Comcast Confirmed as Discriminating Against FileSharing Traffic

An anonymous reader writes "Comcast has been singled out as discriminating against filesharing traffic in quantitative tests conducted by the Associated Press. MSNBC's coverage of the discovery is quite even-handed. The site notes that while illegal content trading is a common use of the technology, Bittorrent is emerging as an effective medium for transferring 'weighty' legal content as well. 'Comcast's technology kicks in, though not consistently, when one BitTorrent user attempts to share a complete file with another user. Each PC gets a message invisible to the user that looks like it comes from the other computer, telling it to stop communicating. But neither message originated from the other computer -- it comes from Comcast.'" This is confirmation of anecdotal evidence presented by Comcast users back in August.

Comments

Any World of Warcraft users...

[mdm-adph]

...noticing problems downloading the patches on Comcast?

Just wondering since WoW uses Bittorrent to distribute its patches (one example of a very legitimate use).

Re:Any World of Warcraft users...

[webvictim]

FYI, it actually pulls them via HTTP (rather than FTP) from Blizzard's servers. The problem is that on patch day (or anything up to about two weeks after it) the HTTP servers get massively overloaded, so if you can't use BitTorrent then it will take an absolute age to download a patch. This is why people started downloading the patches and then putting them on HTTP mirrors. It's quite often a much better way of getting a patch, particularly considering that Blizzard's download client doesn't seem to pay much regard to your upstream speed, and therefore frequently saturates your connection to the point where the patch download actually slows down.

Comcast != Common Carrier

[winkydink]

This is a very common misconception.

Re:Comcast != Common Carrier

[quantum bit]

Source quench is an ICMP message, similar to destination unreachable but less severe. It's a way for a host to tell another host (or router) that it's sending data too fast for it to process and should back off. It was an early attempt at preemptive traffic control to throttle back before something has to start dropping packets.

There's not a whole lot of equipment that sends them, but pretty much every OS I've come across honors the messages to some extent. I don't know if the cheap NAT routers that many people use pass them along or not, though NAT in general tends to be fairly broken when it comes to ICMP.

If a man in the middle were to spoof ICMP source quench packets that looked like they came from either of the p2p nodes that were communicating, the effect would be that they would start sending data more slowly to each other. The connection would still be open, they just wouldn't transmit as fast as they could.

After reading the article it became clear that what Comcast is doing is much more evil. They're setting RST flags on packets (or maybe spoofing new packets in the right segment range with it set), which causes the entire connection to abort rather than just be slowed down. It could cause a lot of grief if their filter misidentifies something as p2p and starts shutting down the connections, as apparently happens to Lotus Notes traffic.

That last link has some good packet dumps of it happening.

Encryption

[Drachemorder]

In my experience, bittorrent transfers are much faster on my Comcast connection when I choose to encrypt them. That suggests to me that Comcast is indeed throttling normal bittorrent traffic.

Re:Encryption

[garbletext]

If you're using a decent client like uTorrent, Azureus, KTorrent, or Deluge, just check the options.
 
  encryption is useless in this case, however, since bittorrent traffic is obvious to an intelligent packet shaper such as the Sandvine systems that Comcast uses. Bittorrent usage generates a very distinctive signature even if you just look at the volume ant timing of packets. Once it figures out you're using bittorrent, it just needs to send the RST packet, which will have the same effect regardless of encryption: Your client will think that the remote peer closed the connection.

Re:Encryption

[jlabelle]

It appears to me that the Sandvine system uses a rudimentary heuristic to decide when something should be blocked. One can trigger the RST packets merely by making a few inbound connections to a Comcast IP. I have been unfortunately been triggering it for several months now by connecting to a machine at home with SSH. It will allow a few connections, (like, maybe 5-8 or so in a 30 minute period of time), before it shuts down *all existing TCP sessions that are inbound on the IP* and apparently *all* attempts at additional incoming connections to the IP in question. This lasts for some period of time around 30 minutes to an hour, then things work normally again. I've had to rewrite my file synching scripts so that they use SCP over a single SSH tunnel -- everything goes over one SSH connection, which I keep open the whole time I might need to transfer something from home. This has solved the problem, but the Sandvine system is anything but brilliant, and excessively heavy-handed. I had a detailed conversation with a Comcast rep. via the website chat thingy, and at the end, I said something like, "so, if I want to remain a Comcast customer, I have to be willing to deal with Comcast fiddling with my TCP sessions?", to which the rep. replied, "yes, basically." He then tried to upsell me some higher level of service which is $40 more per month than the $50 I am already paying.

