Comcast is using Sandvine to manage P2P Connections
Links: home · search · speed test · login · more ·
 
Links:
Forums » Comcast » Comcast HSI » Comcast is using Sandvine to manage P2P Connections
page: 1 · 2 · 3 · 4 ...63 · 64 · 65
funchords @ 12th May 02:26PM:
Comcast is using Sandvine to manage P2P Connections

WHO: Comcast and Sandvine, a peer-to-peer (P2P) management application,

WHAT: A device that monitors P2P activity and interferes with requests for the peer within Comcast to UPLOAD data (downloads appear to be not affected, uploads within Comcast are not affected, transfers already in progress are not affected, and a small percentage of the new transfer requests are still permitted),

WHERE: On the boundaries, at the point where Comcast connects to other points of the Internet,

WHEN: Earliest evidence is 6 months ago, but use appears to have increased or become more "clamped-down" recently,

WHY: To reduce costs associated with P2P bandwidth growth

HOW IT WORKS:

- The Sandvine application reads packets that are traversing the network boundary

- If the application senses that outbound P2P traffic is higher than a threshold determined by Comcast, Sandvine begins to interrupt P2P protocol sequences that would initiate a new transfer from within the Comcast network to a peer outside of the Comcast network

- The interruption is accomplished by sending a perfectly forged TCP packet (correct peer, port, and sequence numbering) with the RST (reset) flag set. This packet is obeyed by the network stack or operating system which drops the connection.

In eDonkey connections, for example, queued UPLOADS (to others) will not be honored to some percentage of non-Comcast P2P users. Immediately after the peer requests ranges to be transferred, the connection is dropped in the above manner. Gnutella transfers are similarly affected in the same manner.

In BitTorrent connections, the RST message is sent well after the handshake, and often after some data has been exchanged. The Sandvine filter interferes during lulls (NOOP and HAVE commands) as well as the moment of transition from the ending of sending one complete piece. When I am not using Comcast, BitTorrent disconnections due to peer resets (RST flag) are 3%. Using Comcast, 39% of connections are terminated using the RST flag.

In Summary: The Sandvine filter has taken steps to try to make the filtering experience innocuous (nearly invisible) to the user. Some transfers are allowed, the interruption seems to come from the distant peer, and it relies on the P2P protocol being used to either find another peer (hopefully a Comcast one) or retry that peer later.

WHY THIS MAY BE GOOD:

- There is reduced cost, and perhaps higher download and upload speeds for everyone (regardless of P2P use), if P2P data requests can be fulfilled entirely within the Comcast network.

- Because a peer will retry to get a file or a piece of a file, uploads are merely delayed. The peer may have to return to the back of a queue and go through the above cycle several times before the transfer request is honored.

WHY THIS MAY BE BAD:

- The decision whether to interrupt a transfer is without regard as to whether there are non-Comcast sources for a file. For example, an amateur band releasing their music on the P2P networks is at a disadvantage. The time it would take to get a complete copy of a music file to a point outside of the Comcast network is dramatically increased.

- Comcast is not the only customer for Sandvine and the like. Other ISPs will and have adopted this and similar technologies and tactics. As they do, the amount of outgoing P2P data that each allows on the wire becomes a competitive element.

- Some P2P networks punish non-sharers. Upon detecting that files offered for sharing cannot be transferred, the network can reduce access to the peer that cannot transfer.

MY OPINION:

I tried to write the above evenhandedly.

As an enthusiast, I use P2P for an IPTV application, Skype, and to deliver Ubuntu Linux and Shareaza, two open-source applications. My music is Tin-Pan Alley and I really watch very few movies. I'm not the guy that RIAA or the MPAA are looking for: I like old ragtime music, historical film, and old magazines. But I know the P2P protocols very well I and noticed something was wrong a few months ago.

What cracked the case for me was when I was telling someone in Brazil about the upload resets (error 10053), and he offered me a VPN connection for comparison. No drops.

The protocol analyzer told the "RST" of the story. And yesterday, I learned about Sandvine and got word from another Sandvine customer that they're bragging about their Comcast deployment in order to make sales.

I am not against this, per se. They are allowing some P2P sharing to points outside of their network, even though they can detect and prevent it. I might even be able to live with it, if I knew exactly what to expect and how to override it if it was stupidly hampering something. (I am convinced it is designed to make P2P prefer Comcast clients when possible, but not designed to hamper communications when there are no alternatives).

However:

- I have always paid for unfettered internet access. No filtering, please. It wasn't filtered when I first signed up, I don't want it filtered now. In this case, they are filtering ME!!

- These are being installed silently -- why? Why not install them noisily, and provoke action on the makers of P2P applications to seek out peers with lower TTLs (translation: electrically closer, more likely to be 'in-network').

- These smart filters are still rather dumb. After a threshold is reached, the interrupting of new transfer requests is made. The app doesn't know whether or not the transfer is important or unimportant, rare or common. (And do we really want our ISP deciding what is important and urgent to us?)

P2P is not illegal. People are currently downloading more media than they can possibly use in a lifetime -- that fruitless task is a fad that will wear off. Comcast may have had what they thought was a good idea, here. But, as implemented, it is having bad effects and puts Comcast in the seat of interfering with my end-to-end client communications.


Update requested by funchords:

** Updated information 2007-08-29 -- »UPDATE Re Comcast is using Sandvine to manage P2P Connection

** See also these topics ---> »[Speed] There are good resets and there are bad resets...

»Man, more fishy stuff going on with Comcast and bittorent?

»[Speed] workaround for Comcast Throttling issues.. (torrent)

»[NEWS] Comcast 'Delaying' Not 'Blocking' Traffic

»Comcast, Sandvine, and the latest WoW patch (v2.3.0)

»FCC to investigate Comcast sandvine packet blocking - YES!!!

»Comcast and P2P filtering (Sandvine)

»Richard Bennett: It'll be like DSL, only Faster



--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
~ Keeper of the D-Link FAQ ~ Did you Search? ~ More features, Free! Join BBR! ~
reply
DoYouKnowMe @ 13th May 07:17AM:
Re: Comcast is using Sandvine to manage P2P Connections

While I feel your pain, since you are a residential customer (I am presuming), you are bound by the Terms Of Service agreement that was provided to you at time of sign-up and which is easily accessible through their website. A few key passages:

"We may change our prices, fees, the Services and/or the terms and conditions of this Agreement in the future. Unless this Agreement or applicable law specifies otherwise, we will give you thirty (30) days prior Notice of any significant change to this Agreement. If you find the change unacceptable, you have the right to cancel your Service(s). However, if you continue to receive Service(s) after the end of the notice period (the "Effective Date") of the change, we will consider that you have accepted the changes. You may not modify this Agreement by making any typed, handwritten, or any other changes to it for any purpose."

"4. CHANGES TO SERVICES
Subject to applicable law, we have the right to change our Services, Comcast Equipment and rates or charges, at any time with or without notice. We also may rearrange, delete, add to or otherwise change programming or features or offerings contained in the Services, including but not limited to, content, functionality, hours of availability, customer equipment requirements, speed and upstream and downstream rate limitations. If we do give you notice, it may be provided on your monthly bill, as a bill insert, in a newspaper or other communication permitted under applicable law. If you find a change in the Service(s) unacceptable, you have the right to cancel your Service(s). However, if you continue to receive Service(s) after the change, this will constitute your acceptance of the change. Please take the time to read any notices of changes to the Service(s). We are not liable for failure to deliver any programming, services, features or offerings except as provided in Section 11e."

"7. USE OF SERVICES
You agree that the Services and the Comcast Equipment will be used only by you and the members of your immediate household living with you at the same address and only for personal, residential, non-commercial purposes, unless otherwise specifically authorized by us in writing. You will not use the Comcast Equipment at any time at an address other than the Premises without our prior written authorization. You agree and represent that you will not resell or permit another to resell the Services in whole or in part. You will not use or permit another to use the Comcast Equipment or the Service(s), directly or indirectly, for any unlawful purpose, including, but not limited to, in violation of any posted Comcast policy applicable to the Services. Use of the Comcast Equipment or Services for transmission, communications or storage of any information, data or material in violation of any U.S. federal, state or local regulation or law is prohibited.

You acknowledge that you are accepting this Agreement on behalf of all persons who use the Comcast Equipment and/or Services and that you shall have sole responsibility for ensuring that all other users understand and comply with the terms and conditions of this Agreement and any applicable Comcast policies including, but not limited to, acceptable use and privacy policies. You further acknowledge and agree that you shall be solely responsible for any transactions, including, without limitation, purchases made through or in connection with the Services. You agree to indemnify, defend and hold harmless Comcast and its affiliates, suppliers, and agents against all claims and expenses (including reasonable attorney fees) arising out of the use of the Services, the Comcast Equipment and/or the Customer Equipment or the breach of this Agreement or any of the applicable Comcast policies by you or any other user."

Now, they key point to the use of Sandvine, of which I have not confirmed due to lack of research ( I am lazy ), is pointed out in Section 7. A P2P connection requires you to "authorize" someone else to use the service for a potentially unlawful purpose. Not that any company wants to think that their customers are out to do wrong, but to physically track EVERY connection and monitor the connection's contents would: a)be an unlawful invasion of privacy, b)cost an enormous amount of money, c)create an undesirable product as all costs would be passed on to the consumer ( even higher monthly charges ) and cause bandwidth availability to drop ( slower speeds ).

Naturally, a company would seek to be proactive rather than reactive to a hot topic issue that is greatly influenced by one of their services, such as the use of P2P to violate copyrights or the proliferation of malicious software. The end results are an improved corporate image, which from what I understand, is something that Comcast REALLY, REALLY needs any way they can get it, and to hinder all the responsible subscribers who use the service legally.

In "short" (lol) blame the idiots out there who force ISP's to take this action or have them do you some "favors"
reply
rody_44 @ 13th May 10:14AM:
Re: Comcast is using Sandvine to manage P2P Connections

any facts that back up your claim? or do we just take your word on it. something in the line of real facts and not this person told this person type of stuff. salesman lie all the time. and just because you changed to vpn doesnt mean jack. i mean your routing also changed correct?
reply
funchords @ 13th May 11:38AM:
Re: Comcast is using Sandvine to manage P2P Connections

said by DoYouKnowMe :

A P2P connection requires you to "authorize" someone else to use the service for a potentially unlawful purpose.
No more or less than an Instant Messenger connection does. All things have potentially unlawful purposes. They are not, in and of themselves, unlawful.

said by DoYouKnowMe :

but to physically track EVERY connection and monitor the connection's contents would: a)be an unlawful invasion of privacy, b)cost an enormous amount of money, c)create an undesirable product as all costs would be passed on to the consumer ( even higher monthly charges ) and cause bandwidth availability to drop ( slower speeds ).
Earlier in this same mentioned, you said that you had not researched this. Had you looked into it, you would have found that this technology is available today and is for sale to ISPs. The cost of the technology is offset by lower payments to backbone providers and the ability to delay expansions of capacity. With somewhere around 75% of all internet traffic being P2P, reducing that traffic that exits the network could provide substantial savings.

As for the invasion of privacy aspect, this is a grey area. It may be one reason they have silently implemented Sandvine. It is not good PR to peer into their customer's packets for the purpose of deciding whether or not they will interfere with them.

said by rody_44 :

any facts that back up your claim? or do we just take your word on it.
I have already presented facts. Regardless, unless you run your own tests, you'll have to decide whether to take my word on it.

I'm hoping that others will run their own tests. If they don't, I hope the facts that I'm a qualified expert on the subject, posting under my own name, will carry some weight.

said by rody_44 :

something in the line of real facts and not this person told this person type of stuff. salesman lie all the time.
I doubt Comcast will let me in to look. The evidence is circumstantial, but the amount is overwhelming.

Sandvine said it has signed a contract with a Tier 1 U.S. service provider ... Sandvine did not identify the company, but it said its new customer has over 5 million residential high-speed Internet subscribers.

Sandvine already counts top U.S. cable provider Comcast Corp among its customers, Barron's said.

said by rody_44 :

and just because you changed to vpn doesnt mean jack. i mean your routing also changed correct?
And so did my packet size. I have accounted for the latter with some other testing. For the former, one should need a VPN endpoint that terminates within Comcast at some points other than Hillsboro, OR..

Once you have that, then this testing is not hard. Set up Wireshark and start your P2P client. Using Comcast, Sandvine will start sending TCP packets with the RST flag set. Not using Comcast, you will see very few such packets.
--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
~ Keeper of the D-Link FAQ ~ Did you Search? ~ More features, Free! Join BBR! ~
reply
fuziwuzi @ 13th May 11:49AM:
Re: Comcast is using Sandvine to manage P2P Connections

The few times I've used bittorrent transfers in the last few weeks I have noticed many disconnects on the up side. I didn't know what was causing it, but your analysis makes sense now.

Now if only the Comcast network was as fast as their fanboys who quickly denounce any criticism of them. :p
reply
Morty @ 13th May 01:18PM:
Re: Comcast is using Sandvine to manage P2P Connections

Sandvine said it has signed a contract with a Tier 1 U.S. service provider to supply its 10 Gbps Policy Traffic Switch platform.

Comcast is not a Tier 1 provider. In fact, the there are only two Tier 1's on that possible list, Vz and ATT. My hunch is with ATT.

Your other article states:

"Sandvine Corp. (SVC.TO: Quote, Profile , Research) could see a boost in demand for their technologies, which could be used to give services such as Web video or voice priority over less urgent Internet traffic, according to Barron's April 9 edition." and then goes on to state "Sandvine already counts top U.S. cable provider Comcast Corp among its customers, Barron's said."
reply
CableTool @ 13th May 01:20PM:
Re: Comcast is using Sandvine to manage P2P Connections

And we all know Comcast prioritizes its Voice packets. None of which have anything to do with DE prioritizing torrent traffic.
--
CableFAQ.org/Technicians Unplugged

reply
funchords @ 13th May 02:12PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by fuziwuzi :

The few times I've used bittorrent transfers in the last few weeks I have noticed many disconnects on the up side. I didn't know what was causing it, but your analysis makes sense now.
Glad I could help.

said by fuziwuzi :

Now if only the Comcast network was as fast as their fanboys who quickly denounce any criticism of them. :p
LOL, well I'm mostly a fan-boy too. I even think this Sandvine idea is well-intended, albeit misguided.

I imagine a lot of P2P these days are popular CDs and Movies. These being copyright violations aside, I'm sure that for any given highly-popular file, enough sources exist within Comcast's netblocks to fill any request quickly. That's smart. I'm sure that's what they were thinking, too.

The problem is that not every file is so popular, the rare files (and those most likely to be completely legal to share, BTW), are badly punished by this filter.
--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
~ Keeper of the D-Link FAQ ~ Did you Search? ~ More features, Free! Join BBR! ~
reply
funchords @ 13th May 02:32PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by Morty :

Sandvine said it has signed a contract with a Tier 1 U.S. service provider to supply its 10 Gbps Policy Traffic Switch platform.

Comcast is not a Tier 1 provider. In fact, the there are only two Tier 1's on that possible list, Vz and ATT. My hunch is with ATT.
Then argue that point with Sandvine. Read the linked article more closely. You'll find that they were the guys that mentioned Comcast in their (rather silly) PR release.

I'm a little lost as to what you're arguing, here. Do you think Sandvine is not installed at Comcast?

If Sandvine were not installed on Comcast, and the RST-flagged packets I received were coming from other networks, then the VPN statistics and the Comcast statistics would be similar. They're not. They're very different.

--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
~ Keeper of the D-Link FAQ ~ Did you Search? ~ More features, Free! Join BBR! ~
reply
Morty @ 13th May 02:55PM:
Re: Comcast is using Sandvine to manage P2P Connections

Then read what I posted more carefully, that news release isn't about Comcast. It states their new subscriber is a tier 1 ISP, Comcast and TW are Tier 2 ISPs, that leaves you with Vz and ATT. The other news release that mentions Comcast as an existing subscriber (which pretty much every telcom equipment company falls under at some point) doesn't state anything about the service in which you are talking about. While it's all nice to speculate and try and stir stuff up, this is an internet help forum. Maybe you want to also post this in the Comcast.net forums to see if you get an actual answer from Comcast about it?
reply
jbob @ 13th May 06:52PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by Morty :

While it's all nice to speculate and try and stir stuff up, this is an internet help forum. Maybe you want to also post this in the Comcast.net forums to see if you get an actual answer from Comcast about it?
Actually it says at the very top of this forum:
quote:
The Comcast forum is for discussions about Comcast's cable internet service; its use, availability, features, customer service issues and general information.


Sounds like an appropriate discussion to me.
reply
Morty @ 13th May 07:19PM:
Re: Comcast is using Sandvine to manage P2P Connections

The issue is you can't really have a great discussion over something that is 100% speculated. If it was known that Comcast actually uses this product, for the reasons stated in the op's thread, then I can see why it would be useful. But at the current time, without more information it isn't very useful. With my recommendation, you'd at least get an answer from Comcast, and from there an actual, informed discussion of the subject could take place. I stated that it was a help forum, and thank you for posting what I said in different words (the ones it says at the top), informed "discussions" into things relating to Comcast's HSI and CDV are helpful, ones filled with "he said, she said" are not.
reply
funchords @ 13th May 07:40PM:
Re: Comcast is using Sandvine to manage P2P Connections

Joe,

You still have me lost. What is your concern, again? I told you what the tests were, I told you what the results were. It is observable!

Do you think that the forums at Comcast.net is a placed to have an informed discussion about this? If you do, then I understand why I am lost.

Why on Earth would I discuss an issue that I want brought into the light on a Comcast-controlled forum? The users on those forums are not informed. I'm not asking whether Comcast is filtering -- it is a fact. I've demonstrated it, published my methods and my results, and you can reproduce it.

My objectives are this:

1. To end the secrecy around this project

2. To explain a phenomena that others users may be experiencing

That's it. I'm not stirring anything up. Facts and evidence have no agenda. I've added my opinion -- quite separately from the facts. But, as the "stir machine" goes, my opinion on the matter is relatively tame.

Now, instead of repeating what you've said, do you have anything to add?
--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
~ Keeper of the D-Link FAQ ~ Did you Search? ~ More features, Free! Join BBR! ~
reply
NormanS @ 13th May 07:46PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by funchords :

WHO: Comcast and Sandvine, a peer-to-peer (P2P) management application,

WHAT: A device that monitors P2P activity and interferes with requests for the peer within Comcast to UPLOAD data (downloads appear to be not affected, uploads within Comcast are not affected, transfers already in progress are not affected, and a small percentage of the new transfer requests are still permitted)...
Well? Which is Sandvine? Application? Or device?

»www.sandvine.com/products/policy···itch.asp

Looks like device, not application. Oh, and here is a competitor:

»www.ellacoya.com/

It seems to me that Comcast is spending money on the wrong equipment. Instead of throttling their users, shouldn't they be adding capacity?

That question is, largely, rhetorical. As the messenger, I hardly expect you to be able to answer it, anyway.
--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum
reply
Morty @ 13th May 07:47PM:
Re: Comcast is using Sandvine to manage P2P Connections

There are no facts posted. Just because you believe it does not make it a fact. Your articles contradict each other, and the other states nothing about the described product in question from this vendor. I did not suggest having the discussion in that forum, I suggested asking for an answer in that forum as to whether or not they actually use it. If they say they do, then sure you can actually have a discussion over it.
reply
hobgoblin @ 13th May 07:59PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by NormanS :

It seems to me that Comcast is spending money on the wrong equipment. Instead of throttling their users, shouldn't they be adding capacity?

That question is, largely, rhetorical. As the messenger, I hardly expect you to be able to answer it, anyway.
Sandvine can do and does everything that the OP has stated. It also can spot users who unknowingly are spamming the world and shut off their mail access, a subject you talk about continuously.

It certainly was used by Adelphia, whether Comcast are using it I don't know but it certainly sounds feasible.

Hob
--
"A foolish consistency is the hobgoblin of little minds."
- Ralph Waldo Emerson

reply
NormanS @ 13th May 07:59PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by DoYouKnowMe :

While I feel your pain, since you are a residential customer (I am presuming), you are bound by the Terms Of Service agreement that was provided to you at time of sign-up and which is easily accessible through their website. A few key passages:

...

"7. USE OF SERVICES
You agree that the Services and the Comcast Equipment will be used only by you and the members of your immediate household living with you at the same address and only for personal, residential, non-commercial purposes, unless otherwise specifically authorized by us in writing. You will not use the Comcast Equipment at any time at an address other than the Premises without our prior written authorization. You agree and represent that you will not resell or permit another to resell the Services in whole or in part. You will not use or permit another to use the Comcast Equipment or the Service(s), directly or indirectly, for any unlawful purpose, including, but not limited to, in violation of any posted Comcast policy applicable to the Services. Use of the Comcast Equipment or Services for transmission, communications or storage of any information, data or material in violation of any U.S. federal, state or local regulation or law is prohibited.

...

Now, they key point to the use of Sandvine, of which I have not confirmed due to lack of research ( I am lazy ), is pointed out in Section 7. A P2P connection requires you to "authorize" someone else to use the service...
I suppose you could look at it that way, but...wouldn't that mean that I am authorizing my sister to use my AT&T service by giving her my 'pacbell.net' email address?

P2P is not "reselling" the service, nor is it "sharing" the connection. Talk about Google getting a free ride on Ed Whitacre's "pipes"! I guess Brian Robers thinks a lot like Ed Whitacre, in the end.
--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum
reply
NormanS @ 13th May 08:02PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by hobgoblin :

Sandvine can do and does everything that the OP has stated. It also can spot users who unknowingly are spamming the world and shut off their mail access, a subject you talk about continuously.
It would cost Comcast less to just block outbound port 25 than to spend a wad of money on monitoring hardware which, by my MTA logs, doesn't seem to be working, anyway; assuming that they are employing Sandvine boxes to monitor SMTP traffic.
--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum
reply
anon @ 13th May 08:39PM:
Re: Comcast is using Sandvine to manage P2P Connections

funchords stated:

"The users on those forums are not informed."

Wow !!!!! What a blanket statement !!!

I'd say that it is you who are uninformed about the users at the Comcast forums :uhh: :uhh:
reply
Combat Chuck @ 13th May 08:53PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by NormanS :

It would cost Comcast less to just block outbound port 25 than to spend a wad of money on monitoring hardware which, by my MTA logs, doesn't seem to be working, anyway; assuming that they are employing Sandvine boxes to monitor SMTP traffic.
If you look at what sandvine product can do it's more than just detect outbound spam. It appears to be more of a general purpose firewall that can do deep packet inspection and take action on what it finds, be that P2P use or outbound spam or a worm.

I will say this however, the behavior of bittorrent on my end has changed within the last month. It seems to take longer to get started and as I look at the list of peers right now it shows all peers I'm connected were inbound connections. That doesn't prove anything (it could just be that I've had the torrent running long enough that new peers find me before I find them) but I have noticed a bit of a difference.
--
Revolution!!!... or some such nonsense.
reply
NormanS @ 13th May 09:16PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by Combat Chuck :

If you look at what sandvine product can do it's more than just detect outbound spam. It appears to be more of a general purpose firewall that can do deep packet inspection and take action on what it finds, be that P2P use or outbound spam or a worm.
Just giving the goblin some feedback on his comments. What Comcast does; well, it is their network, none of us get to say how they run it.
--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum
reply
hobgoblin @ 13th May 09:41PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by NormanS :

It would cost Comcast less to just block outbound port 25 than to spend a wad of money on monitoring hardware which, by my MTA logs, doesn't seem to be working, anyway; assuming that they are employing Sandvine boxes to monitor SMTP traffic.
How much does a Sandvine Box cost?

Hob
--
"A foolish consistency is the hobgoblin of little minds."
- Ralph Waldo Emerson

reply
funchords @ 13th May 10:34PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by paco :

funchords stated:

"The users on those forums are not informed."

Wow !!!!! What a blanket statement !!!

I'd say that it is you who are uninformed about the users at the Comcast forums :uhh: :uhh:
Sorry.

"The users on those forums are not anywhere as nearly informed as they are here at BBR."

I've been here at BBR for a long time, and I've been a Comcast customer for a long time, too -- and yes, I've been to the forums.

Blanket statement -- okay, but I've seen both blankets. So what's wrong with that?
--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
~ Keeper of the D-Link FAQ ~ Did you Search? ~ More features, Free! Join BBR! ~
reply
NormanS @ 14th May 03:12AM:
Re: Comcast is using Sandvine to manage P2P Connections

System glitch double post. How rare.
reply
NormanS @ 14th May 03:13AM:
Re: Comcast is using Sandvine to manage P2P Connections

said by hobgoblin :

How much does a Sandvine Box cost?
How much does it cost to add port 25 to an ACL?
--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum
reply
NormanS @ 14th May 03:24AM:
Re: Comcast is using Sandvine to manage P2P Connections

said by Morty :

Sandvine said it has signed a contract with a Tier 1 U.S. service provider to supply its 10 Gbps Policy Traffic Switch platform.

Comcast is not a Tier 1 provider. In fact, the there are only two Tier 1's on that possible list, Vz and ATT. My hunch is with ATT.
That would be worrisome. Not that it, necessarily would involve me directly; the tier 1 AT&T backbone is part of AT&T Worldnet services, and my routing generally doesn't touch that backbone:
05/13/07 23:19:05 Slow traceroute 74.208.13.161
Trace 74.208.13.161 ...
192.168.102.1   RTT:   1ms TTL:170 (chihiro.aosake.net ok)
192.168.0.1     RTT:   2ms TTL:170 (suzuka.aosake.net ok)
69.105.119.254  RTT:  10ms TTL:170 (adsl-69-105-119-254.dsl.pltn13.pacbell.net ok)
64.164.97.67    RTT:  11ms TTL:170 (dist2-vlan50.pltn13.pbi.net ok)
151.164.93.239  RTT:  15ms TTL:170 (No rDNS)
151.164.94.47   RTT:  13ms TTL:170 (ex2-p12-0.eqsjca.sbcglobal.net ok)
151.164.248.250 RTT:  11ms TTL:170 (as174.eqsjca.sbcglobal.net ok)
154.54.6.85     RTT:  12ms TTL:170 (t3-1.mpd01.sjc03.atlas.cogentco.com probable bogus rDNS: No DNS)
154.54.6.81     RTT:  12ms TTL:170 (v3490.mpd01.sjc01.atlas.cogentco.com probable bogus rDNS: No DNS)
154.54.2.53     RTT:  59ms TTL:170 (t7-1.mpd02.sfo01.atlas.cogentco.com probable bogus rDNS: No DNS)
154.54.6.41     RTT:  61ms TTL:170 (t2-2.mpd01.mci01.atlas.cogentco.com probable bogus rDNS: No DNS)
154.54.2.217    RTT:  61ms TTL:170 (g11-0-0.core01.mci01.atlas.cogentco.com probable bogus rDNS: No DNS)
66.28.6.238     RTT:  60ms TTL:170 (g0-2.na21.b005948-0.mci01.atlas.cogentco.com probable bogus rDNS: No DNS)
38.112.2.194    RTT:  70ms TTL:170 (schlund-partner.demarc.cogentco.com probable bogus rDNS: No DNS)
74.208.1.65     RTT:  60ms TTL:170 (te-1-1.bb-a.slr.lxa.us.oneandone.net ok)
74.208.1.102    RTT:  60ms TTL:170 (te-1-2.gw-distp-b.slr.lxa.oneandone.net ok)
74.208.1.168    RTT:  62ms TTL:170 (ae-1.gw-prtr-r5-b.slr.lxa.oneandone.net ok)
74.208.13.161   RTT:  78ms TTL: 51 (server.elitebusinesschoice.com ok)
...unless I am pushing/pulling packets where Comcast is at the far end:
05/13/07 23:17:54 Slow traceroute 68.34.175.134
Trace 68.34.175.134 ...
192.168.102.1   RTT:   1ms TTL:170 (chihiro.aosake.net ok)
192.168.0.1     RTT:   3ms TTL:170 (suzuka.aosake.net ok)
69.105.119.254  RTT:  11ms TTL:170 (adsl-69-105-119-254.dsl.pltn13.pacbell.net ok)
64.164.97.66    RTT:  11ms TTL:170 (dist1-vlan50.pltn13.pbi.net ok)
151.164.93.231  RTT:  11ms TTL:170 (bb1-g15-0.pltnca.sbcglobal.net ok)
151.164.191.201 RTT:  12ms TTL:170 (ex1-p9-0.eqsjca.sbcglobal.net ok)
12.122.79.101   RTT:  15ms TTL:170 (gar7.sffca.ip.att.net fraudulent rDNS)
12.122.85.142   RTT:  88ms TTL:170 (tbr2033101.sffca.ip.att.net probable bogus rDNS: No DNS)
12.122.10.41    RTT:  88ms TTL:170 (tbr1.sl9mo.ip.att.net fraudulent rDNS)
12.122.10.29    RTT:  87ms TTL:170 (tbr1.wswdc.ip.att.net fraudulent rDNS)
12.122.2.86     RTT:  84ms TTL:170 (tbr2.phlpa.ip.att.net fraudulent rDNS)
12.123.137.213  RTT:  81ms TTL:170 (gar3.phlpa.ip.att.net fraudulent rDNS)
12.118.114.14   RTT: 105ms TTL:170 (No rDNS)
68.86.211.9     RTT: 124ms TTL:170 (te-7-1-ar01.audubon.nj.panjde.comcast.net ok)
68.86.208.26    RTT: 115ms TTL:170 (po-10-ar01.wallingford.pa.panjde.comcast.net ok)
68.86.211.146   RTT: 120ms TTL:170 (po-92-ur01.claymont.de.panjde.comcast.net ok)
68.86.209.98    RTT:  86ms TTL:170 (po-10-ur01.norristown.pa.panjde.comcast.net ok)
68.86.209.102   RTT:  87ms TTL:170 (po-10-ur02.norristown.pa.panjde.comcast.net ok)
68.86.209.169   RTT: 122ms TTL:170 (po-90-ur01.plymouthmtng.pa.panjde.comcast.net ok)
* * * failed
68.34.175.134   RTT:  98ms TTL:109 (c-68-34-175-134.hsd1.pa.comcast.net ok)
But, back before SBC bought them, AT&T set up NSA listening rooms. And, when the company now called, "AT&T", was known as "SBC", CEO Ed Whitacre started making noise about Google getting a "free ride" on "his pipes"; as if it wasn't his customers sending HTTP GET requests down "his pipes" to Google.

