Ransomware attackers specifically target and attempt to destroy backup systems to increase the probability of payment. Hardening your system is critical. Please ensure you have reviewed your platform security using the Security Hardening Checklist
Cohesity

COHESITY Documentation

Explore our documentation to get started, discover products & new features, access troubleshooting guides, register sources, platforms support.

Products
Data Security Alliance
Visit Cohesity.com
Demos
Support
Blogs
Developers
Partner Portals
Cohesity Community
© 2026 Cohesity, Inc. All Rights Reserved.
Terms of Use|
Privacy Policy|
Legal|
  1. Home
  2. Veritas NetBackup™ Deduplication Guide
  3. Configuring deduplication
  4. About MSDP fingerprinting
Veritas NetBackup™ Deduplication Guide

About MSDP fingerprinting

NetBackup uses a unique identifier to identify each file and each file segment that is backed up. The deduplication plug-in reads the backup image and separates the image into files. The plug-in separates the files into segments. For each segment, the plug-in calculates the hash key (or fingerprint) that identifies each data segment. To create a hash, every byte of data in the segment is read and added to the hash.

NetBackup 8.0 and previous versions use fingerprinting calculations that are based on the MD5-like algorithm. Starting with NetBackup 8.1, the fingerprinting calculations are based on a more secure SHA-2 algorithm. On a system that is upgraded to the 8.1 version, every new segment is computed with the SHA-2 algorithm. A data rolling conversion task works in the background to convert the existing MD5-like fingerprints to SHA-2 fingerprints, gradually.

See About the rolling data conversion mechanism for MSDP.

NetBackup 8 .1 can handle both fingerprint types, and the new server is compatible with old clients and old servers. When you perform a backup from an old client to a new server or when you duplicate data from an old server to a new server, conversion from MD5-like to SHA-2 occurs inline on the new server before the data is saved to the disk. Similarly, when you duplicate data from a new server to an old server, conversion from SHA-2 to MD5-like occurs inline on the new server before the data is sent to the old server.

Notes and restrictions that there are some known issues for the compatibility support.

  • The fingerprint conversion requires additional computation time. The interaction between old clients and old servers and new server is slower than if both the client and the server are new.

  • You cannot restore data that is backed up using SHA-2 algorithm on a media server that uses the MD5-like algorithm. However, you may choose to restore the SHA-2 fingerprint data on a new media server.

  • Similarly, you cannot use client-direct restore to restore data that is backed up using Client Direct deduplication on a media server that uses the MD5-like algorithm. However, you may choose to restore the data on a new media server.

  • If you are using two types of media servers for load balancing, where one media server uses MD5-like algorithm and the other media server uses the SHA-2 algorithm, the initial backup may lose deduplication ratio. Therefore, split the old media servers and the new media servers into different groups, and create different storage unit for each of them.

  • When data is backed up from a NetBackup 7.5 or previous version client, using Client Direct deduplication, most of the data is transferred over the network and deduplicated on the server. This may save storage, but it does not reduce network throughput. It is recommended that you upgrade the NetBackup client to the latest version.

More Information

About the MSDP fingerprint cache

Media server deduplication backup process

MSDP client - side deduplication backup process

Feedback

Was this page helpful?
Previous

Configuring deduplication plug-in interaction with the Multi-Threaded Agent

Next

About the MSDP fingerprint cache

Feedback

Was this page helpful?