VERY Slow SSL Connection from Win to Linux

Discussion in 'Java' started by katz.merav@gmail.com, Oct 27, 2005.

  1. Guest

    Hi,

    I have a client application connecting to a server using SSL.
    The connection is very very slow.
    When I add the server ip to the windows hosts file it connects quickly
    but I don't want to rely on users doing this ....
    I tried removing all calls to InetAddress.getByName to avoid DNS lookup
    but it didn't help.
    I found the the bottleneck is the SSLSocketFactory.createSocket call.

    Any ideas ???

    Thanks.
     
    , Oct 27, 2005
    #1
    1. Advertising

  2. On 27 Oct 2005 07:26:38 -0700, wrote:
    > I have a client application connecting to a server using SSL. The
    > connection is very very slow. When I add the server ip to the
    > windows hosts file it connects quickly but I don't want to rely on
    > users doing this .... I tried removing all calls to
    > InetAddress.getByName to avoid DNS lookup but it didn't help. I
    > found the the bottleneck is the SSLSocketFactory.createSocket call.
    >
    > Any ideas ???


    Yes, don't rely on the users adding anything to their host files, fix
    your DNS server instead.

    There are probably two (maybe more) places where DNS is used: when the
    client connects using a symbolic name, and when the server does a
    reverse lookup to determine who the client is.

    Use a tool like ethereal to diagnose the problem.

    /gordon

    --
    [ do not email me copies of your followups ]
    g o r d o n + n e w s @ b a l d e r 1 3 . s e
     
    Gordon Beaton, Oct 27, 2005
    #2
    1. Advertising

  3. Guest

    Hi,
    thnx for the quick reply.

    I'm using Ethereal to monitor the network , and when NOT defining the
    server in the "hosts" file - i've notice many NBNS queries (udp,port
    137 . netbios-name-service...) .
    On the other hand - when i added the server to the "hosts" file, i
    didn't see even one query... , so it seems like client's problem , and
    not server's problem .

    any ideas ?
     
    , Oct 27, 2005
    #3
  4. On 27 Oct 2005 09:31:01 -0700, wrote:
    > I'm using Ethereal to monitor the network , and when NOT defining the
    > server in the "hosts" file - i've notice many NBNS queries (udp,port
    > 137 . netbios-name-service...) .
    >
    > On the other hand - when i added the server to the "hosts" file, i
    > didn't see even one query... , so it seems like client's problem ,
    > and not server's problem .
    >
    > any ideas ?


    Yes, just one - this hardly seems to be a java programming issue, so
    I'd suggest a more appropriate forum (such comp.protocols.misc, or a
    windows specific group).

    /gordon

    --
    [ do not email me copies of your followups ]
    g o r d o n + n e w s @ b a l d e r 1 3 . s e
     
    Gordon Beaton, Oct 27, 2005
    #4
  5. Guest

    Thanks you very much for your help.
    I'll try other forums.
     
    , Oct 27, 2005
    #5
  6. Nigel Wade Guest

    wrote:

    > Hi,
    > thnx for the quick reply.
    >
    > I'm using Ethereal to monitor the network , and when NOT defining the
    > server in the "hosts" file - i've notice many NBNS queries (udp,port
    > 137 . netbios-name-service...) .
    > On the other hand - when i added the server to the "hosts" file, i
    > didn't see even one query... , so it seems like client's problem , and
    > not server's problem .
    >
    > any ideas ?


    I think that part of the process of establishing the authenticity of the SSL
    server is that the client will check that the server IP matches that of the
    hostname in the certificate.

    That you client is using netbios-name-service rather than DNS is most likely a
    feature of Windows.

    --
    Nigel Wade, System Administrator, Space Plasma Physics Group,
    University of Leicester, Leicester, LE1 7RH, UK
    E-mail :
    Phone : +44 (0)116 2523548, Fax : +44 (0)116 2523555
     
    Nigel Wade, Oct 28, 2005
    #6
  7. Roedy Green Guest

    On 27 Oct 2005 09:31:01 -0700, wrote, quoted or
    indirectly quoted someone who said :

    >I'm using Ethereal to monitor the network , and when NOT defining the
    >server in the "hosts" file - i've notice many NBNS queries (udp,port
    >137 . netbios-name-service...) .
    >On the other hand - when i added the server to the "hosts" file, i
    >didn't see even one query... , so it seems like client's problem , and
    >not server's problem .
    >
    >any ideas ?