This bids fair to become a "Net Neutrality" issue. I can see big money in Hollywood, and political pressure applied to use Sandvine (and Ellacoya) to eliminate the freewheeling nature of the Internet.

--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum
reply
tdumaine @ 3rd Jul 05:42AM:
Re: Comcast is using Sandvine to manage P2P Connections

Wheres the line when it becomes illegal? If i alter packets going to someones computer, im doing so unauthorized and am in trouble, am i not?
reply
NormanS @ 3rd Jul 01:07PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by tdumaine :

Wheres the line when it becomes illegal?
AFAIK, there is no such line under the law, just an ages old Internet tradition codified in the RFCs. To the extent that the RFCs amount to anything akin to a code.
If i alter packets going to someones computer, im doing so unauthorized and am in trouble, am i not?
Probably in violation of one, or another RFC, but not of any law that I am aware of. I am pretty sure that this service would not be offered if it was illegal to alter packets in transit.
--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum
reply
comtec5 @ 3rd Jul 01:37PM:
Re: Comcast is using Sandvine to manage P2P Connections

we do indeed use sanvines on each cmts
reply
Qumahlin @ 3rd Jul 03:28PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by comtec5 :

we do indeed use sanvines on each cmts
While you are correct that sandvine is in use and has been for quite some time, it is not used "on" a CMTS. Sandvine works hand in hand with the PacketCable protocol and acts as an application gateway.

This thread is going to garner hate towards sandvine because everyone is basing one users experiences to how things will always work and assuming Sandvine is something installed specifically to block/throttle p2p...that is not the case as there FAR CHEAPER solutions to that issue, many already built into current CMTS's which would negate the need of ever having a Sandvine box and policy server.

Sandvine is an integral application used by quite a few providers that HELPS with bandwidth for P2P, gaming, VOIP, etc. Are there cases where it will cause you to get lower P2P speeds, yes, but there are also cases where it will help with your general latency and will IMPROVE your p2p download speeds.

Sandvine even has a profile for Xbox Live clients (whether this is in use widespread is not known to me, but I know it was used at one point in my area)

Sandvines use at Comcast is not primarily as a P2P blocker, anyone who tells you that is lying or uninformed.
--
Forum Posts:7500
reply
Sadimitsu @ 4th Jul 02:42PM:
Re: Comcast is using Sandvine to manage P2P Connections

It's sure blocking me! I didn't notice it untill yesterday but I can't seed anything on bittorrent now. My ratios are horrible and now I will be banned etc etc. It's not even a slow upload, I really can't seed torrents AT ALL. I get a fat 0 kB/s. I've been a loyal comcast customer for years now, hell even before comcast owned the place and it was @home. I've put up with downtime and crappy service for a very very long time but one good thing i could always say was "When it works it works good" now I can't even say that anymore. I didn't get the higher upload speeds for nothing, I'm paying all this extra money and now I can't even freaking use my upload speed. Someone please tell me, what the hell is my upload for if I can't send anything to people because comcast is blocking me?

Bittorrent is really useless now, i'm sure everyone knows that BT DL speed is connected to your upload speed. If you're not uploading you won't DL anything at a decent speed. Thanks a lot comcast

This is beyond bullshit
reply
CableConvert @ 4th Jul 09:30PM:
Re: Comcast is using Sandvine to manage P2P Connections

FYI...Azureus Wiki lists Comcast as blocking seeding
»www.azureuswiki.com/index.php/Ba···_America
Click for full size
reply
Nerdtalker @ 4th Jul 09:45PM:
Re: Comcast is using Sandvine to manage P2P Connections

Intriguing; has this technology been deployed across all markets? I ask this because I seed at the upstream cap all the time, a number of private trackers I use simply require it, so it's become force-of-habit.

I guess the question becomes whether using traffic prioritization software really is an issue, so long as the behavior is transparent to the user. To be honest, what's ironic about the whole thing is that if this really has been deployed for so long, it's been an amazingly well-guarded secret. The question then becomes, is it really doing anything if nobody has noticed it this long?

Qualitative/subjective analysis aside, I think this really is a non-issue so long as it doesn't adversely affect the end result. I'm pretty pleased overall with latency, especially in online games, and, to be honest, having Comcast do some of the network prioritization for latency-critical protocols makes sense; it's less CPU-load for my m0n0wall.
--
"Some people never see the light till it shines thru bullet holes." -Bruce Cockburn

I'm testing Gmail's spam filters: Broadbandreports1@gmail.com
Spam: 12900+ messages currently using 406 MB.
reply
Sadimitsu @ 4th Jul 10:48PM:
Re: Comcast is using Sandvine to manage P2P Connections

Believe me buddy its damn noticible, and like you i'm part of sites that demand I upload in return or else I face being banned which is what will happen now that comcast has decided to screw people over. Again.
reply
anon @ 5th Jul 12:06AM:
Re: Comcast is using Sandvine to manage P2P Connections

Hey sad, Why don't you try getting the premium VPN account from secureix.com My upload speeds have remain at the max since I signed up. I, like you, sat at that fat 0 before. 9.95 extra a month to me is worth it. They also have a few day trial for you to test it first.
reply
kcisobderf @ 5th Jul 03:27AM:
Re: Comcast is using Sandvine to manage P2P Connections

For what it's worth, I'm in Ann Arbor, MI, and I can D/L and seed torrents. I don't do much other than apps and texts, but I did make a 1+ ratio on a 12GB file last week. I use uTorrent 1.6.1.

My question is on a different aspect, possibly involving the traffic shaping debate. On that 12GB file, I had upwards of 80 peers, in a swarm of 400 or so. I didn't do much upload over 40kB/s, but other activities, like browsing were painfully slow. I have a 100/1000 card in a PCI slot and network utilization was very low. Is it a matter of my cable "modem", local cable loop, or the alleged Sandvine P2P throttling?

Thanks for any ideas!
reply
Sadimitsu @ 5th Jul 05:10AM:
Re: Comcast is using Sandvine to manage P2P Connections

Thanks a lot for your suggestion, I will try it out.
reply
Obliteration @ 5th Jul 05:30AM:
Re: Comcast is using Sandvine to manage P2P Connections

Yep, it has been sucking badly lately. I was able to upload 20MB in almost 2 hrs which is horrible. The screenshot is just above to show it. Never had this probably till recently as well.(I try to be nice and only use it for anime releases from Japan but apparently Comcast doesn't like that so barely noticed it)

I'm looking at getting banned from the torrent pretty soon at this rate since anything under .5 is considered pretty bad by most torrents sites .06 isn't going to cut it. If this isn't fixed by Saturday morning, I'm calling Comcast to cancel all their services and switch to AT&T now that they decided to serve DSL here.

$34.99 a month is actually cheaper and only downside is that there is no boost. Up side is no throttling and cheaper.

Signals are great, everything is fine. Pretty sure it is this new Comcast filter as there has been no other variable changes.

EDIT: Worked for a while at full speed before resetting to zero.

I'm also attaching a screen shot of that.(I had it limited at that amount on that second torrent screen shot)

--
The best signature out there.
reply
anon @ 5th Jul 11:08AM:
Re: Comcast is using Sandvine to manage P2P Connections

The trick for BT is to turn on encryption, that's the
only way I can seed.
reply
sortofageek @ 5th Jul 12:01PM:
Re: Comcast is using Sandvine to manage P2P Connections

See also ---> »[Connectivity] Comcast appears to be limiting bittorrent seeding
--
Join Team Helix * I am praying for these friends .
reply
anon @ 5th Jul 01:09PM:
Re: Comcast is using Sandvine to manage P2P Connections

Try a VPN service guys. Not to mention the additional benefits alongside it.

I am currently using secureix.com
reply
anon @ 6th Jul 09:22AM:
Re: Comcast is using Sandvine to manage P2P Connections

»digg.com/business_finance/Comcas···_hostage
reply
Cabal @ 6th Jul 09:38AM:
Re: Comcast is using Sandvine to manage P2P Connections

Online petitions are useful and effective.
reply
Maarvin @ 6th Jul 01:10PM:
Re: Comcast is using Sandvine to manage P2P Connections

There are some things that you can do to minimize the filtering. One, stop your "Routing and Remote Access Service". Two, in Azureus, Tools --> Options --> Transfer --> Use Lazy Bitfield. If this doesn't help, try encryption.
reply
moko @ 6th Jul 02:55PM:
Re: Comcast is using Sandvine to manage P2P Connections

funchords....that was a great post about whats going on....i just want an isp that does'nt filter anything....and try to tell me what and what not to dl/ul......thats my business.

i look at like a car company selling me a car...and then putting a speed restrictor on it....in-case i might speed and break a law....it is not their business or responsibility.....but them trying to argue that it is.....because it makes them reliable to my bad choice,because they sold me "their" car.....which is wrong,because where all responsible for our own actions.....if i dl/ul something against the riaa for example...they need to come to me,it has nothing at all to do with my isp.

its like me speeding then telling the judge that the car companies need to have some responsibilty in this......because they sold me a car that i could break the law in...and then the judge "seeing my point" goes on and fines the car company too...see how stupid that would be......but some people are stupid :D
reply
plat2on1 @ 6th Jul 03:54PM:
Re: Comcast is using Sandvine to manage P2P Connections

you are just full of bad analogies aren't you. :p

it has less to do with copyright infringement then it does network integrity. downloading requires user intervention and storage space, if no one is at the computer or you run out of space downloading stops. there is really no limit stopping you from uploading 24/7/365, that's what makes p2p so dangerous.
reply
moko @ 6th Jul 07:09PM:
Re: Comcast is using Sandvine to manage P2P Connections

thats what i think i should be able to do.....if i pay for a certain dl/up unlimited access....i should be able to dl/up 24/7 365 days a year.....not that i do.

if comcast is not selling an "unlimited access" internet service....than i wish they or someone else would :D

besides....what i was talking about ....was its not comcast's buisness what i dl/ul.... so they should not be "throttling" anything.....and i don't dl/up 24/7 ....only when i do want to.....i should have full speed that i have.....i really dl/up not very much....but if i want something through p2p...an isp should not limit my line because i'm using a p2p program.
reply
plat2on1 @ 6th Jul 07:30PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by moko :

thats what i think i should be able to do.....if i pay for a certain dl/up unlimited access....i should be able to dl/up 24/7 365 days a year.....not that i do.

if comcast is not selling an "unlimited access" internet service....than i wish they or someone else would :D

besides....what i was talking about ....was its not comcast's buisness what i dl/ul.... so they should not be "throttling" anything.....and i don't dl/up 24/7 ....only when i do want to.....i should have full speed that i have.....i really dl/up not very much....but if i want something through p2p...an isp should not limit my line because i'm using a p2p program.
comcast is very clear in what they sell, if you want 24/7/365 then you need a dedicated circuit.

is their network so it is very much their business. :)
reply
moko @ 6th Jul 07:55PM:
Re: Comcast is using Sandvine to manage P2P Connections

except for my line to the rest of the network thats not theirs.....i'm paying for that one.....so its not their business what i dl/up on my line to the rest of the networks around the world......i want undisturbed access to it :) would a dedicated service do that.....or do i have to start my own network :D
reply
moko @ 6th Jul 08:13PM:
Re: Comcast is using Sandvine to manage P2P Connections

an example of whats wrong with what comcast is doing with p2p is......if i want download a game mod file thats around 500megs....like a battlefield 1942/2 mod....i should be able to dl this file at the speed that i pay for....which sometimes its aviable at a website,then i get the full speed,...but the same file on a p2p program and comcast stops or limits it....and these files are not always on a website with full speed capabilities.....so i go to my p2p which i know lots of people have....and should get my full speed [at my speed would be around 700KBs,after powerboost]but i get blocked.....why? :(
reply
cablejoe @ 6th Jul 09:40PM:
Re: Comcast is using Sandvine to manage P2P Connections

Playing the devil's advocate, here:

Let's say you own a restaurant that offers an all-you-can-eat buffet. People come in, pay for their meal, eat their fill, and then leave. And everyone is happy.

But then someone develops a machine that can eat for them, even when they're not around. They bring this machine into your restaurant, tell it what food to get, and leave the machine there to eat for them. And the machine eats.....and eats...and eats. It's basically eating 24-7, even when the owners aren't there.

You soon discover that a small handful of these eating machines are responsible for 90% of your food costs. What's more, your regular customers are complaining because there's not enough food left to feed everyone else.

As the restaurant owner, what do you do? Do you bite your lip while your food costs go through the roof? Or do you find a way of dealing with the machines, and limit their consumption?
reply
JJV @ 6th Jul 09:53PM:
Re: Comcast is using Sandvine to manage P2P Connections

I have been using Skype to do video with my friend in Alaska for a couple years. Now it doesn't work at all. The call drops in less than 60 seconds.

Is anyone else having issues with Skype?

I have tried the relakks vpn and a free one and they both suck.
reply
EG @ 6th Jul 09:59PM:
Re: Comcast is using Sandvine to manage P2P Connections

HUHHHH?????
reply
moko @ 6th Jul 11:56PM:
Re: Comcast is using Sandvine to manage P2P Connections

but cable joe....thats not the same....because its not advertised as a 24/7 service....when isp's do advertise 24/7 unlimited service for the whole month....i'm paying for unlimited 24/7 use....that includes if i'm dl/up some video's and there taking several hours,it does'nt matter i'f i'm in front of the pc,in the kitchen,bathroom,or down at barnes and noble,waiting for the dl/up to finish :)

i make alot of home videos that i would like to share for other family to dl....instead of paying for them to be hosted so someone can dl them[i'm talking 200/or more meg vids]would'nt it be nice to just email everyone with a link to a bit torrent....then they click on it and it opens there p2p....thats easy,and i don't have to be infront of the pc to do it.

this is another reason comcast advertises there powerboost upload .....but somethings you can only use a p2p program....and then comcast goes and stops you from using your payed for speed.

i know comcast and other isp's know that alot of naieve customers don't know when their p2p is still running in the background on there "allways-on" pc :D but alot of others do....and besides....this is why they should only sell a dl/ul speed to its customers that can run 24/7.

if i want to watch 6 hours or 24 hours a day of comcast cable tv....i still pay the same price.....i know that a network is different....but they should set up the service so it could be run this way...IMO.
reply
plat2on1 @ 7th Jul 12:30AM:
Re: Comcast is using Sandvine to manage P2P Connections

which ISP advertises that? certainly not comcast

if they set it up like that we'd all have 128k/128k connections. i'l stick with what we get now over that.
reply
shades @ 7th Jul 07:06AM:
Re: Comcast is using Sandvine to manage P2P Connections

is there any solution to this seeding problem, my upload speeds are terrible :huh:
reply
FreakyOne @ 7th Jul 10:23AM:
Re: Comcast is using Sandvine to manage P2P Connections

I never received anything from Comcast when they took over from Adelphia stating that my service would be altered or changed in any way whatsoever, including the ability to receive 24/7 365 service whenever i choose. Since i am paying for the service on a monthly basis i never thought to ask them on what days or hours in those days is it appropriate to expect my service to be fully functional and will be able to have full bandwidth, both up and down, so that i might actually enjoy the time i spend online instead of waiting like i used to on dial-up. I am highly anticipating switching to ( hold on to your undies now) DSL. I never asked to be switched they just came in and starting making changes that i had no choice to agree or not. In this i believe is not a very smart move on their part. As far as this P2P issue is concerned i think that could be a totally new subject matter which should not be discussed here. The issues are not whether or not you get service its the fact they are shackling their customers by limiting our usage.
reply
FreakyOne @ 7th Jul 10:51AM:
Re: Comcast is using Sandvine to manage P2P Connections

said by cablejoe :

Playing the devil's advocate, here:

Let's say you own a restaurant that offers an all-you-can-eat buffet. People come in, pay for their meal, eat their fill, and then leave. And everyone is happy.

But then someone develops a machine that can eat for them, even when they're not around. They bring this machine into your restaurant, tell it what food to get, and leave the machine there to eat for them. And the machine eats.....and eats...and eats. It's basically eating 24-7, even when the owners aren't there.

You soon discover that a small handful of these eating machines are responsible for 90% of your food costs. What's more, your regular customers are complaining because there's not enough food left to feed everyone else.

As the restaurant owner, what do you do? Do you bite your lip while your food costs go through the roof? Or do you find a way of dealing with the machines, and limit their consumption?
SO you are saying the ISP is paying for our bandwidth use? if so maybe you can tell us to whom they are paying it to? I thought i was the one paying a bill for bandwidth use. If anyone is not using their Cable bandwidth at its fullest it is like paying 5 times what you would already be paying for the same meal down the road. If it were me i would get the cheaper same quality meal. And it looks like Comcast is gonna have a big change in their customer base if they dont stop making ridiculous changes in our service. I have not had a full connection since they took over a few months ago. I have had numerous technicians out to look at our issue and they through their hands in the air and say they have no clue where the problem is. Take into consideration that these technicians are prior Adelphia employees so they might not be aware of any limitations on system, although i find it doubtful. I am glad to hear that i am not the only one in this takeover that is having issues of this type.
reply
NormanS @ 7th Jul 02:46PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by FreakyOne :

SO you are saying the ISP is paying for our bandwidth use? if so maybe you can tell us to whom they are paying it to?
Comcast pays for the infrastructure which makes up their backbone. In addition, Comcast generally pays for transit routing to other parts of the Internet. They are not a "peer" in the common Internet sense, or so I am told, because they are a net consumer (thanks to residential accounts) of bandwidth. Unlike Level 3 and AT&T Worldnet services (not the former SBC DSL provider!), who have a net parity of packet exchange.

Guess where Comcast gets the funding to build out and operate their backbone? And how much does Comcast have to pay AT&T Worldnet Services, and Level 3 for transit to the rest of the Internet? And what happens to the service for all Comcast users on a "node", when one user takes it upon himself to run full bore at 8MBps down/768kBps up (or whatever the up speed is on the 8Meg package)?
I thought i was the one paying a bill for bandwidth use.
If you are receiving packets from a corner of the Internet which requires transit through AT&T Worldnet Services, or Level 3 routers, Comcast has to pay them for that transit.
If anyone is not using their Cable bandwidth at its fullest it is like paying 5 times what you would already be paying for the same meal down the road.
Most ISPs base their business model on residential consumers not running their connection at full peak bandwidth 24/7.

Frankly, with more residential consumers on "always on" connections, it is probably time for HSI providers to re-evaluate their business model.
If it were me i would get the cheaper same quality meal. And it looks like Comcast is gonna have a big change in their customer base if they dont stop making ridiculous changes in our service.
Comcast isn't changing. Customer expectations are changing.
I have not had a full connection since they took over a few months ago. I have had numerous technicians out to look at our issue and they through their hands in the air and say they have no clue where the problem is. Take into consideration that these technicians are prior Adelphia employees so they might not be aware of any limitations on system, although i find it doubtful. I am glad to hear that i am not the only one in this takeover that is having issues of this type.
I expect that the changes caused by the Comcast buyout of financially troubled Adelphia have a lot to do with commitments for transit services. You could test that, if you had any trace routes from the Adelphia days. Trace route to the same points under Comcast as you did under Adelphia; see if they are still using the same transit routing to places like Google, or MSN, or Yahoo!.
--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum
reply
FreakyOne @ 7th Jul 07:34PM:
Re: Comcast is using Sandvine to manage P2P Connections

I am not bashing Comcast as an ISP i am only agreeing with the original post here which implies that Comcast is in fact "filtering" its customers connections in some way. I have no trace routing from Adlephia days but i can tell you that i can not have more than 1 open connection running at once while online. For instance, when my VOIP phoneline is in use i have limited usage to surf at the same time. This never happened with Adelphia. Also, if i try to download any files with a BT client i can get fairly decent download speeds but my uploads are decreased if non-existent. This tells me that there are changes made to the service for which i am paying. My bill has increased over what i was paying with Adelphia with the promise i would have an 8mb connection versus a 6MB connection. I can tell you that i am not thrilled with theseso-called upgrades. As for the ISp paying someone else for me to have internet connectivity i am not made aware of this in any of my agreements that i have read. If this is the case i am certain that there would be some sort of legal jargen regarding this. What i want to know is how much Comcast is actually saving while i am limited with my broadband usage when they are not giving me at any time i can testanywhere close to my 8MB connection.
Say i have a land line phone with BellSouth/AT&T, they tell me i have connection 24/7 365 but i can not use that line for more than so many hours of use per day otherwise it ties up the lines for everyone else.
Guess what? I wouldnt use BellSouth/AT&T if that were the case. It would be a totally bogus way of doing business. If the ISP can not afford to offer 8MB connection to its customers at full bore 24/7 365 than they shouldnt do it. Because some of us out here in this world will use what we pay for. It is your choice whether or not you wish to do so. If i didnt want or need the 8MB connection i certainly wouldnt have upgraded.
reply
jjoshua @ 8th Jul 12:45AM:
Re: Comcast is using Sandvine to manage P2P Connections

Sabotaging my traffic or otherwise actively interfering with the TCP/IP protocol should not be tolerated.

Perhaps we should dig some holes in Comcast's driveway. Same thing, right?

My traffic is my property. I pay Comcast to deliver it. Why would I pay Comcast to modify or break my traffic.
reply
EG @ 8th Jul 12:56AM:
Re: Comcast is using Sandvine to manage P2P Connections

said by jjoshua :

My traffic is my property.
Hmmm.... I wonder if the federal government agrees with that ? :o :D
--
Let us never forget 9/11
reply
NormanS @ 8th Jul 02:05AM:
Re: Comcast is using Sandvine to manage P2P Connections

said by FreakyOne :

As for the ISp paying someone else for me to have internet connectivity i am not made aware of this in any of my agreements that i have read. If this is the case i am certain that there would be some sort of legal jargen regarding this.
No more than there is legal jargon regarding the cost born by Ford Motor Company for the S.A.E. rated bolts holding their engines together. The cost of third party transit should be transparent to you; built into the price you pay for your connection.
What i want to know is how much Comcast is actually saving while i am limited with my broadband usage when they are not giving me at any time i can testanywhere close to my 8MB connection.
Say i have a land line phone with BellSouth/AT&T, they tell me i have connection 24/7 365 but i can not use that line for more than so many hours of use per day otherwise it ties up the lines for everyone else.
Well, I know for a fact that none the ILECs can't provide you with full access to the PSTN network when half the country is trying to call in to Los Angeles after an earthquake, New Orleans after a hurricane, or Pennsylvania after airing a radio show purporting to be reporting an invasion from Mars. There are PSTN bottlenecks which result in loss of service to saturated regions.
If the ISP can not afford to offer 8MB connection to its customers at full bore 24/7 365 than they shouldnt do it. Because some of us out here in this world will use what we pay for. It is your choice whether or not you wish to do so. If i didnt want or need the 8MB connection i certainly wouldnt have upgraded.
This is the part where the customer expectations are changing, and the ISPs need to adjust. I suspect that some percentage of the people using the Internet still use it in a limited sense; but more are finding ways to use their bandwidth than the ISPs have counted on. I suspect that it is time to start charging for a base amount of data moved; say, $42.95 per month for up to 150GBytes, and charge extra, in a metered fashion, for data volume in excess of the base rate. Just as you pay per kilowatt hour for electricity, or per gallon for gasoline.
--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum
reply
anon @ 8th Jul 11:44AM:
Re: Comcast is using Sandvine to manage P2P Connections

Can I get a clarification here? Lots of tutorials out there simply say to enable encryption in order to get better upload speeds with ISP who throttle torrent activity. But I'm finding that enabling encryption has little to no effect. Peers connect, I get a very brief time of upload activity, and then the speed is throttled back to zero. Peers disconnect. Rinse and repeat.

Is this Sandvine fundamentally different from standard throttling, or just a different variety?
reply
FreakyOne @ 8th Jul 05:21PM:
Re: Comcast is using Sandvine to manage P2P Connections

If this is the case then i want my money back because i believe it is false advertising in every aspect. I cant place an ad in the newspaper/T.V/Radio stating i can offer a plane ride to Spain for 50 dollars and not give it because the demand is so high. I think its rather deceptive if what you are saying is the case. And i am certain that it will not take much time until most of the Customers that demand the most out of their bandwidth get fed up with the BS. Same as the government so i suppose they would agree with Comcast or any other ISP that uses the same tactics. This is my opinion and i am sticking to it.
reply
jjoshua @ 9th Jul 12:36AM:
Re: Comcast is using Sandvine to manage P2P Connections

said by EG :

said by jjoshua :

My traffic is my property.
Hmmm.... I wonder if the federal government agrees with that ? :o :D
What does the government have to do with this discussion?

When you send a document via FedEx, do they open the package, look at the document, decide if the contents are 'acceptable' and make modifications to it? Of course not.

Comcast, or any other ISP, should be no different. I create the packets and they deliver it - end of story.
reply
cablejoe @ 9th Jul 01:11AM:
Re: Comcast is using Sandvine to manage P2P Connections

By using a P2P client, you are allowing remote users to download files from your computer; this essentially makes your computer a server, which is specifically prohibited by the TOS and AUP.

Personally, I'm not real crazy about the decision.

However, it seems to me that if Comcast chooses to implement technology that prevents users from violating the TOS and AUP, they are well within their rights to do so.
reply
SirchMeister @ 9th Jul 06:17AM:
Re: Comcast is using Sandvine to manage P2P Connections

Not quite. Bittorrent doesn't work that way. When you think of server you think of one entity serving up files. When you're defining bittorrent traffic and the way it works it cannot be deemed that anyone seeding is running a server. I suppose if you were the only seeder one could argue that point. It is a gray area.

Either way, the issue to most people I believe is not whether they are breaking any TOS/AUP. But whether it is right for Comcast to implement technologies that are basically unwrapping your packets.
reply
Cabal @ 9th Jul 06:58AM:
Re: Comcast is using Sandvine to manage P2P Connections

I think you would have a difficult time trying to make the case that Comcast is not within their rights to shape and prioritize traffic as they see fit on their network. They do it every day for VoIP and other latency-critical traffic.
--
Interested in open source engine management for your Subaru?
reply
jjoshua @ 9th Jul 11:02AM:
Re: Comcast is using Sandvine to manage P2P Connections

said by Cabal :

I think you would have a difficult time trying to make the case that Comcast is not within their rights to shape and prioritize traffic as they see fit on their network. They do it every day for VoIP and other latency-critical traffic.
Shaping and prioritization is one thing, interrupting and sabotaging the TCP/IP protocol is another thing.
reply
telcolackey @ 9th Jul 12:01PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by SirchMeister :

Not quite. Bittorrent doesn't work that way. When you think of server you think of one entity serving up files. When you're defining bittorrent traffic and the way it works it cannot be deemed that anyone seeding is running a server. I suppose if you were the only seeder one could argue that point. It is a gray area.
Would seeding Bittorrent be similar to file sharing?
reply
EG @ 9th Jul 07:19PM:
Re: Comcast is using Sandvine to manage P2P Connections

Ignorance can certainly be bliss....
--
Let us never forget 9/11
reply
kadar @ 9th Jul 08:29PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by jjoshua :

said by EG :

said by jjoshua :

My traffic is my property.
Hmmm.... I wonder if the federal government agrees with that ? :o :D
What does the government have to do with this discussion?

When you send a document via FedEx, do they open the package, look at the document, decide if the contents are 'acceptable' and make modifications to it? Of course not.

Comcast, or any other ISP, should be no different. I create the packets and they deliver it - end of story.
FedEx no. Uncle Sam Yes.
»sfgate.com/cgi-bin/article.cgi?f···rintable
reply
jjoshua @ 9th Jul 09:53PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by kadar :

FedEx no. Uncle Sam Yes.
»sfgate.com/cgi-bin/article.cgi?f···rintable
I'm failing to see the connection. Uncle Sam isn't going to open your package and change the contents. And it's still my property even if Uncle Sam does decide to take a look.
reply
slovokia @ 10th Jul 02:11AM:
Re: Comcast is using Sandvine to manage P2P Connections

I've done some more observations and reached the following conclusions. If you attempt seeding with bittorrent using encryption, Comcast will tear down the TCP connection after 30 seconds or so. I think the seeding limit is time based not bandwidth based. The heuristic appears to be if Comcast sees a TCP connection established that involves only sending data from a subscriber to another host, that connection is terminated after 30 seconds or so. I'd imagine this limit would affect any TCP flow which cannot be recognised as being "good".
reply
NormanS @ 10th Jul 12:01PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by FreakyOne :

If this is the case then i want my money back because i believe it is false advertising in every aspect. I cant place an ad in the newspaper/T.V/Radio stating i can offer a plane ride to Spain for 50 dollars and not give it because the demand is so high.
I take you have never been bumped from a flight.
I think its rather deceptive if what you are saying is the case. And i am certain that it will not take much time until most of the Customers that demand the most out of their bandwidth get fed up with the BS.
I honestly don't have a count on Comcast's high volume data movers; a Comcast insider seems to think it is on the order of 0.10%. That isn't enough to break any company.
Same as the government so i suppose they would agree with Comcast or any other ISP that uses the same tactics. This is my opinion and i am sticking to it.
As I have said, ISPs base their business on the assumption that normal users aren't using their computers 24/7; even though they can access the Internet 24/7. Most people I know don't spend more than a couple of hours per day online; most don't download a lot of movies, music, porn videos, anime, etc.

