Slow performance after applying post-4.91 Client patches

After applying one of the post-4.91 NWFILTER patches, workstations experience performance degredation when logging in, mapping drives, or any other operation involving a Universal Naming Convention (UNC) path. These patches include:

Novell Client post-4.91 SP1, and SP2 NWFILTER (491presp_nwfilter.zip)
Novell Client post-491 SP3 NWFILTER (491psp3_nwfilter.zip)
Novell Client post-4.91 SP4 NWFILTER (491psp4_nwfilter.zip)

This problem is resolved by upgrading to the Novell Client 4.91 SP5. An improved UNC path filter ( the NWFILTER.SYS module which was removed by applying the post-4.91 SP4 patches listed above) has been re-introduced in the SP5 build.

The performance problem is caused by the application of the NWFILTER patch, as this patch actually removes NWFILTER.SYS and the UNC filter functionality it provides. This likely result is documented in the NWFILTER security patch readme as follows:

"While applying this patch removes the possibility of being affected by the security vulnerability, it also removes the functionality of NWFILTER.SYS. This could result in performance delays when an application needs to resolve a name in order to locate a network resource. See KB 10080741 for more information about NWFILTER.SYS."

The NWFILTER patch is a Novell Client security update released in November, 2007. It disables the UNC Path Filter feature due to a security vulnerability which has never been seen outside of a test environment. Regardless of the likelihood of a particular security vulnerability, Novell must respond. In this case, providing a proper fix was deemed to be not feasible, so the NWFILTER "patch" was provided to disable it altogether.

The Multiple Uniform Naming Convention (UNC) Provider (MUP), MUP.SYS, is a Windows service that assists in locating network resources that are identified via UNC. The MUP receives commands containing UNC names from applications and sends the name to each registered UNC provider, (local area network (LAN) Manager workstation, NetWare Services, etc.), that are installed. When a provider identifies a UNC name as its own, the MUP automatically redirects future instances of that name to that provider.

The "UNC Path Filter" feature provided by NWFILTER.SYS caches the names of Novell Servers so that MUP doesn't attempt a Microsoft client connection to a NetWare server, only to find out that it isn't a Microsoft server. This failed attempt, of course, introduces a delay. The UNC Path Filter feature (NWFILTER.SYS) eliminates that delay.