Comcast Forging Packets To Filter Torrents

An anonymous reader writes "It's been widely reported by now that Comcast is throttling BitTorrent traffic. What has escaped attention is the fact that Comcast, like the Great Firewall of China uses forged TCP Reset (RST) packets to do the job. While the Chinese government can do what they want, it turns out that Comcast may actually be violating criminal impersonation statutes in states around the country. Simply put, while it's legal to block traffic on your network, forging data to and from customers is a big no-no."

Comments

Suure... legal action is possible...

[Creepy Crawler]

But when these huge companies work with other huge companies AND government agencies like the FBI and CIA, do you think you even have a chance in Hell?

Like many have said before me, we need to go pure encrypted communications to prevent this kind of violation. TOR, WASTE, and Linux based encryption techniques allows us these kind of tools to defend against attackers: our very providers of bandwidth.

Technical merit?

[WPIDalamar]

Legal questions aside, is there some technical merit to sending a RST instead of just blocking the packets? Is it less expensive to the ISP or something? I don't understand why they're doing it.

Re:It's better than single-packet blocking.

[Vellmont]

You could configure your computer to reject RST packets, but then you'd end up leaving connections open all over the place and cause all sorts of other problems. It's not something that you can trivially work around.


How about just wait until some specified timeout and see if you receive any other packets? If someone sends RST, but you receive a bunch more packets, there's a very good chance the RST was faked. Better yet, wait for timeout1, then wait timeout2 for any more packets. (Since packets can be received out of order). Then if you receive more packets during timeout2, ignore the RST. I'd say that's pretty trivial. It could even be implemented on a NAT router so you wouldn't even have to modify your OS.

Re:Can you say "class action" ?

[binarybum]

hmm, this is interesting - I am not familiar with this arguement. Any lawyers out there that can verify this? Everyone knows that ISPs have been filtering the dickens out of traffic since the napster era, why haven't they been called out on this already? Also, the post office won't let me ship a can of gasoline to a friend who lives in small town with high gas prices - they consider this "hazardous." Could isps argue that certain traffic is hazardous to their infrastructure (i.e. clogs up the pipes) and refuse it on those grounds (assuming this whole common carrier thing really applies in the first place)?

Re:Can you say "class action" ?

[Ajehals]

Interesting thought.

If the copyright holder decides not to prosecute someone is it still a copyright violation? after all many people distribute copyright material they do not explicitly own. Surely a copyright violation can only be deemed to have happened once the rights holder decides to take action.

Forged RST is a perfectly valid firewall technique

[Jimithing DMB]

Huh? Have you ever even set up a firewall? Assume you do a real one where the firewall system sits in the middle of all connections. There's various ways to handle the blocking of ports. One way is to outright block the port. Another way is to send something like an ICMP service unavailable (in response to UDP) or a TCP reset (in response to TCP). Either way, the firewall basically must forge the source address of the packet.

When I set up a firewall I often outright drop anything coming in from the internet destined for windows file sharing ports (135, 137, 138, 139, and 445 among others). The traffic simply never passes the firewall and just goes into a black hole. However, if the traffic came from the network I am firewalling (the "inside" so to speak) then I'll usually configure the firewall to respond with a TCP RST. Why? Because if you respond with a TCP RST then the Windows client will immediately recognize that it can't connect rather than waiting for 60 seconds or longer. If I accidently mistype an IP of some machine I really don't want to have to wait 60 seconds while Windows Explorer completely HANGS because there is basically no way to cancel a request.

By your logic, I should now be brought up on charges because I forged a TCP RST.

Now, in this case their firewalls aren't in the middle but are merely snooping on traffic. When they want to drop a TCP connection they simply send a RST to both ends which does the job nicely without having to have the firewall pass all traffic. If it drops a packet, it's not that big of a deal. If it goes down there's simply no longer a firewall.

What most people seem to be mad about is that Comcast is using a firewall on their traffic. But ask yourself what would you do if you were in Comcast's position. There is no way in hell they could afford to provide the full advertised downstream and upstream bandwidth 24/7. That's why your cable modem costs a whole lot less than a bandwidth-guaranteed T1. And it's not just for consumers. Businesses who just want an internet connection are now able to get cable modems as well and it's a huge money saver over a T1 because it means you get to burst at much faster speeds and aren't paying for the full bandwidth all the way to an internet backbone which you aren't even using anyway.

