Not looking to reinvent the wheel here but surely someone else has encountered this. Is there an advanced setting that will enable the Smart Queue to recognize and throttle the win10 updates download stream?
While I had a customer win10 machine in my shop recently I observed that the stock Smart Queue in the ERX 1.9 had no effect on the recent massive win10 update being downloaded. My dl side was saturated and rendered the internet unusable. Resmon showed the stream from 13.107.4.50 utilizing 11.74 of my 12mb download. Disabling the updates and brief testing on both the cust pc and a shop pc showed fq_codel working properly on both, but re-enable the update and the chaos resumed. Ping times to 4.2.2.1/8.8.8.8 went from ~30ms to hundreds with many timeouts. Furthermore dpi classifies this stream as web other.
(My test was simply to run the dslreports speedtest with bufferbloat. Peer to peer was disabled as well as privacy and telemetry settings and diagtrack and dmwappushservice was off.)
The machine has been delivered back to the cust and my shop is all win7pro so unfortunately I don;t even have a win10 machine to gather more hard data with (not a win10 fan at ALL).
There are other threads that have asked this question but I can't find one that has a resolution. I can't imagine what this behavior does to an office full of win10 machines. I have a potential cust (large church) that has allowed unmanaged win10 updates to occur to their entire office and this update activity renders the internet unusable so I am panicking because we planned on an ER8 being the solution to control this sh*tty behavior from ms.
Anyone have a fix for this other than local wsus? My only idea at the moment is to gather the list of source ip's such as in this post and put it in a timed block rule and only allow this malicious traffic at night.