Slashdot Mirror
80 Gbps Deep Packet Inspection Hardware Announced
An anonymous reader writes to tell us that Procera Networks is launching a new weapon on the deep packet inspection (DPI) front. At $800,000 these 80 Gbps tanks aren't going to be sitting in everyone's closet, but it could mean that more traffic shaping is on the way. "The PL10000 can handle up to 5 million subscribers and can track 48 million real-time data flows. That's certainly a potent piece of hardware, but larger ISPs will need more. That's why Procera designed the new machines with full support for synchronizing traffic flows where return traffic might be routed to a different PacketLogic machine. The machine receiving the return traffic can make the machine monitoring the outbound traffic aware that it sees the other half of a TCP/IP conversation, for example, giving the devices more accuracy than those which might only have access to one side."
I'm sure this will work just as well as the others. A waste of money.
Just in time for the olympic games!
At almost a million dollars a pop, is it really saving money for ISPs to use these? How many would a major ISP need to shape all of their traffic?
80 Gbps tanks aren't going to be sitting in everyone's closet
Not until Wrath of the Lich King comes out ... wait, what were we talking about?
Shop as usual. And avoid panic buying.
How many Libraries of Congress...?
80 Gbps? Almost... 88 mph!
Joining separate incoming and outgoing paths? 5 million subscribers? Deep Packet? Surely the porn industry will invest in this technology.
Also - $800,000 for 80 Gbps? That's just 1 cent per kilobit per second! What a bargain!
I guess a handful of these would beat a hojillion racks full commodity servers running pf+altq, but how does the cost really add up?
DPI has only one option when presented with encrypted information however (at least afaik). Give the packet a low priority or pass it through normally (of course, it could also drop it entirely but doing that as a rule would be problematic to say the least). So it would be possible to force a bet. Can the ISPs afford to give encrypted traffic a very low priority?
Happiness does not come from having much, but from being attached to little.
in a few years when every client does opportunistic point-to-point encryption. We are headed that way, right?
Surely that money could be better spent improving their capacity by purchasing new equipment with better signaling methods or even extra lines rather than on equipment to inspect and shape (i.e. selectively throttle) traffic?
Even if improving the capacity costs a fair bit extra the space for more customers at higher speeds and more consistent service for existing customers will surely increase their profits by offering more than their competition right?
How much of this advertised speed is more or less advertising hype more than anything else??? We all know what it takes to do packet inspection and rules table lookups, so to me, this number seems a bit on the hyped up side...
Anyone else getting this same riff??
All content in this message is copyright (c) 2008. All rights reserved. RIAA is prohibited here.
Sounds like strong encryption needs to become the norm for everything. Encrypt everything and they have to fight harder to inspect it. It'll turn into a ridiculous arms race, but they're firing the first volley with this, and to do nothing is giving in to it.
I also think that stronger net privacy laws won't be enough to really stop it, since it's not just our government (Or indeed, not just governments in general,) that'll be using these.
only 80Gbps with 5 million subscribers? If my math isn't way off, that's about 16kbps - which is pretty pitiful speed. You'd have to throttle a lot just to be able to use one of these machines at max subscribers per machine.
Welcome to Comcast - our new TOS allows you to view text-only web pages with your *high speed* internet connection!
wtf is the point? p2p isn't going to slow down. It would also be hard to deal with encrypted p2p as instant messaging applications are using encrypted communication too, not to mention gov networks and credit networks.
I'm waiting for an ISP to use one of these so someone can sue the shit out of them for throttling their data connection.
$800,000/5 million subscribers = $0.16 per subscriber.
Expect to see the surcharge in your next bill!!!
Privacy is the big one. I can see a justification for finding DDoS attacks and zero-second malware propagation, this machine is nothing more than a net-neutrality killer of the highest order.
First big customers: Comcast, Rogers, Bell Canada, AT&T, and the others that we love to hate.
The FCC needs to investigate this thing NOW. It's a monopoly-maker in just 12U.
---- Teach Peace. It's Cheaper Than War.
Maxwell Smart's communications might be ultra-secure, but nearby KAOS agents still hear whenever his shoe rings, y'know?
But if Agent 86's shoe phone rings while he is inside the Cone of Silence, does KAOS stll hear it?
