Re: OT: Drive Image 4.0 [Re: jimhogan]
edwin
member

Registered: 26/09/2000
Posts: 194
Loc: Druten, The Netherlands
About the Fasttrak66 controller I have here... It has a BIOS which you enter (before OS boot) to configure stripe/span/mirror configurations. For instance, take a mirror configuration of 2 identical drives connected to both channels. Install Windows 98 and don't install the drivers or tools and you still have a mirror. I think this is really hardware RAID, right?!?!?! DOS and Windows 3.x don't even need drivers....

About Ghost. Symantec or Norton? You decide... Eventually this doesn't hold me back of using version 6.51 Enterprise (without the v7 product activation).

About Drive Image vs. Ghost. Ghost works nicer in networked environments by means of my own experience. It also interfaces directly with RIS on Win2k server. Funny for roll-outs and stuff.

Someone ever in need of a boot diskette of the Enterprise version, mail me. It will be lacking GHOST.EXE however

Edwin de Vaan
mk2 rev.7 # 080000263 (queue 1232) 6+20Gb blue/red
_________________________
[white]ญญ______________[/white]
Edwin de Vaan aka FLaSHmAStER

Top
#36994 - 24/08/2001 11:25 Re: OT: Drive Image 4.0 [Re: tfabris]
edwin
member

Registered: 26/09/2000
Posts: 194
Loc: Druten, The Netherlands
I use it to keep backups of "clean" OS installs for testing.

Ever considered using VMware in non-persistent or undoable mode? Just curious: did you buy a dual processor Tyan mb? I recommend 2 CPUs and a whole lot of memory for using a bunch of virtual machines.

Edwin de Vaan
mk2 rev.7 # 080000263 (queue 1232) 6+20Gb blue/red
_________________________
[white]ญญ______________[/white]
Edwin de Vaan aka FLaSHmAStER

Top
#36995 - 24/08/2001 11:52 Re: OT: Drive Image 4.0 [Re: smu]
Terminator
old hand

Registered: 12/01/2000
Posts: 1079
Loc: Dallas, TX
Ive never used datakeeper, I just saw that it came with drive image. Curiously, I don't have it on my drive image pro disk.

Sean
--


Top
#36996 - 24/08/2001 11:55 Re: OT: Drive Image 4.0 [Re: edwin]
Terminator
old hand

Registered: 12/01/2000
Posts: 1079
Loc: Dallas, TX
Ive never had any problems using drive image, ive used it to make images over ethernet and to deploy images to a few computers at once with no problems w/ deltadeploy. What exactly makes it crap?

Sean


Top
#36997 - 24/08/2001 13:35 Re: OT: Drive Image 4.0 [Re: edwin]
tfabris
carpal tunnel

Registered: 20/12/1999
Posts: 31563
Loc: Seattle, WA
Ever considered using VMware in non-persistent or undoable mode?

Drive image was simpler and easier for the particular things we were doing. VMWare would have been an extra layer of complexity for our particular task.

Just curious: did you buy a dual processor Tyan mb?

Nah, just this one.

I had to match it to a specific CPU and set of peripherals.

___________
Tony Fabris
_________________________
Tony Fabris

Top
#36998 - 24/08/2001 14:37 Re: OT: Drive Image 4.0 [Re: edwin]
jimhogan
carpal tunnel

Registered: 06/10/1999
Posts: 2591
Loc: Seattle, WA, U.S.A.
Edwin,

Not sure that the distinctions b/w RAID types are absolute. These boards are bus-dependent and (as I saw with the Arco DDII) subject to interaction with motherboard chipsets. If you can pop in the card and drives, go to BIOS to configure the RAID, then install any OS, it smells like "hardware" to me. On the other hand, I think that the distinction of having to use main CPU (versus on-board processor) is legit and one of the factors folks use in their definition. I have a FastTrack100 here on the shelf -- no i960 or other familiar processor to be seen. What I do know is that it wants drivers loaded under Win2K *before* installing the board. Not so the Arco and some others. I think perhaps the real distinction is price! If you paid over $300, it's hardware!

