windows update cache

Fri Sep 28 18:57:33 UTC 2007

> From owner-nanog at merit.edu  Fri Sep 28 13:05:54 2007
> Cc: Seth Mattinen <sethm at rollernet.us>, nanog at nanog.org
> From: Warren Kumari <warren at kumari.net>
> Subject: Re: windows update cache
> Date: Fri, 28 Sep 2007 13:32:36 -0400
> To: Steve Gibbard <scg at gibbard.org>
>
>
>
> On Sep 28, 2007, at 1:05 PM, Steve Gibbard wrote:
>
> >
> > On Fri, 28 Sep 2007, Seth Mattinen wrote:
> >
> >>
> >> Adrian Chadd wrote:
> >>> On Fri, Sep 28, 2007, Joe Johnson wrote:
> >>>> Windows Software Update Services doesn't require the end-user to  
> >>>> be part
> >>>> of a domain to get updates. You just need to define the WSUS  
> >>>> server as
> >>>> the source for updates by changing a few registry entries and  
> >>>> make sure
> >>>> the server is available via HTTP or HTTPS to your customers. You  
> >>>> can
> >>>> read more at Microsoft's site.
> >>>> Also, WSUS is free to run on any Windows server.
> >>> Great if you're running a windows IT type LAN; crap if you're  
> >>> running an
> >>> ISP!
> >>
> >> Why? It talks TCP/IP.
> >
> > This seems like a question of how much control ISPs have over  
> > customers' PCs at this point.  In my day (when we had to push  
> > packets up hill through 28.8 kbps modems, both ways...), we used to  
> > send out CDs to all our customers that would install web browsers  
> > and mail clients, and change the computers' dial-up networking  
> > settings to match our network.  Changing some registry strings for  
> > Windows Update would have been trivial.
> >
> > The ISPs I've dealt with recently as an end user tend to just send  
> > out a cable or DSL to ethernet bridge and let DHCP do the rest.   
> > This is progress, as it means devices can move from place to place  
> > and just work, but I don't think it provides a way to change  
> > registry settings.
>
> And, even if it did, once the customer leaves and goes to another ISP  
> they would likely still be pointing at your server -- this means that:
> a: their windows updates would break or
> b: you would carry on servicing them and paying for BW, etc

Silly idea: can one plug in _two_ servers in the registry item for WSUS
and will windows update try the second one ifit can't contact the first one?

If so, set up  local server in RFC 1918 space, make it the preferred one, with
MS's"real" server as the alernate.

If _not_, one could play the same game through DNS -- with a 'wsus.{isp}.com'
that resolves differently for queries from inside your address-space than it
does for queries from outside your space.  for an 'inside' query, it returns 
an A for the local server, for an 'exteral'query, it returns a CNAME pointing 
to MS's real server.

In both scenarios, the customer system keeps working without requiring any
further changes when the customer is 'no longer a customer'.  In the first
there is a query delay, while it fails over to te 2nd adress -- as upate
tends torun in background "no huhu" applies.  In the 2nd case, you take an
"occasional" hit from a former  customer doing a DNS query.  With a _large_
TTL on the CNAME record, this should be 'way down in the noise'

Has the potential to get a bunch of traffic off upstream links. 