Slashdot Mirror
Comcast Gunning for NAT Users
phillymjs writes: "A co-worker of mine resigned today. His new job at Comcast: Hunting down 'abusers' of the service. More specifically, anyone using NAT to connect more than one computer to their cable modem to get Internet access- whether or not you're running servers or violating any other Acceptable Use Policies. Comcast has an entire department dedicated to eradicating NAT users from their network. We knew this was coming since this Slashdot article from two months ago, but did anyone think they'd already be harassing people that are using nothing more than the bandwidth for which they are paying? It makes me very happy that my DSL kit arrived yesterday, and I'll be cancelling my Comcast cable modem early next week." Earthlink and Comcast have both been advertising lately their single-household, multi-computer services (and additional fees) -- probably amusing to many thousands of broadband-router owners, at least until the cable companies really crack down.
So, what are the methods they use, and how can I make it more difficult for them to tell if I have a machine running NAT?
...my DSL provider, PacBell Internet, actually wants to sell you a NAT router when you sign up for basic home DSL service.
They can catch the scumbags that get the cablemodem and then nat their entire apartment building, or the neighborhood but they will never catch a single family dwelling doing it. the ONLY way to detect it is to watch bandwidth and look for 60-70 connections coming out of that cablemodem. anything less will be false positives as just hitting some websites causes at least 10 connections to other servers for ad's popups, etc...
Besides, how is this going to fly with the AT&T policy of allowing it and even encouraging it? AT&T will gladly sell you a smc or linksys NAT/firewall... that constitutes encouraging it.
Do not look at laser with remaining good eye.
I have to congratulate AT&T. I was in the mediaone (originally Highway1) beta in 1996. As they changed to RoadRunner and AT&T, customer service has definitely gone downhill. There are much longer waits on the phone, and there is greater difficulty in reaching knowledgeable support people.
Furthermore, outages are still too common, and performance is still too variable.
However, the basic service is good, and the attitude of AT&T (at least in Eastern MA) is still good. They tolerated NAT, looking the other way, and then (I think) supported it; they don't block ports; and they don't particularly seem to mind members who run servers, as long as those servers are reasonably secure; even though the service agreement disallows servers (last time I checked).
I read about dimwits like Comcast frequently on Slashdot, and I'm thankful that my provider is still reasonable.
As everybody else is wondering: how do they plan to ferret out NAT users? Go to everyone's home and count the number of computers? ComCast used to be such a nice service, it's a shame what they're doing to it. Lets count the ways they've made the service worse recently:
Still, even with all of these indiscresions, I'm inclined not to believe this story as is. There doesn't appear to be much actual evidence (has anyone been flagged for having a NAT yet?) to support the claims. Also, did the co-worker quit because the job is nigh-impossible? My hoax sense is tingling...
I read the internet for the articles.
Exactly. When Comcast can guarantee that no one will hack into my single computer connection, then I will agree not to use a firewall. Until then I need security, as I get about 5-10 probes per day against my firewall.
You'll find more about my experience with Comcast broadband services on my company's web site, if you are interested.
-- Dave Aiello
Your right (and your link doesn't work), but all those headers are trapped at that device (that is if its working properly) - all comcast would see is the mac address of the nat device (in my case a sun mac address)
To avoid this, get the MAC address from an old NIC, or a machine that will never be connected to the subnet on the cable-modem system, and (assuming your NAT box supports MAC spoofing) configure your NAT box to use that IP address.
More likely than not, the providers are too stupid to do the necessary research, and will look at the high bandwidth users and do a packet sniff to see what their activity looks like.
What if I only have one computer online at a time? I go to work every day, but my wife works from home. Sometimes she's online on her Mac, other times on her PC. When I come home, she's watching TV while I'm on my linux box. How is that a problem?
this is getting old and so are you
blog
How much packet inspection can they do, legally? I realize that they can inspect headers, etc, to their hearts content, but can the ISP really monitor the _contents_ of my packet stream without already having clear evidence of an AUP violation? (I haven't read their AUP, so I don't know).
If they can, then it follows that they may read my email (again, without prior evidence of wrongdoing) in order to enforce their business practices - this seems like a pretty clear violation of privacy.
NOTE - I don't really think that my email is private, nor do I believe that IP traffic is secure - the question I'm asking isn't about the capabilities of the ISP. Rather, I'm curious as to whether or not they have the legal _right_ to monitor my traffic (payload, not headers) without a complaint (or a warrant).
As far as I can tell, they only charge more if you buy their home networking kit for $149. Then they want you to pay $9.95 a month more. If you buy someone else's home networking kit, they don't charge you any more money (according to their FAQ, you're allowed to set up your own home network, they won't support it though.) I guess the $9.95/mo is for support then, still it doesn't make too much sense to me.
