SPF: 100% CPU load when copying files over LAN

I regularly update my Ethernet driver, and the last time I did was before I (re-)installed SPF. However, this issue has occured with all previous versions of the Rhine II driver when SPF was installed (I haven't been using SPF for several months but I had the same thing happening before.)

How were you uninstalling SPF? Via add/remove programs? Or did you use the cleanup utility?

Thanks,
Dodi

Oh, I forgot: It's probably not the driver, I have the same issue when moving/copying files via WiFi.

It is very possible that it could be from a bad upgrade/install/uninstall.
For this reason, we have created an uninstaller which will completely clean out SPF. You may wish to backup/export your configuration files prior to running the tool. I would like you to test out the file transfer with a blank configuration first, prior to importing your existing configuration file.
The tool can be downloaded at http://www.sunbelt-software.com/ihs/S...

You can then reinstall SPF by downloading it from

http://go.sunbeltsoftware.com/?linkid...

Thanks,
Dodi

I will share my results ASAP. And thanks for your help.

No worries. I look forward to seeing the results.

Dodi

Okay, I did a clean uninstall. Unfortunately, the file transfer problem persists with default settings via LAN and WiFi. By the way: the process going throught the roof is explorer.exe. (Curiously, I could have sworn that previously (i.e., months ago) it was System, not Explorer. But then again, I'm no longer sure.)

Thanks for the update.
In a command prompt, type in
net stop sbhips

Try the file transfer again...does the speed increase?
Thanks.

Nope. Same thing.

Oops. sorry. The service couldn't be stopped.

Interesting...the service should be able to be stopped without issue.
Let's go one step further and grab some logs from you...
First, click on Logs & Alerts > Settings
Turn on Detailed logs for drivers

Next, click on Network security > and disable Network Security module (uncheck it).

Try to reproduce the slowness. If the slowness does not occur, enable the Network Security module and reproduce the issue.

Once you do this, exit out of SPF from the taskbar icon, compress the entire logs folder, and email it to beta@sunbelt-software.com
Include a copy of your system information report (Start > Run > MSINFO32)
Save the file as a NFO file.

Thanks :)

Same problem with Network Security module disabled. I'm about to send the email. Should I enter some specific subject or will you know that it's me?

Yes please. If you add "For Dodi - Megalo" in the subject line, I will get it.

Okay, done. I hope there's not too much gibberish in there. I'm running a German version of XP and I don't know how far the translation goes...

Thanks!

Thanks! I got the logs and noticed a few things off the bat...
First the system memory (RAM) is fairly low, with only 100mb free, when a transer is not happening.
Second, I would like to see you disable/stop AntiVir and Ad-Aware from running temporarily. Once you do this, does the speed change?

I will continue looking at the logs you submitted.

Thanks,
Dodi

Thanks for noticing the memory issue ;-) It's my oldest machine and I only use it for a few tasks -- like moving files around the network :(

I disabled both AntiVir and AdAware (well, you can't really disable the AdAware service short of uninstalling the whole app, so I killed the process but it restarts after a few seconds). No change.

Since my machine doesn't have this problem with other firewalls I really don't think it's a third party app. Unless, of course, SPF is the program that has a problem with it.

Thank you!

I have seen weirder things happen :) particularly when drivers are involved.
I am leaning to a few things as of now (since I am on lunch and not in my office).
First, low memory on the machine. Second, an incompatibility issue. Third, the operating system being German XP (there could be an issue with certain characters).

The last thing that I will need from you is a speed comparison (with SPF on and off). Also, if you have the version of AntiVir and AdAware.

Once I get back to work, I will begin reproducing the issue to see what I can find.

Thanks,
Dodi

Thank you. (And wow, you're even doing this during lunch? That's dedication!)

Since I'm not sure what you mean by speed comparison (CPU load -- which is my concern -- or transfer speed) I'll give you both.

