Slashdot Mirror
Comcast Forging Packets To Filter Torrents
An anonymous reader writes "It's been widely reported by now that Comcast is throttling BitTorrent traffic. What has escaped attention is the fact that Comcast, like the Great Firewall of China uses forged TCP Reset (RST) packets to do the job. While the Chinese government can do what they want, it turns out that Comcast may actually be violating criminal impersonation statutes in states around the country. Simply put, while it's legal to block traffic on your network, forging data to and from customers is a big no-no."
say it ! and add a "lawsuit" to the end. Such "companies" deserve it.
Read radical news here
But when these huge companies work with other huge companies AND government agencies like the FBI and CIA, do you think you even have a chance in Hell?
Like many have said before me, we need to go pure encrypted communications to prevent this kind of violation. TOR, WASTE, and Linux based encryption techniques allows us these kind of tools to defend against attackers: our very providers of bandwidth.
Legal questions aside, is there some technical merit to sending a RST instead of just blocking the packets? Is it less expensive to the ISP or something? I don't understand why they're doing it.
We use a popular web content filter. The way it works is by doing the same thing. So when we are blocking traffic, we block it by issuing a forged RST. It's either do this, or place the content filter inline ACTIVE. Right now it is passive It does packet capturing and RST to block. If it's down, then traffic still flows. If it were active, we could simply drop the traffic and not forge the RST. But performance and uptime are horrible on many products when these are inline.
Initially this sounded a lot worse to me.
take a look at http://www.dslreports.com/forum/comcast and you will note that plenty of examples of this impersonation exist. They disconnect by impersonation after about 10 seconds of seeding, and it seems to be courtesy of Sandvine. Gotta love lack of net neutrality here, although I am not in favor of extreme net neutrality, some would be, well, nice.
Last time this piece of news was discussed, someone helpfully posted a solution for your Linux firewall.
>north
You're an immobile computer, remember?
You made an spelling error last January 22nd:
7 12652
"un-realisically"
http://slashdot.org/comments.pl?sid=218196&cid=17
You are welcome.
If you mod this up, your slashdot background will turn into a beautiful sunset!
I'm so glad I live in Canada.
I realize that to the nerdish mind falsifying the sender of an IP packet is equivalent to "impersonating another", but no sane prosecutor would ever make such a case.
What I'm listening to now on Pandora...
Obviously not, he edits.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
Yeah, it works better. Sending a RST packet closes the TCP connection. Just eating the packet would cause the computer to resend it, creating more traffic on the network. The forged-RST attack is "fire and forget." You identify a TCP connection that has bad traffic in it, and then you target the connection. It doesn't require matching every packet, you can instead look for patterns of packets that indicate types of traffic you dislike, and then just terminate it, and move on to the next connection. It may use deep-packet inspection, but it's not a 'packet blocking' attack. It's better, because it avoids having the computers retransmit packets that just contribute to the traffic you need to screen.
It's a fairly insidious way to block traffic, which is why the Chinese do it. Frankly it's a fundamental weakness of TCP: it wasn't really designed to cope with hostile intermediate nodes. (Flaky ones, sure, but not hostile ones.) You could configure your computer to reject RST packets, but then you'd end up leaving connections open all over the place and cause all sorts of other problems. It's not something that you can trivially work around.
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
That's a realisic explanation and I believe you :)
Fnord.
Maybe they are kinky and really into violating statues ...
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
This method is how most content filters do their jobs. Why not just drop the traffic you ask? Well here's why.. if you don't reset the connections, both sides will just continue trying to communicate with one another by retransmitting the packets. That's why it's TCP and not UDP.. the whole trying to guarantee the delivery thing. Now, they're not just blocking on IP addresses. If that was the case they could just drop the traffic altogether and not need to "forge" anything. However, since it's discovering the traffic is P2P related later on, it does it in such a fashion.
:)
Now the other thing is that the IP addresses being used are owned by the ISP. I am not so sure this is really forging something on behalf of the customer that's breaking laws. The customer doesn't own that IP. On top of that (and I am ASS-U-MING HERE) they are probably breaking the acceptable use policy for the ISP. If they don't allow P2P stuff, you're in violation. They could do a lot worse stuff to be a PITA than just reset your connections.
That solution as written doesn't work, and even if it did, might still screw up the connection (because you want to un-set the RST flag, not throw away the whole packet). Also, some people have indicated that Comcast is doing more than just forging RSTs, they are also eating packets along the way, so it's not a silver bullet.