Ghost-wise, I looked at pricing on Provantage and it looks like the only distinction with the enterprise site-licensed version now is that you get a console utility. Since everything I care about is within arm's reach, the newer packaging of Ghost with networking will be peachy enough. On the Drive Image front, all I can say is that when I used an earlier version (v2 or 3??) is simply refused to work, at least in creating images; it froze every time. Again, my esteem for Powerquest's talents was/is high, so this was a surprise. If folks are having variable results, perhaps this is one of those 'ol hardware interaction issues again.

Jim

_________________________
Jim


'Tis the exceptional fellow who lies awake at night thinking of his successes.

Top
#36999 - 24/08/2001 17:28 Re: OT: Drive Image 4.0 [Re: muzza]
tanstaafl.
carpal tunnel

Registered: 08/07/1999
Posts: 5539
Loc: Ajijic, Mexico
would it be an idea to have an Off Topic forum for HW/software issues like this and the Raid OT mentioned?

Absolutely!

Some of the very best posts and threads on this bbs have (IMHO) been completely off-topic. We have an extraordinary group of users on this board, and I would be in favor of anything that might encourage a broad range of discussion.

tanstaafl.

"There Ain't No Such Thing As A Free Lunch"
_________________________
"There Ain't No Such Thing As A Free Lunch"

Top
#37000 - 24/08/2001 17:44 Re: OT: Drive Image 4.0 [Re: drakino]
tanstaafl.
carpal tunnel

Registered: 08/07/1999
Posts: 5539
Loc: Ajijic, Mexico
What brand router is it?

Cisco. I think the chief engineer said it was a model 2600... does that sound right?

Today he replaced the cable modem. The problem is still there. The C.E. says that our entire internet service consists of the modem, the router, a piece of cable connecting the two, and the cable company's cable coming into the building. He's now replaced everything, the problem is not solved, and he is at a loss. :-(

tanstaafl.

"There Ain't No Such Thing As A Free Lunch"
_________________________
"There Ain't No Such Thing As A Free Lunch"

Top
#37001 - 24/08/2001 18:10 Re: OT: Drive Image 4.0 [Re: Terminator]
tanstaafl.
carpal tunnel

Registered: 08/07/1999
Posts: 5539
Loc: Ajijic, Mexico
It sounds like this might meed your needs. It should be on the drive image disk.

Yes, it is on the disk, but I didn't investigate it very thoroughly because the instruction manual said pretty much what the ZDNet article said, mainly:

Before we get started, it's important to realize that DataKeeper isn't designed to back up your entire hard disk--just your data files. In fact, DataKeeper's default settings exclude all executable files as well as those files associated with executables such as DLL files.

My goal is to always have a replacement drive that I can go to by swapping a few jumpers or maybe just change the boot order in the BIOS. For that it needs to be an exact copy of the primary drive. Now... if I create the exact copy with drive image (so far V4.0 has given no problems, except that it is slower than I anticipated) and then use DataKeeper to keep the "copy" drive updated... that might work. Or perhaps if I change the default file types in DataKeeper to the equivalent of *.* it would make my exact bootable copy.

I'll try that this weekend, and let you know what happens.

I don't really want a full mirroring system -- because that system instantly mirrors my mistakes. With a backup system (as opposed to mirroring) I can still undo things -- at least until I do the next backup.

tanstaafl.


"There Ain't No Such Thing As A Free Lunch"
_________________________
"There Ain't No Such Thing As A Free Lunch"

Top
#37002 - 24/08/2001 18:26 Re: OT: Drive Image 4.0 [Re: tanstaafl.]
tfabris
carpal tunnel

Registered: 20/12/1999
Posts: 31563
Loc: Seattle, WA
If that configuration you just listed doesn't include a firewall, you're probably (as suggested before) being hit with some kind of hack that's causing the loss of performance. The Code Red worm or something similar could be the culprit.

