Slow performance after applying post-4.91 Client patches

This document (7000668) is provided subject to the disclaimer at the end of this document.

Environment

Novell Client for Windows 2000/XP/2003 4.91 Support Pack 1
Novell Client for Windows 2000/XP/2003 4.91 Support Pack 1a
Novell Client for Windows 2000/XP/2003 4.90 Support Pack 2
Novell Client for Windows 2000/XP/2003 4.91 Support Pack 3
Novell Client for Windows 2000/XP/2003 4.91 Support Pack 4

Situation

After applying one of the post-4.91 NWFILTER patches, workstations experience performance degredation when logging in, mapping drives, or any other operation involving a Universal Naming Convention (UNC) path. These patches include:

Novell Client post-4.91 SP1, and SP2 NWFILTER (491presp_nwfilter.zip)
Novell Client post-491 SP3 NWFILTER (491psp3_nwfilter.zip)
Novell Client post-4.91 SP4 NWFILTER (491psp4_nwfilter.zip)

Resolution

This problem is resolved by upgrading to the Novell Client 4.91 SP5. An improved UNC path filter ( the NWFILTER.SYS module which was removed by applying the post-4.91 SP4 patches listed above) has been re-introduced in the SP5 build.

Additional Information

The performance problem is caused by the application of the NWFILTER patch, as this patch actually removes NWFILTER.SYS and the UNC filter functionality it provides. This likely result is documented in the NWFILTER security patch readme as follows:

"While applying this patch removes the possibility of being affected by the security vulnerability, it also removes the functionality of NWFILTER.SYS. This could result in performance delays when an application needs to resolve a name in order to locate a network resource. See TID 10080741 for more information about NWFILTER.SYS."

The NWFILTER patch is a Novell Client security update released in November, 2007. It disables the UNC Path Filter feature due to a security vulnerability which has never been seen outside of a test environment. Regardless of the likelihood of a particular security vulnerability, Novell must respond. In this case, providing a proper fix was deemed to be not feasible, so the NWFILTER "patch" was provided to disable it altogether.

The Multiple Uniform Naming Convention (UNC) Provider (MUP), MUP.SYS, is a Windows service that assists in locating network resources that are identified via UNC. The MUP receives commands containing UNC names from applications and sends the name to each registered UNC provider, (local area network (LAN) Manager workstation, NetWare Services, etc.), that are installed. When a provider identifies a UNC name as its own, the MUP automatically redirects future instances of that name to that provider.

The "UNC Path Filter" feature provided by NWFILTER.SYS caches the names of Novell Servers so that MUP doesn't attempt a Microsoft client connection to a NetWare server, only to find out that it isn't a Microsoft server. This failed attempt, of course, introduces a delay. The UNC Path Filter feature (NWFILTER.SYS) eliminates that delay.

Document

Document ID:	7000668
Creation Date:	06-13-2008
Modified Date:	12-24-2008
Novell Product:	Novell Client

Disclaimer

The Origin of this information may be internal or external to Novell. Novell makes all reasonable efforts to verify this information. However, the information provided in this document is for your information only. Novell makes no explicit or implied claims to the validity of this information.
Any trademarks referenced in this document are the property of their respective owners. Consult your product manuals for complete trademark information.