It may actually be time for the ISPs to move to metered Internet. You get your 8Mbps/768kbps package, or 10Mbps/1Mbps, or whatever, for a flat $50 per month for up to 150GBytes of data. You pay $1 per GB over that base amount. That would actually make it possible to plan for bandwidth availability for the network engineers; give the network additional revenue to apply towards bandwidth capacity, as well.
--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum
reply
NormanS @ 10th Jul 12:04PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by SirchMeister :

Not quite. Bittorrent doesn't work that way...
Eh? The purpose of BitTorrent is distributed service. Every client is serving up pieces of the file being downloaded. Why do you think you need port forwarding to make BT work? Port forwarding through NAT allows unsolicited access to a computer; that is a typical signature of a server.
--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum
reply
NormanS @ 10th Jul 12:06PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by jjoshua :

When you send a document via FedEx, do they open the package, look at the document, decide if the contents are 'acceptable' and make modifications to it? Of course not.
I wasn't aware that Sandvine modified the contents of the data being downloaded. Only that it used the contents in making a decision on packet priority.
--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum
reply
FreakyOne @ 10th Jul 08:42PM:
Re: Comcast is using Sandvine to manage P2P Connections

Apparently you would not say a word if bumped from a flight? It is not my responsibility to make sure my ISP can give me the service i am paying for, it is their responsibility. My responsibility as far as they are concerned is to pay my bill a month in advance for service i have not received and assume it will be as described. I am not going to put money out month after month while they are scratching their heads about my connection issues.
reply
NormanS @ 11th Jul 07:50AM:
Re: Comcast is using Sandvine to manage P2P Connections

said by FreakyOne :

Apparently you would not say a word if bumped from a flight?
Depends upon the fine print on the ticket.
It is not my responsibility to make sure my ISP can give me the service i am paying for, it is their responsibility. My responsibility as far as they are concerned is to pay my bill a month in advance for service i have not received and assume it will be as described. I am not going to put money out month after month while they are scratching their heads about my connection issues.
What does the Comcast fine print say?
quote:
Prohibited uses include, but are not limited to, using the Service, Customer Equipment, or the Comcast Equipment to:
...
vii. restrict, inhibit, interfere with, or otherwise disrupt or cause a performance degradation, regardless of intent, purpose or knowledge, to the Service or any Comcast (or Comcast supplier) host, server, backbone network, node or service, or otherwise cause a performance degradation to any Comcast (or Comcast supplier) facilities used to deliver the Service;

The whole shebang is here.

To the best of my knowledge, no ISP, not even mine, expects the customer to keep his computer sucking bandwidth 24/7. Hey, we all have to eat, sleep, shower, work, etc. sometime during the day. Lately I've been spending extra time reworking a brick sidewalk that had to be pulled up for removal of a hedge, and replacing of a fence.

If Comcast deems P2P to be a drag on their network, they have the obligation to their customers feeling the drag to manage the network in a manner which mitigates that drag.

Now, if Comcast needs to add capacity to support those 24/7 downloaders, maybe it is time to implement a "Pay-per-Byte" system. Say, $50 per month for 150GBytes, and pay an additional $1 per GByte over that. Metered service, as it were. Those who choose to download 600GB per month can pony up an extra $450 per month toward alleviating bandwidth bottlenecks.

--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum
reply
FreakyOne @ 11th Jul 11:24AM:
Re: Comcast is using Sandvine to manage P2P Connections

Your suggestion is actually quite good as far as the bandwidth hogs are concerned... it would certainly make up for the loss of Recording Industry, Gaming and Movie Industries as well. Maybe they should band together and develop their own Broadband company and make a system like this so they wont care if movies or CD's or Games are transferred via the net .. they would be making too much dough to worry about that. It would also save on attorney fees. I dont believe in the agreement that is posted on that link so i am certain i wont be a customer of Comcast for long. It would make a difference if the Customer Service dept. actually admitted to something along the terms of this topic but they dont admit nor do they have to admit to this or any other kind of filtering of "Comcast" bandwidth. If i were to operate my business like this on a retail level i wouldn't last long. First rule of thumb is "The Customer Is Always Right". For those businesses that don't buy into this philosophy they wont last very long. Or maybe they are just too big for their own good and don't care about their customers. At least individually.
reply
gregbot @ 11th Jul 12:02PM:
Re: Comcast is using Sandvine to manage P2P Connections

As an entrepreneur as well as someone who has a lot of experience in the Computer Services industry I must say the customer is not always right.

That's a very common saying among customers, especially difficult ones, but it just wouldn't make sense to do business with that assumption.

Its easy to say that a big company should bend down towards the customer and satisfy them no matter the cost, but we are not given access to their cost structure or network limitations so we don't know how big their sacrifices would be if they did give unlimited bandwidth.

I am sure Comcast would rather piss off the top 1% of its bandwidth hogs or even bully them into downloading less than risk losing 25% or 50% of its less consuming customers to competing services because their connections are running too slow because of the bandwidth hogs (afterall, they all pay the same monthly bill so its easier to rid of 1% of your customers than 50%).

The point is the customer is not always right and in my field (computer repair) the customer is very seldom right (If I could have a nickel for every customer who insisted the problem is the hard drive or motherboard when it was just a case of limewire downloaded spyware or for every customer who insists that their hardware warranty should cover virus removal I'd have my own OC3 line by now).

With that said, I agree that bandwidth limits should be posted so that people don't live in fear of the dreaded letter or phone call. The bandwidth limits should also be high enough so that casual users who like YouTube and download some movies (Amazon.com's Unbox service movies are as much as 2GB each) don't come dangerously close to or over the limit on a consistent basis. I myself fear getting into trouble with Comcast in the future even though I am a new subscriber and don't have the service hooked up yet which would be alleviated if I just knew the limit.

With the internet increasingly being multimedia I am in shock that bandwidth limits or caps today are the same as they appear to have been in 2002 or 2003 when posts online first started appearing about them since SO MUCH has changed since then on the internet especially in the direction of everything taking up more bandwidth.

As far as people always downloading just under their cap to avoid being terminated while it is a valid concern there are work arounds.

They could introduce what some universities do for their access as in the first 100GB are your regular speed and the more you download after that the slower your speed gradually gets which minimizes the impact your downloads after that speed have on other users.

(Ex. first 100GB are downloaded at rated speed of 8mbps, the next 25GB are 4mbps, the next 25 are 1.5mbps, and everything after that is 768kbps - a speed which should not dent users around you).

This would be favorable to just terminating users.
reply
jjoshua @ 12th Jul 09:46AM:
Re: Comcast is using Sandvine to manage P2P Connections

said by NormanS :

said by jjoshua :

When you send a document via FedEx, do they open the package, look at the document, decide if the contents are 'acceptable' and make modifications to it? Of course not.
I wasn't aware that Sandvine modified the contents of the data being downloaded. Only that it used the contents in making a decision on packet priority.
From the OP...

- The interruption is accomplished by sending a perfectly forged TCP packet (correct peer, port, and sequence numbering) with the RST (reset) flag set. This packet is obeyed by the network stack or operating system which drops the connection.

Sounds like it to me...
reply
funchords @ 12th Jul 08:40PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by Sadimitsu :

It's sure blocking me! I didn't notice it untill yesterday but I can't seed anything on bittorrent now. My ratios are horrible and now I will be banned etc etc. It's not even a slow upload, I really can't seed torrents AT ALL. I get a fat 0 kB/s.
That is not my experience at all (I started this thread, and I started it with data.) Something else is probably going on with your situation -- but your experience and my experience are not the same.
--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
~ Keeper of the D-Link FAQ ~ Did you Search? ~ More features, Free! Join BBR! ~
reply
funchords @ 12th Jul 08:55PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by Qumahlin :

This thread is going to garner hate towards sandvine because everyone is basing one users experiences to how things will always work and assuming Sandvine is something installed specifically to block/throttle p2p...that is not the case
No hate from me about using the technology, but the users need to be let in on it, so that we can get support when we need it.

Whoever adjusts these things has made it impossible to upload files on Gnutella. Every _single_request_ is met with an injected RST packet that drops the connection (as of about 6 weeks ago, when I last tested this). ED2K uploads are dropped a majority of the time, but there some uploading does occur. BitTorrent seems to be the least affected (see my results at the top of this thread).

How do I report this to Comcast Support, who is trained to respond that Comcast does not filter P2P?

IMHO, P2P is low-priority, passive internet use. If a customer is installing a QoS router at his house, P2P is always the thing that gets the last priority. I don't mind that Comcast uses the same prioritization as anyone else would use, but I do mind not being able to upload at all (on Gnutella) and not being able to do anything about it.
--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
~ Keeper of the D-Link FAQ ~ Did you Search? ~ More features, Free! Join BBR! ~
reply
funchords @ 12th Jul 09:43PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by slovokia :

I've done some more observations and reached the following conclusions. If you attempt seeding with bittorrent using encryption, Comcast will tear down the TCP connection after 30 seconds or so. I think the seeding limit is time based not bandwidth based. The heuristic appears to be if Comcast sees a TCP connection established that involves only sending data from a subscriber to another host, that connection is terminated after 30 seconds or so. I'd imagine this limit would affect any TCP flow which cannot be recognised as being "good".
Thank you!!!! Great observations.

Something for you to be aware of, and check if you feel so inclined: 30 seconds is also the slot time for a BitTorrent "Optimistic Unchoke." My tests showed that they did not send the RST during an actual data transfer, but during the more passive conversation that happens while the peers are CHOKED. During this time, BitTorrent sends HAVE and NOOP messages. And the time between the start of the first transmission, and the point where that transmission is stopped by a CHOKE message, happens to be 30 seconds.

Wireshark should be able to confirm that for you, and a great program to use is Azureus -- it seems to have the best logs for diagnostics like this.
--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
~ Keeper of the D-Link FAQ ~ Did you Search? ~ More features, Free! Join BBR! ~
reply
funchords @ 12th Jul 09:46PM:
Re: Comcast is using Sandvine to manage P2P Connections

Upon reflection, I do not wish to post. (my point was was covered by another poster)
reply
kaila @ 12th Jul 11:32PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by funchords :

said by slovokia :
....The heuristic appears to be if Comcast sees a TCP connection established that involves only sending data from a subscriber to another host, that connection is terminated after 30 seconds or so. I'd imagine this limit would affect any TCP flow...
Thank you!!!! Great observations....
Sorry I'm confused now... Does this effect only p2p/bt connections or *any* TCP based connection (uploading photos to print labs, online backup sites, ftp sites, etc.)?
reply
anon @ 13th Jul 02:01AM:
Re: Comcast is using Sandvine to manage P2P Connections

Yep I'm confused as well.

After reading this thread i fired up utorrent, and with and without encryption i was able to upload to a single peer at about 230 KBytes per second for at least 5-10 minutes, then changed to encrypted, and had the same exact result. During this time i consistently received 1MByte per second from the lone seeder uninterrupted.

Based on how much torrenting i do (150-300GB a month) I just have not seen anything like what is being suggested in this thread
reply
gregbot @ 13th Jul 03:03AM:
Re: Comcast is using Sandvine to manage P2P Connections

I wonder if these are just regional issues that affect mostly those on busy nodes or something.
reply
NormanS @ 13th Jul 08:17PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by jjoshua :

From the OP...

- The interruption is accomplished by sending a perfectly forged TCP packet (correct peer, port, and sequence numbering) with the RST (reset) flag set. This packet is obeyed by the network stack or operating system which drops the connection.

Sounds like it to me...
Where is the "content" that is being modified? I take "content" to be the content of the file, not the packet header details.
--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum
reply
Cabal @ 13th Jul 11:01PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by NormanS :

said by jjoshua :

From the OP...

- The interruption is accomplished by sending a perfectly forged TCP packet (correct peer, port, and sequence numbering) with the RST (reset) flag set. This packet is obeyed by the network stack or operating system which drops the connection.

Sounds like it to me...
Where is the "content" that is being modified? I take "content" to be the content of the file, not the packet header details.
While I'm the first to support any form of traffic shaping to get the best utilization out of one's network, it's kind of tough to argue that man-in-the-middle attacks, which are what these RST injections are, are appropriate ways to control bandwidth. I wouldn't be surprised if it was a misconfiguration issue, though. I'm seeding successfully now with no issues, as usual.
--
Interested in open source engine management for your Subaru?
reply
funchords @ 14th Jul 03:07AM:
Re: Comcast is using Sandvine to manage P2P Connections

Like I hope I mentioned at the top of the thread, BitTorrent seems to be the least affected overall of the protocols that I tested. I was able to hit and maintain my top requested speed and number of connections with BitTorrent. However, in reviewing the packets I received using Comcast vs. non-Comcast, the number of RST-driven drops was multitudes higher with Comcast.

With Sandvine, the goal isn't to prevent P2P. The goal is to reduce the cost of your P2P connections. If Sandvine can cause your client to drop an expensive connection, your client will seek a new connection -- and hopefully find one that is either within the Comcast network or one that takes a less expensive or congested route outside of the network.

Tip: For some reason, the injected RST triggers the WINSOCK error 10053, which is (Connection Aborted by local software) and not the 10060 (Connection Reset by Peer.) So if you're not looking at packets, but you are looking at logs from your P2P client -- look for 10053.

Edit: I see that I didn't mention that BitTorrent seemed the least affected of the protocols that I tested. In my tests: Gnutella uploading was completely stopped. ED2K uploading was heavily affected. And BitTorrent uploading was the least affected. Interestingly, that list tends to inversely follow the current popularity of each protocol.

--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
~ Keeper of the D-Link FAQ ~ Did you Search? ~ More features, Free! Join BBR! ~
reply
funchords @ 14th Jul 03:16AM:
Re: Comcast is using Sandvine to manage P2P Connections

said by kaila :

said by funchords :

said by slovokia :
....The heuristic appears to be if Comcast sees a TCP connection established that involves only sending data from a subscriber to another host, that connection is terminated after 30 seconds or so. I'd imagine this limit would affect any TCP flow...
Thank you!!!! Great observations....
Sorry I'm confused now... Does this effect only p2p/bt connections or *any* TCP based connection (uploading photos to print labs, online backup sites, ftp sites, etc.)?
My testing was specific to P2P protocols, and my own experience is that Comcast is not interrupting TCP connections simply based on larger outgoing ratios. I think Slovokia's conclusion was incorrect, but his 30 second observation is on the right track as it applies to BitTorrent.
--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
~ Keeper of the D-Link FAQ ~ Did you Search? ~ More features, Free! Join BBR! ~
reply
funchords @ 14th Jul 03:28AM:
Re: Comcast is using Sandvine to manage P2P Connections

said by NormanS :

said by jjoshua :

From the OP...

- The interruption is accomplished by sending a perfectly forged TCP packet (correct peer, port, and sequence numbering) with the RST (reset) flag set. This packet is obeyed by the network stack or operating system which drops the connection.

Sounds like it to me...
Where is the "content" that is being modified? I take "content" to be the content of the file, not the packet header details.
Without arguing semantics, your understanding is correct.

In the RFCs, the use of the RST flag was never intended to be changed enroute. It was intended for the endpoints of a connection to avoid a lingering open TCP socket condition when connectivity was interrupted. So there is alteration, but not of the payload.

However, it is unexpected to have an RST flag on a data packet, and it is unclear in the RFCs what the receiver is supposed to do with the data payload at that point.

I did notice that empty (no data payload) RST packets were also received, apparently forged to appear that it came from the endpoint.

In short, the RST TCP/IP flag is being modified on some data packets. Also, in some cases a packet is forged to appear like it came from the endpoint with the RST flag set.
--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
~ Keeper of the D-Link FAQ ~ Did you Search? ~ More features, Free! Join BBR! ~
reply
funchords @ 14th Jul 03:34AM:
Re: Comcast is using Sandvine to manage P2P Connections

said by gregbot :

I wonder if these are just regional issues that affect mostly those on busy nodes or something.
I'm wondering that, too.

Sandvine was designed for the network gateways -- where Comcast meets the backbone or other non-Comcast peers. It follows that it would apply not to the local nodes, but to the perimeter of the Comcast network (affecting everyone). But given the vastness and fragmentation of the Comcast network (given the acquisitions), I am wondering if there is a more regional implementation.

Unfortunately, I can only test from here.
--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
~ Keeper of the D-Link FAQ ~ Did you Search? ~ More features, Free! Join BBR! ~
reply
slovokia @ 15th Jul 11:35AM:
Re: Comcast is using Sandvine to manage P2P Connections

Hi Funchords,

Thanks for your observations as well!

I have not been able to test any more since I have left Comcast and switched to DSL. However I saw bittorrent connections being ripped down during active seeding - i.e. the leecher was not being choked at the time.

I would also like to point out that it seems clear that these limitations do NOT seem to affect all Comcast customers uniformly. I have seen other Comcast seeders behave the same way when I was their leecher.

What is interesting is that if I disabled encryption the seeding TCP connections seemed to be terminated instantly. With encryption enabled they would be terminated after 30 seconds or so. I did not test using other P2P programs or random upload TCP streams.
reply
funchords @ 17th Jul 01:18AM:
Re: Comcast is using Sandvine to manage P2P Connections

said by slovokia :

What is interesting is that if I disabled encryption the seeding TCP connections seemed to be terminated instantly. With encryption enabled they would be terminated after 30 seconds or so.
(in my case, after the CHOKE). But I definitely remember seeing something to that effect, too -- encrypted connections lasted longer, but I did not dig deeper to characterize it. I remember wondering at the time if it had anything to do with how encryption was negotiated in the handshake. My goal at the time, however, was just to record under what conditions RST interference happened.
--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
~ Keeper of the D-Link FAQ ~ Did you Search? ~ More features, Free! Join BBR! ~
reply
anon @ 20th Jul 11:26PM:
Re: Comcast is using Sandvine to manage P2P Connections

Has anyone tried configuring their firewall to block incoming RST packets? While this may lead to a lot of stale TCP connections hanging around until they time out (typical timeouts are 5-10 minutes), it may alleviate some of the problems Robb has reported. Alternatively, if the bogus RST packets could somehow be characterized (e.g. empty message body), then perhaps the firewall could be configured to block only these types of RST packets.

I guess the next question is whether or not there are any software firewalls with sufficient flexibility to allow this type of filtering?
reply
NormanS @ 21st Jul 03:15AM:
Re: Comcast is using Sandvine to manage P2P Connections

said by Anonymous Coward :

I guess the next question is whether or not there are any software firewalls with sufficient flexibility to allow this type of filtering?
The two non-Windows firewalls I worked with could filter by TCP, or UDP, by IP address and by port number; but I don't recall that either could check for RST packets.

I haven't played with the Windows firewall. My router firewall can't check that low.
--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum
reply
Cabal @ 21st Jul 09:36AM:
Re: Comcast is using Sandvine to manage P2P Connections

said by Anonymous Coward :

Has anyone tried configuring their firewall to block incoming RST packets?

I guess the next question is whether or not there are any software firewalls with sufficient flexibility to allow this type of filtering?
I have not (since I haven't seen this behavior), but any of the UNIX-based firewalls can filter using TCP header, as can OS X (FreeBSD's ipfw), and I'm sure any of the enterprise-grade hardware firewalls. It can probably be done with the Linux-based Linksys routers through the commandline interface. I'd be interested to hear of any others.
--
Interested in open source engine management for your Subaru?
reply
anon @ 21st Jul 04:52PM:
Re: Comcast is using Sandvine to manage P2P Connections

If anybody figures out how to try this firewall filtering with a DD-WRT firmware-flashed Linksys, please post instructions here. I'm about to get kicked off several **legal** (live-music-sharing) torrent trackers for my piss-poor ratio.
reply
anon @ 21st Jul 10:00PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by Anonymous Coward :

Has anyone tried configuring their firewall to block incoming RST packets?
Yes!
On linux, if you're using a static port for bittorrent, the following command drops incoming reset packets to that port.

I also noticed, that bit 6 of the IP TOS field was set on all these reset packets.
As per the ipv4 rfc, bit 6 is "Reserved for future use". tcpdump shows these packets with
Since that field is not in use, tcpdump should never show any packets with that filter. But it does on comcast! Could someone else on comcast plese verify that they can see these too?

iptables 1.3.5
tcpdump version 3.9.4
libpcap version 0.9.4
linux 2.6.20.1

reply
anon @ 22nd Jul 01:42PM:
Re: Comcast is using Sandvine to manage P2P Connections

Can anyone tell if the RSET packets are sent in both directions, to the comcast user and the other peer, or just to the comcast users?
reply
funchords @ 22nd Jul 08:39PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by Anonymous Coward :

Has anyone tried configuring their firewall to block incoming RST packets?
Yes, I tried this with linux iptables, and got really excited when it seemed to thwart the problem. But then I realized that the connections were dead, but they simply weren't being removed from the active list.

I believe this means that the RST is sent both ways. The response to an RST is not a FIN so the TCP/IP stack doesn't know the connection has been dropped.

Good thinking, though.

said by no oper :

I also noticed, that bit 6 of the IP TOS field was set on all these reset packets.
I hadn't noticed. They could have been set, or not. Are you directly connected? -- or could your router be adding that bit for use on the LAN?
--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
~ Keeper of the D-Link FAQ ~ Did you Search? ~ More features, Free! Join BBR! ~
reply
anon @ 22nd Jul 10:08PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by funchords :

I hadn't noticed. They could have been set, or not. Are you directly connected? -- or could your router be adding that bit for use on the LAN?
I'm not directly connected, there's a router on the way, but this bit is set only on the reset packets I'm receiving on the bittorrent connections and nowhere else.
reply
Descent @ 23rd Jul 01:46AM:
Re: Comcast is using Sandvine to manage P2P Connections

I'm not sure if this is related, but I've been having some really crappy luck with seeding torrents as of late. I was away for about a month earlier in the summer and just returned home about a week ago.

Since returning home, I haven't been able to seed a torrent for the life of me, and whenever I have my bit torrent application open (Azureus) on either of my 3 different computers (wired or wireless, UPnP, regular port forwarded, DMZ host you name it i've tried it) I get a considerable amount of packet loss in general as I've tested for hours pinging speakeasy speed test locations with Azureus open and with it closed from every computer on my network.

I have been reconfiguring and testing and doing everything I can think of trying to get a torrent to seed but even leaving Azureus open anymore makes it a pain to even surf the web or maintain a stable connection to MSN messenger. I'm getting 20% packet loss on average with Azureus open on any one of my PC's. The highest I've been able to seed in the past week is like 300B/s...and i don't even think its actually seeding the file (probably just advertising it to the tracker).

I have gone to work with Azureus open back home, and from my laptop at work I've watched my desktop sign on and off MSN about 3 times per minute for an entire work day. Guess what the results were with Azureus closed... no drops whatsoever.

I am absolutely stumped as to why I cant seed and why I get horrible packet loss only when Azureus is open. Are the bit torrent days over? What if I must use a bit torrent client for something legit? Say.. one of Blizzard's world of warcraft patches. Torrents aren't all bad and i don't see how comcast can completely shut them down like this.
reply
koitsu @ 23rd Jul 10:36AM:
Re: Comcast is using Sandvine to manage P2P Connections

said by funchords :

I believe this means that the RST is sent both ways. The response to an RST is not a FIN so the TCP/IP stack doesn't know the connection has been dropped.
Correct :-). See the below stateful diagram (PDF):

»www.cse.iitb.ac.in/perfnet/cs456···diag.pdf
--
Making life hard for others since 1977.
I speak for myself and not my employer/affiliates of my employer.
reply
funchords @ 23rd Jul 09:56PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by Descent :

Are the bit torrent days over? What if I must use a bit torrent client for something legit? Say.. one of Blizzard's world of warcraft patches. Torrents aren't all bad and i don't see how comcast can completely shut them down like this.
I read your whole post -- and you're certainly seeing something different than what I have observed. For example, I never had any packet loss, and I can seed torrents at full speed -- even while Comcast is resetting certain connections.

Someone else has pointed out that things might be different in different parts of the country, but your story sounds more like upload saturation to me. To test this, set Azureus to 16 KB/s upload limit running on one of your computers. If the symptoms go away, then your problem was upload saturation. Your router/modem was getting data faster than it could put it on the line.
--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
~ Keeper of the D-Link FAQ ~ Did you Search? ~ More features, Free! Join BBR! ~
reply
telcolackey @ 23rd Jul 10:25PM:
Re: Comcast is using Sandvine to manage P2P Connections

Question:

1) How important is your upload file sharing ability. i.e. are you very concerned that the world must download from your PC 7x24 while you are not using your computer?

2) How much of your non-copywrited content is in high demand that would help your P2P ratio?
reply
impulse101 @ 24th Jul 05:14AM:
Re: Comcast is using Sandvine to manage P2P Connections

use newsgroups get Giganews and go for the encryption service. done.
reply
sortofageek @ 24th Jul 03:06PM:
(topic move) Intermittent "freeze" of internet connection

Moderator Action
The post that was here (and all 1 followups to it), has been moved to a new topic .. »[Connectivity] Intermittent "freezes" in Royal Oak, MI

stated reason was: Probably needs to be in separate thread
reply
funchords @ 24th Jul 08:07PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by telcolackey :

1) How important is your upload file sharing ability. i.e. are you very concerned that the world must download from your PC 7x24 while you are not using your computer?

2) How much of your non-copywrited content is in high demand that would help your P2P ratio?
While I have doubt that your questions were put in good faith, I shall answer those parts that I have not covered before.

1) I have already adequately answered the "how important/level of concern" question as it applies to me.

2) I have already adequately answered your question about the nature of my content. Ratio is not a concern to me. I'm more concerned about queuing a request (ala ED2K or Gnutella) and then appearing to drop the connection instead of servicing it. Such behavior is considered abusive on those networks.
--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
~ Keeper of the D-Link FAQ ~ Did you Search? ~ More features, Free! Join BBR! ~
reply
ragingmedic @ 25th Jul 07:44PM:
Re: Comcast is using Sandvine to manage P2P Connections

Everything I've read so far has concerned file sharing. Does anyone have an idea how Sandvine technology may affect online gaming? I remember in the early days that gamers were considered "high bandwidth" users.

Could Sandvine technology affecting P2P connections also affect gamers?
reply
NormanS @ 27th Jul 04:18AM:
Re: Comcast is using Sandvine to manage P2P Connections

said by ragingmedic :

Could Sandvine technology affecting P2P connections also affect gamers?
Given the nature of what Sandvine boxes are checking, I'd say, "Yes". However, it would take some analysis to prove that it is actually being done.
--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum
reply
elvey @ 17th Aug 01:10PM:
Re: Comcast is using Sandvine to manage P2P Connections

Funchords, thanks for doing thorough research. ....
Watched a good presentation on this: »www.nanog.org/mtg-0706/norton.html in which he discusses peering and transit political reality. And he's done his homework.

... some people insist on keeping their heads in the sand.

"Comcast spokesman Patrick McElroy, for instance, says his company has contracted with Sandvine "to examine our network So that we Can better manage it."
- The current page at »news.google.com/archivesearch?q=···ie=UTF-8
Subscription - The Record - HighBeam Research - Sep 13, 2006

As for "Tier 1" - there's no consensus definition of the term.
»www.convergedigest.com/Bandwidth···ID=13186
and traceroute output suggests that comcast is a Tier 1. Nominally, it looks like it's level 3, but it seems it's comcast too.
--
SBC is the world's second-largest SpamHaus and leads an
Organized Crime Syndicate.
Also see TURN.org or UCAN.
reply
elvey @ 17th Aug 03:03PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by NormanS :

In addition, Comcast generally pays for transit routing to other parts of the Internet. They are not a "peer" in the common Internet sense, or so I am told, because they are a net consumer (thanks to residential accounts) of bandwidth. Unlike Level 3 and AT&T Worldnet services (not the former SBC DSL provider!), who have a net parity of packet exchange.
What's your source? This is false. When comcast and AT&T signs up at a public peering point, everyone and their uncle wants to peer with them. They have to pay for transit for a small fraction of their traffic. My source is the public peering database.
--
SBC is the world's second-largest SpamHaus and leads an Organized Crime Syndicate. Also see TURN.org or UCAN.
reply
NormanS @ 17th Aug 05:03PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by elvey :

What's your source?
I was heavily criticized for speaking of Comcast as a peer provider. Now I am criticized for hedging. I can't win for losing! :huh:
This is false. When comcast and AT&T signs up at a public peering point, everyone and their uncle wants to peer with them. They have to pay for transit for a small fraction of their traffic. My source is the public peering database.
AFAIK, nobody signs up with Comcast to use their backbone for transit between non-Comcast endpoints. The only trace routes I have seen posted seem to support that; the Comcast backbone always appears to have one end at a Comcast POP.
The 'sbcglobal.net' to 'att.net' transition is leaving the old SBC (formerly "SBC Internet Services") backbone for the AT&T (AT&T Worldnet Service) transit backbone.

While there is transition from AT&T to Comcast, there is no transition from Comcast to anyplace else. I do not know of a destination where I can jump from my end, through Comcast, to a non-Comcast end.

In general, Level 3, MCI/UUNet, AT&T Worldnet Services, and the other transit providers can make deals for mutual exchange of packets based on symmetric exchange. But Comcast, Net Access Corporation, and AT&T Internet Services (the old SBCIS) tend to have asymmetric packet exchanges, and cost their peers for data transit; they get to pay for that transit.