___________
Tony Fabris
_________________________
Tony Fabris

Top
#37003 - 24/08/2001 18:52 Re: OT: Drive Image 4.0 [Re: tfabris]
tanstaafl.
carpal tunnel

Registered: 08/07/1999
Posts: 5539
Loc: Ajijic, Mexico
If that configuration you just listed doesn't include a firewall...,

There is a firewall in place, and apparently a pretty good one. I wish I were technically enough inclined to offer any kind of intelligent explanation of what our setup here is... I know that Steve Gibson's "Shields Up!" program (see here) gave our system the highest ranking for security).

Steve Gibson, for those who are not familiar, is the author of the world's best hard drive stress-testing and data recovery program, called "SpinRite". If you don't already have it, you should definitely look into it. You'll find links to SpinRite at the URL listed above.

I mentioned to our C.E. that someone had suggested a virus problem, and he is going to look into that possibility. Ummm... I seem to recall that the Code Red worm attacks only servers running IIS (Internet Information Services) software. We're not running that here, i.e., we're not hosting a website on the premises. Wouldn't IIS be pretty much an ISP thing?


tanstaafl.

"There Ain't No Such Thing As A Free Lunch"
_________________________
"There Ain't No Such Thing As A Free Lunch"

Top
#37004 - 24/08/2001 19:58 Re: OT: Drive Image 4.0 [Re: tanstaafl.]
Terminator
old hand

Registered: 12/01/2000
Posts: 1079
Loc: Dallas, TX
"I don't really want a full mirroring system -- because that system instantly mirrors my mistakes. With a backup system (as opposed to
mirroring) I can still undo things -- at least until I do the next backup."

Then drive image will do exactly what you want. I dont know why its so slow for you though. If you wanted, you could tell it to run every afternoon after you leave work.

Sean


Top
#37005 - 24/08/2001 20:48 Re: OT: Drive Image 4.0 [Re: tanstaafl.]
synergy
enthusiast

Registered: 20/02/2001
Posts: 345


I seem to recall that the Code Red worm attacks only servers running IIS (Internet Information Services) software. We're not running that here, i.e., we're not hosting a website on the premises. Wouldn't IIS be pretty much an ISP thing?



First off, the 2600's are prety nice cisco's... Cheap (for cisco, at least) and usable. They do have a firewall capability if you put the right IOS in place on it.

But... That IOS could also be your problem... around 11.0 of the cisco ios (i think.. may have been 12.0) they added the ability to configure it via a browser... ala, internal webserver. Now, Code Red doesn't infect anything besides IIS, but it sure as hell can bog the crap out of any machine running a web server.

My OpenBsd gateway at the house had it's log file grow by 50 megs in 5 hours thanks to all the morons who didn't patch.... Of course, they weren't getting though the firewall , and BSD could care less about NT's buffer overflows, but all of those requests sure pushed the load average up, and certainly used a shitload of bandwidth.

Cisco's with that interface configured would certainly be at risk. Not from the infection, but simply from overload... The 2600 doesn't have the fastest processor on the block, nor the most memory...

_________________________
Synergy [orange]mk2, 42G: [blue] mk2a, 10G[/blue][/green] I tried Patience, but it took too long.

Top
#37006 - 24/08/2001 22:37 Re: OT: Drive Image 4.0 [Re: tanstaafl.]
mcomb
pooh-bah

Registered: 31/08/1999
Posts: 1649
Loc: San Carlos, CA
It is possible that the cable modem bridge (converter box to go from cable to ethernet) is getting overwelmed. Possibly by the virus mentioned. That box is on the Internet side of the firewall in your 2600 series router so it is getting hit with whatever traffic if floating around on your cable modem loop (traffic going to you and possibly everybody else on your city block). If that is the case there is not much you can do about it other than try to get your ISP to replace it with a different model. Is there a traffic lite on that box? Is it always lit up? Your sysadmin should be able to setup a packet sniffer on the Internet side of your firewall and see what kind of traffic is coming through and how much. If he is any good he should have done that already actually.

