Slashdot Mirror
Comcast Forging Packets To Filter Torrents
An anonymous reader writes "It's been widely reported by now that Comcast is throttling BitTorrent traffic. What has escaped attention is the fact that Comcast, like the Great Firewall of China uses forged TCP Reset (RST) packets to do the job. While the Chinese government can do what they want, it turns out that Comcast may actually be violating criminal impersonation statutes in states around the country. Simply put, while it's legal to block traffic on your network, forging data to and from customers is a big no-no."
say it ! and add a "lawsuit" to the end. Such "companies" deserve it.
Read radical news here
But when these huge companies work with other huge companies AND government agencies like the FBI and CIA, do you think you even have a chance in Hell?
Like many have said before me, we need to go pure encrypted communications to prevent this kind of violation. TOR, WASTE, and Linux based encryption techniques allows us these kind of tools to defend against attackers: our very providers of bandwidth.
Legal questions aside, is there some technical merit to sending a RST instead of just blocking the packets? Is it less expensive to the ISP or something? I don't understand why they're doing it.
We use a popular web content filter. The way it works is by doing the same thing. So when we are blocking traffic, we block it by issuing a forged RST. It's either do this, or place the content filter inline ACTIVE. Right now it is passive It does packet capturing and RST to block. If it's down, then traffic still flows. If it were active, we could simply drop the traffic and not forge the RST. But performance and uptime are horrible on many products when these are inline.
Initially this sounded a lot worse to me.
take a look at http://www.dslreports.com/forum/comcast and you will note that plenty of examples of this impersonation exist. They disconnect by impersonation after about 10 seconds of seeding, and it seems to be courtesy of Sandvine. Gotta love lack of net neutrality here, although I am not in favor of extreme net neutrality, some would be, well, nice.
You made an spelling error last January 22nd:
7 12652
"un-realisically"
http://slashdot.org/comments.pl?sid=218196&cid=17
You are welcome.
If you mod this up, your slashdot background will turn into a beautiful sunset!
Obviously not, he edits.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
Yeah, it works better. Sending a RST packet closes the TCP connection. Just eating the packet would cause the computer to resend it, creating more traffic on the network. The forged-RST attack is "fire and forget." You identify a TCP connection that has bad traffic in it, and then you target the connection. It doesn't require matching every packet, you can instead look for patterns of packets that indicate types of traffic you dislike, and then just terminate it, and move on to the next connection. It may use deep-packet inspection, but it's not a 'packet blocking' attack. It's better, because it avoids having the computers retransmit packets that just contribute to the traffic you need to screen.
It's a fairly insidious way to block traffic, which is why the Chinese do it. Frankly it's a fundamental weakness of TCP: it wasn't really designed to cope with hostile intermediate nodes. (Flaky ones, sure, but not hostile ones.) You could configure your computer to reject RST packets, but then you'd end up leaving connections open all over the place and cause all sorts of other problems. It's not something that you can trivially work around.
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
Why, because of the weather? It can't be because of your traffic-throttling happy ISPs:
http://torrentfreak.com/rogers-fighting-bittorren
Maybe they are kinky and really into violating statues ...
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
You made a spelling (or grammar) error today.
You're welcome.
Never shake hands with a man you meet in a fertility clinic.
First, Spyder was not saying that he was Rosa, but even ignoring that, why do you say with certainty that this is not the same? This is standing up to a MUCH bigger bulley who is trying to take what is not theirs. It was no different than when the geek stood up to a circuit city store and then the police. That is a case that may make a difference, as might this (keeping our rights from those that would gladly steal them). You can bet that at the time of Rosa, the locals just thought it was a silly disturbance.
I prefer the "u" in honour as it seems to be missing these days.
Christopher(Tue Sep 04 2007 17:54:47 GMT-0400 (Eastern Daylight Time))>
Please provide me with a complete list of TCP/IP ports which Comcast actively blocks/filters/or limits traffic to users??
analyst Tallilee.7304 has entered room
Tallilee.7304(Tue Sep 04 2007 17:54:50 GMT-0400 (Eastern Daylight Time))>
Hello Christopher_, Thank you for contacting Comcast Live Chat Support. My name is Tallilee.7304. Please give me one moment to review your information.