Not just P2P traffic

[TheHappyMailAdmin]

I've posted this before, but it's pertinent and bears repeating, it's not just P2P traffic that Comcast is filtering. A sysadmin I know has been blogging on Comcast filtering corporate e-mail traffic as well.

http://kkanarski.blogspot.com/2007/09/comcast-filtering-lotus-notes-update.html

Re:Common Carrier

[Frosty Piss]

ISPs generally don't have common carrier status.

From wikipedia: "Internet Service Providers generally wish to avoid being classified as a "common carrier" and, so far, have managed to do so. Before 1996, such classification could be helpful in defending a monopolistic position, but the main focus of policy has been on competition, so "common carrier" status has little value for ISPs, while carrying obligations they would rather avoid. The key FCC Order on this point is: IN RE FEDERAL-STATE JOINT BOARD ON UNIVERSAL SERVICE, 13 FCC Rcd. 11501 (1998), which holds that ISP service (both "retail" and backbone) is an "information service" (not subject to common carrier obligations) rather than a "telecommunications service" (which might be classified as "common carriage")."

Fix to comcast.

[Lumpy]

Set your bittorrent client to only use encrypted traffic. It fixes comcast's little red wagon fast.

Almost all up to date bittorrent clients support this.

Re:Subtitled: How To Lose Your Customers To DSL

[Frosty Piss]

After Comcast loses all their customers to DSL, will they complain about [whatever DSL company]'s unfair monopoly advantage?

This is exceptionally unlikely to happen. The social groups that Slashdot folks circulate in are not the average. I know it's hard to believe, but very few of Comcast's customers give a shit about BitTorrent of p2p, even if they where aware of their existence. Most of Comcast's customers are average low-volume (if at all) computer users who have Comcast to view television, and picked up Interweb connectivity as part of a package.

Comcast has decided that p2p degrades their system, for them it's more of a technical issue than a political one (though I'm sure the **AA Gestapo have been in touch with them).

Question....

[8127972]

Actually two of them:

1. What hardware/software would carriers have to use to do this?

2. Can it be defeated?

Fwiw, Rogers cable in Canada is rumored to be doing the same thing (and perhaps more). Michael Geist talks about this on his blog: http://www.michaelgeist.ca/content/view/1859/

Re:Question....

[kwandar]

Actually, Canadian users should file a complaint about Rogers misleading advertising with the Competition Bureau (not advising purchasers of their high speed service in their advertising that they will lower the speed of P2P apps). I have, and so have others. It really is a question or priorities and complaint volume though, and at present the number of complaints has been very few.

For anyone interested, the Competition Act and there are numerous sections dealing with misleading advertising. By not advising they public they are actually reducing the speed of P2P apps, they are knowingly making a material misrepresentation to the public (Parts VI and VII.1).

You can file complaints with the Canadian Competition Bureau about Rogers, here.

Re:Good

[tlhIngan]

Now maybe the "net neutrality isn't important because we can trust giant corporations not to screw their customers crowd" will shut up. Of course, the people getting paid to lobby or keep those bills out of Congress won't change their mind, but maybe regular people will. And that's a step in the right direction.

This story does make me wish I was not boycotting Comcast already though, so I could boycott it for this.

Actually, this will hurt net neutrality because everyone is getting QoS confused with Net Neutrality!

QoS is legal, and it should exist. Prioritizing classes of traffic is OK, provided the classes are generic classes of traffic (e.g., email, web, ftp, p2p, voip, etc).

Net Neutrality is compatible with QoS. What Net Neutrality proponents want isn't avoidance of QoS, but to prevent deals where if you use Windows Live Search, it comes up instantly, while if you use Google, you'll find yourself waiting a good minute for the frontpage to load up. I.e., both use the same class of traffic (web), but service is differentiated based on who can pay.

So Comcast causing Bittorrent problems is OK for Net Neutrality. But if Comcast suddenly lets Blizzard's WoW updates unimpeded while causing problems for say, Linux ISO torrents, then that conflicts with Net Neutrality.

Basically, like traffic should be treated alike. But unlike traffic may be treated differently. So if Comcast charged an extra $10 for enhanced VoIP QoS, that's OK, as long as it's for all VoIP, not just say, Vonage only, or Skype.

Net Neutrality opponents like to bleat the Anti-QoS line because it's the easiest way to spread FUD, when they really mean "Google, pay us, or we'll make your page take ages to load, while making Windows Live Search load instantly".

Re:Dubious legality of forging resets...

[Anonymous Coward]

http://www.cnet.com/8301-13739_1-9769645-46.html

This article does seem to put forth an interesting idea. I wonder if a case could be reasonably put together for Comcast impersonating its users in violation of the law.

Re:Encrypt Everything

[Anonymous Coward]

you can't encrypt the TCP handshake. The Comcast attack (by sending false TCP resets/RSTs) still works against encrypted traffic. Encrypted traffic is carried as the data payload with in-the-clear TCP headers. As long as Comcast can discern (or even cares to discern) which traffic is undesirable from the TCP headers themselves (e.g., TCP port number, weighted aggregate traffic, many-to-one traffic connections, etc.) Comcast can still send your box a TCP RST and torch the session.