BitTorrent is by design a very greedy protocol. It is fully intended to suck up every last drop of available bandwidth. Comcast has a number of customers to serve with its limited uplink bandwidth. What it does have is pretty amazing but it's still nowhere near capable of saturating every subscriber's line simultaneously. When you got your cable modem service you agreed to this. That's what the whole "speeds may vary" footnote that accompanies cable and DSL advertisements is for.

Comcast is not in fact outright blocking BitTorrent traffic. It seems instead that they send a RST to both ends of BitTorrent TCP connections to force them to close. BitTorrent will turn around and make another connection with different peers. My guess is that they aren't killing all connections, just a random subset of them. This has the effect of throttling BitTorrent down without actually preventing anyone from using BitTorrent, just preventing BitTorrent from taking up all available network bandwidth.

What would you suggest that Comcast do? Not throttle anything? They'd have to increase their uplink bandwidth considerably. Do you suggest the government force them not to firewall anything? Now what.. who do you think is going to pay the added cost? It sure as hell isn't going to be Comcast, they'd sooner exit the business entirely, as would any other sensible business person.

The bottom line is that it really makes no difference what BitTorrent is being used for. Even if you're using it only to download the latest ISO of your favorite Linux distribution it still costs Comcast a lot of bandwidth. A lot more than if you were to just find a fast mirror with the ISO you want. I am pretty

Oversubscription vs Keeping P2P Protocols Scalable

[billstewart]

First of all, there are different places in a network that can be oversubscribed, and of course they're different for cable, DSL, and other architectures. The two most important points are the Internet Backbone feeds and the neighborhood distribution networks. P2P has much different financial and technical effects in the two environments.

For cable modems and DSL, the local distribution transmission technologies are asymmetric, but the upstream media from the head end or DSLAM on up normally has more slack, so the technology tends to limit the amount of resources P2P can consume. It's obviously better if you're uploading material that's being downloaded by somebody on your local distribution network, but for general applications that's unlikely - too few people want too many different files. (Large Universities are a special case, where the bulk of the traffic is probably for relatively popular material, students have more shared tastes than random neighborhoods, and upstream is usually faster and often symmetric.)

The "backbone" bandwidth, which is what costs broadband companies money based on traffic levels, is going to be more affected financially than technically - it's a small number of locations, and broadband companies can monitor it fairly easily so they can keep up with growth. The scalability issues are really critical here - if people usually upload material to other users of the same carrier and in the same geographical area, they're not touching the backbone for high-volume media, only for tracker support, and since _everybody_ on the consumer broadband networks is primarily an information consumer, not producer, the traffic's more likely to stay local, and the traffic ratios which affect what the broadband company pays for traffic are very skewed and P2P balances them a bit rather than exacerbating them. Overall backbone downstream traffic can still increase, but carriers that care about that should be encouraging their customers to use protocols that download locally when possible, and can put up their own P2P caching servers (i.e. fast user machines) if they want to reduce imports from outside.

Napster had centralized databases tracking who was downloading what songs, so if they wanted to they could easily enough have made sure that users stayed within their local networks whenever possible, especially for universities that had scaling problems. BitTorrent trackers can provide somewhat the same capability, if they want to. The fancy way to do it is to look at BGP autonomous system numbers to determine who's sharing with whom, but even just trying to keep systems in the same /19 or /16 together is a good start. Most of the P2P protocols support a cruder approach - checking ping times or other TCP or UDP packet transmission latencies - and even these are a good start, because local stuff tends to stay local. You can do a bit better for scalability if you weight IP addresses or BGP ASNs as well - usually there's enough correlation that overall performance doesn't change much, and it helps your ISP a lot. There's some variance in that, such as that a fast university user who's networkily near one of the exchange points that your ISP uses may be more attactive than a user who's geographically farther away but on your carrier's network, but in general being crude and greedy isn't as bad as you'd expect.

