ESET SS 4 with limiters

[robis]

Hi

usualy i used network limiter or similar program from another company

I have Vista 64b and when use combination x64 and network limiter or DU meter ... than my web pings are very big from 500ms to 1000ms

My scenarios

in Vista 32b and XP 32b pings are 20ms with ESS 4 (good)


1) vista 64b without ESS4 and without Limiter
pings 20 ms

2) vista 64b +ESS4 without limiter
pings are 30ms

3)vista 64b ESS4 + limiter
pings 500-1000ms

4)vista 64b without esset + limiter
pings are 20ms

5)vista 64b ESS3 (i tried older version) + limiter
pings are 20ms

all scenarios was used for Windows 7 (but same as Vista 64b)
1) win7 without ESS4 and without Limiter
pings 20 ms

2) win7 64b +ESS4 without limiter
pings are 30ms

3)win7 64b ESS4 + limiter
pings 500-1000ms

4)Win7 64b without esset + limiter
pings are 20ms

5)win7 64b ESS3 (i tried older version) + limiter
pings are 20ms


when operating system is Vista or Windows 7 64bit version than:
ESS4 - slows my web ping diference between ESS3 and ESS4 is 10 ms (50%)

when with ESS4 is used Network limiter or Du meter than pings are 15* higher

all this causes slow showing webpages

for this test I used web meter tester and I chceck Web odezva
http://rychlost.cz

How to solve it?

[robis]

Today I make another tests

sory for CZ language pictures but when I disable scannign HTTP (I dont know how it called in english see screen) then pings are 20 ms and ESET SS 4 works great with all limiters.

http://img35.imageshack.us/i/esetkontrola.jpg/

http://img12.imageshack.us/i/esetmain.jpg/

What is this proactive http scanning?
Or how shoul I correct this? (Because when I enable this pings are from 500ms to 1000ms)

[robis]

bump :)

[robis]

bump .

[robis]

i will be bumping till 8.3.2010 when my licence ends (paying for unstable product on vista 64 bit, free user of other product and pirates are happy but legaly user no)

any idea how to solve it?

[robis]

bump .

[robis]

bump _

[robis]

nobody can help?

[pinjoa]

hi,
I can't understand what is your real problem or if your problem is related with ESS product...

[robis]

-{ Quote: "hi,
I can't understand what is your real problem or if your problem is related with ESS product..." }-

In ESS 4 when I tick Active check HTTP and I use network limiter program than my pings are about 500-1000ms.

This is my problem.

[Marcos]

Active mode is suitable only for browsers, it may cause problems when used with other types of applications. Network limiters should always be set to passive mode.

[robis]

-{ Quote: "Active mode is suitable only for browsers, it may cause problems when used with other types of applications. Network limiters should always be set to passive mode." }-

Hi Marcos and how to do it? How shoul I set passive mode?

[Marcos]

-{ Quote: "Hi Marcos and how to do it? How shoul I set passive mode?" }-

It's simple - mark only browsers in the Active mode list (Web access protection -> HTTP,HTTPS -> Web browsers -> Active mode). Anyways, DU Meter is not listed there so I wonder what applications you set to work in active mode. It worked fine here with DU Meter and IE/Firefox set to active mode.

[robis]

all program from list I have unchecked like

http://yfrog.com/5fpasivej

[Marcos]

You shouldn't measure communication parameters via HTTP as the HTTP traffic flows through the antivirus scanner and other OS parts (e.g. Windows Filtering Platform on Vista/Windows 2008/Windows 7) which causes certain delays. It could be that the difference you've noticed is affected by the time necessary for WFP to manage the communication flow between drivers at the same WFP level if more drivers are registered (as it most likely is in the case of the HTTP scanner and a network limiter). If you notice higher pings by measuring them not through HTTP, let us know the exact version of the software you used to reproduce the problem.

[robis]

-{ Quote: "You shouldn't measure communication parameters via HTTP as the HTTP traffic flows through the antivirus scanner and other OS parts (e.g. Windows Filtering Platform on Vista/Windows 2008/Windows 7) which causes certain delays. It could be that the difference you've noticed is affected by the time necessary for WFP to manage the communication flow between drivers at the same WFP level if more drivers are registered (as it most likely is in the case of the HTTP scanner and a network limiter). If you notice higher pings by measuring them not through HTTP, let us know the exact version of the software you used to reproduce the problem." }-

Vista 64b SP2 Cz + Network limiter 2 (or Network limiter 3 beta) + eset SS 4 v 4.0.424.0 (or 4.0.437)

First I found in first version of ESET SS 4.