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
I was forming such a clear mental picture of a comcast violating a statue. Too bad I can't draw.
You made a spelling (or grammar) error today.
You're welcome.
Never shake hands with a man you meet in a fertility clinic.
First, Spyder was not saying that he was Rosa, but even ignoring that, why do you say with certainty that this is not the same? This is standing up to a MUCH bigger bulley who is trying to take what is not theirs. It was no different than when the geek stood up to a circuit city store and then the police. That is a case that may make a difference, as might this (keeping our rights from those that would gladly steal them). You can bet that at the time of Rosa, the locals just thought it was a silly disturbance.
I prefer the "u" in honour as it seems to be missing these days.
If any ISP did, it would kiss away any hope of a DMCA safe-harbor claim. As an ISP or other such party, if you know about it, you're supposed to stop it, not throttle it. Not stopping it immediately upon discovery and confirmation IIRC constitutes complicity.
Quo usque tandem abutere, Nimbus, patientia nostra?
Christopher(Tue Sep 04 2007 17:54:47 GMT-0400 (Eastern Daylight Time))>
Please provide me with a complete list of TCP/IP ports which Comcast actively blocks/filters/or limits traffic to users??
analyst Tallilee.7304 has entered room
Tallilee.7304(Tue Sep 04 2007 17:54:50 GMT-0400 (Eastern Daylight Time))>
Hello Christopher_, Thank you for contacting Comcast Live Chat Support. My name is Tallilee.7304. Please give me one moment to review your information.
Christopher_(Tue Sep 04 2007 17:55:23 GMT-0400 (Eastern Daylight Time))>
Hi
Tallilee.7304(Tue Sep 04 2007 17:55:18 GMT-0400 (Eastern Daylight Time))>
The only ports that may be actively blocked on the Comcast network are 67, 68, 135, 137, 138, 139, 445, 512, 520, and 1080 at this time. Any ports that are blocked will not be unblocked. If the port you would like to use is on this list, please select another port to use with your software. There are over 10,000 ports available for use. Please be advised that Comcast reserves the entitlement to block any ports on the network without prior notice. We thank you for understanding this security policy.
Christopher_(Tue Sep 04 2007 17:56:14 GMT-0400 (Eastern Daylight Time))>
I have read that Comcast is now actively retarding bittorrent traffic.
Tallilee.7304(Tue Sep 04 2007 17:56:09 GMT-0400 (Eastern Daylight Time))>
That is not a true statement.
Those who cannot remember the past are condemned to think "profiling is worse than the slaughter of innocent people..."
I wish you continued fun waiting for 2 hours in a download queue at Fileplanet to get a 50 kb/s download slot.
Want to hear the voice of GOD? cat
I haven't done a packet capture recently, but my Comcast modem is usually pegged with crap packets (port scans). Why don't they send some resets for potentially harmful packets, then they wouldn't have to worry about a few torrents.
Have a look at the method on line 22330g ate/usr/src/uts/common/inet/tcp/tcp.c
http://cvs.opensolaris.org/source/xref/onnv/onnv-
Arash Partow's Philosophy: Be a person who knows what they don't know, and not a person who doesn't know.
They send the RST to both ends. It's no good unless both do it.
Then again, if anyone figures out a way to stop it, they could advertise that they're plagued by that curse as part of the BT protocol and only bother conversing with those who can handle it. It should still be obvious that someone is sending data to a connection that should've been reset.
Then again, NATs and things like that in between could go crazy, because the 2nd packet could be lost long before it ever gets to your computer...
It shouldn't be. These companies are advertising access to the internet, there are decades old standards that describe how the internet is supposed to work, and "dropping packets because an router owner might not like the contents" isn't in any of the RFCs. There's a reason why Prodigy, AOL, MSN, Compuserve, and all the old proprietary networks had to become ISPs or become bankrupt, and that's because consumers demanded unrestricted networks. Giving us restricted networks but just calling them "internet access" is fraud.
However, I also have no problem with Comcast restricting the type of traffic that comes across their network.
This is all well and fine, if they actually said in their TOS that bittorrent traffic is not permitted. But they don't, do they?
Let's not pretend that most torrent traffic is legitimate...we all know it isn't. That's like suggesting legalization pot for everyone because it may help with some the side effects of chemo (there is no glaucoma benefit, btw). That argument has nothing to do with the general population.
The current drug laws work on the theory of "Some people use this substance for illegitimate purposes, so let's make it illegal even for those who want to use it legitimately.". I guess the same applies to bittorrent as well.