--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum
reply
supermario00 @ 17th Aug 05:20PM:
Re: Comcast is using Sandvine to manage P2P Connections

Digg has a big front page story on this very issue. While I'm new to Comcast I've gotten some pretty good speeds via Utorrent when its come to BT. I'm not into the movies and music(as my mistaken DMCA notice showed in my old topic). Still though it bothers me that if I wanted to use BT to pick up something like a WoW patch, a game on Steam or even an episode of the latest hit anime I'd have my internet scream to a halt.

I rarely sit and try to seed a torrent for days though when it comes to something like an anime episode. Before anyone goes "ah-ha!" on my they're on a private tracker and the shows aren't licensed for distribution in the US yet. I have a healthy collection of DVD's already. Still though I've noticed a hit in my downloads even though I don't UL. It seems like more and more companies are going to this technology.
reply
anon @ 17th Aug 06:46PM:
Re: Comcast is using Sandvine to manage P2P Connections

As for RST going in both directions. That just means everyone using bittorrent needs to use the filter trick. So I guess solutions need to be figured out for all OSes, and everyone get on implementing them.
reply
anon @ 17th Aug 07:38PM:
Re: Comcast is using Sandvine to manage P2P Connections

I started noticing this problem a few weeks ago here in Northern FL. As long as I keep my downloads below 100kb, my connection doesn't get reset. When I start taking up bandwidth 100kb +, the connect will be reset and will be down for a few minutes and then will pick back up. It'll do this for sometime (repeating the cycle), so it's easier for me to just keep my downloads under 100kb(Under their radar). Anyone else experiencing this same situation?
reply
anon @ 17th Aug 08:35PM:
msg deleted

deleted by a moderator
reply
anon @ 17th Aug 10:21PM:
msg deleted

deleted by a moderator
reply
funchords @ 17th Aug 11:08PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by Gachamp2 :

As long as I keep my downloads below 100kb, my connection doesn't get reset.
That hasn't been the case for me. In fact, I get the reset packets when downloading at a rate of 0 KB/s. It does not seem to have any relationship to downloads.
reply
funchords @ 17th Aug 11:26PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by supermario00 :

Digg has a big front page story on this very issue.
Excellent!

It's from this TorrentFreak article: »torrentfreak.com/comcast-throttl···ossible/

I just want to correct some misconceptions that I've read:

1. Comcast appears to be "managing" P2P traffic, not destroying it. In many cases, BitTorrent seeders can (eventually) get up to their desired speeds if the swarm will support it. It just takes longer to do so. The most impacted protocol seems to be Gnutella, where no uploading seemed possible.

2. Comcast is acting poorly by not notifying their customers, by the improper use and forgery of the RST flagged packet, and by not notifying their technical support staff that their network behaved this way.

It makes sense to me to reasonably prioritize real-time networking over passive networking, especially when one usage may involve an emergency VoIP call and another may involve downloading the latest clothing and armament for an online game character.

Time Warner notified their customers ( see »[TWC] TW Officially Announces Packet Shaping for All RR Users ) as did Westnet ( see »www.slyck.com/story1510.html ). Whether or not one agrees with their actions, they were done in the open. If there were issues (and there definitely are), they could be reviewed and supported.

Generally, Comcast has been a good ISP. As someone who is a geek at heart, I have been happy at the level of unfettered internet access that I have received over many years. Unfortunately, in this situation, I must conclude that they are behaving badly.
--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
~ Keeper of the D-Link FAQ ~ Did you Search? ~ More features, Free! Join BBR! ~
reply
villain106 @ 18th Aug 02:55AM:
Re: Comcast is using Sandvine to manage P2P Connections

Sandvine boxes actually can help online game play services like XBOX Live. They can put a higher priority on the packet to lower latency and improve game play. This is one of features they provide although it might not be enabled.
reply
anon @ 18th Aug 07:12AM:
Re: Comcast is using Sandvine to manage P2P Connections

Could a program like utorrent potentially filter bad RST packets of said signature, or would this have to be done at the level of a hard firewall?
reply
Karl Bode @ 18th Aug 10:03AM:
Re: Comcast is using Sandvine to manage P2P Connections

quote:
Time Warner notified their customers ( see »[TWC] TW Officially Announces Packet Shaping for All RR Users )
Technically Time Warner Cable accidentally announced it in one market (apparently some kind of internal communications mistake), then boldly denied any plans were in place....
reply
Elderon @ 18th Aug 12:41PM:
Re: Comcast is using Sandvine to manage P2P Connections

This is a little disturbing. I'm not sure how the law would view the filtering they have put into place, since they don't know "what" the actual content being downloaded is.

However this is a very slippery slope. They are getting dangerously close to losing their "common carrier status" if they're not careful. I'm sure the RIAA and MPAA would love to add Comcast to their list of people to sue.
reply
hobgoblin @ 18th Aug 12:49PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by Elderon :

This is a little disturbing. I'm not sure how the law would view the filtering they have put into place, since they don't know "what" the actual content being downloaded is.

However this is a very slippery slope. They are getting dangerously close to losing their "common carrier status" if they're not careful. I'm sure the RIAA and MPAA would love to add Comcast to their list of people to sue.
The law?
Being sued by the RIAA?

Am I missing something here?

Hob
--
"A foolish consistency is the hobgoblin of little minds."
- Ralph Waldo Emerson

reply
Elderon @ 18th Aug 12:53PM:
Re: Comcast is using Sandvine to manage P2P Connections

I'm not sure how I was confusing.

as I said I'm NOT sure how it is viewed by the law ie the government USA...etc

when an ISP starts filtering content their common carrier status goes out the window and they are then liable for the content going across their network.

they are not technically there yet since they are working on the protocol and not on actual content, but that could be a possible next step, never know...

perhaps i'm just a little confused. lol :)
reply
hobgoblin @ 18th Aug 01:04PM:
Re: Comcast is using Sandvine to manage P2P Connections

Are there actually any laws that stop Companies doing what ever they want with the network they own and pay for?

I dont believe That Comcast are a "common carrier"
I was under the impression that if they were then their lines would be open to whoever wanted to use them. I recall a number of legal moves to force this Comcast eventually wining.

Hob
--
"A foolish consistency is the hobgoblin of little minds."
- Ralph Waldo Emerson

reply
Elderon @ 18th Aug 01:09PM:
Re: Comcast is using Sandvine to manage P2P Connections

common carrier applies to ALL ISP's at least in the US. It's what prevents them being sued for things such as allowing people to download music and movies or anything else even things such as kiddie porn. once they start filtering content they are liable for ALL content going through their network.

I'm not sure what the word is for opening lines to competitors but common carrier just means that they operate the pipe but don't know or care what goes through it.

but they prob haven't lost it yet since they are not filtering the actual content of the bit torrent.
reply
inferno3387 @ 18th Aug 01:09PM:
Re: Comcast is using Sandvine to manage P2P Connections

I am not having this problem yet. The last torrent I downloaded went 1 - 2 mbps. If it happens, I am just going to go to dsl, sick and tired of comcast right now...
reply
anon @ 18th Aug 01:16PM:
Re: Comcast is using Sandvine to manage P2P Connections

I'm also in northern Florida and while I experienced what I thought was throttling a couple of weeks ago, everything seems to be back to normal now, but only time will tell. I have been worried about this happening for a long time. :(
reply
Elderon @ 18th Aug 01:20PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by hobgoblin :

Are there actually any laws that stop Companies doing what ever they want with the network they own and pay for?
I'm not sure on this. I know they have peering arangements with other ISP's for internet traffic. If they went all willy nilly and did whatever they wanted it would probably affect other isp's as well. I'd have to read up on this one hehe
reply
elvey @ 18th Aug 02:38PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by NormanS :

I was heavily criticized for speaking of Comcast as a peer provider. Now I am criticized for hedging. I can't win for losing! :huh:
Well, it's quite complicated - peering and transit agreements and terminology are often not consistent. Sometimes carriers play 'chicken' with each other.
Example: »www.phoneplusmag.com/articles/33···er2.html .
It gives a definition of Peering and then says the definition is changing...

My point is that if you have eyeballs, you tend to have clout to not have to pay to receive traffic, especially if you have a nationwide or worldwide network.

But then some traffic sources often don't have to pay either, like google.
There's also a tendency that the bigger you get the less you pay per bit, to the point that the biggest guys get paid per bit, whether they're sending or receiving.

I think Comcast's only customers are its cable customers. So in the sense of providing transit to other ISPs, I don't think it does that.

Interesting traceroute I just did:
Shows AT&T's backbone being used to get from SF to Denver for a comcast in SF - comcast in Denver route!
This is atypical, I think.

--
SBC is the world's second-largest SpamHaus and leads an
Organized Crime Syndicate.
Also see TURN.org or UCAN.
reply
anon @ 18th Aug 03:27PM:
Re: Comcast is using Sandvine to manage P2P Connections

Just talked to a Comcast supervisor and he said there's nothing he or they can do about it because so many problems arise from P2P programs that they can't pinpoint it.

Also, he said that Comcast has a reason for everything they implement for the integrity of the network.
reply
funchords @ 18th Aug 04:02PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by Giro55 :

Just talked to a Comcast supervisor and he said there's nothing he or they can do about it...
And that's exactly the problem with this. That is why what Comcast is doing is not appropriate or reasonable. There is no support path.

Since the TorrentFreak article came out, there are several people reporting a total inability to upload using BitTorrent. I definitely do not have that problem, only a percentage of my BitTorrent connections are being RST-terminated. However, in my area, uploading via Gnutella is impossible, as 100% of those connections get 10053/Connection Reset by Peer.

Comcast support doesn't know anything about this part of their network operation. Other than the few techs on page 2 of this thread, Comcast has not acknowledged that they are doing this at all!

That's a problem.

Thank you for calling the Support Supervisor and confirming that part of my article.

PS: By the way --- since the TorrentFreak article came out, this article has been the busiest page on DSLReports/BBR. Check it out!

All topics and news with inbound traffic (counts are this week):

4068 »Comcast is using Sandvine to manage P2P Connections
1940 (news) »Botched Comcast Install Blows Up House
1788 »How to unlock Linksys SPA2102-R
1368 »[Hockey] New Ottawa Senators Logo
1212 »Convert your Earthlink Account to Embarq
1004 »/forums/all
...


--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
~ Keeper of the D-Link FAQ ~ Did you Search? ~ More features, Free! Join BBR! ~
reply
funchords @ 18th Aug 04:12PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by villain106 :

Sandvine boxes actually can help online game play services like XBOX Live. They can put a higher priority on the packet to lower latency and improve game play.
Exactly. And some of us (myself included) believe that type of prioritization is appropriate as long as it is reasonable and supportable. But others hold that the ISP should simply move all traffic, and not decide for its customers which traffic is important and which is not, and maintain a network capable of handling the load. That view is not an unreasonable one.
reply
funchords @ 18th Aug 04:25PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by Supra :

Could a program like utorrent potentially filter bad RST packets of said signature, or would this have to be done at the level of a hard firewall?
It could be done in software, but it would have to be done at a lower level than uTorrent presently uses.

I believe it could be done at the kernel level where PeerGuardian2 and software firewalls operate.

Even though they access the network stack at the right level, I do not know if there are any Windows software firewalls that have a user-configurable way to filter out the RST packets.

That said, this is just more "cat-and-mouse" between the users and the ISP admins. If the level of "P2P management" becomes unreasonable, there needs to be a way to register a complaint, look into the problem, and get it fixed. By keeping this a secret and not supporting it, Comcast is inviting "thwarts" and "kludges" which may ultimately harm their network.
reply
funchords @ 18th Aug 04:26PM:
Re: Comcast is using Sandvine to manage P2P Connections

Thanks Karl.
reply
funchords @ 18th Aug 05:23PM:
How to test how many connections are being reset by RST pack

Here is a quick-and-dirty way to determine whether, and how much, you are being affected by the P2P management that I described at the top of this thread.

1. Start your P2P application, wait about 15 minutes for full connectivity to be established.

2. In a Console window (Start, Run, CMD.EXE), type
netstat -s | find "Reset Connections"
and write down the number that you get in response.

3. Exactly one hour later, repeat Step 2. Subtract the first number from this latest number. The result is how many connections were terminated by a "RST" in the past hour.

If you have a VPN, or an access to a non-Comcast line, repeat the above process (as much as you can, try to match the conditions -- same applications, same uploads and downloads).

Now compare the two numbers. If you are being affected, the "Comcast" number will be an order of magnitude higher than the "non-Comcast" number.



The above result should be enough to show the effect, if it is there, as the difference is huge and undeniable. However, you can be more accurate by using the above process, but using this command and this math at the end of each test, instead:

netstat -s

Look for this output:

TCP Statistics for IPv4

Active Opens = 253461
Passive Opens = 131313
Failed Connection Attempts = 188271
Reset Connections = 12271

These numbers always accumulate (they don't go up and down). Record this output, and at the end of the test, subtract the numbers from the beginning of the test to get the number that applies to the duration of your test.

Now add "Active Opens" and "Passive Opens" and subtract "Failed Connection Attempts." The result will be the number of Successfully Established Connections.

Take the "Reset Connections" and divide that by the number of "Successfully Established Connections," and the result is the ratio of connections that were torn down by Resets.

If you don't have a non-Comcast account to use for comparison, you can use this result to compare with other users of your P2P application (to a degree), since it divides by the number of successful connections instead of by time.



If you know how to use a batch file, here is a batch file that simplifies this testing -- call it CheckRST.BAT:
The above file was written and tested using Windows XP SP2. Use CMD.EXE (which is installed by default in Windows XP), not COMMAND.COM, to run this batch file.

reply
anon @ 18th Aug 06:28PM:
Re: Comcast is using Sandvine to manage P2P Connections

Right now I am on comcast HSI Performance Plus: 8000 kbps / 768 kbps : $52.95 A mouth plan. Is there any news or information about comcast throttling P2P traffic shaping for their higher price tiers customers (Performance Plus or Blast tiers). In pass couple of weeks I have not notice any degradation of download or upload of speed. But as of today I am currently running utorrent 1.7.2 seeding the show 'Lab with Leo' #063. And everytime someone tries connects to me. After five seconds or so, the Connections drops.

If this weekend, Comcast of San Jose, Ca has roll out Sandvine solution to ruin the BT usability Experience for their paying consumers base. Certainly this is one Business decision that will to drive Comcast HSI users to Cancel their Net access for another provider.
reply
Scrod @ 18th Aug 07:38PM:
Re: Comcast is using Sandvine to manage P2P Connections

OK, wacky idea here.
As I understand it, this throttling is taking place when you are communicating with non-comcast peers.
Could one improve their BitTorrent performance by setting their client filter to only communicate with comcast.net peers?

Obviously this would greatly reduce the number of available peers, but at least it would eliminate the cycle of connect, disconnect, connect, disconnect.
reply
war59312 @ 18th Aug 08:23PM:
Re: Comcast is using Sandvine to manage P2P Connections

Nice script funchords...

So is this really bad?


I am using bittorrent - 21.4 kB/s (avg. 26.3 kB/s) and just browsing this post at the moment. Down to 7% now...

But it is a problem:

»[TWC] TW Officially Announces Packet Shaping for All RR Users

Perhaps they are doing something else then...

I should be getting over 900 kB/s on this torrent... Its a linux distro with over 2000 seeds and another 1000+ peers.

As in the thread above, torrents are not the only thing effected but newsgroups as well... Everything is being traffic shaped and it sucks big time!
reply
funchords @ 18th Aug 08:30PM:
Re: Comcast is using Sandvine to manage P2P Connections

Thanks!

For comparison, this is via my non-Comcast line:

54:20 - 66 out of 2430 connections reset (2%) [Ctrl-c quit]
54:30 - 66 out of 2434 connections reset (2%) [Ctrl-c quit]
54:40 - 66 out of 2454 connections reset (2%) [Ctrl-c quit]
54:50 - 66 out of 2475 connections reset (2%) [Ctrl-c quit]
55:00 - 67 out of 2475 connections reset (2%) [Ctrl-c quit]
55:10 - 67 out of 2487 connections reset (2%) [Ctrl-c quit]
55:20 - 67 out of 2494 connections reset (2%) [Ctrl-c quit]

Is 13% bad? It is compared to 2%. But really, probably not. It depends on what you're doing, if you're mostly downloading or not using P2P at this point, you're not going to be very affected anyway.

The technique Comcast is using is definitely not the typical way to employ traffic shaping. Comcast, more accurately, is employing "traffic deflection" by killing an unwanted (by them) connection in hopes that a better connection will take its place.
--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
~ Keeper of the D-Link FAQ ~ Did you Search? ~ More features, Free! Join BBR! ~
reply
BIGHUSKER @ 18th Aug 09:22PM:
Re: Comcast is using Sandvine to manage P2P Connections

Goodbye crapcast and hello DSL! After moving from Omaha to Minneapolis, I went from one of the best cable ISPs (Cox) to possibly the worst (Crapcast). I'm not putting up with this garbage any more. I was willing to tolerate the invisible "bandwidth caps" and the fact that my connection would drop out every once in a while, but this is too much. ISPs like comcast are setting broadband internet access back about 10 years with crap like this. They're not getting any more of my money for internet access!

It's too bad Cox doesn't have a presence in Minnesota. They're able to maintain their network infrastructure without resorting to restrictive crap like this. Even when Cox HSI was tied in with the medicore Excite@Home brand, it was still infinitely more reliable than comcast. If there is a worse cable ISP than comcast, then I'd be saddened to know of its existence.
reply
anon @ 18th Aug 09:51PM:
Re: Comcast is using Sandvine to manage P2P Connections

I'm playing World of Warcraft. I'm getting disconnected about once every 30 seconds. Is sandvine killing my connection because it thinks i'm using bit torrent or something like that?
reply
anon @ 18th Aug 10:11PM:
Re: Comcast is using Sandvine to manage P2P Connections

i've done that reset connections, net stats thing he lists above, and i've gotten 2 in the last like 5 minutes, of "reset connections", the only thing i'm running on my computer is WoW.
reply
anon @ 18th Aug 10:58PM:
Re: Comcast is using Sandvine to manage P2P Connections

Out of speculation, is it possible to block the IP that keeps rejecting the packets? Not sure but i think wireshark should be able to pick up the IP rejecting the packets. Perhaps one can use a home firewall, such as smoothwall, clarkconnect, etc to block that ip. When seeding a linux distro i noticed the same disconnects, damn comcast, can't wait for FIOS. I tried the well made batch file, and my average connections reset are from 7 - 9% within 10 minute range. I'm sure there will be a work-around for this soon other than the SSH solution, i give this a week. :D
reply
DaBears57 @ 18th Aug 11:08PM:
Re: Comcast is using Sandvine to manage P2P Connections

I ran it while uploading at full speed ~40KB/s in µtorrent and it was only 3%.
New Text Doc··· (2).txt 3,252 bytes
reply
anon @ 18th Aug 11:27PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by kandango :

Out of speculation, is it possible to block the IP that keeps rejecting the packets?
No. If you reread the OP, you'll see that the Sandvine application is forging the headers on the RST packets. You get a packet that looks like it came from the remote host, and they get one that looks like it came from you. There is no way to tell the difference between a real RST and a Sandvine-generated RST.

I personally have experienced this throttling in the last few days, but did not know what it was. The symptom I see is that peers drop me as a seed after about thirty seconds, even if I'm the only seed. Then after a few minutes they try again, only to drop again. I was wondering what kind of stupid client behavior this was, and I guess now I know.
reply
anon @ 18th Aug 11:46PM:
Re: Comcast is using Sandvine to manage P2P Connections

I think i found a temporary solution, a bit brute but it should work, got this from other forums. This SHOULD work on linux or linux based systems that have iptables.

iptables -A INPUT -p tcp --dport $YOURTORRENTPORT --tcp-flags RST RST -j DROP

should work, because it drops ALL RST packets indiscrimantely.

And this is for people who have have IPFW, Macs.

ipfw add deny tcp from any to any YOURTORRENTPORT in tcpflags rst
reply
war59312 @ 18th Aug 11:47PM:
Re: Comcast is using Sandvine to manage P2P Connections

So why not just drop all RST Packets then. lol That possible?

Or at least ones that match IP addresses from whatever client is in use..
--
GOD BLESS THE U.S.A
reply
jig @ 19th Aug 12:10AM:
Re: Comcast is using Sandvine to manage P2P Connections

that works on your end, but it still leaves the other end... though i'd be surprised if sandivine had coded a lot of rst's to be sent outside of the local network, since that costs their client $$. i know there's an argument that it saves them more than what they spend, i'm just sayin.
reply
rseiler @ 19th Aug 02:46AM:
Re: Comcast is using Sandvine to manage P2P Connections

said by funchords :

The technique Comcast is using is definitely not the typical way to employ traffic shaping. Comcast, more accurately, is employing "traffic deflection" by killing an unwanted (by them) connection in hopes that a better connection will take its place.
I don't think it's traffic shaping at all, since that falls in a different category in this Sandvine document. Stateful Policy Management seems to be what it is.
»www.sandvine.com/general/getfile···ILEID=16

said by BIGHUSKER :

Goodbye crapcast and hello DSL! After moving from Omaha to Minneapolis, I went from one of the best cable ISPs (Cox) to possibly the worst (Crapcast). I'm not putting up with this garbage any more. I was willing to tolerate the invisible "bandwidth caps"...
Wait a minute, doesn't Cox have VISIBLE usage caps that are enforced? As I recall, they're also significantly lower than the invisible caps some have reported exceeding with Comcast. Those caps seem to always be outrageously high to the point where you really have to be going overboard for an extended period of time to hit them.

Comcast may do a lot of things wrong and Cox a lot of things right, but I don't think this is one of them.
reply
anon @ 19th Aug 04:18AM:
Re: Comcast is using Sandvine to manage P2P Connections

iptables -A INPUT -p tcp --dport $YOURTORRENTPORT --tcp-flags RST RST -j DROP

Anyone try this out to see how well it works?

I think it actually does. I noticed for a short while my bt client wasn't uploading much data. I'd watch torrents and could see connections starting and then closing and couldn't figure out why. Then I looked into it and wound up here. All day BT has been 0-10KB/sec up.... tried using this iptables filter and since then my upload traffic is almost constant 44.9KB/sec according to rtorrent.

I didn't do any further testing so maybe things just happen and alot of comcast peers showed up for me to upload to.

Anyways about the topic in general... I have no problems with traffic shaping as long as its used for good.... but I don't exactly trust Comcast to do good. It would be nice is VoIP and game traffic was givin higher priority on networks and ftp/bt/p2p stuff in general was just given low priorty... not blocked though.

Traffic shapping can be used to make better use of available resources but it shouldn't be used as a substitution for proper network capacity.
reply
tdumaine @ 19th Aug 05:18AM:
Re: Comcast is using Sandvine to manage P2P Connections

Not a reply to anyone in particular, but...

If i forge a packet and send it out i'm a hacker and possibly a felon.

If comcast does it, it's acceptable.

Did i miss anything there?
reply
anon @ 19th Aug 06:33AM:
Re: Comcast is using Sandvine to manage P2P Connections

I too think it is a little questionable. Reminds me of how RIAA makes the claim that an IP address can be used to id a person... the two ideas cannot co-exist. Either IP can identify the sender and forging one would be illegal, or it cannot be used to identify.

Almost all ISPs have the following rule:
Forging of any TCP-IP packet header or any part of the header information in an email or a newsgroup posting.

Not sure if there is any law behind it.

This however might explain why the iptables command works under Linux, Comcast is only sending these RST packets to users on its own network. It is not sending these forged IP packets onto anyone else's networks. If an RST packet was sent to both sides of the connection then the iptables command would not be working.
reply
TSOnsite @ 19th Aug 09:19AM:
Re: Comcast is using Sandvine to manage P2P Connections

said by bexxxxx :

iptables -A INPUT -p tcp --dport $YOURTORRENTPORT --tcp-flags RST RST -j DROP

Anyone try this out to see how well it works?

I just tried this on a torrent that was running. Prior to issuing this command, my upload rate was in the 20s. After running this, my upload rate shot up to around 90 kB/s and has remained there.
reply
mrweirdo @ 19th Aug 10:52AM:
Re: Comcast is using Sandvine to manage P2P Connections

hrm weird I have done the same thing on my linux server which functions as my lans nat router and it works only for about a minute or so then I loose my upload rate untill it goes to 0. I'm wondering if you have to do the firewall rule on the box you are runing the client on. I'm using azureus on a mac over my lan btw.
reply
gwbuffalo @ 19th Aug 01:34PM:
Re: Comcast is using Sandvine to manage P2P Connections

Same here, it doesn't appear to have any effect putting the iptables line into the firewall of DD-WRT.
reply
DslHunter @ 19th Aug 02:14PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by Name_is_taken :

If you reread the OP, you'll see that the Sandvine application is forging the headers on the RST packets. You get a packet that looks like it came from the remote host, and they get one that looks like it came from you. There is no way to tell the difference between a real RST and a Sandvine-generated RST.
Is that digital fraud?
reply
ztmike @ 19th Aug 04:34PM:
Re: Comcast is using Sandvine to manage P2P Connections

I haven't read the hole thread here but, I'm I the only one that can upload to full speed of my lozy 384?
reply
anon @ 19th Aug 05:45PM:
Re: Comcast is using Sandvine to manage P2P Connections

iptables -A INPUT -p tcp --dport $YOURTORRENTPORT --tcp-flags RST RST -j DROP

^^^^^^

Anyway to use that at all if I'm not running Mac or Linux?
I'm on Vista and having a lot of trouble seeding my torrents. :/

Can I do something in cmd or ANYTHING to get around this?
reply
alucard_x @ 19th Aug 06:14PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by Giro55 :

iptables -A INPUT -p tcp --dport $YOURTORRENTPORT --tcp-flags RST RST -j DROP

^^^^^^

Anyway to use that at all if I'm not running Mac or Linux?
I'm on Vista and having a lot of trouble seeding my torrents. :/

Can I do something in cmd or ANYTHING to get around this?
same here..
reply
gwbuffalo @ 19th Aug 07:49PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by Giro55 :

iptables -A INPUT -p tcp --dport $YOURTORRENTPORT --tcp-flags RST RST -j DROP

^^^^^^
Can I do something in cmd or ANYTHING to get around this?
That doesn't appear to do anything. If anyone has had success with it I'd love to hear about it.
--
Alt-This -- My Tech Podcast
reply
anon @ 19th Aug 08:02PM:
Re: Comcast is using Sandvine to manage P2P Connections

I think the real issue at hand is the COMPLETELY IGNORANT ASSUMPTION that all P2P sharing involves something illegal (warez, etc.) or violates some copyright and thus is unjustified traffic. This is obviously not true to those of us that don't have their heads in their anuses, which apparently does not include Comcast. The fact is that allow such traffic can actually save upload bandwidth when multiple peers are available for the same file and downloading shouldn't make a difference, 700MB is 700MB as far as that's concerned.
reply
mrweirdo @ 19th Aug 08:26PM:
Re: Comcast is using Sandvine to manage P2P Connections

Yeah I don't think it works anymore or maybe Comcast has gotten light of that workaround and found another method. I saw a report on digg claiming that in some areas besides just the RST packets they were doing something else as well. I believe they probably are rolling that out nationwide to make it full proof after having done the RST thing.

I for one am not happy about this and if nothing is done within the next by comcast month will be looking into dsl/fiber from surewest. First adds on their cable box guides and now this. Its time to give comcast the boot with their shady practices of late.
reply
EG @ 19th Aug 08:42PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by bblover :

I think the real issue at hand is the COMPLETELY IGNORANT ASSUMPTION that all P2P sharing involves something illegal (warez, etc.) or violates some copyright and thus is unjustified traffic.
I don't believe this was done based on legality issues.

I believe this was done for bandwidth management/consumption reasons..
--
Let us never forget 9/11
reply
gwbuffalo @ 19th Aug 08:58PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by EG :

I believe this was done for bandwidth management/consumption reasons..
I agree with you. I'm actually considering a DSL line now just for trading live and legal music torrents. The real bitch of this matter is Comcast isn't telling it's customers what it's doing and that's just bad business.

If it's just about bandwidth then why don't they limit P2P bandwidth and not disrupt the connections? Again, piss poor customer service.
--
Alt-This -- My Tech Podcast
reply
alucard_x @ 19th Aug 09:02PM:
Re: Comcast is using Sandvine to manage P2P Connections

when i run the script i get

Divide by zero error.
0:10 - 0 out of 0 connections reset (%) [Ctrl-c quit]
Divide by zero error.
0:20 - 0 out of 0 connections reset (%) [Ctrl-c quit]

the entire time..
reply
anon @ 20th Aug 07:17AM:
Re: Comcast is using Sandvine to manage P2P Connections

I use Comcast in Muncie, In - home of Ball State Univ, and they closed the p2p door about the time the students started returning. School starts today I believe. They might be throttling due to the influx of users they are expecting.

Using EG's script - They are closing around 23% of my connections....

0:10 - 4 out of 12 connections reset (33%) [Ctrl-c quit]
1:00 - 20 out of 42 connections reset (47%) [Ctrl-c quit]
2:00 - 25 out of 83 connections reset (30%) [Ctrl-c quit]
3:00 - 36 out of 121 connections reset (29%) [Ctrl-c quit]
4:00 - 45 out of 158 connections reset (28%) [Ctrl-c quit]
5:00 - 56 out of 210 connections reset (26%) [Ctrl-c quit]
6:00 - 61 out of 242 connections reset (25%) [Ctrl-c quit]
7:00 - 67 out of 282 connections reset (23%) [Ctrl-c quit]
8:00 - 72 out of 318 connections reset (22%) [Ctrl-c quit]

I'm calling tech support today to see what they have to say.
reply
hobgoblin @ 20th Aug 07:23AM:
Re: Comcast is using Sandvine to manage P2P Connections

said by Comcast User :

I'm calling tech support today to see what they have to say.
What do you expect them to say?