The reason that broadband cable access is so cheap is because they don't exect you to use it all of the time.
I say that cable is cheap because you can get near T1 performance (~$600/mo) from a cable line. The companies don't want you online all of the time because it costs them more money for the extra bandwidth.
Its kind of like the 56k ISPs. You can have unlimited hours of use, but they don't want you connected if you're not using it. They don't want an idle connection wasting a phone line. Don't get me wrong though. I'm not on their side. I want to be able to run my network on a cable connection as well. We just need to compromise or something...
"A plan fiendishly clever in its intricacies"- Homer Simpson
I work for Adelphia...and I've yet to see anyone get cut off for this (unless tehy were abusing it). Everyone in my department has a router and multiple PCs....so it's not a big deal:)
At what point do these ISPs stop being 'Internet Providers', and start becoming 'Web Page Providers'? As early as a year ago, an 'Internet Connection' meant that my computer could talk to any other computer that is also on an 'Internet Connection.' Nowadays, though, ISP's are playing games with blocking off what you can do with this connection. It seems like companies like ATTBI really only want to provide you the ability to do what Internet Explorer allows you to do. Anything beyond that and they try to nix it.
They don't want me doing P2P, they don't want me to play games, they don't want me to have more than one computer hooked up, and they don't want me going wireless. How much more can they block off before its no longer really an Internet Connection?
It seems to me that if they are going to behave this way, then they shouldn't be considered Internet Service Providers anymore. They're not! You can't call it an ISP if they're telling you you can't do the things that makes the Internet the Internet. I have two computers on the net at home. One I use just as an email terminal (very low bandwidth), and the other is where I go cruising the web and do IM etc. Until they tell me that I can only use so much bandwidth, they have no business telling me I can't use more than one computer. They advertise "unlimited bandwidth, 24-7", and then they play these silly games with me. It really makes me want to sue for false advertising.
"Derp de derp."
Actually, they can't win in court because of precedent. The phone companies tried suing people with home PBXs some time back. The courts decided that what happens with the service after it hits the home is none of the phone company's business and the consumer is allowed to use the service they paid for in any way they see fit.
I asked: "I have a broadband router / basic firewall connected before my computer do you permit this? Or, do you not want one set up since multiple users can connect through one?"
and I quote: "We don't care, run the firewall, hook up a few computers, we don't really like servers on the network. Just be aware that when you call tech support we're going to ask you to remove the router so that we can test the connection."
If you're really concerned about it... don't run they're browser software... Don't go look at their homepages... I don't think I looked at Excite.com the entire 8 months I was a subscriber before they went down. Just pay your bill in the mail and enjoy the bandwidth when all the easily scared jump ship. If they do knock at your door, phone, e-mail... drop them... there's no contract involved and there are other ISP's out there. Hooray for capitalism!
I got pretty fired up when I read the introduction to this story. Before I got to the end, I had decided that I would switch to DSL if Comcast came-a-knocking, even though DSL is more expensive in my area.
However, I read the linked article and my Comcast agreement.
I doubt most people here have done either.
The effort is clearly aimed at people who are sharing their connections outside their homes. The article even has a diagram showing multiple homes. Take a look at this excerpt:
For example: Neighbor Bob buys cable modem service and a wireless home network. Neighbors Carol, Ted and Alice don't buy cable modem service, but they go out and buy antennas compatible with Neighbor Bob's wireless network. Everybody agrees to share Neighbor Bob's connection.
If you have a problem with trying to stop this type of activity, then you also probably think it would be OK to run phone line from your house to your neighbor's house, since you "pay for the bandwidth and can do whatever you wish with it." You would probably think it's OK to run Cat 5 or fiber all over your neighborhood too.
If Comcast tries to make me pay extra for having three networked computers, I'll be as angry as the next geek. But sheez, let's tone down the hype until that actually happens.
Evil is the money of root.
I just e-mailed ComCast and told them that I have a Linux box set up as a firewall with 2 Windows 2K machines behind it. I look forward to their response.
My justification was as follows:
1: I don't trust Win2K to be directly connected to the internet because of the many security flaws of the past and surely in the future.
2: The 2 Win2K machines I use, 1 is for personal use, and one I use as a database server and to pcAnywhere into work. I never use both at the same time, I can't.
3: They're benefitting from the fact that I'm running Squid on my Linux box and therefore caching web pages and reducing my actual bandwidth usage.
If I get a response soon, I'll post it, but I've basically come straight out and told them the truth. How they react will be a judgement of their character as a company
I chose ComCast for 1 reason: I could get billing for cable and internet from one company. If they wish to deny me that, I'll simply switch to satellite TV and DSL modem, and they lose my business entirely ($100/month for them right now).
My reply: "Fine, I want to cancel the service right now."