Frankly, blocking torrent traffic is the only sure way Comcast could secure themselves from lawsuits by copyright holders, which, I am sure, scares them a lot more than some nerds on Slashdot.
ISPs are common carriers, which makes them immune to such copyright lawsuits, in much the same way the RIAA won't sue AT&T if you decided to sing "Like a Virgin" over the phone. Under the DMCA all they have to do is take down alleged infringing content and notify alleged infrigers - if they do that, they have no liability.
10001001111001110110011000011101110
If I want a static IP, I pay more. If I want more bandwidth, I pay more. If I want to run a mail server, you guessed it, I pay more. I think the solution is simple for ISPs if they're not too chicken to try it. Offer a premium "file monster" service for an extra $5/month. Don't phrase it that way of course, just roll out the usual price increases and a couple months later offer a "$5 discounted, non-p2p" service.
I almost feel dirty for posting this, but somebody else has already thought of it who didn't post to /. and seeing it here will make it sound familiar when they start doing it. Doubtless this will come as some vague fine print like ISP reserves the right to terminate disruptive traffic buried at the back of a bill.
Back in my day when we chiseled our bits into stone and sent them by mule train from village to village...
We told you that you'd regret breaking IPsec with NAT, but did any of you people listen to us? No. Now, you're going to have to set up VPN's if you want your Torrent love to flow. We told you this would happen.
Love, your pals, the end-to-end zealots in the IETF.
jhw
Huh? Have you ever even set up a firewall? Assume you do a real one where the firewall system sits in the middle of all connections. There's various ways to handle the blocking of ports. One way is to outright block the port. Another way is to send something like an ICMP service unavailable (in response to UDP) or a TCP reset (in response to TCP). Either way, the firewall basically must forge the source address of the packet.
When I set up a firewall I often outright drop anything coming in from the internet destined for windows file sharing ports (135, 137, 138, 139, and 445 among others). The traffic simply never passes the firewall and just goes into a black hole. However, if the traffic came from the network I am firewalling (the "inside" so to speak) then I'll usually configure the firewall to respond with a TCP RST. Why? Because if you respond with a TCP RST then the Windows client will immediately recognize that it can't connect rather than waiting for 60 seconds or longer. If I accidently mistype an IP of some machine I really don't want to have to wait 60 seconds while Windows Explorer completely HANGS because there is basically no way to cancel a request.
By your logic, I should now be brought up on charges because I forged a TCP RST.
Now, in this case their firewalls aren't in the middle but are merely snooping on traffic. When they want to drop a TCP connection they simply send a RST to both ends which does the job nicely without having to have the firewall pass all traffic. If it drops a packet, it's not that big of a deal. If it goes down there's simply no longer a firewall.
What most people seem to be mad about is that Comcast is using a firewall on their traffic. But ask yourself what would you do if you were in Comcast's position. There is no way in hell they could afford to provide the full advertised downstream and upstream bandwidth 24/7. That's why your cable modem costs a whole lot less than a bandwidth-guaranteed T1. And it's not just for consumers. Businesses who just want an internet connection are now able to get cable modems as well and it's a huge money saver over a T1 because it means you get to burst at much faster speeds and aren't paying for the full bandwidth all the way to an internet backbone which you aren't even using anyway.
BitTorrent is by design a very greedy protocol. It is fully intended to suck up every last drop of available bandwidth. Comcast has a number of customers to serve with its limited uplink bandwidth. What it does have is pretty amazing but it's still nowhere near capable of saturating every subscriber's line simultaneously. When you got your cable modem service you agreed to this. That's what the whole "speeds may vary" footnote that accompanies cable and DSL advertisements is for.
Comcast is not in fact outright blocking BitTorrent traffic. It seems instead that they send a RST to both ends of BitTorrent TCP connections to force them to close. BitTorrent will turn around and make another connection with different peers. My guess is that they aren't killing all connections, just a random subset of them. This has the effect of throttling BitTorrent down without actually preventing anyone from using BitTorrent, just preventing BitTorrent from taking up all available network bandwidth.
What would you suggest that Comcast do? Not throttle anything? They'd have to increase their uplink bandwidth considerably. Do you suggest the government force them not to firewall anything? Now what.. who do you think is going to pay the added cost? It sure as hell isn't going to be Comcast, they'd sooner exit the business entirely, as would any other sensible business person.