ISPs will spend money on DPI/traffic shaping whether i like it or not, so might as well make it efficient.
in ankle bracelets on truants, cameras around london, etc.
those are just stunts, it is propaganda and hysteria to overinflate the significance of those developments
but this massive dpi stuff, this is big brother for real
but its not as sexy a lightning rod visceral symbolic issue like ankle bracelets on truants. so it won't experience the same outcry
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
I'm pretty sure porn will get 1st priority!
think about the original definition of ethernet and of IP, in general.
in general, it was setup to pass packets and ideally to keep them in the same order and not drop them. beyond that, the upper layers (tcp and udp) did any higher level functions.
this worked! for the longest (damned) time, it worked.
and now, ISPs (and large networks) are starting to try to break out the 'cable is a bunch of bits' into discrete 'services' and then try to re-order things, drop things, queue them differently or somehow treat things non-uniformly.
I think this is Evil(tm).
I've been in the networking field for a few decades (really) and I've seen traffic shaping (what a euphemism, btw!) try to argue its case over and over again. but I keep getting back to the basic design principles of ethernet (csma-c/d) and tcp/udp-ip and when you have large enough pipes, you don't NEED a 'fast lane' or diamond lane, so to speak. it just mucks up the works, makes things harder to design and manage and really isn't helpful since you still need large pipes and all the shaping in the world won't CURE that, it only DEFERs things. that's not a cure.
data should be 'opaque' and first-come first-served. equal access. standard layer (phys, dl, network) rules should still apply.
ISPs who employ shaping are simply RIPPING OFF customers from their rightful bandwidth and also passing along the COST of the packet snooping hardware to us, the users. (don't think they'll just spring for the hardware on their own; they'll pass the costs of this stuff to us, to be sure).
I think its evil. once you look at it from enough angles, you see that its not at all a good thing.
--
"It is now safe to switch off your computer."
It's bad for the end user and good for the "corps" nothing good will come from this from my perspective, and not just because I am a p2p user.
"If any question why we died, Tell them because our fathers lied."
If my ISP is going to inspect my packets to the point of identifying their content as p2p, then they should be 100% responsible for any and all illegal activities I may or may not conduct on their connections.
The entire concept of the DMCA safe harbor clause was founded on the understanding that it would be virtually impossible for providers to monitor and filter illegal or unlawful activities and data. However, now it has become perfectly reasonable that they can identify and reroute or slow this traffic. This clearly nullify's the safeharbor provisions.
The ISP's need to realize they cant have it both ways.
If sharing a song makes you a pirate, what do I have to share to be a ninja?
It looks like a disaster in a box to me: not only does it allow anyone with the price of the machine to monitor and inspect each and every packet you exchange, it also is capable of destroying the legal protections that ISPs currently enjoy.
The ISPs are treated like common carriers and are exempt from many liabilities because they carry all traffic equally and don't know or control the content of that traffic. Now that they're insisting that they need to "prioritize" some traffic at the expense of others, monitor and drop traffic because of its content, and are installing machines like these that further refine their ability to monitor and control what traffic you'll be allowed to transmit - well, their "safe harbor" exemptions are based on them not doing any of this.
Just the existence of this machine will be the undoing of many...
It kind of does, actually (at least on some management bits and pieces)
Like all regex/NFA/DFA based inspection engines, they all fail when malware hides inside archive files.
Don't say that he's hypocritical
Say rather that he's apolitical
"Once the rockets are up, who cares where they come down
That's not my department," says Wernher von Braun -- Tom Lehrer
From the people that brought you the War on Drugs and the War on Terror, its the War on Privacy!
It looks like a disaster in a box to me: not only does it allow anyone with the price of the machine to monitor and inspect each and every packet you exchange, it also is capable of destroying the legal protections that ISPs currently enjoy.
The ISPs are treated like common carriers and are exempt from many liabilities because they carry all traffic equally and don't know or control the content of that traffic. Now that they're insisting that they need to "prioritize" some traffic at the expense of others, monitor and drop traffic because of its content, and are installing machines like these that further refine their ability to monitor and control what traffic you'll be allowed to transmit - well, their "safe harbor" exemptions are based on them not doing any of this.
As said many times here, in the USA, an ISP is not, repeat. not. a. common. carrier.Just the existence of this machine will be the undoing of many...
To everyone saying, well, I'll just encrypt everything: That's great, but this thing falls back on service fingerprints to identify traffic if it can't inspect packet contents. This is a similar concept to nmap's service and OS fingerprinting tech. Idiosyncracies of timings, handshake protocols, header flags, and traffic patterns can give away that a packet contains p2p content.
