Slashdot Mirror
Google Caught in Comcast Traffic Filtering?
marcan writes "Comcast users are reporting 'connection reset' errors while loading Google. The problem seems to have been coming and going over the past few days, and often disappears only to return a few minutes later. Apparently the problem only affects some of Google's IPs and services. Analysis of the PCAP packet dumps reveals several injected fake RSTs, which are very similar to the ones seen coming from the Great Firewall of China [PDF]. Did Google somehow get caught up in one of Comcast's blacklists, or are the heuristics flagging Google as a file-sharer due to the heavy traffic?"
I'm on Comcast, and haven't had any problems. Doesn't mean they're not doing it elsewhere, but they don't seem to be doing it here.
ZuluPad, the wiki notepad on crack
70% of all "file sharers" use Google. Anyone with even a small background in statistics can see that Google is behind all this piracy. Comcast is simply watching out for our economy. I say good for them. Now if they would only do something about that wretched Slashdot and its wanker community.
See my journal for slashdot ID's by year. Mine created in 2005. http://slashdot.org/journal/289875/slashdot-ids-by-year
After all, doesn't Google host more copyrighted content than any other person/company in the world? ;)
Starting yesterday my Gmail Notifier Firefox extension stopped working at home where we have Comcast, but at work it works just fine. I thought maybe the plugin had broken due to some API changes or something but I thought it was odd it worked one place and not the other. This really seems like it's related and even though I believe Gmail Notifier is a third party extension, it's still accessing Google's servers.
Comcast is really pissing me off. But what's my other option: Qwest DSL.
Reviewing just the first hour of video games.
Hard. Nothing worse than a pissed off multi-billion dollar company suing your ass off. That will teach them.
Knowledge is power. Knowledge shared is power lost.
Is the title clear enough? I can't imagine any judge or jury saying Comcast is allowed to impersonate Google and tell Comcast customers they're not allowed to use Google's services or that Google's services are overwhelmed and shutting down connections. That's essentially what forged, fraudulent RST packets from a MITM attack are doing. That can't possibly be considered a legitimate business practice in court.
If Google were being wrongly flagged, and Google ends up suing the ass off Comcast to put an end to this bullshit.
use connection tracking on this one:
iptables -I INPUT -j LOG -p tcp -m tcp --tcp-flags RST RST -m conntrack --ctstate NEW,INVALID
The fake RST will probably not have a valid sequence number for the established TCP connection, so the Linux stack will flag it as a NEW connection, and the fact that you're getting a RST for a NEW connection should be good enough alarm.
Or maybe it would also work with just the matching code
iptables -I INPUT -j LOG -p tcp -m tcp --tcp-flags RST RST -m state --state NEW,INVALID
What do y'all think?
When loading a Google Page, an intermediate page pops up saying
"Your ISP is interfering with the transmission of data requested from Google our users, and as a result we are unable to consistently provide advanced services to you. You will be redirected to a more basic version of Google's services so that we can provide as much as we can in the manner you have come to expect from us".
Wait 10 seconds, then redirect to Google's non-AJAX pages.
I predict hordes with torches and pitchforks (led by a little old lady with a claw hammer)
"As God is my witness, I thought turkeys could fly." A. Carlson
Not sure if this is anything, but I use Google Web Accelerator on Comcast at home. Lately, I have been getting a lot of DNS issues at home with it. When I take my laptop to school, I do not get any DNS issues.
What if Google, a (justifiably) huge advocate of network neutrality, is deliberately sending the type of RST packets that imitate Comcast's faked packets, specifically to Comcast IP addresses, knowing the inevitable fallout that would result? It would make an already bad situation for Comcast far, far worse, and it's likely that the requested Senate investigation would turn into nails in the coffin for those who want preferential treatment of packets on the Internet.
For a company that does no evil, if they could pull it off, it would be absolutely diabolical. But then, it could easily be one of those "ends justify the means" kinds of situations. At any rate, all I can say is "MWAH HAH HAH HAH HAH!!!! Suckers!"
(No, I don't actually believe that's what's happening, but man, what an AWESOME plan to make network neutrality happen once and for all.)
I have been unable to use Google maps for months now on Comcast. I have called them, but, you can guess how that went. Yahoo maps and Mapquest work fine, but on Google I get about half the tiles filled in before it stops. And I mean it stops. It ends up looking like a checkerboard. Occassionally it will finish a couple of minutes later, but typically it never does.
Getting Comcast to fix it seems unlikely.
Do you have ESP?
This looks like it could be extended - add a -j DROP rule after the -j LOG (log the offending packet, and then send it to the bit bucket).