Probably that they don't support 3rd party applications the use of which is sucking the life out of a network.

Hob
--
"A foolish consistency is the hobgoblin of little minds."
- Ralph Waldo Emerson

reply
MemphisPCGuy @ 20th Aug 08:37AM:
Re: Comcast is using Sandvine to manage P2P Connections

I suppose one way to show your appreciation for Sandvine is for everyone with the 8Mb Tier to drop back to the 6Mb tier, specifying Sandvine as the reason.

Also, I find it hard to believe Sandvine cannot be adjusted to allow things like World of Warcraft Patches to flow unimpeded... has there been a patch thats affected at this point?

While I do not use a P2P client, some applications do use it for updates etc. My real concenr is the use of both invisible caps AND now sandvine to limit my use of the network. One or the other seems fair, both seems rather draconian.

Also, did anyone else experience less than stellar downloads on newsgroups starting last night or is it just my over active imagination :)
--
»www.memphispcguy.com
reply
anon @ 20th Aug 09:17AM:
Re: Comcast is using Sandvine to manage P2P Connections

Actually, they said I have a weak signal and are sending a Tech out to fix the problem. He said he was getting all the packets back, but the weak signal would cause resets.

I also talked to the "chat" support online @ Comcast.net and he said the same thing, who knows maybe they are right?

I told him about the Reset Connection problem and that I was using Bit Torrent P2P to share Linux and Firefox nightlies (Yes, that's really what I'm doing). He said the only thing they were cracking down on was "Spammers", but I doubt he would blurt out "Yes, we're throttling BT traffic, so there!"

I will wait to see if anything changes, next Monday after the repair tech looks for the problem. They could have gotten here sooner, but I'm not missing work for an upload problem.
reply
MemphisPCGuy @ 20th Aug 09:35AM:
Re: Comcast is using Sandvine to manage P2P Connections

said by Comcast User :

Actually, they said I have a weak signal and are sending a Tech out to fix the problem. He said he was getting all the packets back, but the weak signal would cause resets.
As you mentioned P2P they are probably really just coming out to get thier modem back from you! LOL

Post your modem numbers and lets see :)
--
»www.memphispcguy.com
reply
funchords @ 20th Aug 10:24AM:
Re: Comcast is using Sandvine to manage P2P Connections

Thanks for trying the test script at

»How to test how many connections are being reset by RST pack

said by alucard_x :

when i run the script i get

Divide by zero error.
0:10 - 0 out of 0 connections reset (%) [Ctrl-c quit]
Divide by zero error.
0:20 - 0 out of 0 connections reset (%) [Ctrl-c quit]

the entire time..
Do you get any error messages before that?

Are you using Windows XP? Are you using COMMAND.COM or CMD.EXE?

This was written using CMD.EXE and Windows XP.

If you are using something different, there might be issues.
reply
funchords @ 20th Aug 10:29AM:
Re: Comcast is using Sandvine to manage P2P Connections

said by Comcast User :

He said he was getting all the packets back, but the weak signal would cause resets.
True, but only under two conditions:
1. Your modem signal was so weak that you were losing your WAN connection
2. Your signal was weak enough that your TCP connections were routinely timing out.

In either case above, I think you'd be finding it hard to use DSLReports, and given the numbers you showed, 1/3rd or so of your web surfing would result in pages that were unable to load.
reply
da sponge @ 20th Aug 10:56AM:
Re: Comcast is using Sandvine to manage P2P Connections

Weak signal is not causing my issue. I've confirmed the RST behavior in Philadelphia w/ uTorrent. As expected, uTorrent protocol encryption has no effect.

Tunneling the traffic through a VPN works brilliantly though.
reply
anon @ 20th Aug 10:57AM:
Re: Comcast is using Sandvine to manage P2P Connections

This is what the modem says...
Downstream ----------------- Value
Frequency ------------------- 549000000 Hz Locked
Signal to Noise Ratio -------- 35 dB
Power Level ----------------- 5 dBmV
The Downstream Power Level reading is a snapshot taken at the time this page was requested. Please Reload/Refresh this Page for a new reading

Upstream -------------------- Value
Channel ID ------------------ 4
Frequency ------------------- 22000000 Hz Ranged
Power Level ----------------- 53 dBmV
reply
MemphisPCGuy @ 20th Aug 11:03AM:
Re: Comcast is using Sandvine to manage P2P Connections

Indeed your Upstream Power level of 53dBmv is on the threshold of failure and a truck roll is warranted. Per the FAQ »/faq/7124
reply
anon @ 20th Aug 11:27AM:
Re: Comcast is using Sandvine to manage P2P Connections

Yes, I found that faq after I posted, thanks.

That said I ran EG's script WITHOUT utorrent running (sorry to all the PCLinuxOS people downloading) and I got this -

results will begin to be reported shortly,
please wait or use Ctrl-c to quit...

0:10 - 0 out of 0 connections reset (%) [Ctrl-c quit]
0:40 - 0 out of 5 connections reset (0%) [Ctrl-c quit]
0:50 - 3 out of 16 connections reset (18%) [Ctrl-c quit]
5:00 - 5 out of 64 connections reset (7%) [Ctrl-c quit]
9:10 - 8 out of 276 connections reset (2%) [Ctrl-c quit]
9:20 - 20 out of 276 connections reset (7%) [Ctrl-c quit]
19:50 - 20 out of 295 connections reset (6%) [Ctrl-c quit]

9:20 was when I got here, before that I opened every tab on Firefox I had, in every folder and viewed every booked makred page I had starting @ 0:00.

It certainly seems like something else is going on, 6% without and 33% with utorrent. Could that just be the strain the p2p traffic is causing?
reply
anon @ 20th Aug 11:29AM:
Re: Comcast is using Sandvine to manage P2P Connections

Sorry for the constanst post but I forgot to show these. Just to give you an idea of my connection.



reply
alalper @ 20th Aug 11:33AM:
Re: Comcast is using Sandvine to manage P2P Connections

I'm having no problem with Utorrent in Philly. 8/768 tier with uploads set to 60KB. Seeding at 60KB.
reply
ztmike @ 20th Aug 01:25PM:
Re: Comcast is using Sandvine to manage P2P Connections

Maybe its just in select areas? That their cracking down on upload speed, I live in Indiana but i get my connection from Chicago..so I guess Chicago is not being affected by this, "Sandvine."
reply
anon @ 20th Aug 01:48PM:
Re: Comcast is using Sandvine to manage P2P Connections

Seeing it here in Denver, Colorado. blocking RST packets has no effect.
reply
da sponge @ 20th Aug 01:55PM:
Re: Comcast is using Sandvine to manage P2P Connections

someone should set up a tracker for people who are blocking RSTs and see if blocking them on both ends does the trick (it should).
reply
Vampyre @ 20th Aug 02:30PM:
Re: Comcast is using Sandvine to manage P2P Connections

I am in Indiana, and I"m seeing nothing of this....
reply
anon @ 20th Aug 03:36PM:
Re: Comcast is using Sandvine to manage P2P Connections

I added the RST drops on my ipCop firewall (linux based) and it worked. Had to add them to my port forwarding rules.
reply
funchords @ 20th Aug 06:03PM:
Re: Comcast is using Sandvine to manage P2P Connections

That appeared to work for me, too, except look at your log entries. Notice that the IPs that sent the dropped RSTs are not sending you any data.

See »Re: Comcast is using Sandvine to manage P2P Connections
reply
alucard_x @ 20th Aug 06:45PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by funchords :

Thanks for trying the test script at

»How to test how many connections are being reset by RST pack

said by alucard_x :

when i run the script i get

Divide by zero error.
0:10 - 0 out of 0 connections reset (%) [Ctrl-c quit]
Divide by zero error.
0:20 - 0 out of 0 connections reset (%) [Ctrl-c quit]

the entire time..
Do you get any error messages before that?

Are you using Windows XP? Are you using COMMAND.COM or CMD.EXE?

This was written using CMD.EXE and Windows XP.

If you are using something different, there might be issues.
I'm using Vista. I looked over the .BAT and couldn't find anything that shouldn't work. obviously one of the variables isn't registering.

Also, I'm not seeing any errors before the script runs.
reply
digitel @ 20th Aug 06:52PM:
Re: Comcast is using Sandvine to manage P2P Connections

Seeding in Denver no issues so far.
reply
anon @ 20th Aug 07:27PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by funchords :

- The interruption is accomplished by sending a perfectly forged TCP packet (correct peer, port, and sequence numbering) with the RST (reset) flag set. This packet is obeyed by the network stack or operating system which drops the connection.

I read the whole thread...

IMHO the best short term way to work around this is to not drop but to re forge it with the RST flag not set. Since you should be using a dedicated port for just bittorrent it should be easy enough to packet sniff and un set the RST flag on all packets going to that port. Now some legit RST will be changed but my guess if you look at the streams you should be able to tell which ones should not be re forged and which ones should and if not oh well they will timeout sooner or later but at least you get and stay connected until a legit timeout.
reply
alucard_x @ 20th Aug 07:39PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by DrCable :

said by funchords :

- The interruption is accomplished by sending a perfectly forged TCP packet (correct peer, port, and sequence numbering) with the RST (reset) flag set. This packet is obeyed by the network stack or operating system which drops the connection.

I read the whole thread...

IMHO the best short term way to work around this is to not drop but to re forge it with the RST flag not set. Since you should be using a dedicated port for just bittorrent it should be easy enough to packet sniff and un set the RST flag on all packets going to that port. Now some legit RST will be changed but my guess if you look at the streams you should be able to tell which ones should not be re forged and which ones should and if not oh well they will timeout sooner or later but at least you get and stay connected until a legit timeout.
i believe someone earlier in the thread noted how these RST packets had a reserved bit set that isn't usually used. perhaps this could be used?

this is a good idea, now the smart people just need to step up and try it out. :)
reply
anon @ 20th Aug 07:43PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by funchords :

That appeared to work for me, too, except look at your log entries. Notice that the IPs that sent the dropped RSTs are not sending you any data.

See »Re: Comcast is using Sandvine to manage P2P Connections
well of course because those peers fully expect you to reply but you are not going to since you dropping the packet out right.

don't drop/deny the packet. un set the RST flag or find a way to ignore the RST flag so you can use the data in that packet to connect to that peer so they know you are there and will send you data.
reply
anon @ 20th Aug 07:53PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by alucard_xi believe someone earlier in the thread noted how these RST packets had a reserved bit set that isn't usually used. perhaps this could be used?

this is a good idea, now the smart people just need to step up and try it out. :)
[/BQUOTE :

if it is always set and only set in comcast forged packets then yeah it would super easy to spot and re forge only the packets that need to be reforged

legit RST's would get through then which would be great.

however, you could never count on that and comcast could change it easy also to be random etc... It makes be wonder what affect that bit has on all this. It may be just a simple way for comcast to quickly identify forged packets which then their routers would mark as low priority packets.
reply
funchords @ 20th Aug 08:03PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by DrCable :

Since you should be using a dedicated port for just bittorrent
True for incoming connections, not for outgoing.
reply
EG @ 20th Aug 08:17PM:
Re: Comcast is using Sandvine to manage P2P Connections

Resistance may be futile.

I would think that the Sandvine engineering team is doing its homework....
--
Let us never forget 9/11
reply
dfxmatt @ 21st Aug 03:47AM:
Re: Comcast is using Sandvine to manage P2P Connections

I would like to know really. Can someone give me an email address to send an ethereal capture about 2mins long of attempted seeding (100% disconnects) to? I can't tell if comcast is resetting. What do I filter/ what do I specifically look for in these continual RST flags to determine if this is comcast's doing? (I'm on comcast and somewhat new to ethereal).

To explain, I don't know enough about networking so for me it is speculative, so I was wondering if someone could analyze these results (I do however know how to make ethereal listen to my port, just not what to filter/etc). And I don't want to assume improperly. So can someone explain these results and show me if they are the type that the OP was referencing?

I got a very aggressive technician when I called about this issue over the phone. I asked him how I was getting a reset flag about the issue and then he goes on saying how comcast can't be doing the resets and I provide him a comcast IP and he basically refuses to say anything. (I recorded the conversation; I will turn it into mp3s and add it)

I don't like it if comcast is preventing me from sharing a legitimate file with friends (A Japanese anime series that is not licensed in the US is fair game/legit sharing as far as I knew)
resets 337,267 bytes
This was the log		test 1,356,494 bytes
2nd test with pingable lniksys router
reply
NormanS @ 21st Aug 05:04AM:
Re: Comcast is using Sandvine to manage P2P Connections

said by dfxmatt :

I don't like it if comcast is preventing me from sharing a legitimate file with friends (A Japanese anime series that is not licensed in the US is fair game/legit sharing as far as I knew)
I suspect it has less to do with the legitimacy of the files (and anime is protected by copyright law; if the Japanese companies owning the rights want to stop distribution through P2P channels, they have every right to), and more to do with "quality of service" for all Comcast users.
--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum
reply
anon @ 21st Aug 06:25AM:
Re: Comcast is using Sandvine to manage P2P Connections

said by funchords :

said by DrCable :

Since you should be using a dedicated port for just bittorrent
True for incoming connections, not for outgoing.
no true for both. All in and out are on the same port
if you use a decent client. All my torrent traffic
both in and out is all on the same port because Azureus
allows you to set it that way. it would be silly not
to use just 1 port when you do not have to.
reply
anon @ 21st Aug 06:37AM:
Re: Comcast is using Sandvine to manage P2P Connections

said by funchords :

said by DrCable :

Since you should be using a dedicated port for just bittorrent
True for incoming connections, not for outgoing.
BTW it is moot on out going since the packet will be forged by comcast before it reaches the peer. so no matter what and even with crappy clients you only need to sniff and re forge incoming traffic. it will be up to the others to sniff and re forge THEIR incoming traffic.
reply
anon @ 21st Aug 07:02AM:
Re: Comcast is using Sandvine to manage P2P Connections

Everyone a HUGE part of this is if comcast is forging packets that are heading outside comcast net. I can see comcast doing it to all torrent packets coming in to you and all out going packets headed to other comcast users but doing it to packets headed outside comcast net is asking for trouble.

it would be very bad if they did since many ISP's world wide claim to be p2p friendly and I doubt they would look kindly to comcast sending sabotaged packets to their customers and then having to spend time and money explaining to their customers why things are fubar.

time will tell huh :D
reply
dfxmatt @ 21st Aug 08:17AM:
Re: Comcast is using Sandvine to manage P2P Connections

I will consider releasing the recorded conversation to the local news and see if they bite.

I agree with Dr. in that what they are doing is not only a big deal in terms of net neutrality (not getting what we paid for), and also in terms of we never received a communication stating "we will not allow you to share files on torrent applications". Yes they have the whole speech about how they can modify things at any time but if they don't notify you = not allowed. There was a lawsuit in regards to this: »blogs.techrepublic.com.com/tech-news/?p=940 . This was not a new lawsuit. Says just because the contract is online doesn't mean that you can make changes without notification.

So tell me, when did you all receive a letter about torrent throttling? :)
reply
AthlGrond @ 21st Aug 10:29AM:
Re: Comcast is using Sandvine to manage P2P Connections

A customer signed an agreement with AOL; AOL then sold its telephone services, then the new company changed terms without customer consent, or even notice, to hike prices, force arbitration, and bar class actions.
I'm going to guess that Comcast will see pricing changes and terms are different from blocking ports or throttling specific kinds of traffic when it comes to informing consumers. (Especially when you aren't bound to a long term contract in the latter case but are in the former.)
--
"It's like a Zen koan - if you say something stupid, and no one is there to hear it, are you still an idiot?" -Mike Krahulik
reply
anon @ 21st Aug 11:36AM:
Re: Comcast is using Sandvine to manage P2P Connections

said by EG :

Resistance may be futile.
“the Internet interprets censorship as damage and routes around it.” John Gilmore, Co-founder, EFF Circa 1990

China may well disprove this, but ISPs are hardly China.

-Greg
reply
EG @ 21st Aug 11:50AM:
Re: Comcast is using Sandvine to manage P2P Connections

[disclaimer]

"May be"

[/disclaimer]

;) :D
--
Let us never forget 9/11
reply
NormanS @ 21st Aug 11:52AM:
Re: Comcast is using Sandvine to manage P2P Connections

said by DrCable :

All in and out are on the same port
if you use a decent client.
Are you sure?
The first three "KOZUE" lines are outbound connections, the last an inbound connection for a current "Torrent" I am in. Using BitTornado. You would only ever be able to make a single connection out if you only used one port for the outbound connection.

BTW, I wonder what download speed that Comcast peer seems to be having trouble with this torrent, if I am read was seeing before he got to 100% complete. I am only at 20% complete, yet his upload appears to be choked. See the screen shot.

--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum
Click for full size
Torrent peers.
reply
dfxmatt @ 21st Aug 12:03PM:
Re: Comcast is using Sandvine to manage P2P Connections

I was able to seed the people that I was downloading from before it finished, once it finished it would send a RST ACK to anyone I connected to after about 8 seconds
reply
funchords @ 21st Aug 12:20PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by funchords :

WHERE: On the boundaries, at the point where Comcast connects to other points of the Internet,
I'm going to have to modify this, as I'm now seeing RSTs being forged on paths that never leave Comcast.net space.

Comcast techies -- can you help me understand why? Also, is there a decoder ring for the prefixes "GE," "TE," "PO," and etc.?


--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
Are you affected by Comcast's RST forging? How to test it! -or- Read my original report.
reply
funchords @ 21st Aug 12:23PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by DrCable :

well of course because those peers fully expect you to reply but you are not going to since you dropping the packet out right.

don't drop/deny the packet. un set the RST flag or find a way to ignore the RST flag so you can use the data in that packet to connect to that peer so they know you are there and will send you data.
You might be absolutely right about that. I haven't tried that approach.

(PS: I think this exercise is entertaining, but ultimately the solution is to get Comcast to implement this correctly AND support it, or remove it altogether.)
reply
Karl Bode @ 21st Aug 12:24PM:
Re: Comcast is using Sandvine to manage P2P Connections

I think you'll need to get them to acknowledge it actually exists, first.

I've yet to get an official comment confirming these measures in any markets.
reply
EG @ 21st Aug 12:47PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by funchords :

Comcast techies -- can you help me understand why? Also, is there a decoder ring for the prefixes "GE," "TE," "PO," and etc.?
ge = gigabit ethernet.

te = ten gigabit ethernet.

p, po, pos = Packet Over Sonet (an OC-3 or faster connection).

1-1, 1-2, 1-11, 6-1, 9-1, 2-2, etc. = slot and port.

ar01, cr01, ur01 = probably a router name ?
--
Let us never forget 9/11
reply
funchords @ 21st Aug 01:07PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by dfxmatt :

I can't tell if comcast is resetting. What do I filter/ what do I specifically look for in these continual RST flags to determine if this is comcast's doing? (I'm on comcast and somewhat new to ethereal).
I looked at your 2-minute log "resets" (which the attached file is actually resets.zip and the capture file is inside) and only found two that might have been suspicious: they were entries #602 and #1050. However, it's hard to tell whether the connection was healthy as it appears there were some dropped packets. Applying the filters I suggest below should help keep the number of dropped packets down.

I'm a little worried about your configuration, because your local IP address (192.168.1.100) is also the IP address often used by cable modems. It may be fine, but it caught me by surprise.

For your capture filter, just use "tcp" and check "Limit each packet to 768 bytes (just enough to be able to tell what is going on)." Then start capturing.

For your display filter, you can leave it blank if your computer is fast enough (black lines with red letters usually means the data is coming faster than can be captured and you are dropping data). Colorize Packet List is on by default, and RST packets are red with yellow letters. Or, you can use the Conversation Filter "tcp.flags.reset == 1" which will only show the RST packets. When you see a suspicious one, right click on it and choose "Follow TCP stream" and a new Conversation Filter is created that allows you to see it. Click on the drop-down next to the conversation filter to go back to your previous conversation filter (if any) and click Apply, or just press Clear for no filter.

RSTs with a Seq=0 are usually legit. RSTs with a Seq= of something else means that you should investigate further (look at the conversation, what happened just before).

Unfortunately, I couldn't open "test" neither as a zip or as a capture file. But hopefully, this is enough info to get you going.
--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
Are you affected by Comcast's RST forging? How to test it! -or- Read my original report.
reply
funchords @ 21st Aug 01:13PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by Karl Bode :

I think you'll need to get them to acknowledge it actually exists, first.

I've yet to get an official comment confirming these measures in any markets.
I don't think they'll officially acknowledge anything (consider the ongoing invisible caps saga). But we do have some members "in the know" that have said so:

Seen HERE on page 2...
said by Qumahlin :

said by comtec5 :

we do indeed use sanvines on each cmts
While you are correct that sandvine is in use and has been for quite some time, it is not used "on" a CMTS. Sandvine works hand in hand with the PacketCable protocol and acts as an application gateway.

This thread is going to garner hate towards sandvine because everyone is basing one users experiences to how things will always work and assuming Sandvine is something installed specifically to block/throttle p2p...that is not the case as there FAR CHEAPER solutions to that issue, many already built into current CMTS's which would negate the need of ever having a Sandvine box and policy server.

Sandvine is an integral application used by quite a few providers that HELPS with bandwidth for P2P, gaming, VOIP, etc. Are there cases where it will cause you to get lower P2P speeds, yes, but there are also cases where it will help with your general latency and will IMPROVE your p2p download speeds.

Sandvine even has a profile for Xbox Live clients (whether this is in use widespread is not known to me, but I know it was used at one point in my area)

Sandvines use at Comcast is not primarily as a P2P blocker, anyone who tells you that is lying or uninformed.

--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
Are you affected by Comcast's RST forging? How to test it! -or- Read my original report.
reply
dfxmatt @ 21st Aug 02:05PM:
Re: Comcast is using Sandvine to manage P2P Connections

Thanks func, I'm just starting to get into this stuff....I still can't figure out why it kept dropping every person I was trying to seed to. I wasn't sure if it was just someone getting the piece of the torrent intended or just getting kicked off.

I have a new log from today where the same situation appeared to occur (people would get kicked/dc after grabbing 1 piece of the torrent if even that much)...I seeded for almost 10mins and had about 50 people try to connect and all disconnect.

Anyway, with the TCP filter and the packetsize one, here is the new log. Anything different? This time I was wired straight to cable modem, no router.

Also how do I export a log from ethereal into some more-usable format? when I define a file beforehand it seems to come with these filetypes and the export command tells me the file doesn't exist (do I need to export into a blank zip or something?)
reply
funchords @ 21st Aug 02:38PM:
Re: Comcast is using Sandvine to manage P2P Connections

It's been over 3 months since my original post, so I decided to see if the numbers or behaviors had changed.

The numbers did not change, much. In May, 39% of my BitTorrent connections were killed by the RST flag, but I was still able to seed a torrent at my preferred speed (16 KB/s). Today that number is 46% killed, and still able to seed a torrent at my preset upload limit speed (16 KB/s).

What did change is the behavior toward BitTorrent's standard DHE encrypted connections: Surprisingly, none were dropped! It was only yesterday or the day before that I noted encrypted connections were still being killed by RST, so this is new behavior for me. This could be due to policy parameters such as time-of-day, level of global or individual use, or localized adjustments -- so your milage may vary.

The test method:
1. Start a BitTorrent client performing an upload (seeding) to an established swarm.
2. Wait 5 minutes to allow connections and speeds to stabilize.
3. Record the starting number of connections and resets reported by "netstat -s" or start the batch file (see »How to test how many connections are being reset by RST pack for details).
4. Wait 5 minutes.
5. Record the ending number of connections and resets, and determine the amount that took place during the test (or obtain the numbers from the batch file).

I used the above method on the same small (25-30 peer, 4 seed) swarm, using uTorrent 1.7.2.

No encryption ...                      34 out of 73 reset (46%)
Encryption enabled (with fallback) ...  5 out of 20 reset (25%)
Encryption forced (no fallback) ...     0 out of 17 reset ( 0%)

reply
funchords @ 21st Aug 03:23PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by dfxmatt :

Anyway, with the TCP filter and the packetsize one, here is the new log. Anything different? This time I was wired straight to cable modem, no router.
Something is wrong. Your output is full of duplicate ACKs and just lots of evidence that you and your peers are having trouble with the TCP/IP protocol.

While I see a lot of RSTs, most of them follow a TCP conversation that was clearly falling apart. These are likely legitimate RSTs.

Maybe you are saturating your upload? Try setting your upload speed limit to 20 KB/s.

said by dfxmatt :

Also how do I export a log from ethereal into some more-usable format? when I define a file beforehand it seems to come with these filetypes and the export command tells me the file doesn't exist (do I need to export into a blank zip or something?)
I am using Wireshark, which is the new name for Etheral. You may want to see if your version is out of date.

On Wireshark, File - Export - File... allows you to choose TXT, CSV, etc..
--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
Are you affected by Comcast's RST forging? How to test it! -or- Read my original report.
reply
funchords @ 21st Aug 04:43PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by NormanS :

BTW, I wonder what download speed that Comcast peer seems to be having trouble with this torrent, if I am read was seeing before he got to 100% complete. I am only at 20% complete, yet his upload appears to be choked. See the screen shot.
For most clients, that's normal. Most BitTorrent clients usually only unchoke 3-5 clients in their peer list at a time in order to keep the upload speed reasonable to each one. One exception is BitComet, which unchokes the majority of peers in its peer list, but might only upload at 0.5 KB/s to each.

The Download Rate column that you have circled means something else entirely. Basically, that is a rough calculation of how fast THEY are downloading (not uploading) based on the rate they report receiving new pieces to share. Since a seeder already has all the pieces, he never reports having new ones and so the rate is always 0.
reply
Karl Bode @ 21st Aug 05:51PM:
Re: Comcast is using Sandvine to manage P2P Connections

First public denial that I've seen (and I've been trying to get a confirmation or denial for much of the week):
»www.lightreading.com/document.as···d=132115

quote:
"We're not blocking access to any application, and we don't throttle any traffic," says Charlie Douglas, a Comcast spokesman.

Douglas didn't explicitly deny the use of deep packet inspection or traffic shaping products. "[Comcast] has a responsibility to manage our network to ensure our customers have the best service, and we use available technologies to do so."
Semantics I'm guessing. But this month I've seen other companies boldly lie about using traffic shaping, so who knows.
reply
funchords @ 21st Aug 07:24PM:
Re: Comcast is using Sandvine to manage P2P Connections

"We're not blocking access to any application, and we don't throttle any traffic," says Charlie Douglas, a Comcast spokesman


Both are true. BitTorrent isn't blocked, but some percentage of peer connections are being interrupted. It's not throttling, in the common way. Until this morning's Comcast-to-Comcast connection got reset (which may have been a fluke), I would say that it is more selective than that.

The Sandvine sales pitch to ISPs is that it's P2P product deflects or reroutes P2P traffic from more costly and congested routes to those less so, while preserving the customer experience. This behavior fits that description, except that there are problems that need to be addressed.
--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
Are you affected by Comcast's RST forging? How to test it! -or- Read my original report.

PS: Karl, I just read your latest article. You covered my points quite well (even before I made them). :)
reply
Karl Bode @ 21st Aug 07:28PM:
Re: Comcast is using Sandvine to manage P2P Connections

quote:
Both are true. BitTorrent isn't blocked, but some percentage of peer connections are being interrupted. It's not throttling, in the common way. Until this morning's Comcast-to-Comcast connection got reset (which may have been a fluke), I would say that it is more selective than that


Yes, as noted, he's playing semantics and picking his words carefully. Note he doesn't deny that the company is limiting the ability of some users to seed fully. This is something RCN implemented but was far more forthcoming about. The CEO even stopped by our forums to discuss it in full.

See our front page report
reply
funchords @ 21st Aug 07:33PM:
Re: Comcast is using Sandvine to manage P2P Connections

I just read it. Great job!
reply
pokesph @ 21st Aug 07:57PM:
Re: Comcast is using Sandvine to manage P2P Connections

did a test the other day.. watched the packets as i had a friend d/l a file from me using BT.. interesting results.. (BT uses port 61194 and this was a 2 min capture on a rather small torrent file.. just to see what would happen.)
Click for full size
screenshot of the 2 min packet capture BT test (one reset frame highlighted)
reply
anon @ 21st Aug 10:58PM:
Re: Comcast is using Sandvine to manage P2P Connections

I tried in utorrent 1.6.1, setting the Protocol Encryption: OUTGOING, as FORCED. And i noticed that a brazilian ip is downloading one of my linux isos. And the connection hasn't interrupted its been about 10 minutes straight. Maybe they are not able to knock down fully encrypted connections? If this is the solution, or part of it, i hope in the next utorrent releases and azureus releases the clients come with forced or enabled encryption as default.
reply
Diaboyos @ 22nd Aug 12:35AM:
Re: Comcast is using Sandvine to manage P2P Connections

This has just hit my area within the past few weeks. I noticed it really well about a week ago but haven't had time to look into it until now.

I noticed about a week ago that none of the peers I was trying to seed to would stay connected for more than a few seconds making it virtually impossible to seed anything.

It took me two entire days to seed a 38MB file! This should have been accomplished in about 15 minutes. Before you get the wrong idea about what I was seeding it was a very old film which is now in the public domain and is free to share. That is definitely one bad thing about the way they are handling this. By doing this the way they are doing it they are penalizing innocent people who use BT to share LEGAL files. P2P is NOT illegal. Only certain files shared on it are. To blanket the entire network with this aggressive throttling method is ludicrous.

Not to mention I actually pay more for their higher speed connection of 8Mb/80KB because I share my photography using BT. There are so many legal uses of the BT technology I can't believe it's legal for them to do this to their customers.