Christopher_(Tue Sep 04 2007 17:55:23 GMT-0400 (Eastern Daylight Time))>
Hi
Tallilee.7304(Tue Sep 04 2007 17:55:18 GMT-0400 (Eastern Daylight Time))>
The only ports that may be actively blocked on the Comcast network are 67, 68, 135, 137, 138, 139, 445, 512, 520, and 1080 at this time. Any ports that are blocked will not be unblocked. If the port you would like to use is on this list, please select another port to use with your software. There are over 10,000 ports available for use. Please be advised that Comcast reserves the entitlement to block any ports on the network without prior notice. We thank you for understanding this security policy.
Christopher_(Tue Sep 04 2007 17:56:14 GMT-0400 (Eastern Daylight Time))>
I have read that Comcast is now actively retarding bittorrent traffic.
Tallilee.7304(Tue Sep 04 2007 17:56:09 GMT-0400 (Eastern Daylight Time))>
That is not a true statement.
Those who cannot remember the past are condemned to think "profiling is worse than the slaughter of innocent people..."
Huh? Have you ever even set up a firewall? Assume you do a real one where the firewall system sits in the middle of all connections. There's various ways to handle the blocking of ports. One way is to outright block the port. Another way is to send something like an ICMP service unavailable (in response to UDP) or a TCP reset (in response to TCP). Either way, the firewall basically must forge the source address of the packet.
When I set up a firewall I often outright drop anything coming in from the internet destined for windows file sharing ports (135, 137, 138, 139, and 445 among others). The traffic simply never passes the firewall and just goes into a black hole. However, if the traffic came from the network I am firewalling (the "inside" so to speak) then I'll usually configure the firewall to respond with a TCP RST. Why? Because if you respond with a TCP RST then the Windows client will immediately recognize that it can't connect rather than waiting for 60 seconds or longer. If I accidently mistype an IP of some machine I really don't want to have to wait 60 seconds while Windows Explorer completely HANGS because there is basically no way to cancel a request.
By your logic, I should now be brought up on charges because I forged a TCP RST.
Now, in this case their firewalls aren't in the middle but are merely snooping on traffic. When they want to drop a TCP connection they simply send a RST to both ends which does the job nicely without having to have the firewall pass all traffic. If it drops a packet, it's not that big of a deal. If it goes down there's simply no longer a firewall.
What most people seem to be mad about is that Comcast is using a firewall on their traffic. But ask yourself what would you do if you were in Comcast's position. There is no way in hell they could afford to provide the full advertised downstream and upstream bandwidth 24/7. That's why your cable modem costs a whole lot less than a bandwidth-guaranteed T1. And it's not just for consumers. Businesses who just want an internet connection are now able to get cable modems as well and it's a huge money saver over a T1 because it means you get to burst at much faster speeds and aren't paying for the full bandwidth all the way to an internet backbone which you aren't even using anyway.
BitTorrent is by design a very greedy protocol. It is fully intended to suck up every last drop of available bandwidth. Comcast has a number of customers to serve with its limited uplink bandwidth. What it does have is pretty amazing but it's still nowhere near capable of saturating every subscriber's line simultaneously. When you got your cable modem service you agreed to this. That's what the whole "speeds may vary" footnote that accompanies cable and DSL advertisements is for.
Comcast is not in fact outright blocking BitTorrent traffic. It seems instead that they send a RST to both ends of BitTorrent TCP connections to force them to close. BitTorrent will turn around and make another connection with different peers. My guess is that they aren't killing all connections, just a random subset of them. This has the effect of throttling BitTorrent down without actually preventing anyone from using BitTorrent, just preventing BitTorrent from taking up all available network bandwidth.
What would you suggest that Comcast do? Not throttle anything? They'd have to increase their uplink bandwidth considerably. Do you suggest the government force them not to firewall anything? Now what.. who do you think is going to pay the added cost? It sure as hell isn't going to be Comcast, they'd sooner exit the business entirely, as would any other sensible business person.
The bottom line is that it really makes no difference what BitTorrent is being used for. Even if you're using it only to download the latest ISO of your favorite Linux distribution it still costs Comcast a lot of bandwidth. A lot more than if you were to just find a fast mirror with the ISO you want. I am pretty
For cable modems and DSL, the local distribution transmission technologies are asymmetric, but the upstream media from the head end or DSLAM on up normally has more slack, so the technology tends to limit the amount of resources P2P can consume. It's obviously better if you're uploading material that's being downloaded by somebody on your local distribution network, but for general applications that's unlikely - too few people want too many different files. (Large Universities are a special case, where the bulk of the traffic is probably for relatively popular material, students have more shared tastes than random neighborhoods, and upstream is usually faster and often symmetric.)
