Comcast is definitely discriminating against internet traffic

[Wombat]

But how do they know? I'm running on a non-standard port, encrypted. How can they get into my encrypted data stream to send the "reset signal", which is bogus anyway? WTF is a "reset signal" in Bit Torrent? They'd have a heck of a time impersonating the machine on the other end to do handshaking and "thank you I've got it" and then they'd have to repeat the MD5 hash. I mean, it's non-trivial. It's not just "sending a signal that hangs up".

I think you might have skipped over my post? They're not hacking your data stream, just profiling your traffic, and resetting your *TCP* connection. Whatever you're running over that connection, BT or not, encrypted or not, is shot down.

[Gurm]

I think you might have skipped over my post? They're not hacking your data stream, just profiling your traffic, and resetting your *TCP* connection. Whatever you're running over that connection, BT or not, encrypted or not, is shot down.

Bah.

[az]

As I said, a TCP RST (reset) flag is sent and your machine drops the connection.

[Gurm]

*shrug*

I believe something is happening, but not as described.

Look, you have to understand that I'm a skeptic at heart, and a journalist as well. In the same way that no "news story" ever reported by the Register or similar rags will ever be "true" in my book, regardless of its veracity, because of their record of printing fiction as news... this story smacks of bullshit.

Let me explain.

If you say to me "the other day, I felt a strange feeling, and all of a sudden a monkey clawed its way out of my ass. Then, a flock of pigs flew by! After that, I saw Paris Hilton giving a dissertation on particle physics, and to top it all off Britney Spears was there, playing with her kids and being a great mom! Oh, and by the way the price of milk went up to $4 a gallon."

Everything you've said is a lie, or unprovable, or highly improbably... so then you get to the milk thing. It's true, but I don't care any more because you're a liar. *shrug*

SOOOOO when they say:

- Comcast is hacking BitTorrent (not likely)
- Oh wait, no see they're sending a TCP Reset (possible)
- They're only sending it when you're seeding (how would they know? utter rubbish)
- They're doing it when you're seeding in eMule too (again, how would they know?)
- They have magic software that KNOWS WHAT YOU'RE DOING WAAAAAAAAAAAAAAH! (crap)

So there's ONE potentially truthful statement amongst a pile of rubbish. I'm not going to sort through the rubbish to get to the nugget, which might or might not be rancid.

There is NO WAY for them to know when you're seeding or not seeding. Just no way. There's ALSO no way for them to tell when you're seeding in eMule, in Kazaa, in Limewire, etc.

So the article is 99.99% crap. Are TCP Resets being sent? Maybe, but the rest of the article is so much crap that I must assume it's ALL crap until shown otherwise.

That's the problem with "journalism" and "reporting" on the Intarwebz. It's crap.

[az]

See, and I read it on heise.de, which is very trustworthy (and thus sometimes a bit slow), and I only read about the TCP RST thing. I think somebody is confusing "seeding" with "uploading", whether that's intentional or not. Traffic shaping against eMule is done by some german providers since quite a while, so it is certainly possible. I don't know if this can be circumvented by using different ports; I doubt it's that easy though, because then it wouldn't be a big deal, which it actually is for users on those networks.

[Gurm]

See, and I read it on heise.de, which is very trustworthy (and thus sometimes a bit slow), and I only read about the TCP RST thing. I think somebody is confusing "seeding" with "uploading", whether that's intentional or not. Traffic shaping against eMule is done by some german providers since quite a while, so it is certainly possible. I don't know if this can be circumvented by using different ports; I doubt it's that easy though, because then it wouldn't be a big deal, which it actually is for users on those networks.

Traffic shaping is something else entirely, and happens all the time. The "knowing what you're uploading and who you're uploading to and magically making it stop" is what I call BS on.

[Wombat]

*shrug*

I believe something is happening, but not as described.

Look, you have to understand that I'm a skeptic at heart, and a journalist as well. In the same way that no "news story" ever reported by the Register or similar rags will ever be "true" in my book, regardless of its veracity, because of their record of printing fiction as news... this story smacks of bullshit.

You should spend your time reading up instead of denying. First off, the link that started this discussion is to an Associated Press article, not the Register. Second, it's not "oh wait," it's "Gurm didn't understand it the first time."

You're ignoring the evidence: not only anecdotes, but packet traces.

And it's VERY easy to identify BT traffic. Nothing profiles like it. The only thing that seems easier to profile is Skype - it has a very unique signature, I'm told.

[az]

Whoever in this thread here said anything to that effect? They block torrent uploads, regardless of what is uploaded (AP tested with a copyright-free bible) by making your computer think its packets get nowhere.

[az]

And it's VERY easy to identify BT traffic. Nothing profiles like it. The only thing that seems easier to profile is Skype - it has a very unique signature, I'm told.

I thought it was very hard to effectively block Skype, at least ithout packet analyzing, because of all the troubles it goes through to get through firewalls, NATs etc. (UDP hole punching, trying very large port ranges when ports appear to be blocked, etc.)

