PS7 – Network Activity Port 445 Opening Image File

KR
Posted By
Kevin_Rawls
Mar 1, 2004
Views
921
Replies
28
Status
Closed
Problem:
-Users are experiencing a long delay, ranging from 5 seconds to 30+ seconds when opening an image using Adobe Photoshop 7.0 from the local hard drive.

Initial Analysis:
-The long delay is only experienced when the image file resides on the local hard drive (C:\). -If the image file resides on any other storage device (network drive, cd-rom, usb drive, floppy), it opens normally, almost instantly.
-Opening the image file while having local admin permissions, opens the file normally, even if it resides on the local hard drive.
-Unplugging the network cable, opens the file normally, even if it resides on the local hard drive.

Troubleshooting/Observations:
-There seems to be heavy network activity during the time Photoshop is opening the image file. Photoshop will not completely open the file until the network activity is finished. Several observations show that from the time the image file is double clicked from Windows Explorer, Photoshop opens, heavy network activity begins, approximately 5000+ packets are received/sent through the NIC, network activity stops, Photoshop opens the image successfully. This process can take anywhere between 5 to 30+ seconds.
-A local user account (non-admin) does not see latency when opening files (not bound to a domain controller)
-A domain user account without local admin rights experiences the latency. -Size of the image file is not relevant to how long the latency will last. File sizes that were used include, 38MB .tif | 24KB .jpg | 2.4MB .bmp
-Unplugging the network cable resolves the latency because no network activity can occur. -Unknown why having local admin rights eliminates the network activity, thus eliminating the latency in opening image files in Photoshop 7.0.
-Disabling NetBIOS over TCP/IP also resolves the issue, but mapped drives and network printers need to have this service enabled. Not a solution.
-After viewing a network port analyzer results, the network traffic is going directly to the domain controller via port 445.

Question for Adobe:
-Why does PS7.0 need to contact the domain controller only when the image file is opened from the local hard drive. Opening image files from a network drive does not cause this network activity. What is it authenticating before it opens the image file? It does this every time an image is opened from the C:\ drive.

Seems like this problem only hinders domain users. Oh and I have cleared the pref settings, which didn’t help at all.

Regards,
Kevin
Related Tags
file image network open

MacBook Pro 16” Mockups 🔥

– in 4 materials (clay versions included)

– 12 scenes

– 48 MacBook Pro 16″ mockups

– 6000 x 4500 px

DS
Dave Simpson
Mar 1, 2004
That’s an interesting one. Port 445 is the Microsoft DS (Denial of Service) port, which happens to be vulnerable to the Lioten, Randon, WORM_DELODER.A, W32/Deloder.A, and W32.HLLW.Deloder viruses/worms. Now I’m not an expert on port 445, specifically – other processes that use Server Message Block (SMB) may use it as well.

What type of network are you running? OS and version, please. How many nodes on your network? Does the computer that is storing files on the C: drive run a different version of Windows than the PDC/BDC? How are your permissions set up for the folder that contains the stored files on the C: drive? Are you using individual user permissions or group permissions?

—
Dave Simpson
RND Solutions – Creative Graphic Design

(619) 322-3385 (Local San Diego)
(888) 690-0938 (Nationwide)
http://www.rnd-solutions.com