The bottom line is that it really makes no difference what BitTorrent is being used for. Even if you're using it only to download the latest ISO of your favorite Linux distribution it still costs Comcast a lot of bandwidth. A lot more than if you were to just find a fast mirror with the ISO you want. I am pretty
For cable modems and DSL, the local distribution transmission technologies are asymmetric, but the upstream media from the head end or DSLAM on up normally has more slack, so the technology tends to limit the amount of resources P2P can consume. It's obviously better if you're uploading material that's being downloaded by somebody on your local distribution network, but for general applications that's unlikely - too few people want too many different files. (Large Universities are a special case, where the bulk of the traffic is probably for relatively popular material, students have more shared tastes than random neighborhoods, and upstream is usually faster and often symmetric.)
The "backbone" bandwidth, which is what costs broadband companies money based on traffic levels, is going to be more affected financially than technically - it's a small number of locations, and broadband companies can monitor it fairly easily so they can keep up with growth. The scalability issues are really critical here - if people usually upload material to other users of the same carrier and in the same geographical area, they're not touching the backbone for high-volume media, only for tracker support, and since _everybody_ on the consumer broadband networks is primarily an information consumer, not producer, the traffic's more likely to stay local, and the traffic ratios which affect what the broadband company pays for traffic are very skewed and P2P balances them a bit rather than exacerbating them. Overall backbone downstream traffic can still increase, but carriers that care about that should be encouraging their customers to use protocols that download locally when possible, and can put up their own P2P caching servers (i.e. fast user machines) if they want to reduce imports from outside.
Napster had centralized databases tracking who was downloading what songs, so if they wanted to they could easily enough have made sure that users stayed within their local networks whenever possible, especially for universities that had scaling problems. BitTorrent trackers can provide somewhat the same capability, if they want to. The fancy way to do it is to look at BGP autonomous system numbers to determine who's sharing with whom, but even just trying to keep systems in the same
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
I'm skipping the TCP RST as I mostly agree with what you are saying, though I would say that comcast doing it is MUCH more irritating than myself doing it. I agree with many posters above that it should call into question their common carrier status if they are only doing it to file sharing protocols. You can't have it both ways.
"But ask yourself what would you do if you were in Comcast's position. There is no way in hell they could afford to provide the full advertised downstream and upstream bandwidth 24/7. That's why your cable modem costs a whole lot less than a bandwidth-guaranteed T1. And it's not just for consumers. Businesses who just want an internet connection are now able to get cable modems as well and it's a huge money saver over a T1 because it means you get to burst at much faster speeds and aren't paying for the full bandwidth all the way to an internet backbone which you aren't even using anyway."
Therein lies the problem - at least where I live Comcast runs tons of commercials showing people cheering about the money saved with no loss going with them. Were I in Comcast's shoes and I were not able to provide that I wouldn't advertise it as such - especially if it was something I was artificially throttling through TCP resets (MUCH harder to defend in a lawsuit). Had they sold their service under a different idea then yea, I would fully agree. But at is they heavily commercial one thing, have their service contract vaguely say something else, and finally do something totally different from both and hope people bend over and take it because "what else are they to do - it costs too much money".
There is no reason to quote the rest of your stuff as I agree - Bittorrent is a bandwidth hog and Comcast has WAY oversold what their bandwidth can service. But then, that is their fault for advertising things they can not hope to even come close to covering. There is no other consumer market where that is acceptable. Lets face it, if Denny's ran commercials with normal ingredients as caviar, swallows nest, sea bass, truffles, and other high end items, put a small note in the bottom "ingredients may differ", and then you got spam, American cheese, and old lettuce there would be a VERY strong legal case against them. No difference here - they shouldn't commercial what they will not give and the small print isn't going to save them. With them also heavily commercialing their home service for streaming videos this is only going to get worse.
That being said - I use Comcast and have had no real issues. In fact, I'm constantly surprised what I do doesn't get any note sent to me. This month I have over 70 gigs down and an unknown amount upstream and not a peep from them, this was not really a heavy or light month and I've been a customer for about 6 years now (and there have been months where I have gone WAY over that). I've had their service technicians be as courteous as can be expected (though since I generally knew what the issue was I just pretended to do what they wanted until I got to who I needed to talk too, I understand why the lower level people wouldn't just move me on and stayed very polite) and I even had my cable modem replaced at no charge or questions when I told them it "quit working" (I spilled a bottle of soda in it).