When I cancelled AT&T's cable modem service the order droid basically begged me to stay. "I'll even give you 6 months of a special promo pricing." Fe. What good is special pricing when the service no longer works for 7-day stretches 'cause they screwed up something at their end and refuse to even have a look until they can schedule a needless "service call". The loudest message someone can send a company is to quit doing business with them.
Why skew the stats in MS's favor? Change it to someother company that can use the market share reports. (Opera would be my pick, but I am sure you have your own.)
______
Once: you're a philosopher. Twice: a pervert.
I have a friend who uses a router with comcast. This concerned him enough to call them (in hopes of making a rightous big-stink!). They said there is NO problem with someone using a router (and using multiple computers). The only (no so) negative thing the tech said was "we offer multiple IP's; if you don't want to buy a router". This went down in SE PA.
While I don't work on the phones (my job is to keep the client machines that tech support personnel use for logging calls running) I do end up listening to quite a few calls in that account. In fact I was listening to call today, where a gentleman was trying to get his Linksys four-port NAT-enabled router working with Comcast's service. Not only did the tech not mention anything about not supporting NAT, but the tech support agent helped him set up the router, made it work with one machine, waited while this gentleman went to his other machine, and helped him ensure that his tcp/ip settings were correct. He was using the 192.168 network locally.
Hmmm maybe we're just slow to get the news?
Lousy facepalm.
Ok, new list with some other points:
I've been a Comcast customer for some time and have had relatively no problems with them to date. I am a little concened that since my IP changed on the 22nd (our area's cutover) I'm unable to ping it from work. Something to do tonight I guess.
I'm against picketing, but I don't know how to show it.
How will they tell that someone is using NAT? Are they actually going to examine packets looking for matching source and destination ports??? What if I want to hide my computer behind private IP for security? These boneheads don't want computer savvy people as customers, they want computer dolts that can't keep their machines virus and trojan free and cost them money!
I operate a bunch of computers behind a NAT, SPI firewall on a cable modem connection with anti-virus and my own DNS server! I'm their smallest liablity since I don't stress their DNS servers, I trouble-shoot my own problems (their tech support sucks anyway) and I pay my monthly bill.
They should want more customers like me; not less.
-ted
Quite likely they had no particular technical approach in mind and planned on just waiting until the Slashdot crowd surveyed the possible techniques for them. That has been accomplished.
I repeat: this is RUMOUR. Why is it on Slashdot? This is not responsible journalism.
But, since everyone else seems to be hopping on the bandwagon taking this as fact I'll chime in anyways.
The solution is to play it smart and don't ever ever tell tech support you're using more then one computer. If they accuse you of using more then one, deny it. They're going to have fun proving that one.
Adelphia Powerlink flipped their freaking lid when the guy was trying to troubleshoot my connection by pinging it and I told him I'd gotten his ping.
"How do you know that? It's coming up as host unreachable here."
"Yeah I know I'm running a firewall on my machine."
"What?! You're not allowed to use a firewall on our network!"
"Uhm, why not? Oh maybe I should turn it off so all these people trying to DoS me can mess up your network a little more?"
So remember, when calling tech support:
1) You are using 1 computer.
2) You are using Windows.
3) Never mention the words: firewall, router, linux, server. They are verboten.
Always "follow" their absurd troubleshooting suggestions no matter how stupid they sound. Hey.. sometimes they do work, but otherwise just take what they tell you and translate the steps into your OS of choice. Or if you already tried it give them the answer they're looking for.
On the contrary. Having a bunch of nodes behind an OpenBSD NAT firewall with state modulation should, it seems to me, look the same to an outside observer as having a single OpenBSD node.
Nevertheless, the documented point of state modulation isn't to hide the fact that you're doing NAT. It's to correct for the fact that many operating systems pick initial sequence numbers poorly, and are thus vulnerable to sequence prediction attacks. So there may well be ways to tell the difference -- though it would surprise me.
In the end, though, I agree with the sentiment expressed elsewhere under this topic: that ISPs are misguided in trying to penalize intelligent use of their services, but also that users are misguided in playing hide-and-seek with bad ISPs' policy enforcement rather than choosing more honest and professional ISPs.
How many people do you know that have free cable TV? Wouldn't it make more sense for these idiots to spend their time trying to bill people the $30/month for cable tv rather than $6.95 for an extra IP address? I guess prioritizing business goals is not a characteristic of cable broadband providers (see "Excite@Home").
Not all broadband providers suggest a firewall. I believe comcast explicitly forbids it, as their method of having multiple computers on a network is:
1) Purchase a 5-port hub
2) Plug cable modem into it.
3) Plug up to four computers into it
4) Pay $5 for each additional IP used
You are explicitly NOT allowed to have anything in front of those boxen, thus they would not be able to assign you IP's, and you would not pay them extra. The cap of 4 PC's is too low as well.
Lex orandi, lex credendi.