wrote in message
Problem:
-Users are experiencing a long delay, ranging from 5 seconds to 30+
seconds when opening an image using Adobe Photoshop 7.0 from the local hard drive.
Initial Analysis:
-The long delay is only experienced when the image file resides on the
local hard drive (C:\).
-If the image file resides on any other storage device (network drive,
cd-rom, usb drive, floppy), it opens normally, almost instantly.
-Opening the image file while having local admin permissions, opens the
file normally, even if it resides on the local hard drive.
-Unplugging the network cable, opens the file normally, even if it resides
on the local hard drive.
Troubleshooting/Observations:
-There seems to be heavy network activity during the time Photoshop is
opening the image file. Photoshop will not completely open the file until the network activity is finished. Several observations show that from the time the image file is double clicked from Windows Explorer, Photoshop opens, heavy network activity begins, approximately 5000+ packets are received/sent through the NIC, network activity stops, Photoshop opens the image successfully. This process can take anywhere between 5 to 30+ seconds.
-A local user account (non-admin) does not see latency when opening files
(not bound to a domain controller)
-A domain user account without local admin rights experiences the latency. -Size of the image file is not relevant to how long the latency will last.
File sizes that were used include, 38MB .tif | 24KB .jpg | 2.4MB .bmp
-Unplugging the network cable resolves the latency because no network
activity can occur.
-Unknown why having local admin rights eliminates the network activity,
thus eliminating the latency in opening image files in Photoshop 7.0.
-Disabling NetBIOS over TCP/IP also resolves the issue, but mapped drives
and network printers need to have this service enabled. Not a solution.
-After viewing a network port analyzer results, the network traffic is
going directly to the domain controller via port 445.
Question for Adobe:
-Why does PS7.0 need to contact the domain controller only when the image
file is opened from the local hard drive. Opening image files from a network drive does not cause this network activity. What is it authenticating before it opens the image file? It does this every time an image is opened from the C:\ drive.
Seems like this problem only hinders domain users. Oh and I have cleared
the pref settings, which didn’t help at all.
Regards,
Kevin
CC
Chris_Cox
Mar 2, 2004
Most likely it’s looking for a network connected printer. If that printer is missing, it can cause a delay at launch.

Also, VersionCue can contact localhost (the machine itself) – but that doesn’t seem to be what you’re seeing.

If you haven’t disabled the Adobe Online Manager, it will check for updates at launch time if connected to a network.
KR
Kevin_Rawls
Mar 2, 2004
This problem occurs with a brand new account, no mapped drives, no mapped printers. No previously mapped printers or drives since the account is new.

The network activity is to the domain controller in every case I’ve tested. It’s not the same one each time as a computer can contact many domain controllers.

AOM has been disabled both in Photoshop settings and in registry. Network Port Analyzer proves there is no communication to Adobe during launch time, only to domain controller.

The question is, why does the network activity occur only when the image file is opened from the local c:\ drive? The network activity does not occur when the image file is opened from a mapped network drive. Then, it opens immediately.

Is this a normal Photoshop behavior when using a domain user account versus a local user account?
CC
Chris_Cox
Mar 4, 2004
Photoshop doesn’t know anything about domain controllers — so it’s probably some part of Windows touching the network.
SW
Steve_Weightman
Jul 29, 2004
Kevin: The network traffic happens with local accounts as well, it’s just not as noticeable.

Kevin: The Network Port Analyzer is probably only showing traffic between the domain controller and the local machine, not outside the network past firewalls and or proxy servers. It could in fact be communicating with Adobe’s website.

Chris: "Photoshop shop doesn’t know anything about domain controllers"? I have saved EtherPeek traces showing photoshop.exe directly accessing HKLM to get Tcpip Parameter information in preparation for the network traffic it initiates. Why is it doing this?
DM
dave_milbut
Jul 29, 2004
Why is it doing this?

online updates maybe?

turn them off. there won’t be anymore updates for 7 anyway.

now about the problem. is it possibly looking for a network printer that’s offline?

can it be trying to access a file that was opened at one time from the network and now is gone (deleted or moved)? check your recent files list to see what’s in there.
KR
Kevin_Rawls
Aug 2, 2004
Steve: If the network traffic was going out to Adobe’s website the destination ip address would show. Also, since I’m in an enterprise environment, we route all http(s) traffic through a proxy server (port 80). This does not show up in any of the traces. I’ve turned off auto updates in the registry and in the program itself, none helps the issue. I don’t see the network traffic to the domain controller when opening the image file from any other storage source, except C:\.