A few people said that using a VPN or SSH tunnel will stop their interfering. As well Azureus recommends an encryption of Level 2 and up for Comcast users and to enable the Lazy Bitfield option. I already had Level 2 encryption now I'm gonna try the Lazy Bitfield.

Azureus has already updated its Wiki page adding Comcast to it's list of bad ISPs because they block uploads.
reply
rseiler @ 22nd Aug 12:43AM:
Re: Comcast is using Sandvine to manage P2P Connections

Another non-denial denial here:
»news.com.com/8301-10784_3-9763901-7.html

And as a special bonus, we learn that it's not a good thing to send 13 million emails a month. I keep it to 12 million myself.

Meanwhile, 100Mbps Internet is $14/mo in Japan....
reply
NormanS @ 22nd Aug 02:06AM:
Re: Comcast is using Sandvine to manage P2P Connections

said by rseiler :

Meanwhile, 100Mbps Internet is $14/mo in Japan....
Citation?

It looks like Yahoo! BB 50M Revo (50.5M/12.5M ADSL) is $39.51 per month.

Going by the dollar-yen exchange rate at 11:05 PM (just before this posting).
--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum
reply
rseiler @ 22nd Aug 02:12AM:
Re: Comcast is using Sandvine to manage P2P Connections

said by NormanS :

said by rseiler :

Meanwhile, 100Mbps Internet is $14/mo in Japan....

Citation?
I saw it here:
»www.pbs.org/cringely/pulpit/2007···683.html
reply
NormanS @ 22nd Aug 02:35AM:
Re: Comcast is using Sandvine to manage P2P Connections

I don't know who the author is, or what service he was getting, or how to verify his claim. I only know how to go to a Japanese web site and find the service by speed and price. SoftbankBB+Yahoo! offers 50.5Mbps/12.5Mbps for 4,521¥.

I also know that AT&T U-Verse requires the customer to be within 3,128 feet of a VRAD in order to get the product; not sure about bandwidth limits within that distance, other than 25Mbps divided between Internet (6Mbps max) and IPTV. So I would guess that getting 50Mbps Internet would require being right on top of the DSLAM.

I suppose a lot of people in Tokyo can get it; but I am wondering how many people in Sapporo, or Aomori can get it that fast and cheap? And how many Japanese, given the choice between $20 1.5Mbps and $40 50Mbps will choose cheap over fast?
--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum
reply
funchords @ 22nd Aug 10:43AM:
Re: Comcast is using Sandvine to manage P2P Connections

More story sightings:

Comcast (CMCSA): We Don't Throttle BitTorrent - Silicon Alley Insider

Comcast Wrongfully Denies Interfering with BitTorrent - TorrentFreak
--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
Are you affected by Comcast's RST forging? How to test it! -or- Read my original report.
reply
funchords @ 22nd Aug 12:46PM:
Comcast P2P Mgmt: Wireshark BitTorrent Example

This is a typical example of the RST interference that I am seeing. In this case, the connection is not encrypted, and the interference occurs during the handshake.

My comments in "quotes" below:


--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
Are you affected by Comcast's RST forging? How to test it! -or- Read my original report.
reply
funchords @ 22nd Aug 12:50PM:
Comcast P2P Mgmt: Wireshark eMule Example

Since WireShark's translator for eMule is pretty good at identifying what's going on, there's no need to show the Byte-by-Byte details as I did with BitTorrent.


I ran the eMule session for about an hour. Here are the results:


--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
Are you affected by Comcast's RST forging? How to test it! -or- Read my original report.
reply
mrweirdo @ 22nd Aug 05:48PM:
Re: Comcast P2P Mgmt: Wireshark eMule Example

hrm i wonder what would happen if everyone who did the iptables trick to drop RST packets instead rejected those very same packets. If enough people did it I bet it would create a bigger load on the network then what Comcast was hoping to save in the first place. It might give Comcast a little of their own medicine by crippling the network ;) j/k
reply
EG @ 22nd Aug 06:07PM:
Re: Comcast P2P Mgmt: Wireshark eMule Example

said by mrweirdo :

It might give Comcast a little of their own medicine by crippling the network ;)
Great idea... Bite off nose to spite face... Let's all suffer :uhh:
reply
mrweirdo @ 22nd Aug 06:26PM:
Re: Comcast P2P Mgmt: Wireshark eMule Example

Yeah not the best idea ;) but I'm sure there is people out there thinking of that. The bad part is its quite possible with the method Comcast uses.

Anyways I seemed to have found a workaround combination that works for me at least for now. I'm dropping the RST packets with my firewall, then have azureus set to use lazy bitfield, along with forced encrypted transport(RC4) and using cryptoport to prevent plain incoming connection attempts. Others out there might want to give it a try.
reply
anon @ 22nd Aug 06:57PM:
Re: Comcast is using Sandvine to manage P2P Connections

My personal favorite article in the comcast TOS is number 4:
(summarized) "We can do whatever the hell we want to your service and if you don't like it, vote with your dollars. Otherwise, tough shit."

Seriously... I have no problem with the changing the service to our benefit. But to restrict it and allow us to do less with our connections is ridiculous. In the long run it may provide faster speeds for all, but never once has comcast given me the full 6 mbps down / 3 up I pay for. Does anyone honestly believe that comcast wants to deliver their advertised speeds? Think about it... a car company doesn't get to remove a cylinder from all the engines of cars they've sold just because some people are speeding. What right does that give comcast to change the product that we've payed for?
reply
NormanS @ 22nd Aug 07:24PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by teeray :
But to restrict it and allow us to do less with our connections is ridiculous.
Your connection? Did you get title from Comcast transferring their IP address to you? You don't own your Internet connection, you rent it from Comcast (as do I rent my connection from AT&T).
Think about it... a car company doesn't get to remove a cylinder from all the engines of cars they've sold just because some people are speeding. What right does that give comcast to change the product that we've payed for?
I have thought about it. I don't like car analogies, and this one isn't any better than any of the others. Comcast does have a responsibility, as do all ISPs, to manage their networks in a manner which minimizes the adverse impact of some one user on the whole network.
--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum
reply
anon @ 22nd Aug 08:04PM:
Re: Comcast is using Sandvine to manage P2P Connections

Norman, his analogy may be bad, but he does have a point about Comcast (and probably most other cable providers) never providing what they promise. And by that, I mean, I've never hit the max download rate on Cable. Comcast can change the cap to 100 million TeraBYTES/second down, and in the end, it's just marketing weanies trying to get people to switch. I still find that the tend to top out at 2mb/s....maybe I'll hit 3 mb/s (rarely) for a second or 2.

IMO, they should be forced to provide MINIMUM rates. At least then we'd get something meaningful to go along with the marketing BS.

FWIW, I'm finding that a large percentage of the time my seeds are at 0%. Though right now, I'm shockingly getting 30KB/s....I'm sure they'll reset everything soon enough.
reply
NormanS @ 22nd Aug 08:21PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by KC At Bat :

Norman, his analogy may be bad, but he does have a point about Comcast (and probably most other cable providers) never providing what they promise. And by that, I mean, I've never hit the max download rate on Cable.
At least one Comcast user (in Hercules, California) has shown that he routinely hits his maximum advertised speed.

Now I have seen downloads which don't max my DSL connections speed; but I have also seen downloads which do. There are a number of variables outside of the control of the ISP which impact speed. I am currently running two BT downloads. One has finished downloading, but my share ratio is under 1.0 (currently showing 0.768), so I am letting it continue to seed. At near the maxi of my upload. The other is downloading slower than my max (it is currently hovering between 2KBps and 4KBps), but there are only 4 peers, and they are all residential connection; probably with asymmetric down/up speeds, and I could well be pulling the maximum that they are allowing (some people voluntarily throttle their upload to avoid bandwidth saturation).

I am disinclined to believe that you can't hit your Comcast maximum due to anything other than their use of Sandvine, or technical faults in your connection which should be addressed by a truck roll.
--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum
reply
funchords @ 22nd Aug 08:52PM:
Re: Comcast is using Sandvine to manage P2P Connections

quote:
I am disinclined to believe that you can't hit your Comcast maximum due to anything other than their use of Sandvine, or technical faults in your connection which should be addressed by a truck roll.

Based on my experience alone, I would be agreeing with you, here. My results today and yesterday are pretty similar to the results I had back in May when I started this Topic.

But something has happened, 3-4 weeks ago or so, that has affected a large number of other customers who now cannot seed at all. I've heard from quite a few of them due to the publicity over the past weekend.

Something is broken or mal-adjusted in their system (which they don't acknowledge having).
reply
funchords @ 22nd Aug 09:35PM:
Re: Comcast is using Sandvine to manage P2P Connections

... Messages from another Topic ... from February '06 ... from the Adelphia forum ...

»[Connectivity] Adephia Blocking P2P Packets

said by pupurin :
quote:
Adelphia seems to be blocking bittorrent seeding. Regular bittorrent is fine, but when you complete/switch to seeding, the new incoming connections are forced close. Guess they're sniffing packets and seeing the file is completed header and then dropping.

...

Regular BT works fine, but they are blocking seeding. Most people wouldn't notice it in big torrent of like 100+ people, but on small 20 peer torrents, you notice peers drop out and not coming back. That's why your upload suffers because you have no one to connect to.

...

Jig try to seed a torrent from cold. By that I mean close your client, wait a couple of seconds, start it back up again to seed one torrent. You'll see that new peers will connect to you for a second and then get dropped.


Here's a quote from another user:
said by MikeMyers :

quote:
I have the same problem, uploads only, started about a week ago, and I'm in Southern California too. I seed Limewire all day and I hardly get any uploads any more. Yesterday in three hours I had 3 uploads. It should be more like 3 per minute based on previous results (these are small files, less than 200kb each). I get many connects, but most get dropped. I changed nothing on my system either, it just suddenly slowed drastically.

In uTorrent, I just tried seeding a poplular file from a cold start and that seems to be a problem too. On my system I've confirmed this problem with Limewire, uTorrent, BDCC, and Kazaa Lite Resurrection.


Sounds rather familiar!
--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
Are you affected by Comcast's RST forging? How to test it! -or- Read my original report.
reply
alalper @ 22nd Aug 09:38PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by funchords :

Something is broken or mal-adjusted in their system (which they don't acknowledge having).
I don't really understand all this but, I'll offer one remote possibility. . . Maybe something from windows update (I don't update my torrent machine very often) changed the half-open connections and the system needs patching again? :uhh: I've got no problem here. :)
reply
war59312 @ 23rd Aug 02:25AM:
Re: Comcast is using Sandvine to manage P2P Connections

My firewall has started to pick up things like this but only when using bittorrent:

quote:
Date/Time :2007-08-23 02:16:27
Severity :High
Reporter :Network Monitor
Description: Blocked by Protocol Analysis (Invalid Flag Combination)
Direction: TCP Incoming
Source: 74.117.12.207:6881
Destination: XXX.XXX.XXX.XXX:2882
Reason: ACK FIN RST is an invalid TCP flag combination

Date/Time :2007-08-23 02:16:02
Severity :High
Reporter :Network Monitor
Description: Blocked by Protocol Analysis (Invalid Flag Combination)
Direction: TCP Incoming
Source: 189.11.46.22:6881
Destination: XXX.XXX.XXX.XXX:2846
Reason: ACK FIN RST is an invalid TCP flag combination

Date/Time :2007-08-23 02:15:47
Severity :High
Reporter :Network Monitor
Description: Blocked by Protocol Analysis (Invalid Flag Combination)
Direction: TCP Incoming
Source: 74.117.12.207:6881
Destination: XXX.XXX.XXX.XXX:2830
Reason: ACK FIN RST is an invalid TCP flag combination


Basically sending these RST packets less than every 30 seconds. Not sure if this is the same thing atm...
reply
funchords @ 23rd Aug 05:07AM:
Re: Comcast is using Sandvine to manage P2P Connections

said by alalper :

Maybe something from windows update (I don't update my torrent machine very often) changed the half-open connections and the system needs patching again?
That's good thinking, except that the TCP half-open limit doesn't fail in that manner. Also, the results would be the same whether or not encryption was in use, and whether or not a VPN was in use.
reply
anon @ 23rd Aug 06:30AM:
Re: Comcast is using Sandvine to manage P2P Connections

Torrents are uploading this morning for the first time in weeks.I don't know what that means and I'll leave it to greater minds to speculate upon what it means.
What was not happening yesterday happens today.Comcast giveth..blah blah
reply
dfxmatt @ 23rd Aug 06:35PM:
Re: Comcast is using Sandvine to manage P2P Connections

time for a test of a seed off a previously downloaded document again....1minute to scrape, wireshark will be running.

same thing happens as before. Reset after reset after reset.

So....hmmm...and I have it on "encrypt when available" etc
reply
funchords @ 23rd Aug 07:27PM:
Re: Comcast is using Sandvine to manage P2P Connections

I just ran a test and found something interesting. When looking at the injected RST packets, check out the TTL!

During my test, I had 18 injected RSTs (not counting duplicates, since there are usually two). What was interesting is that they all had a TTL of 123 -- a TTL that was several hops away either me or my peer! The perfect forgery is not so perfect!

So, let's find out what lives at TTL=123 (TTL is decremented before the facing side of each hop)


Now "123" is not a magic number. That means that I'm 5 (128 - 5 = 123) hops away from the device that is interfering with me.

I'm not sure this information is useful, but it sure is interesting!

Edit: Another user forwarded his Wireshark capture to me. The TTL phenomena doesn't hold true for him, unfortunately.

--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
Are you affected by Comcast's RST forging? How to test it! -or- Read my original report.
reply
jig @ 23rd Aug 08:27PM:
Re: Comcast is using Sandvine to manage P2P Connections

it means you have something to filter against rather than just all rst packets
reply
anon @ 23rd Aug 09:31PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by funchords :

said by DrCable :

well of course because those peers fully expect you to reply but you are not going to since you dropping the packet out right.

don't drop/deny the packet. un set the RST flag or find a way to ignore the RST flag so you can use the data in that packet to connect to that peer so they know you are there and will send you data.
You might be absolutely right about that. I haven't tried that approach.

(PS: I think this exercise is entertaining, but ultimately the solution is to get Comcast to implement this correctly AND support it, or remove it altogether.)
i totally agree.

IMHO comcast should simply just let a customer do whatever until they reach a monthly max Gig limit. I do see comcast's side of things so I'm ok with monthly total bandwidth usage limit. I'm just not ok with comcast telling me how i can or can not use my bandwidth (within reason of course) prior to reaching that limit.
reply
anon @ 23rd Aug 11:39PM:
Re: Comcast is using Sandvine to manage P2P Connections

Interesting that in TTL=123 (12.118.177.49) is an ATT Ip Adress. "AT&T WorldNet Services ATT". Isn't Comcast and ATT merged as far as the net? Funchords how did you see that your RST packets had a TTL of 123, i have wireshark installed.
reply
NormanS @ 24th Aug 12:29AM:
Re: Comcast is using Sandvine to manage P2P Connections

said by Kandango :

Interesting that in TTL=123 (12.118.177.49) is an ATT Ip Adress. "AT&T WorldNet Services ATT". Isn't Comcast and ATT merged as far as the net? Funchords how did you see that your RST packets had a TTL of 123, i have wireshark installed.
AT&T Worldnet Services is not the same thing as the old AT&T Broadband Internet. ATTBI was spun off from the AT&T mothership, and became Comcast[1]. But AT&T Worldnet Services was part of the old AT&T, and remained independent of Comcast. In fact, AT&T Worldnet Services was part of the AT&T which was bought by SBC in 2006; and is currently still called AT&T.

[1] Somewhere I got the idea that ATTBI bought Comcast.

»www.corp.att.com/news/2002/11/18-11087
--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum
reply
war59312 @ 24th Aug 12:49AM:
Re: Comcast is using Sandvine to manage P2P Connections

never mind
reply
funchords @ 24th Aug 02:42PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by Kandango :

Funchords how did you see that your RST packets had a TTL of 123, i have wireshark installed.
Expand the "IP" section (above the TCP section), the TTL appears there.
reply
funchords @ 24th Aug 02:49PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by Kandango :

Interesting that in TTL=123 (12.118.177.49) is an ATT Ip Adress. "AT&T WorldNet Services ATT".
That's not necessarily where the box is, but it could be.

If it's not a router, it shouldn't decrement TTL. So TTL=123 includes the non-facing side of the router with a TTL=124, the facing side of the router with a TTL=123, and anything in between.

As a practical matter, it also includes any added technology at either router, such as a Sandvine P2P Policy Management (PPE 8200).
--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
Are you affected by Comcast's RST forging? How to test it! -or- Read my original report.
reply
elvey @ 24th Aug 04:03PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by Bomper :

Torrents are uploading this morning for the first time in weeks.
Not here. 0 bps.
reply
Nougat @ 24th Aug 04:23PM:
Re: Comcast is using Sandvine to manage P2P Connections

I may have found something. I applied QoS to the port I'm using for bittorrent - and hey, look, I can upload again, for the first time in a week.

»digg.com/software/Possible_solut···rottling

My theory is that if they're prioritizing their voice traffic, then they're not pumping QoS traffic through Sandvine because that would screw it up.
reply
anon @ 24th Aug 05:34PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by elvey :

said by Bomper :

Torrents are uploading this morning for the first time in weeks.
Not here. 0 bps.
They stopped again this morning.The same torrents that were uploading yesterday stopped.
reply
funchords @ 24th Aug 07:55PM:
Re: Comcast is using Sandvine to manage P2P Connections

I found a patent application by Sandvine where they describe a proxy server between a network segment and the Internet.

Of extreme interest is the handling of the judgment of the Application Analysis device -- it is described on Page 19 of the PDF and shown on Page 4 of the PDF.

said by Sandvine Patent Application 20040006643-TCP proxy providing application layer modifications :
[0097] State machine 100 will on occasion need to generate segments, for example when:

    •[0098] a) sending ACK segments to the sender to force the sender's rapid re-transmit algorithm to activate;

    •[0099] b) sending ACK segments to the sender when entire segments are deleted by application layer analysis module 104; and

    •[0100] c) sending RST segments in both directions when the flow is forcibly terminated by application layer analysis module 104.

[0101] This generation of segments is handled by segment generation module 106.


That describes exactly what I'm seeing!

The entire application makes great reading, but it's quite technical. It's literally a Master Class on how to successfully perform a man-in-the-middle attack -- not just using RST to tear down connections. It describes how to replace original data and forge the packets, checksums, fragmentation, ACKs, Sequence Numbers, and etcetera to make the replacement undetectable by the two peers that are exchanging the data!

Attached is a PDF, with my comments on Pages 4 and 19 (I really had trouble with the images US Patent Office's site - click HERE), so I made the PDF.

[att=1]

I'm feeling pretty vindicated right now. Someone in Comcast's PR department needs to get an education on what's really in their network!
--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
Are you affected by Comcast's RST forging? How to test it! -or- Read my original report.
Sandvine Pat···6643.pdf
Sandvine Patent Application 20040006643-TCP proxy providing application layer modifications
reply
alucard_x @ 24th Aug 08:24PM:
Re: Comcast is using Sandvine to manage P2P Connections

interesting find.. perhaps we have enough pieces to figure out a solution.
reply
EG @ 24th Aug 08:58PM:
Re: Comcast is using Sandvine to manage P2P Connections

I have been following this thread from the beginning, and although I'm not affected by this (yet ?), but for what it is worth, I felt that I had to say that have really done your homework Mr. Funchords !

I've have found this thread to be very interesting reading and I'm certain that you have opened many eyes and enlightened many readers, and for that you deserve an A+ :)
reply
macguy @ 24th Aug 10:30PM:
Re: How to test how many connections are being reset by RST pack

Anyway I could test this in the os X terminal? I tried, but entering netstat -s find "rest connections" didn't give me any data that said anything about active opens or passive opens or anything else that your post said to look for.
reply
funchords @ 24th Aug 11:35PM:
Re: How to test how many connections are being reset by RST pack

said by macguy :

Anyway I could test this in the os X terminal? I tried, but entering netstat -s find "rest connections" didn't give me any data that said anything about active opens or passive opens or anything else that your post said to look for.
Try netstat -s | grep "connection resets received"

If that doesn't work, it's because I got the string "connection resets received" wrong. Just do a netstat -s and look for something like: 

Tcp:
    79600 active connections openings
    35524 passive connection openings
    12573 failed connection attempts
    5257 connection resets received


--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
Are you affected by Comcast's RST forging? How to test it! -or- Read my original report.
reply
NormanS @ 24th Aug 11:44PM:
Re: How to test how many connections are being reset by RST pack

Two torrents running. AT&T is not (AFAIK) running Sandvine (or Ellacoya):

--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum
reply
funchords @ 25th Aug 12:00AM:
Re: How to test how many connections are being reset by RST pack

Those are some really, really, really strange numbers. :o

You've had 1,737,538 successful connections.
3% Incoming, 97% Outgoing

95% were terminated by the RST flag (instead of FIN).

What the heck are you doing that makes 1.7 million outgoing connection attempts? How many years since the last reboot? :p
--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
Are you affected by Comcast's RST forging? How to test it! -or- Read my original report.
reply
NormanS @ 25th Aug 02:06AM:
Re: How to test how many connections are being reset by RST pack

Anime fansub "H2" has been running for the last 38 hrs., 10 mins. Only 67.3% complete. Connected to 22 peers, 4 seeds. Running at 23KBps down.

Anime fansub "Zombie Loan" is complete, but share ratio is at .886. Took 1 hr., 13 mins. to download 171.49 MBytes. Currently connected to 33 peers.

In that same 38 hour period I have downloaded probably 6, or 7 other shows at ~171MBytes each. Two, or three completed in under 20 minutes.

The box was rebooted some time before I started downloading "H2", which is a 41 episode series; 9,488.64 MBytes for the whole shebang.

The combined upload is roughly 43KBps; which, I think, is about right for a 512kbps DSL upload (512*.85/8?) The SpeedStream 4100 reportedly has a built-in QoS priority for outbound ACK packets, so saturating the upload has minimal impact on download.

I have no idea why so many resets.

Not counting stuff happening on the LAN, of course. A mail server running on another computer, with twice daily access from this one. Web surfing. Email testing to off-site servers for helping poster in Usenet groups. Downloading Usenet headers...
--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum
reply
war59312 @ 25th Aug 03:24PM:
Re: Comcast is using Sandvine to manage P2P Connections

There is an odd bug in the script by the way...

quote:
results will begin to be reported shortly,
please wait or use Ctrl-c to quit...
0:10 - 0 out of -10 connections reset (0%) [Ctrl-c quit]
0:20 - 0 out of -5 connections reset (0%) [Ctrl-c quit]
Divide by zero error.
0:30 - 1 out of 0 connections reset (0%) [Ctrl-c quit]
0:40 - 1 out of 1 connections reset (100%) [Ctrl-c quit]
0:50 - 1 out of 27 connections reset (3%) [Ctrl-c quit]
1:00 - 1 out of 42 connections reset (2%) [Ctrl-c quit]
1:10 - 1 out of 72 connections reset (1%) [Ctrl-c quit]
1:20 - 1 out of 76 connections reset (1%) [Ctrl-c quit]
1:30 - 2 out of 84 connections reset (2%) [Ctrl-c quit]
1:40 - 4 out of 90 connections reset (4%) [Ctrl-c quit]
1:50 - 4 out of 91 connections reset (4%) [Ctrl-c quit]
2:00 - 4 out of 96 connections reset (4%) [Ctrl-c quit]
2:10 - 4 out of 99 connections reset (4%) [Ctrl-c quit]
2:20 - 5 out of 109 connections reset (4%) [Ctrl-c quit]
2:30 - 6 out of 107 connections reset (5%) [Ctrl-c quit]


--
GOD BLESS THE U.S.A
reply
funchords @ 25th Aug 03:37PM:
Re: Comcast is using Sandvine to manage P2P Connections

Yep, it happens if you start the script while the system has half-open connections. Ugly but harmless.
reply
anon @ 25th Aug 05:07PM:
Re: Comcast is using Sandvine to manage P2P Connections

What is unfortunate here is that we agreed to the TOS.
Whether or not the changing/forging of packets is ethical or not is like beauty (in the eye of beholder).
What would be nice however, is the truth from Comcast.
I doubt that will happen.
reply
anon @ 26th Aug 09:49AM:
Re: Comcast is using Sandvine to manage P2P Connections

I have a quick question: I recently downloaded WoW (which uses bittorrent), and my upload speeds were fine. In fact, they were very good. Is this considered seeding? Or does the disconnecting happen once you have finished downloading a torrent and continue to share it?
reply
funchords @ 26th Aug 01:01PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by Jforsyth :

I have a quick question: I recently downloaded WoW (which uses bittorrent), and my upload speeds were fine. In fact, they were very good. Is this considered seeding?
Not for the purposes of this Topic. When I talk about seeding or uploading in this topic, I'm talking about sending the payload data in an outbound direction only.

said by Jforsyth :

Or does the disconnecting happen once you have finished downloading a torrent and continue to share it?
Yes, you've got it.
--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
Are you affected by Comcast's RST forging? How to test it! -or- Read my original report.
reply
anon @ 26th Aug 07:37PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by funchords :

said by Jforsyth :

I have a quick question: I recently downloaded WoW (which uses bittorrent), and my upload speeds were fine. In fact, they were very good. Is this considered seeding?
Not for the purposes of this Topic. When I talk about seeding or uploading in this topic, I'm talking about sending the payload data in an outbound direction only.

said by Jforsyth :

Or does the disconnecting happen once you have finished downloading a torrent and continue to share it?
Yes, you've got it.
yeah seeding only is totally hosed. I can't get any UL on a huge peer rich torrent in todays testing when i seed only. I can't stay connect to ANY peers. deny RST like I figured didn't help since you need that data in that packet to connect to peers.

Anyway, the sabotaged packet has to have the correct source port, destination port, sequence Number etc... else your firewall would think it was under a spoofing type tcp reset attack. Basically that info needs to be correct else you would just drop that packet anyway. i.e. it has to look like the other computer TOLD/SENT a legit reset packet. It also appears 2 RST's are sent because the first might be missed since it is cached and delayed on most systems and the second forces it to be looked at immediately and also higher % of it not being missed completely which does happen if a legit back and forth comes in quickly enough before the RST is seen at which time the rst will be dropped.

So i guess I'm stuck reforging packets.
(one problem though is comcast appears to be sending the RST to both sides, so both sides would need to reforge. This IMHO crossing the line if comcast is sending RST to users outside their own network. We need to set up a small test torrent with a couple people on comcast and couple not and all sniff packets to see if RST are for sure being sent outside of comcast.net)

Comcast is so penny wise, pound foolish. sigh...
reply
ztmike @ 27th Aug 03:31PM:
Re: Comcast is using Sandvine to manage P2P Connections

Still seeding at my max upload....a whopping 35.00 ;)

Feels like im still living in 1999 with that upload speed..

Note* I set my upload to 384, instead of maxing out my hole upload speed, so i can still surf the interwebs.
Click for full size
reply
funchords @ 27th Aug 03:40PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by ztmike :

Still seeding at my max upload....a whopping 35.00 ;)
The issue that I'm reporting is noted when only uploading. Try this again after you are 100% complete with your download.

Note: I can also reach 100% of my desired speed, it just takes more time. Watch the peer list and see how often users arrive just to drop off a few seconds later.

said by ztmike :

Feels like im still living in 1999 with that upload speed..

Note* I set my upload to 384, instead of maxing out my whole upload speed, so i can still surf the interwebs.
You're smarter than the average bear!

uTorrent's forum has a whole section for people who can't figure that out. They ignore the SpeedGuide and set upload HIGHER than their subscribed upload speed, and then wonder why they can't surf!

Makes me want to give some users a fire hose and say, "Hey, suck on this!"
--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
Are you affected by Comcast's RST forging? How to test it! -or- Read my original report.
reply
NormanS @ 27th Aug 04:36PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by funchords :

You're smarter than the average bear!

uTorrent's forum has a whole section for people who can't figure that out. They ignore the SpeedGuide and set upload HIGHER than their subscribed upload speed, and then wonder why they can't surf!

Makes me want to give some users a fire hose and say, "Hey, suck on this!"
When I was using a Westell WireSpeed B90-36R516 DSL modem (dumb bridge), I had to throttle my upload to around 66% of rated capacity to avoid saturation related surfing problems.

When I changed to a SpeedStream 4100 DSL modem (routed device), I had left it at that level until I encountered a post describing how the SS4100 automatically prioritized outbound ACK packets. So I relented, and set the upload to the maximum. Surfing is no problem with a saturated BT upload.

If you have QoS capability on the modem, I guess you don't have to worry about upload saturation.
--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum
reply
ztmike @ 27th Aug 05:32PM:
Re: Comcast is using Sandvine to manage P2P Connections

.
Click for full size
reply
modemslayer @ 27th Aug 08:48PM:
Re: Comcast is using Sandvine to manage P2P Connections

...so if everyone just ran everything through a third party PPTP tunnel, what could any ISP do? No traffic shaping, no blocked outbound ports, no "deep packet inspection". You might lose some of the benefits of QoS, but all in all, it sounds like the perfect solution!

I'm not a TCP/IP guru (although TCP/IP Illustrated sits on my shelf) but methinks that ISPs will rue the day when everyone is running a VPN.

Which leads me to my next point. Why shouldn't I just be able to pay comcast ten bucks a month extra to bypass that sandvine box? It makes sense since it's possible to subvert it by other means.
reply
hobgoblin @ 27th Aug 08:56PM:
Re: Comcast is using Sandvine to manage P2P Connections

"Which leads me to my next point. Why shouldn't I just be able to pay comcast ten bucks a month extra to bypass that sandvine box? It makes sense since it's possible to subvert it by other means."

Or pay by the Gig for every Gig uploaded or downloaded over say 75?