[Marcos]

As I wrote, you shouldn't measure ping via HTTP, it will always produce delays. Disabling HTTP scanning for the time of testing should return correct results, however.

[robis]

-{ Quote: "As I wrote, you shouldn't measure ping via HTTP, it will always produce delays. Disabling HTTP scanning for the time of testing should return correct results, however." }-

Yes I agree but

I tried many test diference 20ms - 30ms but no (500 - 1000)ms

when I tryed from 2 difrent PC throught 1 router test XP result 20-30ms but vista 64b 500-1000ms (same time and this is strange)

and this functionality caused slow loading webpages with many objects.
Usualy if i am seeing www.idnes.cz :
normaly webpage is loaded about 1 second
with this combination it takes about 30 seconds (I see on screen that image1 is show, than text array is show .... then flash is show .... after 30 second all page is showed)

[Marcos]

-{ Quote: "
when I tryed from 2 difrent PC throught 1 router test XP result 20-30ms but vista 64b 500-1000ms (same time and this is strange)
" }-

Of course, as I said, that would explain the delay to be caused by Windows Filtering Platform and the time it needs to pass the data to other drivers that are registered in the WFP chain.

[robis]

Than I dont understand where is problem if Vista or comunication between smart security with limiter. Why under 64bit systems (Vista and Win7 RC) dont work correctly?

Under version 3 of smart security it is ok but I dont know if there is Web access protection.

[Marcos]

As I wrote previously:

-{ Quote: "...that would explain the delay to be caused by Windows Filtering Platform and the time it needs to pass the data to other drivers that are registered in the WFP chain." }-

[robis]

and it is possible to somehow get correctly working with WFP?

How shoul I correct? or Why ESS SS 3 works ok? (other avira nad kaspersky works great too). I am still thinking that something in v 4 is wrong.

[Marcos]

Again, I'll repeat it: we assume there's a problem with WFP supported in Vista SP1 and newer OS. WFP support was first added to v4, hence v3 works fine. WFP is a feature in the hands of Microsoft, software developers only utilize its API, they are not familiar with all the ins and outs.

[robis]

OK now I understand ... I am sorry for slow understanding :)

How long esset will be supporting v3 of smart security?

And could you please tell me differences between 3 and 4?

[robis]

-{ Quote: "Again, I'll repeat it: we assume there's a problem with WFP supported in Vista SP1 and newer OS. WFP support was first added to v4, hence v3 works fine. WFP is a feature in the hands of Microsoft, software developers only utilize its API, they are not familiar with all the ins and outs." }-

Ok Marcos I tested again if this is WFP bug from microsoft than why trial KIS 2010 works ok? (it should be same as ESET SS v 4 - means no dellayed ping?)

[Marcos]

-{ Quote: "Ok Marcos I tested again if this is WFP bug from microsoft than why trial KIS 2010 works ok? (it should be same as ESET SS v 4 - means no dellayed ping?)" }-

Just to make sure, can you confirm that KAV actually employs WFP? Has somebody from KAV confirmed it?

[robis]

-{ Quote: "Just to make sure, can you confirm that KAV actually employs WFP? Has somebody from KAV confirmed it?" }-

No I cant confirm because I do not know how to recognize if it is WFP. I only know that works.

KIS has NDIS driver for filtering when i am looking on network details.

[Marcos]

ESET, too, uses an NDIS driver for filtering the communication by the firewall. For HTTP/POP3 checking, we use WFP in Vista SP2 and newer.

[robis]

-{ Quote: "ESET, too, uses an NDIS driver for filtering the communication by the firewall. For HTTP/POP3 checking, we use WFP in Vista SP2 and newer." }-

But problem was found in Vista SP1 when Smart security comes vith 4-th version. Are you sure that WFP was used from SP2? not from SP1?

[Marcos]

-{ Quote: "But problem was found in Vista SP1 when Smart security comes vith 4-th version. Are you sure that WFP was used from SP2? not from SP1?" }-

Whether or not WFP is used depends on the build of v4. Newer builds support WFP from Vista SP2.

[robis]

-{ Quote: "Whether or not WFP is used depends on the build of v4. Newer builds support WFP from Vista SP2." }-

But problem I found in SP1 when SS4 was released. If first version not using WFP in SP1 then problem is not in WFP. Am I right?

[Marcos]

The earlier builds of v4 utilized WFP from Vista SP1, the latest builds support WFP from Vista SP2.

[robis]

-{ Quote: "The earlier builds of v4 utilized WFP from Vista SP1, the latest builds support WFP from Vista SP2." }-

ok now I understand thank you

Did eset contact microsoft about this bug in wfp?