Dave: I’ve created a domain user account with no admin permissions. Also, I’ve reimaged a box and cleanly loaded PS7. Since the user account is new, no mapped drives or mapped printers exist. Also, no previous Adobe history is available since PS7 was just installed, no recent files. Problem is still evident. It is quite interesting that disabling NetBIOS over TCP/IP makes the problem go away, however the user will not have any mapped drives/printers. I’ve even removed all GPO’s from user/computer. I can duplicate the issue on any domain workstation, not just specific ones.

For Adobe: Why does Adobe PS7 need to access the network (domain controller) when opening an image file? It only does it when opening the file from the C:\ drive. Is it attempting an authentication method? Is it because the File Browser was added to version 7.0?

Does Adobe have any debug tools for Photoshop 7?

Regards,
Kevin
CC
Chris_Cox
Aug 2, 2004
That sounds like you’ve got a default network printer or something.

Photoshop does NOT access the network when opening an image. But if you have a default printer set to a network printer, then we have to initialize some information that may try to access the printer (that is the OS/driver’s doing, not Photoshop’s).
KR
Kevin_Rawls
Aug 2, 2004
Chris: No default printers at all. Printers folder is empty. There are *NO* printers installed or attached to the workstation.

"Photoshop does NOT access the network when opening an image."

Here is one of the lines from the filemon capture (network named pipes): 12:57:58 PM Photoshop.exe:1728 FSCTL_PIPE_TRANSCEIVE \\DC01.domain.com\PIPE\samr SUCCESS WriteLen: 44 ReadLen: 3036

This clearly shows application "Photoshop.exe" is passing data to local Domain Controller. This line is repeated over and over throughout the filemon log.

Additionally, a netmon capture shows the same network activity, but to multiple domain controllers (DC01 and DC02) via port 445.

Question: Is there a way to disable the File Browser function in Photoshop 7.0?
CC
Chris_Cox
Aug 2, 2004
No, that shows that something running from process Photoshop.exe is accessing the network.

Drivers and many parts of the OS will run from within the process.

Photoshop itself does not access the network like that (even VersionCue just hits localhost).

You need to figure out what on your system is trying to connect to the network and fix it.

But it isn’t Photoshop.
SW
Steve_Weightman
Aug 2, 2004
I agree with Kevin, when opening local image files in Photoshop 7, something either compiled in photoshop.exe, or something it kicks off that still shows up as photoshop.exe in any monitor program is definitely retrieving tcp/ip information from the registry and inititating a connection via port 445. Disabling NETBios over tcp/ip stops this from happening.

I have a fresh install on a clean box with no printers and it still happens, over and over again. The average latency to open images is anywhere between 30-60 seconds.

"Drivers and many parts of the OS will run from within the process." I don’t understand this statement. Are we not supposed to believe that what is running under the process name ‘photoshop.exe’ is not directly associated with starting and/or using Photoshop 7?
CC
Chris_Cox
Aug 2, 2004
Steve – if Photoshop asks for printer information, and the printer driver goes out on the net, it will look as if the request came from Photoshop (because the printer driver doesn’t have a separate process).

Again – Photoshop isn’t going out to the network by itself.
SW
Steve_Weightman
Aug 2, 2004
I understand. So, in the instances mentioned in this thread where there are no printers (mapped or otherwise), which seems to me would be the only thing photoshop would need to go get info for, what else could be causing it? The File Browser feature?
CC
Chris_Cox
Aug 2, 2004
No, the file browser only uses file system calls, and only when it’s open.

Again, you need to look at the rest of the system.
DM
dave_milbut
Aug 3, 2004
how about plugins? will they go out to the net and report under the photoshop name? any of the default ones? how about digimarc?
CC
Chris_Cox
Aug 3, 2004
None of the default plugins or Digmarc will touch the net.