Re:ha

[Wildfire Darkstar]

Nope. This has been discussed ad nauseum already, but Comcast (and Sandvine, which they are in all likelihood using) isn't looking at the actual data, it's looking at the overall pattern of traffic. It is still going to send RST packets, regardless of whether or not your connections are encrypted.

Re:Illegal forgery and defense

[deftcoder]

You could just disable it temporarily on that one port.

http://redhatcat.blogspot.com/2007/09/beating-sandvine-with-linux-iptables.html

That was linked from the first result (a Digg article) for "iptables DROP RST".

This may have been considered already, but...

[rickb928]

... if Comcast is essentially attempting to disable Bitorrent, are they by any chance either violating or subverting one or more RFCs? Substitute the proper term for 'violating', that was the strongest word I could come up with quickly.

I recall that in the Early Days of the Internet, not abiding by the RFCs would get you in hot water. Especially screwing up with SMTP would do it, but even bad behaviour due to your incompetence would get your T-1 unclocked, and it would take a few calls to the powers that be to assure them that you found someone who knew what they were doing and that problem wouldn't occur again. At least not for a while.

My point is, perhaps it's time for the other Internet providers to consider requiring Comcast to not mess with traffic in this way, or sanction Comcast.

Sanctions could be as graduated as throttling at the NAPs, degrading Comcast traffic, even disconnects.

Some providers have a stake in this. If the legal Bitorrent users (WoW for instance) get a crossed hair over this, why would they not ask their providers to pressure Comcast into stopping this?

Ultimately, this may be Comcast clinging to their ToS and 'server' restrictions, and that would mean Comcast users won't be sharing out Bitorrent files. Bummer.

Another wrinkle, I wonder if Comcast sends forged RSTs to Comcast users sharing with *other* Comcast users. Intranetwork traffic shouldn't 'cost' so much for Comcast.

My theory is simple - Imagine if ISPs started throttling or denying traffic from Akamai, because of the volume... What a mess. And while Bitorrent is used for all sorts of purposes, so is SMTP. So if they think the illegal use of Bitorrent is sufficient excuse for them to deny it, why don't they throttle/deny SMTP, since simple spam is bad enough, but the emails of worms/trojans/scams also are objectionable. even arguably illegal. And certainly harmful, to users and the Internet. Maybe even Comcast.

Of course, that's not the point. Comcast is trying to avoid costs due to the volume of Bitorrent traffic that leaves them paying for NAP ports, lines to other ISPs, and routers/switches to manage all this.

In other words, they are trying to control costs by controlling usage.

One of the reasons I got out of the business pre-2000. Couldn't make a profit with my business model. Network costs were too high.

Well, another option is to surcharge high-volume users. Or charge more to afford to provide the service ostensibly advertised.

It's not often I can be happy to have Cox Cable. My Qwest DSL before just sucked, but the traffic got through.

Good luck. My bet is the best avenue is a class-action over either false advertising or Magnuson-Moss.

Re:LOL

[dajalas]

See if Earthlink offers cable Internet through your cable system. They do where I am. Earthlink has it's own gateways, etc. They have better policies. They allow low-bandwidth servers on a residential connection. And no, I don't work for them.

Re:Ubuntu 7.10 and Comcast

[Malevolyn]

Not sure why you were modded Informative, but you make a weak point. Cable providers (internet or otherwise) are very much regional here in the US, even inside the same company. I can drive 30 minutes in one direction and the TV channels are the same, but 30 minutes in the opposite direction and all the channels are different. And that is just Bright House Tampa and Bright House Central Florida, not yet different providers.

But what happens is a small company starts up, gets gobbled by a larger company (Time Warner owns Comcast, IIRC), and then dominates the area because that's more cost effective than rebranding. Especially in larger coverage areas.

Another issue you fail to realize is that for every spam host, there are probably 10 people legitimately using smtp. Believe it or not, ISPs simply cannot do all of our spam filtering for us because those spam hosts also send legitimate e-mails. Besides, with software like SpamAssassin, there really is no need for the ISP to do our work. I, for one, would be very upset if I no longer received e-mail from Sourceforge because of an ISP-side filter that I couldn't control.

The ISPs around here aren't stupid. They know that there isn't much they can do about BitTorrent traffic because of the ability for legitimate use. In fact, there is legal precedence to protect BitTorrent as the same issue was addressed with the blank VHS tape. There was a legitimate use, so blank media is legal. BitTorrent really isn't THAT much different, in that case.