[robis]

bump .

[agoretsky]

Hello Robis,

ESET works with Microsoft on a number of things, including issues like this.

Regards,

Aryeh Goretsky

[robis]

-{ Quote: "Hello Robis,

ESET works with Microsoft on a number of things, including issues like this.

Regards,

Aryeh Goretsky" }-

OK thanks for responding
It is possible to se somewhere progres of this issue?

[agoretsky]

Hello,

As I understand it, Microsoft would make a change to WFP functionality when a Service Pack is released, so checking the technical documentation for Service Pack 2 and then on MSDN for information about WFP would be a good start.

Regards,

Aryeh Goretsky

[robis]

-{ Quote: "Hello,

As I understand it, Microsoft would make a change to WFP functionality when a Service Pack is released, so checking the technical documentation for Service Pack 2 and then on MSDN for information about WFP would be a good start.

Regards,

Aryeh Goretsky" }-

ESET used bugged functionality of WFP and user must read whole documentation? I am shocked..
Its sounds like we have new tool lets use it, it does not matter that new tool is buggy It is new than use it.

If esset knows bug from SP1 and now from SP2 why they are still using buggy WFP?

[agoretsky]

Hello,

I think you misunderstood my previous message.

Microsoft changes things all the time--sometimes these changes are related to security issues, but they could also be to fix bugswhich are non-security related. Microsoft also makes changes to APIs, adding or removing new functions, or changing the way in which an existing one works. That occurs more rarely, though, since it can require a lot of Microsoft as well as third-party software to be updated. Sometimes the changes are at the request of independent software vendors (ISVs) who would like additional functionality.

When API changes occur, ISVs update their products to take advantage of whatever new features or fixes Microsoft has added, which is what happened in this case: Microsoft made changes to WFP, and ESET updated their software for compatibility purposes.

Regards,

Aryeh Goretsky

[trjam]

-{ Quote: "ESET used bugged functionality of WFP and user must read whole documentation? I am shocked..
Its sounds like we have new tool lets use it, it does not matter that new tool is buggy It is new than use it.

If esset knows bug from SP1 and now from SP2 why they are still using buggy WFP?" }-
Geez give me a break. Agoretsky gave you a valid response and no, the sky isnt falling.:dry:

[robis]

-{ Quote: "Hello,

I think you misunderstood my previous message.

Microsoft changes things all the time--sometimes these changes are related to security issues, but they could also be to fix bugswhich are non-security related. Microsoft also makes changes to APIs, adding or removing new functions, or changing the way in which an existing one works. That occurs more rarely, though, since it can require a lot of Microsoft as well as third-party software to be updated. Sometimes the changes are at the request of independent software vendors (ISVs) who would like additional functionality.

When API changes occur, ISVs update their products to take advantage of whatever new features or fixes Microsoft has added, which is what happened in this case: Microsoft made changes to WFP, and ESET updated their software for compatibility purposes.

Regards,

Aryeh Goretsky" }-

Yes I understand but:

ESSET SS4 was released - problem starts VISTA SP1 64b
now after many months with SS4 VISTA SP2 64b problem still there

I am using v 4 since was released ... from my point of view I am paying for product witch not working correctly since was released. If ESSET knows that why ESSET using bugged WFP instead another nobuggy technology? I know that microsoft updating they products but, I dont understand why so long is this functionality in ESSET SS 4 working bad.
FYI: This bug was announced to esset since SS was released.

[agoretsky]

Hello Robis,

If you review messages #15 (http://www.wilderssecurity.com/showpost.php?p=1522578&postcount=15) and #23 (http://www.wilderssecurity.com/showpost.php?p=1523113&postcount=23) from Marcos earlier in this message thread, you will see that ESET is using Microsoft's recommended method for implementing this type of security, and that the issue does not seem to be with ESET's software, but rather with what happens on Microsoft's side. As Marcos wrote in message #17 (http://www.wilderssecurity.com/showpost.php?p=1523113&postcount=17) the solution is to not measure ping using HTTP as this skews the results.

Regards,

Aryeh Goretsky

[robis]

-{ Quote: "Hello Robis,

If you review messages #15 (http://www.wilderssecurity.com/showpost.php?p=1522578&postcount=15) and #23 (http://www.wilderssecurity.com/showpost.php?p=1523113&postcount=23) from Marcos earlier in this message thread, you will see that ESET is using Microsoft's recommended method for implementing this type of security, and that the issue does not seem to be with ESET's software, but rather with what happens on Microsoft's side. As Marcos wrote in message #17 (http://www.wilderssecurity.com/showpost.php?p=1523113&postcount=17) the solution is to not measure ping using HTTP as this skews the results.