That would be better.

Hob
--
"A foolish consistency is the hobgoblin of little minds."
- Ralph Waldo Emerson

reply
modemslayer @ 27th Aug 09:42PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by hobgoblin :

"Which leads me to my next point. Why shouldn't I just be able to pay comcast ten bucks a month extra to bypass that sandvine box? It makes sense since it's possible to subvert it by other means."

Or pay by the Gig for every Gig uploaded or downloaded over say 75?

That would be better.

Hob
If they do away with traffic shaping? I'd go for that, and it would be a good solution to those invisible caps too. There's so many things that ISPs could be doing. Since it usually comes down to money, I should be able to pay for value added services such as "de-throttled" access, detailed usage reports, on-demand metered bandwidth, etc.

Certainly I don't think the current model of "let's pretend you have unlimited, unfettered internet access" is working. There's lots of different usage paradigms people have, so lets see subscription plans that reflect that.
reply
funchords @ 27th Aug 10:00PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by modemslayer :

...so if everyone just ran everything through a third party PPTP tunnel, what could any ISP do?
The users of rogers.ca have some experience with this. They found that VPNs were throttled, for a while at least.

Rogers this week decided to shape all encrypted traffic, preventing any encrypted transfers from reaching optimal speed, in short, crippling anything you are trying to do online that is secure, illegal or not. -- http://www.jamieplucinski.com/blog/?p=64


The answer is not more "cat-and-mouse," either by the P2P community or the ISPs.

Many of us use traffic-shaping in our homes, or we pause our file transfers so we can play an online game or watch a You Tube video without too much trouble.

It shouldn't surprise anyone that our ISP manages their bandwidth in a similar way. As I've said many times, I don't mind that fact. But it does need to be supported, and since Comcast doesn't even admit it, they certainly cannot support it.

said by modemslayer :

Why shouldn't I just be able to pay comcast ten bucks a month extra to bypass that sandvine box? It makes sense since it's possible to subvert it by other means.
That's actually the problem we're having, now. We subscribed to Cable Internet because it's faster! Many of us could pay our telephone companies half of what we're paying now for "slower" DSL.

But is Comcast really faster? Consider this...

With Comcast, I get 8 Mbps down, but if 4 others in my neighborhood also start downloading at that rate -- the bandwidth for the entire neighborhood is tapped out. From that point on, everything else slows down. Each node on Cable Internet -- 100 to 200 residences each -- divides 38 Mbps between them.

Now, my telco's Central Office probably serves 10,000-20,000 residences -- 100x more. If 5 -- or 500 -- of us start downloading at our maximum, perhaps nobody suffers. As long as the telco can get the additional bandwidth at the CO, it's quite a bit easier for the telco to deal with bandwidth demands and adjust to deliver on them than it is for CATV. With CATV, the physical ceiling is rather low.

On an individual basis, it's a lot easier for a individual DSL subscriber to "max out" his line than it is for a cable subscriber. But on a neighborhood basis, it's a lot easier to "max-out" cable.
reply
hobgoblin @ 27th Aug 10:00PM:
Re: Comcast is using Sandvine to manage P2P Connections

"Since it usually comes down to money, I should be able to pay for value added services such as "de-throttled" access, detailed usage reports, on-demand metered bandwidth, etc."

Don't mistake what you and the members of this forum want with what is commercially viable.

Most people don't care about packet filtering, caps, BT and everything else this forum whines about.

Hob
--
"A foolish consistency is the hobgoblin of little minds."
- Ralph Waldo Emerson

reply
anon @ 27th Aug 10:11PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by hobgoblin :

"Which leads me to my next point. Why shouldn't I just be able to pay comcast ten bucks a month extra to bypass that sandvine box? It makes sense since it's possible to subvert it by other means."

Or pay by the Gig for every Gig uploaded or downloaded over say 75?

That would be better.

Hob
Wow. When users are begging for per-byte billing, you know the isps are onto something.
reply
hobgoblin @ 27th Aug 10:15PM:
Re: Comcast is using Sandvine to manage P2P Connections

"Wow. When users are begging for per-byte billing, you know the isps are onto something."

If the average customer understood what per byte billing was, they would all love it.

The Hogs would hate it....so would would this forum...and everyone in here would think it was the norm.

Hob
--
"A foolish consistency is the hobgoblin of little minds."
- Ralph Waldo Emerson

reply
Movieman420 @ 28th Aug 06:42PM:
Re: Comcast is using Sandvine to manage P2P Connections

Up until today I couldn't seed crap after completing a d/l. Today I am seeding (not quite as fast as usual) but..seeding nonetheless. Maybe CC is trying to tweak things for the better. (And no...my only peers aren't comcast too..lol).
I'd rather use a vpn. D/led Hamachi, set it up..is shows as a working network. But I'm a noob to networking...anyone know how to force uTorrent or Azureus to use the vpn and not my standard connection? Thanx...Mm
reply
anon @ 29th Aug 02:28AM:
Re: Comcast is using Sandvine to manage P2P Connections

said by ztmike :

.
ZTMIKE close the app wait 10 minutes then re open it and seed fresh. if you just cross over you will have a lot of peer data cached and will still be able to connect some peers.
(at least this is what I see here)

Also not ALL comcast net is being stopped. Though it will be as they add more and more black boxes at main router choke points. :)
reply
anon @ 29th Aug 02:52AM:
Re: Comcast is using Sandvine to manage P2P Connections

Just a note about that script of yours - it won't work on a PC with IPv6 installed. The FOR loops return IPv4 stats first (the number you want) followed by the IPv6 number (almost always 0) ... this then gives the repeated 'Divide by Zero' and '0 of 0 connections' messages. It has been tested and repeatable on my home PC.

Is there a way to tell a FOR loop to return only the first match? Or perhaps telling Find to only return the first one?

EDIT: Seems that it is easier than that. "Find all lines containing 'Active Opens' and not containing '= 0' ... example here:

FOR /F "usebackq tokens=2 delims==" %%i IN (`netstat -s ^| find "Active Opens" ^| find /V "= 0"`) DO set /A CESTABL1=%%i
reply
anon @ 29th Aug 03:00AM:
Re: Comcast is using Sandvine to manage P2P Connections

Full modified script below - no lost functionality AFAICT.
The poster that was having the repeated Divide 0 erorrs earlier might want to try this one.


Enjoy. :)

reply
anon @ 29th Aug 03:02AM:
Re: Comcast is using Sandvine to manage P2P Connections

(Apologies for the triple post - can't seem to edit anon posts. This post is so I can set a watch on the topic)
reply
anon @ 29th Aug 03:04AM:
Re: Comcast is using Sandvine to manage P2P Connections

This Comcast (sandvine) throttling is starting to cross the line. If I pay for my 6mbps internet I should be able to use it for anything I want. None of this throttling junk or anything. Instead of spending money on Sandvine hardware maybe they should spend money on IMPROVING INFASTRUCTURE! To make it worse they don't even inform customers of it and install it invisibly.

Oh and @Jye this is true and can i get a revised script that will work in Vista with IPv6 enabled. The script is returning to me Divide by Zero error every time even though I keep getting more RST connections

Support Net Neutrality and the EFF!!
reply
Diaboyos @ 29th Aug 03:50AM:
Re: Comcast is using Sandvine to manage P2P Connections

said by Kelex :

This Comcast (sandvine) throttling is starting to cross the line. If I pay for my 6mbps internet I should be able to use it for anything I want. None of this throttling junk or anything. Instead of spending money on Sandvine hardware maybe they should spend money on IMPROVING INFASTRUCTURE! To make it worse they don't even inform customers of it and install it invisibly.
That's exactly how I feel. I pay for the 8mbps line to have a faster upload speed since I use BitTorrent to help distribute my work (photographer). I created and own the files I am uploading. Comcast's restricting my legal right to distribute my work where I want after I have paid them for the bandwidth to do so is not only wrong, it should be illegal.
I could see if there were nothing but illegal files shared on the BT network but that's not the case. There are many individuals and businesses that use the BT network for completely LEGAL reasons (myself included) and for them to be denied accessibility is beyond wrong. They need to specify concrete caps, no more invisible caps that you're unaware of until you cross them, and if they're so concerned with bandwidth consumption then target the users that use the most and not blanket the entire BT network with this ludicrous Sandvine method.
Comcast needs to provide the bandwidth they quoted upon sign-up and nothing else. We need Net Neutrality NOW.
reply
anon @ 29th Aug 04:23AM:
Re: Comcast is using Sandvine to manage P2P Connections

thanks for the bat script Jye!

We need net neutrality bad... I live in Utah and I've sent multiple letters to my congressman and senators and I hope that soon we can see a breaking point so we will not be stuck between this stalemate of government/ISP/Consumer.
reply
anon @ 29th Aug 04:39AM:
Re: Comcast is using Sandvine to manage P2P Connections



I activated all my torrents and this should be enough proof to show that sandvine is enabled and working the Utah region.
reply
Cabal @ 29th Aug 07:09AM:
Re: Comcast is using Sandvine to manage P2P Connections

This has nothing to do with net neutrality. Net neutrality doesn't mean unmanaged, unQoS'd bandwidth everywhere, which will never happen when paying to use someone else's network. Please don't use the term incorrectly, doing so dilutes its importance.
--
Anonymous posts are ignored. If you wish to be heard, speak for yourself.
Interested in open source engine management for your Subaru?
reply
alucard_x @ 29th Aug 10:13AM:
Re: Comcast is using Sandvine to manage P2P Connections

said by Jye :

Full modified script below - no lost functionality AFAICT.
The poster that was having the repeated Divide 0 erorrs earlier might want to try this one.


Enjoy. :)
thanks, this is exactly the problem, though i haven't tested yet.

I knew it was something with IPv6 since that table reports another Reset connection entries and was throwing the script off. Just haven't had time to get in this forum.

On another note, by going into uTorrent and changing Encryption to Forced (allow legacy connections still checked) I'm able to keep an upload going on *some* torrents. It's not a full solution, but it has helped on a few torrents so I can keep my ratio up if I get lucky and it works on that torrent.

I'm not sure how the feature works, I believe when it's on Forced the other end has to support it or have it enabled as well.

reply
NormanS @ 29th Aug 10:16AM:
Re: Comcast is using Sandvine to manage P2P Connections

said by Diaboyos :

said by Kelex :

This Comcast (sandvine) throttling is starting to cross the line. If I pay for my 6mbps internet I should be able to use it for anything I want...
That's exactly how I feel...
I hate to rain on your parade, but you don't own your Internet connection, you rent it from Comcast. As with any rental, you use it within the limitations set by the owner; which, in this case, is Comcast.
--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum
reply
NormanS @ 29th Aug 10:21AM:
Re: Comcast is using Sandvine to manage P2P Connections

said by Kelex :

We need net neutrality bad... I live in Utah and I've sent multiple letters to my congressman and senators and I hope that soon we can see a breaking point so we will not be stuck between this stalemate of government/ISP/Consumer.
Be careful what you wish for...

I really don't think that you want "Net Neutrality". Such would play havoc with tiered service. What you want is tiered service, where advanced uses can pay "per GB" down/uploaded. You want to down/upload more GB, you pay more money. Comcast uses the additional revenue to add network capacity to support the additional traffic.

Either that, or tax you to high heaven; let the government take your money straight from your paycheck to buy the additional capacity. Nice for the handful of you who uses lots of bandwidth; but for the rest of us who don't, a pain in the pocket book.
--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum
reply
funchords @ 29th Aug 11:16AM:
Re: Comcast is using Sandvine to manage P2P Connections

said by Kelex :

This Comcast (sandvine) throttling is starting to cross the line. If I pay for my 6mbps internet I should be able to use it for anything I want.
You pay for the ability to reach 6 Mbps, and that's realistic when you're downloading a few songs off of a website. But the reality is that you are sharing the network with your neighbors -- 38 Mbps, in fact. So if 6-7 of your neighbors simultaneously start to download from sources that can top-out your speed, then the whole neighborhood will slow down. It's just like turning on all the faucets and flushing all the toilets reduces the water pressure and suddenly changes the temperature of your shower.

It's not the customer's fault for misunderstanding this. Comcast does not make this clear except in the mouseprint of AUPs and TOSs that they know nobody reads.

Sharing the bandwidth is a reality everywhere, to some degree -- the entire internet is a shared service. There is a maximum capacity to any gateway, and everyone behind that gateway shares it.

said by Kelex :

Instead of spending money on Sandvine hardware maybe they should spend money on IMPROVING INFASTRUCTURE!
In some cases, yes, spending money can help.

1. Comcast needs to stop the perception that people are buying bandwidth to download at 6 Mbps or upload at 350 Kbps full-time. They only make it clear if you break their invisible caps.

2. Comcast needs to build its network so that the demands of a wide array of customers is met. AFAICT, they're doing this. Sandvine is not an evil tool, but...

said by Kelex :

To make it worse they don't even inform customers of it and install it invisibly.
... that's exactly the problem. Comcast: Tell us what it does, where it does it, and how to get support if it's screwing up the system.
reply
funchords @ 29th Aug 11:19AM:
Re: Comcast is using Sandvine to manage P2P Connections

said by Jye :

Just a note about that script of yours - it won't work on a PC with IPv6 installed.
::: FOREHEAD SLAP :::

Thanks, Jye! That's excellent!
reply
hobgoblin @ 29th Aug 11:20AM:
Re: Comcast is using Sandvine to manage P2P Connections

"... that's exactly the problem. Comcast: Tell us what it does, where it does it, and how to get support if it's screwing up the system. "

I see your point.

Your an intelligent man,

HOW would you write the informational document for the customer base that EVERYONE would understand and not get the wrong idea.

Hob
--
"A foolish consistency is the hobgoblin of little minds."
- Ralph Waldo Emerson

reply
funchords @ 29th Aug 11:29AM:
UPDATE Re Comcast is using Sandvine to manage P2P Connection

Just an update -- it's been 3 months since my original post, which I tried to make as accurately as possible. Naturally, I've learned a few things since then.

HOWEVER -- please still see the first post and my commentary that follows it. All the proof is here, and it is easily testable and reproducible -- that it is happening is non-disputable. Unless my testing is somehow flawed, These are facts.

However, you will have to decide for yourself whether it is done in an acceptable way or at an acceptable level. Those issues are opinions.

Here are some developments, just in case you haven't been keeping up with the thread...

What is working for me:

    •Encrypted tunnels to a point outside the Comcast network (VPN, SSH tunnel, etc.)
    •Forcing encryption (works for me, but not for many others who have tried it)
    •When downloading, make sure that the user has met his uploading goal by the time that the download completes. The easiest way to accomplish this is to set a download rate slower than the uploading rate.
    •Tolerating the up to 40% rate RSTs when using BitTorrent to upload a file and not forcing encryption. Even at that seemingly high rate, I can still reach my preferred 16 KB/s (256 Kbps) upload limit.

What is not working for me:

    •Setting your firewall to drop RST packets. Since the RST is confirmed to be sent in both directions, ignoring the RST on only one side creates a useless half-open connection.
    •Lazy Bitfield
    •Reporting the issue to Technical Support
    •Gnutella uploads -- almost always blocked (nearly 100%).
    •Tolerating RSTs when using ED2K to share files. Although some uploads go through, way too many fail. Additionally, the ED2K anti-abuse routines in most clients will ban users who accept requests and then later fail to upload when a request is made for parts of files that I have. This means that I cannot download from them, and they are holding parts I need of these same files. The ED2K implementation of Sandvine at Comcast is very broken!

Significant reports I've read but can't confirm:

    •Seeding is "impossible" -- numerous reports, it just doesn't happen to me.
    •Forced Encryption does not help in many reported cases.
    •Cannot upload 2 GB of data without a reset, using FTP or Lotus Notes -- I haven't tried it.

--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
Are you affected by Comcast's RST forging? How to test it! -or- Read my original report.
reply
ztmike @ 29th Aug 01:51PM:
Re: Comcast is using Sandvine to manage P2P Connections

I thought All Comcast upload speeds were at 384 for their lowest offering, how is it that you have (256 kbps) 16 KB/s ?

To the person that said to quit utorrent and restart the program and to seed...i did and it still uploaded at my max. (See 2nd picture.)
reply
funchords @ 29th Aug 02:25PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by ztmike :

I thought All Comcast upload speeds were at 384 for their lowest offering, how is it that you have (256 kbps) 16 KB/s ?
256 KB/s is my preferred max -- my setting for "Upload Limit" on my BitTorrent client. I have 768 KB/s up (more or less, depending on the test), some of that I also use for eMule but the majority of it I leave free for me and my housemates.
--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
Are you affected by Comcast's RST forging? How to test it! -or- Read my original report.
reply
anon @ 29th Aug 03:38PM:
Re: Comcast is using Sandvine to manage P2P Connections

Does Verizon cap any bittorrent or throttle it in any way on their FIOS lines? If not, as soon as that gets to town I'm jumping the 'pirate' ship comcast is and adding to my cell plan a FIOS plan.
reply
anon @ 29th Aug 03:50PM:
Re: UPDATE Re Comcast is using Sandvine to manage P2P Connection

Forced encryption is working better than leaving it off but its still not the same as before. Harder to keep my ratios up on private trackers now. I usually get to around 40% RST connections when using the .bat file also.

Going to test on the p2p application that pushes patches through on World of Warcraft next time a big patch comes out and see what kind of outcome it has in store.
reply
ztmike @ 29th Aug 04:12PM:
Re: Comcast is using Sandvine to manage P2P Connections

FIOS doesnt cap your speeds, or no caps on how much you can send/receive

You could seed till you bleed on fios or hell even Cablevision internet with Boost.
reply
Battousai1 @ 29th Aug 04:15PM:
Re: Comcast is using Sandvine to manage P2P Connections

Has anyone else tried the QoS theory posted by Nougat on page 13? It's been working pretty darn well for me the past couple of days.
reply
anon @ 29th Aug 04:17PM:
Re: UPDATE Re Comcast is using Sandvine to manage P2P Connection

I tested my Utah comcast connection last night, seeded about 10GB to approx 20 peers maxed at 220KB per second upload the entire time. I didn't download any part of the torrent, it was a 3.5GB file i already had. So far in the last couple weeks I've been able to seed around 35GB of data on various torrents/trackers

I don't have encryption forced so i cant comment on whether all the connections were encrypted or not.

I guess what I'm saying is that i don't notice anything unusual (yet).
reply
anon @ 29th Aug 04:31PM:
Re: Comcast is using Sandvine to manage P2P Connections

Forced encryption is not working at all for me. (Then again, I'm initially-seeding at best possible upload speed.)
reply
anon @ 29th Aug 05:40PM:
Re: Comcast is using Sandvine to manage P2P Connections

quote:
WHY: To reduce costs associated with P2P bandwidth growth
Wrong; that's just propaganda. The real reason for this is to KILL bittorrent by preventing the seeding of torrents. Unseeded torrents = dead torrents = dead Bittorrent.

Simple as that.
reply
Roundboy @ 29th Aug 06:38PM:
Re: UPDATE Re Comcast is using Sandvine to manage P2P Connection

You know, when I first read your post & followups I haven't used any torrent traffic at all.... but i did need to pull a few large files.

i did notice that my upload topped out at 0-3kB/s.. i don't know the reconnect rate, as the script wasn't working for me in Vista.

I just read THIS post, and was set to try it again with all suggestions... and as i set down to try it 'stock' to get a baseline.. i notice that now my torrents are running along just like normal..

Currently 527 kB/s down and > 20kB /s up ... ZERO connections reset.

5 minutes in, I am now looking at a wildly fluctuating upload at 2 - 12 kB/s . still zero resets. I'll begin my testing now..

Edit: With still nothing enabled.. I see that the total for all my current uploading files (currently 4) is pretty strong at > 50 kB/s .. so maybe its just that file..
--
$fontbg Steve the pirate DIES! $Fontbg
reply
alucard_x @ 29th Aug 06:44PM:
Script in Vista still not working

I tested the previous users fix for boxes that have both IPv4 and v6.

It got rid of the divide by zero error, but now i have something else, the total connections increases into the negatives:


etc.. it just keeps going.

here's my output for netstat -s

reply
tshirt @ 29th Aug 10:18PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by Mike18xx :

quote:
WHY: To reduce costs associated with P2P bandwidth growth

Wrong; that's just propaganda. The real reason for this is to KILL bittorrent by preventing the seeding of torrents. Unseeded torrents = dead torrents = dead Bittorrent.

Simple as that.
And why do YOU believe Comcast spent many million'$ just to kill BT?
reply
anon @ 29th Aug 11:03PM:
Re: Comcast is using Sandvine to manage P2P Connections

I can easily fathom many reasons. Hollywood and HBO, for instance, would certainly love to see all those aXXo and Deadwood torrents disappear, and they certainly have had no compunction throwing money at the problem.

Given the massive bandwidth consumption of High-Def (which the major providers are agog over), I find bandwidth arguments concerning bittorrent more than slightly ridiculous. In fact, it's total hokum. Most people would scratch their heads and go "Huh? What's that?" if you walked up to them and whispered "Bittorrent!" in their ears, but 99% of those people are going to go home and watch HOURS AND HOURS AND HOURS OF STREAMING VIDEO called "television". What's BT traffic compared to that?

If it really were a bandwidth rather than ulterior-motive problem, they'd either charge more for bandwidth-intensive usage, or lower their present 44kbps cap down to, say, 20kbps.

No, this Sandvine implementation is expressly intended to kill torrents by depriving them of seeds.
reply
hobgoblin @ 29th Aug 11:13PM:
Re: Comcast is using Sandvine to manage P2P Connections

"but 99% of those people are going to go home and watch HOURS AND HOURS AND HOURS OF STREAMING VIDEO called "television". What's BT traffic compared to that?"

You are comparing apples to ferrets.

Hob
--
"A foolish consistency is the hobgoblin of little minds."
- Ralph Waldo Emerson

reply
macguy @ 29th Aug 11:52PM:
Re: UPDATE Re Comcast is using Sandvine to manage P2P Connection

Even with forcing encryption I'm still getting disconnected. I can seed to a peer for maybe a minute, and then I lose them.

So, apparently, comcast is still preventing seeding in my area.
reply
NormanS @ 30th Aug 12:34AM:
Re: Comcast is using Sandvine to manage P2P Connections

said by Mike18xx :

quote:
WHY: To reduce costs associated with P2P bandwidth growth

Wrong; that's just propaganda. The real reason for this is to KILL bittorrent by preventing the seeding of torrents. Unseeded torrents = dead torrents = dead Bittorrent.

Simple as that.
And why must they kill BitTorrent? And what about the ISPs which aren't trying to kill BitTorrent. AT&T is in bed with the entertainment industry; but I am seeding BT just fine.
--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum
reply
anon @ 30th Aug 12:43AM:
Re: Comcast is using Sandvine to manage P2P Connections

quote:
You are comparing apples to ferrets.
Rubbish; data is data, and it's all managed by a single Comcast box for a "Triple Play" subscriber. Comcast doesn't have a problem finding the bandwidth for HD, or permitting users to browse YouTube all day long, or IRC monstrous files to each other -- yet a measely throttled 44kbps capped upload speed is now somehow suddenly WAY too much for Comcast's bandwidth to handle, and so a technology specifically tailored to croak bittorrent seeding (as opposed to just dropping the cap) is introduced?

The "limited bandwidth" excuse does not wash.
reply
anon @ 30th Aug 12:52AM:
Re: Comcast is using Sandvine to manage P2P Connections

quote:
AT&T is in bed with the entertainment industry; but I am seeding BT just fine.
My nearly exact words, about three days ago in a uTorrent forum, were, "I hope I don't jinx myself, but I'm not having any problems with Comcast." Well, I did jinx myself.

Sandvine is a very recent development, and it and similar "traffic shaping" is spreading quickly throughout ISPs, particularly those granted legal regional monopolies (to say nothing of direct government-run ISPs, as is the case in many countries). Rogers (of Canada) was the camel's nose in the tent; Comcast is the camel's head in the tent. If one more US regional monopoly "triple play" ISP adopts sandvining before new tunneling mechanisms are invented and deployed "default = 'on'" by BT clients, there's a very real possibility that thousands of formerly well-seeded torrents will croak within weeks if not days.
reply
macguy @ 30th Aug 12:54AM:
Re: Comcast is using Sandvine to manage P2P Connections

Forced encryption isn't working here either. I can connect for a maybe a minute or two and then the peer disconnects from me.

Oh well.
reply
hobgoblin @ 30th Aug 01:03AM:
Re: Comcast is using Sandvine to manage P2P Connections

"Rubbish; data is data, and it's all managed by a single Comcast box for a "Triple Play" subscriber. Comcast doesn't have a problem finding the bandwidth for HD, or permitting users to browse YouTube all day long, or IRC monstrous files to each other -- yet a measely throttled 44kbps capped upload speed is now somehow suddenly WAY too much for Comcast's bandwidth to handle, and so a technology specifically tailored to croak bittorrent seeding (as opposed to just dropping the cap) is introduced?

The "limited bandwidth" excuse does not wash."

I think if you understood how a cable plant was set up then you might have a clue why Upstream bandwidth is at a premium.

What single "box" are you rambling on about?

Hob
--
"A foolish consistency is the hobgoblin of little minds."
- Ralph Waldo Emerson

reply
tshirt @ 30th Aug 01:49AM:
Re: Comcast is using Sandvine to manage P2P Connections

said by Honeyko :

Rubbish; data is data, and it's all managed by a single Comcast box for a "Triple Play" subscriber. Comcast doesn't have a problem finding the bandwidth for HD, or permitting users to browse YouTube all day long, or IRC monstrous files to each other -- yet a measely throttled 44kbps capped upload speed
The "limited bandwidth" excuse does not wash.
That HD channel while huge in comparison, streams out to 10's of thousands, maybe millions of viewers, more users do not increase the bandwidth used, and each channel generates considerable monthly income. (via ads, ,premium channel fees, and PPV) it also can by allowed for in the plant design well in advance of demand.
compare that to tens of thousands/millions of different small files transferring by torrent may quickly exceed the data volume of all the HD channels combined, and generate no more income then the same number of "light duty" users.
As Hob said/implied cable by design has massively more downstream capacity then upload, with HSI you may have noticed speeds offer are always around a 12:1 - 8:1 ratio
and most likely will always be in that range, it is a limitation of the technology. Notice that even DSL and fiber offerings, which very easily could be symmetric, are 5:1 or more on the download side.
ComCast could be afraid of legal action from the XXaa's or want to protect future television revenue streams, but I doubt the xxaa's have enough clout/cash on hand to influeance any large ISP away from their best interest keeping the most customers happy and using as many services as possible.
in the long run Hollywood revenues will pale compared to the steady monthly income of the winning triple play providers.

reply
b1gdr3 @ 30th Aug 07:14AM:
Re: Comcast is using Sandvine to manage P2P Connections

said by ztmike :

FIOS doesnt cap your speeds, or no caps on how much you can send/receive

You could seed till you bleed on fios or hell even Cablevision internet with Boost.
Before you say that fios doesn't cap anything I'd read :

»www2.verizon.net/policies/acceptable_use.asp

specifically, letters I, N, and probably Z.
--
I wasn't born with enough middle fingers.
reply
Movieman420 @ 30th Aug 10:21AM:
Re: Comcast is using Sandvine to manage P2P Connections

As I posted on pg 15, I'm able to seed now...and at normal speeds (for me) up to 120k! Never figured out how to force uT to use the VPN I set up (I'm not network savy..lol) so I just enabled the lazy bit field and turned on crypto and 2 days later I was seeding again. Doubt setting the LBF and crypto had much to do with it tho. Not sure what to think. I had it out with a CC tech over the phone when this started..basicaly pinned him down..lol.
Hope other CC peeps see the same happen to them. ;)

Deets:

Live in WV...my connection ultimately comes from Pittsburgh, PA
I pay for the 8Mb connect. My avg. max sustained d/l speeds are between 1 and 2MB/s and my avg max sustained up is ~120kBp/s. These speeds are rather high unless I was just speaking of a power boost 'surge' (I hit 20Mb down and 2500kb up on the flash speed test with boost)..otherwise these are my everyday speeds tho...I live in a semi rural area, maybe my node is actually 'undersold'?? Rofl...
Click for full size
reply
NormanS @ 30th Aug 10:42AM:
Re: Comcast is using Sandvine to manage P2P Connections

said by Honeyko :

Sandvine is a very recent development...
If you consider something that was deployed prior to June, 2005 "recent".

I don't see any evidence that traffic shaping is spreading rapidly; unless the "Slowskis" are your idea of rapid.

I see no evidence of telco use of Sandvine (even checked the Bell Sympatico (Canada) forum; nothing definitive). I see no evidence of Rogers style choking with Comcast. At least Funchords is demonstrating that Comcast is doing this more to mange bandwidth than to kill BitTorrent.

If AT&T were truly at the "beck and call" of the *IAA, they would have rolled over (when they were called, "SBC") for the DMCA subpoenas, instead of refusing to honor them.

And, while it is unclear to me whether SBC joined with Verizon in appealing a court decision in favor of the *IAA, Verizon did appeal, and the *IAA got their heads handed to them by a U.S. Appellate court.
--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum
reply
jbob @ 30th Aug 10:49AM:
Re: Comcast is using Sandvine to manage P2P Connections

Just for a report, I had downloaded a few files yesterday using Shareaza. When it was done I let Shareaza run the rest of the day until late last night. It was seeding files from some previous downloads over the last 2 months. During the night I noticed it was uploading at over 600K. Comcast Gold subscriber, 768K. I'm not big into P2P so wouldn't consider myself all that knowledgeable in all the nuances but that seemed very fast to me. FWIW
reply
funchords @ 30th Aug 01:35PM:
Re: Comcast is using Sandvine to manage P2P Connections

Nice article -- Comcast killing BitTorrent upload connections (Verified)

Snapped 2007-08-30 13:35:13

»davidjsmitty.com/blog/me/archive···ied.aspx

reply
reelbigfish @ 30th Aug 01:58PM:
Re: Comcast is using Sandvine to manage P2P Connections

Currently I am uploading between 24 KB/s and 88 KB/s. It seems like they are throttling the speeds but not killing the connection completely. I don't think this is so bad as it is keeping the network up and running but still allowing me to seed files.
reply
johnmwilson7 @ 30th Aug 09:13PM:
Re: How to test how many connections are being reset by RST pack

FunChords,

Your script was passed on to me by a friend and I learned a lot from it.