Copying a 350 Meg file to the machine with SPF on:
2m25s / CPU avg. ~98%

With SPF off:
0m50s / CPU avg. ~40%

Also: AntiVir (8.1.0.331) / Ad-Aware (7.1.0.10) are both the most recent versions.

Thanks :) That is the information I was looking for...
And yes, thats the joy? of having a Blackberry :D

From the driver logs, it appears that the reason you are seeing CPU load is due to the machine constantly caching the data, filling up the buffers, and purging the data. When the buffers are full, the drivers "pause" until there is room for more data.
This may be due to the amount of RAM installed, as the drivers are slowing themselves down to allow the machine to keep up.

If you have another machine with more RAM, I would be interested in knowing if this still happens when transferring files.

Thanks,
Dodi

Thanks so much for your help. But if this is a RAM issue, why don't I see the same behavior with ZoneAlarm (which in itself is a miserable memory hog) or Windows Firewall?

Unfortunately(?), all my other machines are Macs. (One runs Vista in Boot Camp, but still, it's a different OS.) Would it help to try it there?

I can't really say why ZA wouldnt show this issue without seeing how the code is written.

We use TDI (Transport Driver Interface - http://msdn.microsoft.com/en-us/libra...) drivers (which work fine with machines that aren't limited in RAM).

Testing with Boot Camp could lead false results as Windows is being emulated within Boot Camp. If you'd like, give it a shot and see what happens.

Let's try something else: I will kill as many processes as possible on this machine and see what happens. I'm pretty sure I can free around 250 Megs of RAM. Would that -- theoretically -- be enough to prevent the hiccup?

"Windows is being emulated within Boot Camp."
FYI: It's not. Boot Camp is basically just a boot loader that only emulates BIOS since Windows can't recognize EFI. Everything else runs natively.

Just my two cents as a Mac zealot. :P

Thanks! I'll keep you posted.

Thanks for the Mac education :) The more I know the better hehe.
I would be interested in seeing if the speeds/CPU usage changes with more RAM available.

OK, I killed as many processes as possible, freeing around 250 megs of memory. However, I could not detect any speed increase or lower CPU usage. During the file transfer, the free RAM fell to around 190 megs, but that was it.

I have prepared a new set of log files reflecting this change. If you want, I can email them.

Yes, please. Beta@sunbelt-software.com
Thanks!

Edit: Also, if you could disable HIPS from within the console and see if this has any affect on CPU utilization.

I received the logs and I am having my driver developer take a closer look at the logs to see if anything sticks out to him. I will let you know what we find out :)

I was referring to HIPS within the console, but since HIPS is already disabled, that would explain why the you encountered the issue shutting the service down :)

Out of curiosity, if you go to the network connections screen from the control panel, then to the Local Area Connection Properties screen and uncheck the Sunbelt NDIS IM filter, does the CPU usage drop during a file transfer?

Dodi

Great! Disabling the NDIS IM filter did the trick. No idea what it does, though. But I'm sure you know.

It effectively disables the firewall drivers from running :)
Application blocking will continue to work, but any IDS/packet filtering will not.
I will be researching this issue more.

Thanks,
Dodi

"any IDS/packet filtering will not"
I understand the subtle hint that this isn't a permanent solution. ;-)

Anyway, thanks again for your help. Now all I need is a new version of SPF that fixes my problem :P

Just a more or less random thought: Is it possible that the cache/purge orgy is caused by the chipset or chipset drivers?

Correct, it is not a permanent solution...
I should have more feedback for you from my driver devs.

Im not sure what you mean by "Is it possible that the cache/purge orgy"...

Dodi

That's what I call an orgy: "it appears that the reason you are seeing CPU load is due to the machine constantly caching the data, filling up the buffers, and purging the data."

:-)

I dont think its caused by the chipset or drivers...I use the Rhine chipset myself and dont have this issue.

One of the improvements that we will be making to SPF is the upgrade from NDIS (Network Driver Interface Specification) 5 to NDIS 6, which should improve performance. There is no ETA on when this should be ready, however this should resolve the issue you are seeing.

Thanks,
Dodi