Regards,

Aryeh Goretsky" }-

ok but why simply page www.seznam.cz with this proactive version is loading about 15-30 seconds? if I unticked then within 1-2 seconds? I used web ping only as number for better explanation.

[agoretsky]

Hello,

I am not sure. It could be an issue with how the software is configured, or with the type of network connection in use.

Since you mentioned Seznam, by any chance are you located in the Czech Republic or Slovak Republic? If so, perhaps it would be easier to get your questions answered if you called ESET's headquarters and asked to speak to an engineer.

Regards,

Aryeh Goretsky

[robis]

-{ Quote: "Hello,

I am not sure. It could be an issue with how the software is configured, or with the type of network connection in use.

Since you mentioned Seznam, by any chance are you located in the Czech Republic or Slovak Republic? If so, perhaps it would be easier to get your questions answered if you called ESET's headquarters and asked to speak to an engineer.

Regards,

Aryeh Goretsky" }-

Yes I am form czech ... but from support I hear only wait for new version ... since 4 was released. It doesent matter if www is seznam.cz or other site. Fact is that www with few objects is loading very slow.

Connection to internet is garanted 4Mbit/1Mbit. I have router ASUS WL-500W ... but if I directly connect internet is it same.

[robis]

At WFP forum some good man tell me try this:

NET STOP BFE

At my PC this command kills 2 services IPSec

after killing all is ok ping is 20ms

1)What BFE and IPSec services do?


2)If i disable this services what with security? I have smart security 4 is it ok is this replacing BFE and IPSec and Windows firewall?

I tried disabled one by one and problem is caused by BFE service. If i manualy shutdown by NET STOP BFE then all is ok. But if I all those services stop and set to dissabled than my computer is booting to blue screen :/ .


I tried uninstall smart security and boot with disabled services that is ok. But when I am trying install SS4 then i got bluescreen.

Why when I install SS 4 or booting windows where SS4 starting must be BFE service enabled?

Strange is that if I stop BFE and run again BFE then all works ok. When ESET SS4 is starting it seams that corrupt BFE functionality.

[stackz]

BFE Service -
http://itsvista.com/2007/03/base-filtering-engine/

[robis]

I speak with microsoft man we together create test case via WFPUtil.
He gets my logs from that application and he say:


I've received the files and am looking them over. 1 thing I noticed is that Eset uses 5 filters, 3 of which would affect IPv4 traffic, of these 3, 1 is specific to TCP.
On an outbound flow, one of Eset's callout gets invoked (ALE_AUTH_CONNECT_V4). when the reply comes back another of their callout's gets invoked (ALE_AUTH_RECV_ACCEPT_V4) Additionally if the packet is a TCP packet (such as HTTP), then another of their callouts is invoked (INBOUND_TRANSPORT_V4). You would ned to have talks with them as to the performance and what they are doing in the callouts at those layers.
I am seeing 2 drops of multicast packets, and a lot of errors in regards to stream injection and removing associated contexts.

Marcos or Agoretsky please where should I send those logs from WFPUtil?

[agoretsky]

Hello,

Please mail them to support@eset.sk, along with a link to this message thread.

Regards,

Aryeh Goretsky

[robis]

Hi

Now email was send with included file link to discusion

please let me know if you found something

EDIT: I got email from ESSET that i didint have ticket number. Do you have those logs?

[robis]

Aryeh Goretsky any news about that?

[robis]

Marcos or Agoretsky

Could you check the log? How it looks?

[robis]

Still waiting for answer from Marcos or Agoretsky

[agoretsky]

Hello,

When you initially contacted ESET's technical support department, did you receive a ticket or case number?

Regards,

Aryeh Goretsky

[robis]

-{ Quote: "Hello,

When you initially contacted ESET's technical support department, did you receive a ticket or case number?

Regards,

Aryeh Goretsky" }-


this is answer

-{ Quote: "Hi

Now email was send with included file link to discusion

please let me know if you found something

EDIT: I got email from ESSET that i didint have ticket number. Do you have those logs?" }-


from email

Dear Customer,

Your email request does not contain a valid ticket number. If you already have a support request open with ESET Customer Service, please use the "Reply" function to respond to any email received from our Customer Service Representative.

In case you would like to open a new service request, please use our technical support form found in the "Help and support" section in your version of our product (applies to ESET Smart Security and ESET NOD32 Antivirus version 3 and higher). Alternatively, you are free to use the Technical Support Form on our webpage as follows:

http://www.eset.eu/support/form

Kind regards,

ESET Customer Service

Aupark Tower, 16th floor,
851 01 Bratislava,
Slovak Republic
www.eset.eu

I will send them again via ESET UI form.