    If it appears the DNS lookup is not being cached, have a look at the
    master time to Live of the master domain server for your domain name
    to see if you need to put a longer freshness date on it.

    You need to know about DNS/BIND to do this. see
    http://mindprod.com/jgloss/dns.html






    --
    Canadian Mind Products, Roedy Green.
    http://mindprod.com Java custom programming, consulting and coaching.
     
    Roedy Green, Oct 28, 2005
    #7
  8. RobertDoidge

    Joined:
    Jul 6, 2007
    Messages:
    2
    Location:
    Marina, CA
    Found a fix.

    I realize this is a VERY old thread, but when I do a Google search on "slow java ssl client connections", this thread is one of the most relevant results I find.

    The problem above is actually a Java problem related to the WINS Name Service in Windows. Basically, a reverse DNS lookup during the SSL handshake causes a long timeout.

    To fix the problem, cache your server address as an InetAddress object and reuse it in the Socket constructor whenever you are making a new connection to your server.

    Thanks to Merav for emailing me his solution.
     
    RobertDoidge, Jul 6, 2007
    #8
  9. tobbebobbe

    Joined:
    Jan 14, 2010
    Messages:
    1
    This is stil a problem.

    Can verify that this is still a issue on the following setup:
    Windows Vista Business SP2
    Sun JDK 1.6.0_17

    The solution (and problem maker) above is correct. Even if accessing a
    SSL-based server with a IP address things slow down.

    You can also add the SSL certificate CN (Common Name) and IP address to
    the host file on the Windows machine to fix the timeout on the reverse DNS lookup.

    //Tobias Höglund
     
    tobbebobbe, Jan 14, 2010
    #9
  10. RobertDoidge

    Joined:
    Jul 6, 2007
    Messages:
    2
    Location:
    Marina, CA
    Tobias,

    Adding the URL and IP address to your hosts file is another option, but you will need to remember to update the entry if your server address ever changes.

    Also, if you're deploying software to client machines, you might want to resist changing the user's system files unless it's absolutely necessary.
    Those types of fixes often create more problems, both for you and the user, than the ones they are solving.

    -Robert
     
    RobertDoidge, Jan 14, 2010
    #10
  11. justkeys

    Joined:
    Feb 9, 2012
    Messages:
    1
    disable naming servies on windows

    1. Control Panel\Network and Internet\Network and Sharing Center\Advanced sharing settings
      turn off network discovery
      turn off file and printer sharing
    2. edit group policy
      compouter configuration / administrative templates / network / DNS client /
      ENABLE "turn off multicast name resolution"
    3. Control Panel\Network and Internet\Network Connections
      properties of the lan adapter
      ipv4 properties
      advanced
      WINS
      disable NetBIOS over TCP/IP
     
    justkeys, Feb 9, 2012
    #11
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Earl Teigrob
    Replies:
    7
    Views:
    471
    Scott M.
    Feb 16, 2004
  2. Krist
    Replies:
    6
    Views:
    804
    Arne Vajhøj
    May 7, 2010
  3. Alf P. Steinbach /Usenet

    Slow -- VERY slow brain

    Alf P. Steinbach /Usenet, Jun 16, 2011, in forum: C++
    Replies:
    17
    Views:
    555
    Noah Roberts
    Jun 29, 2011
  4. Jeremy Chapman

    ssl very slow

    Jeremy Chapman, Jun 26, 2006, in forum: ASP .Net Mobile
    Replies:
    2
    Views:
    798
    Jeremy Chapman
    Jun 27, 2006
  5. Nick Green
    Replies:
    4
    Views:
    221
    Nick Green
    Nov 18, 2009
Loading...

Share This Page