Repeat after me: encryption isn't a panacea.
obviously no deficiencies vs. no obvious deficiencies
I'll bet in the war against p2p, making p2p data look like normal "priority" data is going to be far easier, and far cheaper than the ISPs trying to identify and block/slow the data they don't like. Consider that hiding p2p data takes one person with a keyboard and some smarts. In a month this guy will work around any solution the $800K machine guys have put together, and the next machine will be 8 million dollars to do the same job.
Encryption? Just the first salvo. Others have pointed out that p2p makes a lot of connections. That's fine, just create a secure queuing system where people wait their turns (and don't have multiple data streams). Or, a repeater system where you get one or two data feeds in, and feed to one or two other people. There's no reason why a p2p system has to have 50 different connections to different people. Start looking at the data itself and see if it's http-like? Okee-doke, just create an http wrapper around your data so it looks like http. These are just the dumb ideas I came up with on the fly. Real solutions would be a lot better.
This kind of asymmetric "war" has been fought before, namely with copyright protection in the 80s. The result? Cracked programs are more valuable than non-cracked programs (oh, and all copyright protection schemes were cracked)
In a system with untrusted intelligent nodes, you can't really create a priority system without some people making their non-priority data look like priority data. The internet was designed for the end nodes to be smart, and the network to be dumb. (The exact opposite of the phone system). It seems to me this is just a basic design principle of the internet.
AccountKiller
As they have proven, they just blame the slow speeds on hackers and pirates, kick everyone off who complains or uses too much, and then over charge the rest.
I steal signatures. This one used to be yours.
Why don't ISPs just monitor bandwidth and just throttle people who consume too much. All this packet inspection crap is easily overcome through encryption but bandwidth usage is transparent.
With IPsec, they won't even be able to see what protocol is being used. The more we use IPsec for everything, the less these things will look like an attractive way to spend money that would otherwise go to expanding capacity.
now we need to go OSS in diesel cars
why cant this be done in a powerfull pc, a few gpus to do the math (trivial to paralelize), and a couple of pcie 16x channels to do the trafic... ad a few pcie 10gb ethernet and write good code... i mean, a 35k computer (cluster?) can do this, at a fraction of the cost!
They can try to block p2p traffic all they want I don't care if my isp starts to block p2p traffic I'll simply change to an isp who doesn't block it. So they can buy all the 800,000 dollar machines they want its going to cost them that plus unhappy customers. The free market will speak.
for years. This is not new. They have products (marketed towards the intelligence side of the world initially) that have been able to do DPI in near realtime on OC circuits. They can even take it a step further and do near real time packet replacement and data insertion... This is what you should be afraid of.. not of the fact that they can read your traffic in real time, but they can manipulate it in near realtime. It goes much deeper as well when you tie these types of products into other things like firewalls, IDS/IPS, netflow monitoring, etc etc...
I came, I conquered, I coredumped
OK then lets play a game. I can still spot your traffic and classify it as p2p with near 100% accuracy. I'm not going to tell you how, you have to guess and experiment. If you reply here with another attempt then I'll tell you if you pass or fail, but not why.
Still want to play? If this sounds unfair then consider how this machine will be deployed...
PS You still haven't defeated the encryption fingerprints that the DPI uses but there is something much more obvious that identifies your traffic as p2p
Slashdot: where don knuth is an idiot because he cant grasp the awesome power of php
Look at the priority the user requested for that packet, check to make sure the router you received the packet from hasn't filled their quota for that priority, and if not, give the packet that priority.
Remember when the internet was supposed to be a "dumb" network that could therefore be easily and seamlessly improved by just improving the software at the endpoints? Those were good times.
What the parent said does not work in Canada. Basically, Bell Canada subject ALL traffic (including those that are leased to other ISP) through its last mile with DPI. They capped ALL traffic that are not on their white list. If you use SSL or any encryptions, you get 30kB/s caps...
No amount of encryption is going to work when they are throttling your PPPoE on its way to your ISP.
http://www.dslreports.com/forum/r20465278-Proof-Bell-throttles-everything-but-known-portsprotocols
I'm not going to tell you how, you have to guess and experiment.
You obviously have underestimated peoples tenacity at solving puzzles. The is FUN to a lot of people, and all it takes is one guy to find out your secret.
but there is something much more obvious that identifies your traffic as p2p
I'm sure there is, and the P2P guys will work around that problem. Are you (the ISP) will to continue shoveling money into the companies that develop this, or would you rather just either buy more bandwidth, or establish real bandwidth usage limits? I'm betting on the latter. The war has to be worth fighting. The guys fighting the copy protection wars largely gave up 15+ years ago because they decided the cure was worse than the disease.