-Mike

_________________________
EmpMenuX - ext3 filesystem - Empeg iTunes integration

Top
#37007 - 25/08/2001 00:22 Re: OT: Drive Image 4.0 [Re: synergy]
drakino
carpal tunnel

Registered: 08/06/1999
Posts: 7868
Cisco has this advisory about Code Red. It shows their products directly affected due to running IIS, and also the ones that are affected as side effects.

Oh, and most of the slowdown is caused by another side effect of the worm, all the ARP requests it's generating. Since @Home neighboorhoods act like a LAN, my cable modem gets all the random ARP requests. The worm it's self is just proving what MCSE sysadmins out there have no clue, and how many @home users are violating their terms of service (in more ways then just having a web server now.)

Oh well, it might go away in a year or so at this rate.

(4173 attacks and counting...)

Edited by Drakino on 25/08/01 08:27 AM.


Top
#37008 - 25/08/2001 00:28 Re: OT: Drive Image 4.0 [Re: tanstaafl.]
jimhogan
carpal tunnel

Registered: 06/10/1999
Posts: 2591
Loc: Seattle, WA, U.S.A.
tanstaafl: "As long as we are off topic... here's another. [...]. Our chief engineer then goes up and reboots something (can you reboot a router?) and everything is fine again for a few minutes and then it starts slowing down again. This cycle takes about an hour, perhaps two hours to run. He thought it was a bad router, replaced it, problem still remains. Any ideas?"

Doug,

I read some of the follow-ons. Interesting puzzle. Sounds like it will take more diagnostic work. If the Cisco 2600 is the first thing with an IP address that packets hit (from your ISP), then the cable "modem" is set in bridging mode and it seems unlikely that it would have much to do with this. The fact that rebooting the router temporarily improves the situation (have you measured this empirically?) supports that thought as well. Some Cisco products have been affected by Code Red, but most are IIS-based software and the one notable hardware product that I am aware of are the 600-series web-manageable SOHO routers. No mention of problems with 26xx-series by Cisco, and I wasn't aware that they include HTTPD function, but, if so, you should be able (like with the 600s) to turn it off at the command line (or move it to a higher, non-standard port). From what I read (I have a Cisco 675 here, so I care) Code Red overflow disables 600s -- kills 'em dead -- and I can't tell from Cisco docs whether this happens gradually or immediately.

Back to the router....no reason why this should be so, but the gradual degradation of performance smells of a router with insufficient memory that is accruing an overwhelmingly large route table over time (or some other cache that I can't really imagine) that is taxing the CPU/router. There are *so* many 25xx/26xx routers in service as corporate boundary routers out there that I'd be surprised if there were a specific Code Red vulnerability with those product that hasn't been documented.

Code Red includes a randomizer that will attempt connections to a long, unpredictable list of IP addresses. This makes me wonder if Code Red ir reaching something "inside" your Cisco boundary that is generating traffic, loading the router (perhaps loading route table/cache, though that still seems like a bit of voodoo), or perhaps hitting the BRB (Big Red Button -- I know it's really a small, black button on the 2600) on the Cisco doesn't really do anything to clear the Cisco, but simply interrupts loading connections from inside your network (until they accumulate again and overwhelm the Cisco.

Pretty gross speculation. It does sound like time to find a sniffer and see what's connecting to what. If the Cisco is your only line of defense (are you running routable "public" IP addresses on your internal hosts or is the 2600 configured for Network Address Translation?), seems like after you take a look with a sniffer and map your network/connection, that someone at minimum would want to build some access control lists on the Cisco.

Interested to hear what develops.

Jim

_________________________
Jim


'Tis the exceptional fellow who lies awake at night thinking of his successes.

Top
Page 1 of 2 1 2 >