Slashdot Mirror
An Education In Deep Packet Inspection
Deep Packet Inspection, or DPI, is at the heart of the debate over Network Neutrality — this relatively new technology threatens to upset the balance of power among consumers, ISPs, and information suppliers. An anonymous reader notes that the Canadian Privacy Commissioner has published a Web site, for Canadians and others, to educate about DPI technology. Online are a number of essays from different interested parties, ranging from DPI company officers to Internet law specialists to security professionals. The articles are open for comments. Here is the CBC's report on the launch.
How would the authorities like to be deep inspected?
It's a hacky technology to implement QOS because folks don't like setting the QOS bits and protocol in the headers. Usually because some Microsoft firewall only allows http on port 80 (;-))
It's the use of it by the famous "men of good will but little understanding" that is bad, plus of course the use of it by men of ill will.
--dave
davecb@spamcop.net
Taking a quick look through the content at the government site, I must say I'm surprised. CC licensed content, links to external resources, a collection of international points of view. I'd be truly impressed if they'd managed to get all these folks in a room together.
Regardless, kudos to Canada for hitting the 21st century.
And I was doubly impressed to notice the absence of web beacons / analytics scripts.
inspect this! ... askjdkasjdlajsldkjaskl djaksjdklasjdklajsldaskljdaljdaslkdjalkdjalsdj ... \
D.I. is neither good or bad, it is the illegal or immoral application of the technology that is the problem. I really am amazed that no-one on a technology site noted that the heart of the debate on net neutrality is free speech, not deep inspection.
Oh, must be in the wrong thread...
Doesn't a good encryption system stop DPI from giving any useful information?
"If any question why we died, Tell them because our fathers lied."
You go for DPI.
I go for encryption, SSL, and HTTPS. Even my slowest home system can easily handle this.
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
... if they'd managed to build a web site that displayed correctly (or displayed the essay collection AT ALL) on Firefox 2.0.0.8.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
Charge more for higher QoS. Give a discount for lower QoS.
You go ssl.
I go man in the middle. I handle your connections and key exchanges between both ends and look at your unecrypted traffic before I forward it on encrypted.
In Soviet Russia, Party deep inspect you!
If an ISP decides to inspect all traffic, doesn't this make them responsible for the traffic? As in... you are not a common carrier, you do not have the "I didnt know" defense and now anything (virus's, copyright,child porn, etc..) that goes through you is your responsibility? I assume there is a money solution to this that will make this problem disappear, like buying a few laws or stacking some judicial BB's somewhere.. but I thought you either let it all go or you buy the responsibility..
On what grounds do advertisers have the right to spy on anyone? to make a bigger dollar. Of all the reasons this DPI is bad,allowing advertisers to use this is out right criminal. and if anyone would would abuse it the advertisers would be the first. DPI is nothing more then wire tapping and the last time i hurd you need a warrant to wire tap anyone. And that the only reason it should be used,with a warrant
Jack of all trades,master of none
"The articles are open to comment"
But if you disagree with us, we'll inspect all your pron out of existence.
As has been mentioned here before, this is a new arms race. And while there MAY be some DPI's that work, but my previous employers' was pretty unreliable. Because we, in support, were not privy to even a hint on how this black-box part of the software worked, the failures I saw left me wondering if any of it worked at all.
The signatures must be pretty hardware-dependent: if your DSP's are not fast enough, you're going to be limited to port and maybe a teeny amount of header info. We were told our DSPs (IBM's) were more than fast enough to do the active signatures (a subset of the total) and service 1gig ethernet. And "deep" seemed to be pretty shallow, "port + header" seemed to be a major part of it. "Encrypted" torrents simply obfuscated the header a little and changed port-behavior and we totally lost track of it.
So having said all of this, I would wager that we have the upper hand, albeit slightly, in this arms race. (Witness torrent traffic, and virtually everything P2P in China.) So support the FOSS of your choice to keep ahead. Ultimately, the big ISPs will be hardest pressed to catch stuff because the volume of traffic, the economic slowdown, and pressures to NOT spend money. I'd worry more about the small & medium tier simply because they can benefit from having 1 smart person being listened to. That's where an asymmetrical leap might happen.
My 2 cents, sorry to post anonymously.
Unencrypted data will always get you in trouble. There is no reason in the year two thousand and nine to send or receive anything over the internet without encapsulating it in a SSH or SSL tunnel. Whine all you like about performance hits, but if the technology has reached the point where your residential ISP can look inside every packet you send to see what's there - in real time - then the point has come to spend some processing power on protecting your data in mid-flight, or invest in some encryption hardware.
I'm more than half convinced that this is how everything =inside= a LAN should communicate with each other, too. The firewall should allow port 22, port 443, and drop the rest.
While we're at it, everything should be firewalled right at the VLAN, on the switch.
As the DPI box has access to, and holds records of, an extroardinary stream of data that mnust make it an incredibly tempting target for hackers. What have they put in place to prevent it being compromised?
Not really - there's always going to be a legitimate consumer need for encrypted traffic eg anything involving money (banking, purchasing goods). If you have to allow some encrypted traffic and there's no way to tell the difference between legitimate and "illegitimate" encrypted traffic then you can't arbitrarily assume all encrypted data to be hostile and filter accordingly...
Deep Panty Inspection
Performed for (and/or on) you by the Female Body Inspectors in cooperation with the Clitoris Investigation Agency.
(note: I didn't say pus*y or any other naughty word)
vpn? pgp? why is this news?
The stories and info posted here are artistic works of fiction and falsehood.
Only fools would take it as fact.
Since when was DPI a new or relatively new technology?
- Developer who has been involved with DPI for a decade
.. boggle my mind.
Here's what I say to all you paranoid conspiracy freaks ..
go ahead and encrypt your dang traffic. The Internet companies don't really care about the CONTENT of your traffic.
Rather, they want to know what TYPE of traffic you're using - file transfer, web browsing, voice, video.
You think I'm wrong that they don't care about your content. I'm sure you think I'm wrong - because every one of you posting on this thread is f*cking paranoid.
But I can tell you first hand - they don't give a damn.
You also don't want them using DPI to sell you stuff, or to hinder access to competing products.
Fine .. they all provide opt-out capabilities for sales pitches .. and simple legislation would suffice to keep them from slowing down, say, skype, on their network.
They can do many legit things with this data. For example ..
1. Yes, they can set the QoS for you, so that video and voice can be allocated high priority, low latency resources, while file transfers can be assigned to more appropriate resources.
2. They can trend the patterns of traffic in their network, fine tuning it for the type of data being sent, and adding capacity prior to bottlenecks occurring.
3. They can more precisely understand events on their network - e.g., associating the release of a new version of some browser, or video player, or VOIP tool, or social website, etc. with a sudden rise in traffic on their network.
For them, it is all about understanding what TYPES of applications run over their network. It is NOT about reading your email or facebook profile - they really couldn't give a sh*t about that.
So, DPI technology has the potential for abuse? Sure .. and I'm sure some countries will try to take advantage of that.
Does that frighten you? OK .. then by all means, go ahead and use encryption and port hopping !!! Contrary to what 99.99% of you on this board believe - encryption and port hopping won't prevent DPI and similar technologies from identifying WHAT you're doing. It does hide the content, for sure - which is what you want, right?
So, buzz off already about this net neuter stuff. You can have your privacy. The companies can have their trending analysis tools. These things are NOT mutually exclusive.