[Wombat]

I was talking to some network security guys about it. If there's a Skype machine on the corporate network, they usually can tell pretty quickly, and target the machine for some remote administration.

[Gurm]

I'm not misunderstanding. The article claims that they know whether you're downloading that torrent or just uploading it.

That's "magic", because there's just no way to tell how much of your inbound torrent traffic is torrent X and how much is torrent Y.

The article says over and over that if you're downloading it works fine, but "seeding" is what breaks. How do they KNOW you're seeding? Virtually ALL p2p'ers have multiple streams going, multiple files running at once, up AND down. Everyone has both inbound and outbound, all the time. So what this magic software does, then, is somehow susses out which of your torrents you're seeding, which of your eMule downloads you're done with, and when you're done with all your downloads it BREAKS your connection?

It's still "magic", and "magic" doesn't happen on networks.

I believe a reset is being sent. Absolutely. I just don't believe it happens by magic.

[Helevitia]

Traffic shaping is something else entirely, and happens all the time. The "knowing what you're uploading and who you're uploading to and magically making it stop" is what I call BS on.

Gurm, go read up on NBAR and PISA.

It does exactly this "magic" that you are so ignorantly denying.

NBAR

• Provides the ability to discover protocols and applications running on the network

• Allows Intelligent traffic classification based on application type

• Supports addition of new protocols and applications using packet description language modules (PDLMs)

• Provides the ability to load new PDLM's without changing Cisco IOS Software releases and without rebooting the switch

• Supports a wide variety of applications and protocols, including:

- P2P: BitTorrent, eDonkey/eMule, FastTrack, Gnutella, KaZaA

- Enterprise applications: PCAnywhere, Citrix ICA, Microsoft SQL Server

- Streaming Media applications: Real Time Streaming Protocol (RTSP), CU SeeMe, Netshow, StreamWorks, VDOLive

- Network Mail Services: Simple Mail Transfer Protocol(SMTP), point of presence (POP3), Internet Mail Access Protocol (IMAP), Lotus Notes, Microsoft Exchange

- Internet: HTTP(Hypertext Transfer Protocol) , FTP (File Transfer Protocol), NNTP (Network News Transfer Protocol ), IRC (Internet Relay Chat)

• GUI based management using QoS Policy Manager (QPM)

PISA

• Provides next generation "Super ACL" pattern matching capability for granular and customized packet filtering

• Provides the ability to match on arbitrary bits of a packet at arbitrary depth (offset) in the packet header and payload hence allowing detection of malicious patterns deep within the packet

• Allows users to define customized classification criteria for stateless traffic using CLI or off-box via XML

• Provides the ability to install new filters on switches without reload

• Thwarts worms like Slammer and MyDoom and protects against malicious attacks such as Fragmented UDP, HTTP Vulnerabilities and TCP SYNC floods

• Supports Flexible Configuration in the Cisco Security Manager to push configuration files to switch

Basically what all of this is saying is that we can know exactly what kind of traffic it is down to a single bit in the data portion, not to mention the actual non-data portion of the packet.

EDIT: Forgot to say that not only can we figure out what kind of traffic it is, but we can then do anything we want with it.

[Victorian]

Y'all might find the following of some interest:

http://arstechnica.com/news.ars/post/20071021-comcast-traffic-blocking-even-more-apps-groupware-clients-affected.html

[Claymonkey]

http://www.techreport.com/discussions.x/13456

On Monday, news broke out that Comcast was restricting peer-to-peer file sharing on protocols like BitTorrent, eDonkey, and Gnutella. Some Internet service providers simply slow down peer-to-peer traffic, but Comcast was said to block outgoing P2P traffic altogether. When asked by the Associated Press, the company denied any such filtering was taking place. "Comcast does not block access to any applications, including BitTorrent," the company said, although it took care to mention that it "uses sophisticated methods to keep Net connections running smoothly."

However, after making headlines with the move, Comcast has owned up to "delaying" peer-to-peer traffic. To be specific, the AP quotes the service provider as saying it "may block initial connection attempts between two computers," although it "eventually lets the traffic through if the computers keep trying."

"During periods of heavy peer-to-peer congestion, which can degrade the experience for all customers, we use several network management technologies that, when necessary, enable us to delay — not block — some peer-to-peer traffic. However, the peer-to-peer transaction will eventually be completed as requested," [Comcast Online Services Senior VP Mitch Bowling] said.

The AP says its testing is consistent with Bowling's explanation. "In one case, a BitTorrent file transfer was squelched, apparently by messages generated by Comcast, only to start 10 minutes later. Other tests were called off after around 5 minutes, while the transfers were still stifled," the news agency explains.

[Gurm]

So if you torrent the way you're supposed to - by leaving the torrent running for a long time after you finish downloading - it works fine? TO THINK!