[robis]

Email was send with logs from Smart security v 4.0.424.0 but it is same as 4.0.437.0 and versions before.

[agoretsky]

Hello,

Just to confirm, you never received a ticket number when you initially contacted ESET, and you used the in-product support form to open the ticket?

Regards,

Aryeh Goretsky

[robis]

-{ Quote: "Hello,

Just to confirm, you never received a ticket number when you initially contacted ESET, and you used the in-product support form to open the ticket?

Regards,

Aryeh Goretsky" }-

When I used email than no ticket.
When I used form from ESET SS 4 then i got ticket number EIA-491051 .

Could you please look at those logs?

[agoretsky]

Hello,

I have asked ESET's support department to contact you regarding the ticket.

Regards,

Aryeh Goretsky

[robis]

waiting for answer from ESET
could somebody from ESET answer or give coments about this logs?

because I read again my mail from eset and after I send this WFP logs eset send me Ticket number

Ticket ID: EIA-491051
Oddělení: support cz
Priorita: Low
Stav: Closed

but with status closed :)

[agoretsky]

Hello,

I do not actually have access to the Czech office's support ticketing system (I'm in the US office) but I would suggest contacting them and asking them to keep the ticket open until you have a chance to download the next version and validate its operation in your computing environment.

Regards,

Aryeh Goretsky

[robis]

-{ Quote: "but I would suggest contacting them and asking them to keep the ticket open until you have a chance to download the next version and validate its operation in your computing environment.

Regards,

Aryeh Goretsky" }-

I wrote email but waiting for response maybe 3 days

[robis]

Still waiting ... maybe eset has a lot of emails :)

[Marcos]

The case is actually being investigated by the developers which will take some time.

[robis]

I received email from esset that this thing is now out of czech office.


-{ Quote: "The case is actually being investigated by the developers which will take some time." }-

Thanks Marcos

Is there possibility to be more informed?

and question about new release SS4 what is meaning by:
■Improved: HTTP scanning compatibility
■Other minor fixes and improvements

I tested latest version ... same error

[robis]

How it is lookslike?

[robis]

I have same isue with ESET SS4 and Google chrome ... ping are 500ms +-

when I disable this function (Active check HTTP) then 20ms

[robis]

still no respond from esset

[Marcos]

A fix has been made which will be available in some of the future builds.

[robis]

-{ Quote: "A fix has been made which will be available in some of the future builds." }-

wow

thanks marcos it is great news

it is possible somehow test it? or i must wait for next application build?

[Marcos]

No, it's not possible. Due to big changes in the code it won't be released some time soon and must undergo in-depth internal tests before it's provided as a beta.

[robis]

-{ Quote: "No, it's not possible. Due to big changes in the code it won't be released some time soon and must undergo in-depth internal tests before it's provided as a beta." }-


how do i found that this correction was released?

[Marcos]

-{ Quote: "how do i found that this correction was released?" }-

A new beta will be announced when available.

[robis]

-{ Quote: "A new beta will be announced when available." }-

ou this I understand but what should i look for?

FIXED: xxxxxxxxxxxxx

what will be xxxxxxxxxxxxx

[pegas]

-{ Quote: "ou this I understand but what should i look for?

FIXED: xxxxxxxxxxxxx

what will be xxxxxxxxxxxxx" }-
Hi my Czech mate ;), no offence but I suggest you to take it easy a bit. I think the Eset's moderators have been replying you with the highest degree of patience however I am sort of afraid you always will have a counter reply. As far as this thread is concerned, I think it stands in very clear position ... Wait for new beta and if you encounter the same problems then come back and discuss them. Sry I had to ;D.

[robis]

Hi
after long time:

in IE pings are ok now
in FF pings are ok now
in Orca browser pings are ok now
in Google chrome pings are not OK still same problem pings are 500-1000ms

What was changed during my last reply?

[agoretsky]

Hello,

ESET Personal Firewall v1054 was released, as mentioned in this (http://www.wilderssecurity.com/showthread.php?t=257831) message thread.

Regards,

Aryeh Goretsky

[robis]

If nolimiter installed:
Still problem in Google chrome pings are not OK still same problem pings are 500-1000ms.

If network limiter is installed
Still same problems pings are 500-1000ms for all browsers.

any news?

[robis]

any news?

[agoretsky]

Hello,

Have you re-tested with the beta-test version of ESET Smart Security v4.2.22.0?

Regards,

Aryeh Goretsky

[robis]

yes
same isue on vista 64b SP2