As for encryption, there's nothing anyone can do about it. It is 100% perfectly legal to encrypt anything I want and send it over the internet. The content itself may not be legal, but the act itself most certainly is. I have yet to see anything about a government raid on anything OpenSSL related.

[citation needed]

[nothings]

This is nonsense. If you have any backing for your claim that the internet somehow relied on asymmetrical bandwidth selling, [citation needed], because your presentation doesn't add up. (I certainly don't have any clue how it works behind the scenes, but your description of the endpoints sounds silly.)

Enter P2P, and now there's a lot of data being transferred between the users, with noone paying for it. ... we're all on flat rate, so noone pays. Every 1 MB I download is 1 MB that Blizzard didn't pay for.

But somebody somewhere is uploading that data that's being downloaded. It's not magically coming from nowhere. If the trick is that the cost of bandwidth is supposed to be shouldered by the uploaders, then it's shouldered by the uploaders, and it doesn't matter if it's being downloaded by p2pers or anything.

Which you vaguely get at later in your reply, but this sort of comment is nonsense: "Legal" BitTorrent transfers tend to fall in that category. Someone thought he's smart if he, basically, cheats the ISPs of the bandwidth price. Instead of putting the file on a site and paying for the bandwidth, now he leaves it to a bunch of users that the ISP can't figure out how to bill for it. Nobody posting legal files thinks anything like they're "cheating"! Even if your theory is true, nobody out there knows it, so how could they think they're cheating? They think they're 'spreading the load' somehow. They're using 'available bandwidth' that's not being used for anything.

Then you say:

2. To make things work, paying for the receiving end too was based on oversell and... well, a self-throttling sharing scheme.

Ok then. If all download bandwidth requires corresponding upload bandwidth, and p2p uses "average users'" upload bandwidth, and upload bandwidth for "average users" was oversold... then that means your argument ends up being "broadband vendors oversold bandwidth"! (Just that it's upload bandwidth, not download bandwidth like everyone thinks.)

But this all hinges on a rather bizarre claim about how bandwidth is sold (by upload bandwidth only) that does things like ignore people in the middle... it may be true but your presentation is so sloppy that it doesn't seem trustworthy at all.

You can take it as an example of a problem their own massive oversell created, if it makes you feel any better.

Yeah, gee, I think I'll do that, since that's what your argument boils down to.

Re:Not that simple

[vsync64]

I appreciate your effort to view all sides of this issue and bring balance to the discussion. Unfortunately your points are utter hogwash.

The pricing model for ISP's was based on the idea that the provider of that content paid for the bandwidth. That's why you can get a flat rate, in a nutshell.

It's based on the users of bandwidth paying for that bandwidth. How do you explain consumer-only ISPs that don't host content? How do they stay afloat?

Enter P2P, and now there's a lot of data being transferred between the users, with noone paying for it. If I download a WoW patch from Tom, Dick and Harry -- the WoW patch downloader being a modified BitTorrent client -- we're all on flat rate, so noone pays.

Tell me how "flat rate" equates to "noone[sic] pays". ISPs charge the cost of their bandwidth divided by the number of customers, plus a little on top for their operations.

Keep in mind that all connections have bandwidth limits, and most have monthly transfer limits. (The latter should be treated as fraud by the courts; ISPs love to shout "unlimited!" in their advertisements. But that's a separate discussion.) If you start transferring a lot, uploading or downloading, you have to get a higher-priced account or pay for the extra data transferred a la carte.

Someone thought he's smart if he, basically, cheats the ISPs of the bandwidth price. Instead of putting the file on a site and paying for the bandwidth, now he leaves it to a bunch of users that the ISP can't figure out how to bill for it.

Please. If I am a thoughtless user and I create a giant 10MB dancing hamster video and mail it to my friends, and they start forwarding it around, am I "cheating the ISPs"? (Collectively, by the way... since when does everyone have to start considering the welfare of every business out there? What happened to capitalism?) The ISPs absolutely can figure out how to bill for it: charge by connection time or by quantity of data transferred. Look at business accounts; they have detailed billing for "burst" and "sustained" transfers, transfer limits, and more. What they can't figure out is how to avoid getting hoist by their own petard, after they made fun of AOL for those practices, and then repeated AOL's mistakes.

What BitTorrent does, though, is best described as "not playing nice" in that sense. It will keep opening more and more and more connections until it fully saturates those 6 Mbit/s, everyone else be damned.

So what are those "max connections" and "max bandwidth" settings I've seen in every BitTorrent client I've ever used?

Now again, I'm not saying that Comcast and the gang are doing the right thing there. I'm just saying what their problem is. You can take it as an example of a problem their own massive oversell created, if it makes you feel any better.

We're in agreement there. But why does your unbiased simple explanation contain numerous factual inaccuracies which all back up the terrible business practices and fraud of the ISPs?