Oh, no! You have walked into the slavering fangs of a lurking grue!
It's called DNS caching.
Did you actually flush your DNS caches like, say, the one in your router, the one in your linksys box, the one on your PC? You can do it manually but the quickest way for a lot of equipment is to reboot. Hence the suggestion.
Additionally, it was quite likely google because something on your machine (maybe yourself "trying" the connection) had accessed google while the DNS redirection was in place (that was how they "redirected" you to their page). Once you'd done it once it'd linger until the TTL's had expired all the way back to your computer. Ping, nslookup, etc. would ALL show the Comcast IP until that happened, which could be minutes, hours, days, months, depending on your setup.
In your case, it looks like it was less than 24-hours, because it worked the next day without having to reboot. If you had rebooted immediately, it would have all worked when it came back up. That's WHY he was telling you that.
Before you start throwing accusations around, delve into such things just a little bit deeper.
IPSec would thwart this sort of attack (since it encrypts at the IP layer, you can't forge a RST packet in the TCP header). Yeah, it costs more CPU, but that's not a problem for modern PC clients, and I suspect Google can handle it, too. Is it time for this to become SOP?
Now, whether MS would be cooperative in that, I dunno... I know XP supports it, but not too much about configuration specifics.
You're looking at the date the posters joined the forum, not the date of the post.
Your OWN COMPUTER was redirecting you to Comcast (maybe you should be indignant towards Microsoft? >_>). It's called DNS caching.
In Windows a simple ipconfig /flushdns can take care of that, although some applications, such as Firefox, keep their own DNS caches which must also be cleared (In Firefox there's a DNS cache timeout in about:config somewhere, you just set it to 0 and then back and that should flush the cache).
Also the tech was almost right... restarting your computer WOULD have fixed it (since DNS caches are only kept in memory and would have been wiped when you rebooted) although it wouldn't have been the OPTIMAL solution.
Let me take you through the steps your computer took.
I recently moved from one house serviced by comcast to another and I can tell you there is DEFINTELY something screwy going on, and it's not just bittorrent trafic.
I've done bandwidth tests and my upstream STARTS at a nice 1.5MB/s and then 15 seconds later drops to 30K/s EVERY TIME.
What this does is give false results when people are doing speed tests. When you do your test you get great results (in my case 15Mb/s downstream and almost 2Mb/s upstream) for the first 15 or 20 seconds. Then after that it just BLOWS.
Someone knowledgeable about this issue should update the wikipedia page about sandvine.
The way it's written now, everyone should use Sandvine - it sounds like wonderful software.
There's a lot of guesswork here about what providers may or may not be doing; are there any applications for actually testing ISPs? Such testing apps would discover traffic shaping, port filtering, connectivity, and other traffic modifications by the ISP. Something like a bandwidth tester on steroids.
I was working from home last week, so I was using my Comcast connection extensively every day. The problems with Google connection happened several times a day. Intermittently, my attempts to connect to www.google.com failed for 5-10 min at a time. Oddly enough, going directly to Google services (Gmail, Notebook, Bookmarks, etc.) worked just fine.
Putting an extraneous link in front of your posts like you did is spam. Having said that, putting the link into your signature is accepted practice here. It's less annoying and nobody will get upset.
comcast.net search is still powered by google, I wonder if they looked at my search term "comcast [RST]" on the way out?
Apocalypse Cancelled, Sorry, No Ticket Refunds
I have to go with the dutch situation because that is the one I know.
In holland you used to have PTT (Post, Telecom, Telegram) which was owned by the state and also had banking services. Basically they where huge, slow, old but worked and kept things under control. For instance Postbank does NOT charge end users for tranferring money and has a free debit card. Essentially for normal people banking in holland was FREE and paid an interest if you had a postive balance.
But no that was not good enough, we needed competition and PTT was split up into the mail segment, the phone segment (KPN) and the bank segment (postbank) (The whole story is a bit more complex)
KPN now is a commercial business competing on a free market. Yeah right, it was the state that lay down the copper network that they essentially got for free. How is any other business supposed to compete with that?
It is as laughable as competing the NS (dutch railway) which is now supposed to be a commercial company, but got all its infrastructure for free. Oh yeah, they got to pay a few million each year, how does this compare with the cost of installing a rail network thatruns right to major cities?
Free market and fair market are insane ideas by themselves, but the idea that you can have BOTH is so laughable it is to cry.
For telecoms the problems is the wire, who has the wire, controls the user. So either you put in very heavy regulation to make sure everyone can access those wires (not a free market) or you accept that those who happen to inherit the wires own the customer (not a fair market).