AccountKiller
Yes, some providers do some pretty bad mangling of BitTorrent and yes, that's pretty daft. The worst case scenario for them even if they were to block it entirely on the other hand is that they lose a limited number of customers hogging the majority of their bandwidth. For now. P2P usage is increasing in non-filesharing scenarios as well, one being IPTV. Extremely common in China, we westerners are slow on the uptake. The ISP will need to adjust.
Enter distance-aware P2P - P4P if you prefer buzzwords. This will enable the providers - especially the larger providers - to keep the majority of the P2P traffic within their networks. Sure, it'll still lead to congestion points (trust me, 10 gig fibers isn't feasible everywhere for a while yet), but it won't eat into the global transit like it does today. Now there's a solution - faster speeds and no traffic limits for you, less valuable transit traffic eaten for the ISP. Fancy your puzzle? Implement better P2P routing algorithms that allows willing providers to participate in some fashion and adapt this in P2P clients.
As for DPI, if it means that my SSH usage or WoW raid doesn't lose out on packets to your downloading of porn, nice. Or better, if it means that your neighbours won't suffer much when you hog all the bandwidth in your cable loop. As long as the usage is sane, there's benefits. Insane usage won't pan out in the end.
'll simply change to an isp who doesn't block it.
You are lucky and in the minioriy who can choose from several broadband providers. I have a choice also.
It's Comcast of any of several dial-up offerings in the area.
Have you tried to do P-P on 0.3 Kbs dial-up lately?
The truth shall set you free!
It can be used to offer different flavors of connections. Maybe people here at /. can not even imagine it, but, there are millions of people that could agree to pay a little less if they have the P2P blocked.
What about companies, buying internet connections with P2P blocked on the ISP? ISP could even sell that as a plus, then, they can charge more giving less, and IT admins can forget about managing they're own filters.
What about a http/smtp/pop3 only connection?
Obviously, DPI was developed to cut P2P down, but it can used for many more.
l2iptables? All this hype seems to imply that 80gbps of data is actively changed... which would be impressive, but since it just queues it into priority based classes, it isn't. My SparcStation 5 can do 100mbps traffic shaping while sitting at 0.0 average load. So, for a machine that costs 800k, seems like an overpriced piece of hardware that can always be overcome by advanced protocol encryption. Why not spend it on giving everyone a bigger pipe? Oh WAIT, that would be more bandwidth for the P2P TERRORISTS, AHHHHHHH.
entry level models, and these things are pure evil on a stick, the kind that gets packet snoopers salivating. I was watching a live demo where they were using a control console with a box installed in another country at some ISP, and we were quickly able to drill down and watch a chat between some manager and his secretary (NSFW by the way), real easy. Procera is locking up the ISP market in europe , and is pressing hard into other markets. These guys make these kinds of capabilities affordable, compared to the Narus boxes used on those AT&T taps, which brings the barriers to trivial and largely unverified use down.
There is major difference between this and copy protection. btw I've never heard someone with so much religosity on the subject, outside of this bizarre context that is slashdot you would be quite scary
This "puzzle" has none of those characteristics. You are changing one of a million attributes of a dataflow. Somebody else is reading and estimating that attribute. You have to get the whole set to fall below their threshold before you get any feedback. That is what we call "work".
Slashdot: where don knuth is an idiot because he cant grasp the awesome power of php
What I'm pointing out is that some of the give-aways that label a stream as p2p traffic are not simple to fix. They impact download performance.
Does that really matter? Reduced performance is better than no performance.
the pool of people skilled enough to do it that think it is fun is shrinking rapidly.
Why?
btw I've never heard someone with so much religosity on the subject, outside of this bizarre context that is slashdot you would be quite scary
Thanks for the douche bag comment. I really don't see any reason to get personal here.
You are changing one of a million attributes of a dataflow. Somebody else is reading and estimating that attribute.
I nice theoretical assessment, but how well will it stand up to the real world? How much processing can you reasonably do to each data flow to find out if you like it or not? How many false positives are you going to identify as p2p? How much maintenance cost do you have to do the system to keep it in working order? This is a non-trivial problem, as the environment keeps changing. In the end it's all about $$, and I'm betting the p2p guys can make it cheaper for the ISPs to stop trying to block p2p (or whatever other traffic they decide they don't like).
AccountKiller
Slashdot: where don knuth is an idiot because he cant grasp the awesome power of php
Seriously. I have seen glaciers that move faster than Freenet.
HSJ$$*&#^!#+++ATH0
NO CARRIER