Re:Forged RST is a perfectly valid firewall techni

[bm_luethke]

I'm skipping the TCP RST as I mostly agree with what you are saying, though I would say that comcast doing it is MUCH more irritating than myself doing it. I agree with many posters above that it should call into question their common carrier status if they are only doing it to file sharing protocols. You can't have it both ways.

"But ask yourself what would you do if you were in Comcast's position. There is no way in hell they could afford to provide the full advertised downstream and upstream bandwidth 24/7. That's why your cable modem costs a whole lot less than a bandwidth-guaranteed T1. And it's not just for consumers. Businesses who just want an internet connection are now able to get cable modems as well and it's a huge money saver over a T1 because it means you get to burst at much faster speeds and aren't paying for the full bandwidth all the way to an internet backbone which you aren't even using anyway."

Therein lies the problem - at least where I live Comcast runs tons of commercials showing people cheering about the money saved with no loss going with them. Were I in Comcast's shoes and I were not able to provide that I wouldn't advertise it as such - especially if it was something I was artificially throttling through TCP resets (MUCH harder to defend in a lawsuit). Had they sold their service under a different idea then yea, I would fully agree. But at is they heavily commercial one thing, have their service contract vaguely say something else, and finally do something totally different from both and hope people bend over and take it because "what else are they to do - it costs too much money".

There is no reason to quote the rest of your stuff as I agree - Bittorrent is a bandwidth hog and Comcast has WAY oversold what their bandwidth can service. But then, that is their fault for advertising things they can not hope to even come close to covering. There is no other consumer market where that is acceptable. Lets face it, if Denny's ran commercials with normal ingredients as caviar, swallows nest, sea bass, truffles, and other high end items, put a small note in the bottom "ingredients may differ", and then you got spam, American cheese, and old lettuce there would be a VERY strong legal case against them. No difference here - they shouldn't commercial what they will not give and the small print isn't going to save them. With them also heavily commercialing their home service for streaming videos this is only going to get worse.

That being said - I use Comcast and have had no real issues. In fact, I'm constantly surprised what I do doesn't get any note sent to me. This month I have over 70 gigs down and an unknown amount upstream and not a peep from them, this was not really a heavy or light month and I've been a customer for about 6 years now (and there have been months where I have gone WAY over that). I've had their service technicians be as courteous as can be expected (though since I generally knew what the issue was I just pretended to do what they wanted until I got to who I needed to talk too, I understand why the lower level people wouldn't just move me on and stayed very polite) and I even had my cable modem replaced at no charge or questions when I told them it "quit working" (I spilled a bottle of soda in it).

But, if I had the above happen to me I would be quite irritated - they sold me a service and I expect the service they advertised to be provided. I can pay the same price to the local DSL provider and have *none* of those issues though their advertised bandwidth is less you *do* actually get all of it (and it is greater than what many are reporting). That type of little finger to mouth rationalization doesn't work in almost any other field and I suspect it will not work if this type of thing goes to court. My guess is that I live in a fairly rural area and they do not have bandwidth issues so I get to hog all I want.

Re:Can you say "class action" ?

[Curunir_wolf]

You are correct. I note that a number of phone company shills that have tried to discredit your statement, so I will respond here instead of trying to correct each one.

While it's true that it was not tax dollars that directly went to telecommunications companies, it was still taxpayers that paid the money. The telecoms made promises to invest hugely in infrastructure in return for rules that resulted in huge profit increases. They did not honor those commitments, but pocketed the money instead. They are now in fact threatening again not to build any more infrastructure unless they can get more favorable regulations.

I'm not sure why the shills keep repeating the "it's cheaper overseas due to higher population density". That has been discredited over and over again. I'll repeat the numbers here for completeness:

Country - Broadband Penetration - Population Density
Iceland 26.7 3.0

Korea 25.4 483.0

Netherlands 25.3 399.0

Denmark 25.0 125.0

Switzerland 23.1 179.0

Finland 22.5 15.0

Norway 21.9 14.0

Canada 21.0 3.0

Sweden 20.3 20.0

Belgium 18.3 341.0

Japan 17.6 338.0

United States 16.8 31.0

No correlation. Do not listen to the telecom shills.