The idea that a new player in the market can just install their own network is idiotic, the costs are extreme and the benefits miniscule, plus do we really want anymore companies digging up roads?
We are in luck that years ago cable tv happened, else the telecoms would totally own the internet. Now at least we got two end-point networks in the ground, but as The Netherlands showed, until the phone network was forcibly opened and a third part could enter the market and start offering better service for less money only then did the cable companies start to improve theirs.
At least on the phone network you now got plenty of supplies, yes they use the underlying KPN network, but some of them are indeed competing by just selling you bandwidth and nothing else. You rent a pipe from them, and that is what you get.
Offcourse, you pay for that, and as long as Joe Average continues to only look at the initial price, companies that offer real quality with no hidden strings are going to lose out.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
*Comcast phone ringing at head office*
... Uh, um, I- I'll talk to our engineers about getting this straighted up right away... sir.
Comcast Secretary: Hello, thank you for calling Com-
Google Big Cheese: This is Google Inc. calling, I want to talk to whoever's in charge. Now.
Comcast Secretary: I don't know who you think you are but-
Google: Go visit google.com right now.
*secretary visits google.com, google recognizes the comcast head office IP range and serves up a pdf of a lawsuit document (Comcast as defendant) instead of the google homepage*
Secretary: Oh my, one moment please I'll transfer you.
Comcast Big Boss: What? I'm busy lining my socks with money and throwing darts at customer photos.
Google: This is Google Inc. You know why I'm calling.
Comcast: *stutters* y-yes, but we have the right to do whatever we need to, to ensure that our networks....
Google: Seriously?
Comcast: Seriously what?
Google: Seriously, you want to mess with us? Are you sure?
Comcast: *Long pause, and painful griding noises of "thinking"* Well... I think you overestimate how powerful you a-
Google: You have a lot to lose 'my friend'. You have 823 employees using Gmail. 138 office locations on Google Maps, 2,345 website pages indexed by the google search engine that recieve a collective 546 thousand search hits per day from Google Search. You currently rank first for the search term "cable internet" and nearly all your press releases are picked up by Google News. Do I need to go on?
Comcast: *speechless silence*
Google: That's right. And be quick about it. *snaps fingers*
--
(All numbers are made up)
Yeah, that's what I see coming...
This had me up far too late yesterday trying to figure out WTF is going on.
.pcap format if you'd like to take a look.
Here's the condensed version:
* Pings work fine, other websites work fine - only HTTP to google.com with a "google.com" host header is affected
* HTTP 1.0 without host header isn't affected
* Going to one of google's web servers by IP works fine (no "google.com" host header)
* I am typically seeding torrents and was at the time of each service interruption
* TCP RSTs follow a specific pattern. 2 RSTs in rapid succession in response to the initial GET statement (1 with a valid SEQ, one with a SEQ in the 12xxx range), followed by a second batch of the same. As the article here states (and as I posted in the linked thread), this matches perfectly with results from the China firewall
* The problem went away at almost exactly 12:00am EDT this morning (give or take a minute)
* This is from a Comcast subscriber in Grand Rapids, MI.
For more detail, visit the thread linked. I have links to the raw packet capture data in
Let's face facts - Slashdot geeks will get upset over anything. There's no hope for someone who tries not to offend here. You can't help but piss off some lonely basement dweller no matter what you do.
Slashdot - where whining about luck is the new way to make the world you want.
I'm on a Comcast business account. I recently had a problem where a working, light loaded Postfix installation suddenly had 10-20% of my outbound email traffic just hang. Verbose logging showed that the problem always occured at the DNS query stage. Mail sent through a backup server suffered the same fate.
Using tcpdump showed that all the bad dns queries stopped after 4 frames, while the successful ones went 68 or 70 frames.
Switching from Comcast's regional DNS servers to their national DNS servers fixed the problem immediately.
Makes me wonder what they're doing on the regional ones.
Never shake hands with a man you meet in a fertility clinic.
Just hoping for an informative here:
I believe that 4.2.2.1 - 4.2.2.5 (or maybe 6) are all DNS servers for Level3, in case you want multiples available.
My blog. Good stuff (when I remember to update it). Read it.
It's far more likely that Google, rather than imitate Comcast's packets, would instead alter some subset of their traffic in a way that would make it more likely it would trigger Comcast's filtering. No need to fake the interference--it's actually there. Just figure out how to trigger it and you have your talking point.
Build a man a fire, he's warm for one night. Set him on fire, and he's warm for the rest of his life.