VersionCue (and it checks localhost by default), checking for updates (not in this case), the OS and drivers are the only options. (other than the usual viruses, trojan horses, worms, etc.)
M
MarcPawliger
Aug 3, 2004
See http://ntsecurity.nu/papers/port445/ This shows Windows is using the port. Version Cue, when it is enabled, uses port 3703 (See http://www.creativepro.com/story/feature/21052.html)

–marc
SW
Steve_Weightman
Aug 3, 2004
Marc: Thanks for the info. I think we can all agree that NETBios is running on port 445, and we know how it works. We just don’t know what in photoshop is kicking it off when opening an image file, especially on a clean box with a fresh install with no peripherals or mapped drives. I only get the port 445 traffic when running photoshop.
KR
Kevin_Rawls
Aug 3, 2004
Adobe Support:

Is it possible to get Adobe to duplicate this latency issue in a "test lab"? (Windows 2000 domain environment)

The question of what part of Adobe is creating the network traffic (port 445) or what part of Adobe is calling another OS driver/process to produce network traffic has been voiced several times in this post. Does Adobe have any technical reference/documentation for this latency/network traffic behavior? Are they blaming the Operating System (Micorosoft) for this issue and not Adobe Photoshop 7.0? As Steve mentioned, this traffic is only produced when running Photoshop 7.0.

This latency problem does not occur with Photoshop 6.0 in my environment. Only Photoshop 7.0 has this problem. Was there a huge change from versions 6.0 to 7.0 concerning the need to access the network upon opening an image file?

Kevin
DM
dave_milbut
Aug 3, 2004
Are they blaming the Operating System (Micorosoft) for this issue and not Adobe Photoshop 7.0?

that’s what it sounds like to me… and we’re not adobe support. this is a user to user forum. any adobe people who happen to (or not) show up here do so on their own nickel.
KR
Kevin_Rawls
Aug 3, 2004
Thanks Dave. Appreciate your assistance.
CC
Chris_Cox
Aug 3, 2004
NO part of Adobe’s code is using port 445.

Lots of parts of Adobe’s code call the OS and drivers.

Again, Photoshop does NOT access the network when opening files other than using VersionCue (which is on a different port).

You’re still asking all the wrong questions.

You need to look at YOUR system configuration and figure out what is using that port.
M
MarcPawliger
Aug 5, 2004
In article ,
wrote:

Marc: Thanks for the info. I think we can all agree that NETBios is running on port 445, and we know how it works. We just don’t know what in photoshop is kicking it off when opening an image file, especially on a clean box with a fresh install with no peripherals or mapped drives. I only get the port 445 traffic when running photoshop.

That is strange, and not something we’ve seen before (and we have tested with network sniffing on).

What flavor of Win2K is this?

–marc
SW
Steve_Weightman
Aug 5, 2004
Marc: We’re running WIN2K boxes with SP4 on them. Again, both local and domain accounts are experiencing this port 445 traffic. The domain accounts get a lot more traffic however which is how this issue was noticed in the first place. We are using freshly imaged boxes and installing from the Photoshop 7 install cd with a license key. There are no mapped drives or peripherals of any kind.

If this is determined to be something that cannot be removed from photoshop that’s fine, we just need to identify what it is so we can present it to our customers who are using this app.
SW
Steve_Weightman
Aug 5, 2004
Marc: Specifically the boxes are WIN2K 5.00.2195 with SP4. Thanks again for the help.
CC
Chris_Cox
Aug 6, 2004
Steve – there is nothing IN Photoshop to remove? How many times do I have to say that?

Adobe has no idea what is touching the network on that port – because it is not in our code.
SW
Steve_Weightman
Aug 6, 2004
Chris: I’ve been snooping around here and saw a lot of discussion on disabling or changing the settings for the File Browser. This seems like a good thing to try. Where are the preferences for it in PS7? Thanks.
DM
dave_milbut
Aug 6, 2004
Where are the preferences for it in PS7?

there are none. they’re new in ps. in 7 the browser just "did it’s thing". but it wasn’t color managed or high res like in cs. there were also a lot of bugs in 7’s browser. mostly (all?) fixed in the 7.01 update.

How to Master Sharpening in Photoshop

Give your photos a professional finish with sharpening in Photoshop. Learn to enhance details, create contrast, and prepare your images for print, web, and social media.

Related Discussion Topics

Nice and short text about related topics in discussion sections