But, if I had the above happen to me I would be quite irritated - they sold me a service and I expect the service they advertised to be provided. I can pay the same price to the local DSL provider and have *none* of those issues though their advertised bandwidth is less you *do* actually get all of it (and it is greater than what many are reporting). That type of little finger to mouth rationalization doesn't work in almost any other field and I suspect it will not work if this type of thing goes to court. My guess is that I live in a fairly rural area and they do not have bandwidth issues so I get to hog all I want.
------- Sorry about the spelling, I suffer from two problems. Dyslexia makes it difficult to spell well, lazy makes it
Slap a filter on all your web sites and torrent trackers that keep Comcast customers out.
Give the reasons that all the bogus resets cause wasted connections and time and deny legitimate users from using the service effectively.
That's just the technical end. No effective net changing strategy will work on only that basis. It requires social fixes also.
Notify Comacst customers what's happening and why. Tell them the action is against Comcast, not them, that you're sorry for them, but have no other choice due to Comcast's actions. Tell them to contact Comcast to tell them to either remove the block or they'll change services or call a class action suit.
The Comcast users become collateral damage. It's a sad thing, but it's what happens sometimes. If it's presented to them in the right way, they'll become and loyal and effective allies.
It's worked before. Against Worldcom/UUNet, PSINet, the pipe into India via their country's long distance, network and satellite company affecting 90% of India, and others. It was called the Usenet Death Penalty. Look it up. It made news stories all over the world. The biggest, against Worldcom, was launched on a Friday evening so they couldn't react until Monday, and by Thursday afternoon John Sidgemore made them change their corporate policy to cut off their downstreams that were major spam sources (which was the reason all these were done). In all cases I/we got many emails from effected customers decrying the need for this, but supporting the action and us, most of them promising to step up complaints against the company involved.
A key is to get individuals participating in doing this based on a publicized suggestions from someone who doesn't participate. That makes the people doing it a temporary autonomous group, not an official body or organized group with a membership or leadership. The result of that is each individual has to be pursued one by one, and they can just drop off if and when they need to, and come back on at another point. Best way is to set aside a few people who aren't participating themselvess, but are holding forth the whys and wherefores, and acting as contacts for the affected users, the press, and inevitably the company.
It works, oh my yes. Combine technical and social tactics, and you'll have them by the nadgers. As big and bullying and rich and litigious as the companies are, they all rely on a user base. When that base threatens to jump ship, they listen and things get done.
The 70% to 80% figure doesn't hold water. The same was said about the increase in traffic on usenet binaries groups, and that was fought off in some cases and gave rise to companies advertising specifically to provide them in others. There's nothing in their TOS that says what sort of programs the users can and can't use, just as when they decided to start dropping and blocking alt.binaries.*. There's stuff about illegal activities which is good and for a good reason, but it's up to the company to prove that's going on. If they don't, forcing their customers to drop P2P connections regardless of content is denial of service, and that's illegal. Since their doing it to people who are paying them to provide the service their denying, it's also fraud. With those points made to the media prior to and during the action, and with some affected but supporting Comcast members having their word in, it'd be damn hard for Comcast to defend itself without looking like thugs, and if they don't defend themselves they look like hypocritical and greedy thieves.
I'm serious. This works a charm. Set up and laid out properly, its the perfect media fodder to garner support -- the little guys inside and out fighting the awful corporate ogre to take back the net. And, it stirs up righteousness more of the affected users, bring them on board, and it's enormous fun for those doing the actual fighting against the suits.
Not planned and executed properly, it falls apart when the press is able to make the action look like a blackmail attempt. P
"I may be synthetic, but I'm not stupid." -- Bishop 341-B
Bottlenecks.
...because "hacker" sounds way sexier than "code drone."
Sounds like a job for Mike Rowe!!!
If any ISP did, it would kiss away any hope of a DMCA safe-harbor claim. As an ISP or other such party, if you know about it, you're supposed to stop it, not throttle it. Not stopping it immediately upon discovery and confirmation IIRC constitutes complicity.
Actually Comcast did monitor traffic and in 2002 were taken to court for violating the 1984 Telecommunications ACT. I found it while googling. I've been tempted to post it on my blog but save it for later in case this raises it head again. I don't know what the verdict was. I've been sending letters to the lawyers representing the case and have searched for it. All I could find was an article on Infoworld or maybe that was PC World. Don't recall off the top of my head.
Anyway, it's illegal and they were slapped. If they did this for P2P, they would have BIG issues to deal with... again.
Has Comcast disconnected your Internet account? Same here. You can read about it at http://comcastissue.blogspot.com