The "backbone" bandwidth, which is what costs broadband companies money based on traffic levels, is going to be more affected financially than technically - it's a small number of locations, and broadband companies can monitor it fairly easily so they can keep up with growth. The scalability issues are really critical here - if people usually upload material to other users of the same carrier and in the same geographical area, they're not touching the backbone for high-volume media, only for tracker support, and since _everybody_ on the consumer broadband networks is primarily an information consumer, not producer, the traffic's more likely to stay local, and the traffic ratios which affect what the broadband company pays for traffic are very skewed and P2P balances them a bit rather than exacerbating them. Overall backbone downstream traffic can still increase, but carriers that care about that should be encouraging their customers to use protocols that download locally when possible, and can put up their own P2P caching servers (i.e. fast user machines) if they want to reduce imports from outside.
Napster had centralized databases tracking who was downloading what songs, so if they wanted to they could easily enough have made sure that users stayed within their local networks whenever possible, especially for universities that had scaling problems. BitTorrent trackers can provide somewhat the same capability, if they want to. The fancy way to do it is to look at BGP autonomous system numbers to determine who's sharing with whom, but even just trying to keep systems in the same
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
I'm skipping the TCP RST as I mostly agree with what you are saying, though I would say that comcast doing it is MUCH more irritating than myself doing it. I agree with many posters above that it should call into question their common carrier status if they are only doing it to file sharing protocols. You can't have it both ways.
"But ask yourself what would you do if you were in Comcast's position. There is no way in hell they could afford to provide the full advertised downstream and upstream bandwidth 24/7. That's why your cable modem costs a whole lot less than a bandwidth-guaranteed T1. And it's not just for consumers. Businesses who just want an internet connection are now able to get cable modems as well and it's a huge money saver over a T1 because it means you get to burst at much faster speeds and aren't paying for the full bandwidth all the way to an internet backbone which you aren't even using anyway."
Therein lies the problem - at least where I live Comcast runs tons of commercials showing people cheering about the money saved with no loss going with them. Were I in Comcast's shoes and I were not able to provide that I wouldn't advertise it as such - especially if it was something I was artificially throttling through TCP resets (MUCH harder to defend in a lawsuit). Had they sold their service under a different idea then yea, I would fully agree. But at is they heavily commercial one thing, have their service contract vaguely say something else, and finally do something totally different from both and hope people bend over and take it because "what else are they to do - it costs too much money".
There is no reason to quote the rest of your stuff as I agree - Bittorrent is a bandwidth hog and Comcast has WAY oversold what their bandwidth can service. But then, that is their fault for advertising things they can not hope to even come close to covering. There is no other consumer market where that is acceptable. Lets face it, if Denny's ran commercials with normal ingredients as caviar, swallows nest, sea bass, truffles, and other high end items, put a small note in the bottom "ingredients may differ", and then you got spam, American cheese, and old lettuce there would be a VERY strong legal case against them. No difference here - they shouldn't commercial what they will not give and the small print isn't going to save them. With them also heavily commercialing their home service for streaming videos this is only going to get worse.
That being said - I use Comcast and have had no real issues. In fact, I'm constantly surprised what I do doesn't get any note sent to me. This month I have over 70 gigs down and an unknown amount upstream and not a peep from them, this was not really a heavy or light month and I've been a customer for about 6 years now (and there have been months where I have gone WAY over that). I've had their service technicians be as courteous as can be expected (though since I generally knew what the issue was I just pretended to do what they wanted until I got to who I needed to talk too, I understand why the lower level people wouldn't just move me on and stayed very polite) and I even had my cable modem replaced at no charge or questions when I told them it "quit working" (I spilled a bottle of soda in it).
But, if I had the above happen to me I would be quite irritated - they sold me a service and I expect the service they advertised to be provided. I can pay the same price to the local DSL provider and have *none* of those issues though their advertised bandwidth is less you *do* actually get all of it (and it is greater than what many are reporting). That type of little finger to mouth rationalization doesn't work in almost any other field and I suspect it will not work if this type of thing goes to court. My guess is that I live in a fairly rural area and they do not have bandwidth issues so I get to hog all I want.
------- Sorry about the spelling, I suffer from two problems. Dyslexia makes it difficult to spell well, lazy makes it