Anyway, here is Version 3, it tracks current reset percent, average reset percent and displays a histogram. The histogram shows where the majority of your reset activity is occurring.

Perhaps it is overkill, but I had fun testing it.

Thanks,

John M. Wilson

------CUT HERE ------

@ECHO OFF
REM
REM Title: NetStat Check Reset V3
REM
REM Description: Extract summary data from Netstat and display percentage of current, average and a histogram of connection resets.
REM
REM CURRENT percentages are the difference between the previous (20 seconds ago) and current Netstat results.
REM AVERAGE percentages are the running total of the current percentages.
REM HISTOGRAM is a ranking of the number of current percentages that occurred. This shows the distribution of resets from 1-99 percent.
REM
REM So while the Average percentage may be 35%, the Histogram may show the majority of Current percentages are in the 20% range
REM with some spikes in the 40% or 50% range. This would indicate normal reset activity to be in the 20% range and the focus would be
REM in resolving the spikes.
REM

SETLOCAL
TITLE NetStat Check Reset V3
CLS
ECHO NetStat Check Reset Batch V3 [Ctrl-c quit]

REM Initialize variables
:init

REM Histogram values
SET HST00=0
SET HST10=0
SET HST20=0
SET HST30=0
SET HST40=0
SET HST50=0
SET HST60=0
SET HST70=0
SET HST80=0
SET HST90=0

REM Histogram print strings
SET PST00=___
SET PST10=___
SET PST20=___
SET PST30=___
SET PST40=___
SET PST50=___
SET PST60=___
SET PST70=___
SET PST80=___
SET PST90=___

REM Loop counter for header print
SET /A TESTCYCLE=-1

REM run Netstat summary page, find line and save 2nd field value
FOR /F "usebackq tokens=2 delims==" %%i IN (`netstat -s ^| find "Active Opens"`) DO SET /A PRVACTI=%%i
FOR /F "usebackq tokens=2 delims==" %%i IN (`netstat -s ^| find "Passive Opens"`) DO SET /A PRVPASS=%%i
FOR /F "usebackq tokens=2 delims==" %%i IN (`netstat -s ^| find "Failed Connection Attempts"`) DO SET /A PRVFAIL=%%i
FOR /F "usebackq tokens=2 delims==" %%i IN (`netstat -s ^| find "Reset Connections"`) DO SET /A PRVRESE=%%i

REM Begin loop section
:begin

REM Increment test cycles
SET /A TESTCYCLE=%TESTCYCLE%+1
IF %TESTCYCLE% GEQ 10 SET /A TESTCYCLE=0

REM Ping to nul used as timer
REM Each ping approximately 1 second delay
REM Value of 20 used as minimum wait time for connection activity.
REM
ping -n 20 localhost >nul

REM run Netstat summary page, find line and save 2nd field value
FOR /F "usebackq tokens=2 delims==" %%i IN (`netstat -s ^| find "Active Opens"`) DO SET /A NXTACTI=%%i
FOR /F "usebackq tokens=2 delims==" %%i IN (`netstat -s ^| find "Passive Opens"`) DO SET /A NXTPASS=%%i
FOR /F "usebackq tokens=2 delims==" %%i IN (`netstat -s ^| find "Failed Connection Attempts"`) DO SET /A NXTFAIL=%%i
FOR /F "usebackq tokens=2 delims==" %%i IN (`netstat -s ^| find "Reset Connections"`) DO SET /A NXTRESE=%%i

REM Subtract Previous from Next to get Current
SET /A CURACTI=%NXTACTI%-%PRVACTI%
SET /A CURPASS=%NXTPASS%-%PRVPASS%
SET /A CURFAIL=%NXTFAIL%-%PRVFAIL%
SET /A CURRESE=%NXTRESE%-%PRVRESE%

REM Accumulate the totals for averaging
SET /A CUMACTI=%CUMACTI%+%CURACTI%
SET /A CUMPASS=%CUMPASS%+%CURPASS%
SET /A CUMFAIL=%CUMFAIL%+%CURFAIL%
SET /A CUMRESE=%CUMRESE%+%CURRESE%

REM Add Active and Passive connections then subtract Failed connections
REM Calculate Percentage of Resets
SET /A CURESTA=(%CURACTI%+%CURPASS%)-%CURFAIL%

REM Bypass divide by zero errors
SET /A CURPRCT=0
IF %CURESTA% NEQ 0 SET /A CURPRCT=(%CURRESE%*100)/%CURESTA%

REM Accumulate current results for session average
SET /A CUMESTA=(%CUMACTI%+%CUMPASS%)-%CUMFAIL%

REM Bypass divide by zero errors
SET /A CUMPRCT=0
IF %CUMESTA% NEQ 0 SET /A CUMPRCT=(%CUMRESE%*100)/%CUMESTA%

REM Load histogram with current percentages in the range of 1-99%
IF %CURPRCT% LEQ 0 GOTO display

:break00
IF %CURPRCT% GEQ 10 GOTO break10
SET /A HST00=%HST00%+1
SET PST00=%HST00%
IF %HST00% LSS 10 SET PST00=_%PST00%
IF %HST00% LSS 100 SET PST00=_%PST00%
GOTO display

:break10
IF %CURPRCT% GEQ 20 GOTO break20
SET /A HST10=%HST10%+1
SET PST10=%HST10%
IF %HST10% LSS 10 SET PST10=_%PST10%
IF %HST10% LSS 100 SET PST10=_%PST10%
GOTO display

:break20
IF %CURPRCT% GEQ 30 GOTO break30
SET /A HST20=%HST20%+1
SET PST20=%HST20%
IF %HST20% LSS 10 SET PST20=_%PST20%
IF %HST20% LSS 100 SET PST20=_%PST20%
GOTO display

:break30
IF %CURPRCT% GEQ 40 GOTO break40
SET /A HST30=%HST30%+1
SET PST30=%HST30%
IF %HST30% LSS 10 SET PST30=_%PST30%
IF %HST30% LSS 100 SET PST30=_%PST30%
GOTO display

:break40
IF %CURPRCT% GEQ 50 GOTO break50
SET /A HST40=%HST40%+1
SET PST40=%HST40%
IF %HST40% LSS 10 SET PST40=_%PST40%
IF %HST40% LSS 100 SET PST40=_%PST40%
GOTO display

:break50
IF %CURPRCT% GEQ 60 GOTO break60
SET /A HST50=%HST50%+1
SET PST50=%HST50%
IF %HST50% LSS 10 SET PST50=_%PST50%
IF %HST50% LSS 100 SET PST50=_%PST50%
GOTO display

:break60
IF %CURPRCT% GEQ 70 GOTO break70
SET /A HST60=%HST60%+1
SET PST60=%HST60%
IF %HST60% LSS 10 SET PST60=_%PST60%
IF %HST60% LSS 100 SET PST60=_%PST60%
GOTO display

:break70
IF %CURPRCT% GEQ 80 GOTO break80
SET /A HST70=%HST70%+1
SET PST70=%HST70%
IF %HST70% LSS 10 SET PST70=_%PST70%
IF %HST70% LSS 100 SET PST70=_%PST70%
GOTO display

:break80
IF %CURPRCT% GEQ 90 GOTO break90
SET /A HST80=%HST80%+1
SET PST80=%HST80%
IF %HST80% LSS 10 SET PST80=_%PST80%
IF %HST80% LSS 100 SET PST80=_%PST80%
GOTO display

:break90
IF %CURPRCT% GEQ 100 GOTO break100
SET /A HST90=%HST90%+1
SET PST90=%HST90%
IF %HST90% LSS 10 SET PST90=_%PST90%
IF %HST90% LSS 100 SET PST90=_%PST90%
GOTO display

:break100

REM Final formatting and print
:display

REM Assign values to print strings
SET PCUMESTA=%CUMESTA%
SET PCUMRESE=%CUMRESE%
SET PCUMPRCT=%CUMPRCT%
SET PCURESTA=%CURESTA%
SET PCURRESE=%CURRESE%
SET PCURPRCT=%CURPRCT%

REM Skip leading zero for negative numbers
IF %CUMESTA% LSS 0 GOTO dbreak1
IF %CUMESTA% LSS 10 SET PCUMESTA=0%CUMESTA%
:dbreak1

IF %CUMRESE% LSS 0 GOTO dbreak2
IF %CUMRESE% LSS 10 SET PCUMRESE=0%CUMRESE%
:dbreak2

IF %CURESTA% LSS 0 GOTO dbreak3
IF %CURESTA% LSS 10 SET PCURESTA=0%CURESTA%
:dbreak3

IF %CURRESE% LSS 0 GOTO dbreak4
IF %CURRESE% LSS 10 SET PCURRESE=0%CURRESE%
:dbreak4

REM Print line break and header every 10 cycles
IF %TESTCYCLE% EQU 0 ECHO .
IF %TESTCYCLE% EQU 0 ECHO %TIME% - CURRENT AVERAGE I 00%% I 10%% I 20%% I 30%% I 40%% I 50%% I 60%% I 70%% I 80%% I 90%% I

REM Print Current percentage, Average Percentage and Histogram
ECHO %TIME% - %PCURPRCT%%% (%PCURRESE%/%PCURESTA%) %PCUMPRCT%%% (%PCUMRESE%/%PCUMESTA%) I %PST00% I %PST10% I %PST20% I %PST30% I %PST40% I %PST50% I %PST60% I %PST70% I %PST80% I %PST90% I

REM Save values into Previous
SET /A PRVACTI=%NXTACTI%
SET /A PRVPASS=%NXTPASS%
SET /A PRVFAIL=%NXTFAIL%
SET /A PRVRESE=%NXTRESE%

REM Loop again
GOTO begin

------CUT HERE ------
reply
Movieman420 @ 31st Aug 08:54AM:
Re: How to test how many connections are being reset by RST pack

Since script JW. I went from being unable to seed at all a week ago...set up a vpn but couldn't get Az or uT to use it..lol. As of 2 days ago I'm seeding like normal (see above post).
Just used the script above...after 5 cycles (sets) my rst rate is almost exactly 20%.

Q to JW...does this script count all rst's or just the forged sandvine rsts??

Dunno wat I did to regain seeding ability (except a rather heated one sided convo with a CC tech bout traffic shaping..rofl) but I'm glad to be 'back'.
reply
funchords @ 31st Aug 06:21PM:
Re: How to test how many connections are being reset by RST pack

said by Movieman420 :

Q to JW...does this script count all rst's or just the forged sandvine rsts??
The script counts them all, but on a "clean" (non-Sandvine) line, there should be very, very few (0% to 1%?). The RST is designed to close improperly half-open TCP connections. They generally only occur when one side or the other has closed the connection without going through the "FIN" final handshake. (This usually only happens when one side or the other spontaneously reboots).
--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
Are you affected by Comcast's RST forging? How to test it! -or- Read my original report.
reply
johnmwilson7 @ 31st Aug 08:10PM:
Re: How to test how many connections are being reset by RST pack

FunChords,

My next step will be to install WireShark and view the traffic to see what I can see. I am used to using Ethereal on my Linux box, but I can run WireShark on Windows. Other than the standard filtering options, any tips on sourcing the resets with this tool?

Sincerely,

John M. Wilson
reply
funchords @ 31st Aug 08:36PM:
Re: How to test how many connections are being reset by RST pack

said by johnmwilson7 :

Other than the standard filtering options, any tips on sourcing the resets with this tool?
RST's with a sequence number seq=0 are probably not injected. Everything else is a "maybe" so you have to look at what was happening in the conversation and decide. RST's right on the tail of a bunch of data that was not problematic are very suspicious.

My last interesting discovery is that the injected RSTs had a TTL (in the IP header) of 123. The norm TTL from my computer was 128, and my peer was often in the 110s or 100s TTL. If my peer was coming in TTL=109 but the RSTs were TTL=123, that is surely injected. HOWEVER, someone on the east coast sent me his capture file, and his RSTs that were seemingly injected all had the right TTL for his peer. :( I don't have enough data -- so look out for that for me.
--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
Are you affected by Comcast's RST forging? How to test it! -or- Read my original report.
reply
johnmwilson7 @ 31st Aug 09:33PM:
Re: How to test how many connections are being reset by RST pack

FunChords,

Pardon my obvious question. I got WireShark installed and running. However, I could not figure out how to build a filter string for the RSET commands. I want to see all resets, so the filter should be simple.

By the way, cool website, I like the view from your house.

P.S. I found your other post detailing how to view the resets, so I am good.

»Comcast is using Sandvine to manage P2P Connections

Sincerely,

John M. Wilson
reply
johnmwilson7 @ 31st Aug 10:26PM:
Re: How to test how many connections are being reset by RST pack

FunChords,

Using the following filter string

"(ip.src != your.ip.addr.ess) and (tcp.flags.reset == 1)"

I was able to get a steady display of incoming resets. Of course most would be normal. However looking at the list, which ones should I consider to be suspect?

Sincerely,

John M. Wilson
reply
funchords @ 31st Aug 11:28PM:
Re: How to test how many connections are being reset by RST pack

The ones where Seq>1 and Ack>1 in the display (generally this means that data has already passed both ways, even if it was just a handshake).
reply
johnmwilson7 @ 1st Sep 08:40AM:
Re: How to test how many connections are being reset by RST pack

FunChords,

Great, that will help. I have updated my filter string as shown below;

"( ip.src != your.ip.addr.ess ) and ( tcp.flags.reset == 1) and (tcp.seq > 1) and ( tcp.ack > 1)and (tcp.dstport == yourport)"

With name resolution turned on, many of the connection sources are identified. So it is easy for me to recognize the packets from my network provider.

So my question is, are the forged resets spoofed as well? Or will they have the same name as my network provider?

Thanks for taking the time to walk me thru this. Hopefully others will find it useful as well.

Sincerely,

John M. Wilson
reply
funchords @ 1st Sep 12:09PM:
Re: How to test how many connections are being reset by RST pack

It looks like you're ready -- right click on one of those red lines and choose "Follow TCP Stream"

The RSTs are forged to appear to come from your Peer. They sometimes come at the end of stream of data, but more often they come right after a peer makes a request or after bitfields are exchanged.

An example is here: »torrentfreak.com/images/comcast-rst1.txt

Many of the RSTs you'll see will be clear cases of injected (forged) RST. Get to know those patterns.

When you look at the TCP Stream, one possibility is that the connection was shaky -- you'll see lots of retransmits and the RSTs that come won't fit the pattern of ones that are positively injected. These RSTs may or may not be legitimate, and when I'm not sure, I discount it.

Hope that helps!
--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
Are you affected by Comcast's RST forging? How to test it! -or- Read my original report.
reply
anon @ 1st Sep 01:08PM:
Re: UPDATE Re Comcast is using Sandvine to manage P2P Connection

Robb,

I've notice my bit torrent share ratios have dropped over the past few months. My seeding stops after the download completes. Where do I change the setting to forced encryption? On my bit torrent client? On my lynksys router? I'm technology challenged but can follow directions.

Thanks

Kevin
Kreilly (at) aol.com
reply
funchords @ 1st Sep 04:05PM:
Re: UPDATE Re Comcast is using Sandvine to manage P2P Connection

Hi Kevin!

Set it in your BitTorrent client. (You'll need to make sure that your client supports it.)

Here is a list that is somewhat current:

»en.wikipedia.org/wiki/BitTorrent···versions
reply
villain106 @ 1st Sep 05:59PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by NormanS :

said by Honeyko :

Sandvine is a very recent development...
If you consider something that was deployed prior to June, 2005 "recent".

I see no evidence of telco use of Sandvine (even checked the Bell Sympatico (Canada) forum; nothing definitive). I see no evidence of Rogers style choking with Comcast. At least Funchords is demonstrating that Comcast is doing this more to mange bandwidth than to kill BitTorrent.

Bell is DSL, Sandvine is primary focused on Cable ISP. Rogers uses a company called P-cube.
reply
Kelex @ 1st Sep 10:00PM:
Re: Script in Vista still not working

said by alucard_x :

I tested the previous users fix for boxes that have both IPv4 and v6.

It got rid of the divide by zero error, but now i have something else, the total connections increases into the negatives:


etc.. it just keeps going.
I am having the same problem... the version 2 script is returning all negative data now. The Version 3 is showing zero's across the board. Any Suggestions?

reply
Movieman420 @ 1st Sep 10:11PM:
Re: How to test how many connections are being reset by RST pack

said by funchords :

It looks like you're ready -- right click on one of those red lines and choose "Follow TCP Stream"
:o eegads..waaay to deep for me..lol.
Click for full size
reply
funchords @ 1st Sep 10:50PM:
Re: How to test how many connections are being reset by RST pack

158 kB/s upload is insanely fast! Is this one of those 16Mb/2Mb tiers of service?

Remember, all things in moderation. Even though you have 16M/2M, your neighborhood is still sharing the same pipe. Be a kind sharer. :)
reply
johnmwilson7 @ 2nd Sep 10:54AM:
Re: How to test how many connections are being reset by RST pack

FunChords,

Thank you for your kind assistance. I have summarized your explanations on a new post with credit to you.

»[Speed] There are good resets and there are bad resets...

Sincerely,

John M. Wilson
reply
funchords @ 2nd Sep 11:31AM:
Re: How to test how many connections are being reset by RST pack

said by johnmwilson7 :

Regarding Resets, there are good resets and there are bad resets.
Good and bad are subjective assessments. How about Expected and Unexpected, or perhaps Genuine and Forged

said by johnmwilson7 :

Along with the received SEQuence is included a command to be executed, such as SYNchronize at the beginning and reset (RST) at the end. Normal network transactions finish with a reset (RST) command.
Each received SEQuence may include a command to be executed, such as SYNchronize at the beginning and Final (FIN) at the end. Normal network transactions finish with a Final (FIN) command. »tools.ietf.org/html/rfc793#section-3.5

One command in a sequence may be Abort (RST). Abort is sent by an endpoint when a received SEQuence is not expected or allowed, such as attempting to connect to a closed port, or attempting to send data to an endpoint without first going through the SYN process.

It is not unusual to see an RST being sent at the very end of a properly-ended connection (using the FIN commands). These packets are a result of a stateful firewall at one endpoint or another which has closed the connection but then receives the final acknowledgment ("FIN,ACK") packet. While these RST responses are not necessary, they are harmless.

said by johnmwilson7 :

and then a second reset (RST) with an out of sequence number is also sent.
Yeah, I don't know what this second one is about. It is superfluous. There is no reason to send it.

said by johnmwilson7 :

Understand that you cannot easily verify the source of these resets: They can come from anyone who can view and transmit on the network. If they are forged, they can be made to look like anyone, even you. Some sources can be low-end traffic shapers, network blocking programs, hacker programs, or the actual sender may have a problem with their client.
It's key to understand that an idle attacker cannot easily accomplish this. This needs to be done by someone/something that it "in-line," that can read both sides of the conversation, and inject or forge a packet with exactly the correct sequence numbers.

Forging TCP packets is exceedingly difficult unless you are "the man in the middle."

said by johnmwilson7 :

Some solutions, in order of difficulty;
These are all generally fine suggestions.

One thing I don't see here is anything about tolerating it or "complaining" about it.

The ISP is not necessarily an evil entity. You got 3 resets in 10 minutes, and you're okay with that. I got a lot more and, still, I'm okay with that (for BitTorrent, anyway.)

However, Gnutella is broken for me. One option that I should explore is calling (or writing, with evidence provided) into Support and asking for the problem to be investigated and fixed.
--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
Are you affected by Comcast's RST forging? How to test it! -or- Read my original report.
reply
anon @ 2nd Sep 11:41AM:
Re: How to test how many connections are being reset by RST pack

The problem though is whatever Comcast is doing to monitor P2P is resulting in serious latency crud for some of the rest of us who don't use or even have BitTorrent. 3 days straight I have had my cable modem here in the MD/VA/DC area literally bombarded with 6881 incoming port traffic (the log is long and glorious) - a reverse lookup on those IPs reveal cable modems from both comcast.net as well as other cable/dsl providers and our routes are toasted as a result. Comcast Tech Support knows about it and calls it "network maintenance" If they're going to use to such software and monitoring tools, perhaps they should at least configure it correctly.
reply
anon @ 2nd Sep 12:43PM:
Re: Comcast is using Sandvine to manage P2P Connections

Sheesh! If you all don't like Comcast's terms, go get a 45 Mb DS3. They can be had for ~$15,000/mo.

Too spendy for ya? Maybe you could find 5 neighbors to split the tab, you each would have 7Mb pipes to suck on 24/7/365. You'd be in file pirate's heaven! No restrictions!
reply
funchords @ 2nd Sep 01:21PM:
Re: How to test how many connections are being reset by RST pack

said by dontask2much :

The problem though is whatever Comcast is doing to monitor P2P is resulting in serious latency crud for some of the rest of us who don't use or even have BitTorrent.
I read your whole message. I'm 100% sure this is not related to Sandvine or BitTorrent monitoring.

What you are seeing sounds like "P2P Afterglow." »Re: Dangers of P2P filesharing networks?

Your firewall should be ignoring these packets. If they are causing latency, it probably is due to the number of CPU cycles that the router has to spend to evaluate or log them. It doesn't take any CPU cycles to drop them.

But if they really are causing problems, you can change your IP: »Comcast High Speed Internet FAQ »How do I get a different IP address?
--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
Are you affected by Comcast's RST forging? How to test it! -or- Read my original report.
reply
NormanS @ 2nd Sep 02:48PM:
Re: How to test how many connections are being reset by RST pack

said by dontask2much :

3 days straight I have had my cable modem here in the MD/VA/DC area literally bombarded with 6881 incoming port traffic...
Such connection attempts have never been a problem for me. And I often see them after I close a torrent. It sound more like your equipment can't handle the probes than that the Comcast network is suffering.

Also, I don't see how Sandvine can be a part of the problem. You shouldn't see so many BT connection attempts if you never use it. The peers only attempt to connect to a client which was part of torrent.

If I were a guessing person, I'd guess you have a wireless LAN, and an uninvited hitch hiker using your WLAN for their torrent sessions.
--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum
reply
Movieman420 @ 2nd Sep 05:42PM:
Re: How to test how many connections are being reset by RST pack

Heh..this will blow your mind...Blast! isn't available in my area (WV..go figure...lol)! I signed up for the premium tier..the 8Mb line..when I asked what the upload bw was, I couldn't get an answer from the comcast person I talked to...I just figured it couldn't be any worse than my previous RoadRunner 9Mb line w/ 512kbps up, ~60k max u/l. My local computer guru who is also on comcast (formerly adephia like my area) told me of his speeds (he's in a semi-rural area)..thought it was a fluke. But I was wrong :)...I can maintain ~1,500k down (1.5MB) and between 80 and 160k up...u/l fluctuates. My only guess is my node is way undersold (I'm in a semi-rural area as well)..or it has something to do with the comcast/time warner buyout of Adelphia cable and my 'limits' got lost in the shuffle..I dunno but I love it..lol. On the flash bw test I hit 20+ down and usually 1.5Mb up but thats powerboost involved.

My last few tests:

»/archive/comca···t=Search

Any way...a quick thought (for wat it's worth..lol)..Some clients do not show as a seed to other peers when in superseed mode...wonder if this mode could somehow be modified/used/employed to help 'fool' the sandvine box into thinking your not 'seeding'. I may be p!issin in the wind..just thought I'd mention it tho.
reply
funchords @ 2nd Sep 07:00PM:
Re: How to test how many connections are being reset by RST pack

said by Movieman420 :

My last few tests:

»/archive/comca···t=Search
I hate you and everything that you stand for! ;)
said by Movieman420 :

Any way...a quick thought (for wat it's worth..lol)..Some clients do not show as a seed to other peers when in superseed mode...wonder if this mode could somehow be modified/used/employed to help 'fool' the sandvine box into thinking your not 'seeding'.
Lazy Bitfield does about the same thing, but I think your suggestion is worth a test.
--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
Are you affected by Comcast's RST forging? How to test it! -or- Read my original report.
reply
funchords @ 3rd Sep 07:09PM:
Optimize BitTorrent To Outwit Traffic Shaping ISPs

said by funchords :

said by Movieman420 :Some clients do not show as a seed to other peers when in superseed mode...wonder if this mode could somehow be modified/used/employed to help 'fool' the sandvine box into thinking your not 'seeding'.
Lazy Bitfield does about the same thing, but I think your suggestion is worth a test.
I tried it both ways today, no joy. But very good thinking on your part! :)

On a related note, here's something from Wired's HOW-TO Wiki. I am not the original author, but since I provided the last revisions, some displays (like the RSS) have listed me as the author. I don't deserve the credit:

Optimize BitTorrent To Outwit Traffic Shaping ISPs
--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
Are you affected by Comcast's RST forging? How to test it! -or- Read my original report.
reply
Movieman420 @ 3rd Sep 07:25PM:
Re: Optimize BitTorrent To Outwit Traffic Shaping ISPs

A somewhat dark ending in that article...let's just hope the developers of Az and uT are getting busy with something. As the two most popular clients it'd be nice if they came up with a joint strategy together. One can only hope... :hmm:
reply
deblin @ 3rd Sep 10:18PM:
Re: Optimize BitTorrent To Outwit Traffic Shaping ISPs

Doesn't enabling (forcing) encryption have a similar effect, though? At least until it catches on, this means less peers (both up and down) if you enable and force encryption. Perhaps not as detrimental to the upstream side, but then the downstream side suffers, too.
--
"The Dude abides."
reply
jig @ 3rd Sep 11:47PM:
Re: Optimize BitTorrent To Outwit Traffic Shaping ISPs

the major reason to care about seeding is for ratio purposes, and there are two ways to fix that....
reply
StuartA67 @ 4th Sep 12:39PM:
Re: Optimize BitTorrent To Outwit Traffic Shaping ISPs

I'm a little technically challenged. What would I be looking for to see if the rst's are being sent. I have a network sniffer and saw quite a bit of action coming from Comcast and going to the port I have opened for bittorrent. Just not sure what it means exactly and I don't see rst in those.
reply
Movieman420 @ 4th Sep 04:14PM:
Re: Optimize BitTorrent To Outwit Traffic Shaping ISPs

Thu a vpn or ssh tunnel (works for now at least) ...or spend a little money and get a host for a seed box. :)
reply
Selenia @ 4th Sep 07:51PM:
Re: Comcast is using Sandvine to manage P2P Connections

I have looked at Sandvine out of curiousity and possibly for proposing it for a certain municipal network. I can say it is an awesome tool. There are many tools in computers these days that can be used to do great things, but also terrible things. Sandvine is one such tool, It is very configurable and can redirect traffic relatively transparently, keeping backbone traffic and network load down, yet helping out many ping dependent games and applications all the while speeding up plenty of P2P downloads, It can also be configured to pretty well kill a protocol in such a way that it does not point to ISP blocking(shame on any ISP that does this). Its filters can be set in an advanced manner but it sounds like there are some primitive users. Some tools are only as good as their users. I can say with confidence that Sandvine can be a very good thing. I am just not sure how good it would be in huge greedy corporate hands like Comcast.
reply
funchords @ 4th Sep 08:34PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by Selenia :

Its filters can be set in an advanced manner but it sounds like there are some primitive users. Some tools are only as good as their users.
Sandvine (the Company) has a very strong interest in seeing Comcast and its customers succeed with Sandvine (the P2P Policy Product). If Comcast needs help, I'm positive it is just a telephone call away.

PS: I know that this topic is being regularly read by Comcast and Sandvine insiders -- you guys really should pick up the phone and talk to one another.
--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
Are you affected by Comcast's RST forging? How to test it! -or- Read my original report.
reply
Roundboy @ 4th Sep 08:48PM:
Re: Comcast is using Sandvine to manage P2P Connections

is it possible to selectively drop RST packets?

one packet is not a false packet, but many over a period of time are fake..

can we filter one packet, and after a small period of time (milliseconds) allow it though if its the only one, or keep filtering if its repeated ?
--
[spoiler]Steve the pirate DIES![/spoiler]
reply
Maarvin @ 4th Sep 09:48PM:
Re: Comcast is using Sandvine to manage P2P Connections

It has taken me a few days to read through this whole thread. I took interest in it as Azureus has been acting up badly within the last month or so. I don't do very much P2P, but I find it useful at times.

I first noticed things acting strange after a problem free download. The seed displayed that I was firewalled even though a test of the port showed that it was open. Nothing I could do would get me to seed. I just gave up.

Recently, Azureus updated to 3.0.2.0, so using the CheckRST.bat file (that I am grateful for) I ran another test with logging on and with the following conditions set to on:
- Require Encrypted Transport
- Minimum Encryption level to RC4
- Use Lazy Bitfield

And for the heck of it:
- Allow multiple connections from same IP
- Prioritize first and last pieces of file(s)

This worked. Although the RSTs received were averaging about 25%. The download completed normally as did seeding. It continues as I write this.

Edit: P.S. QoS for the port was enabled at the router as well.
--
The first rule of fiber optics: you do not talk about fiber optics, ever!


reply
dfxmatt @ 4th Sep 10:55PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by funchords :

said by Selenia :

Its filters can be set in an advanced manner but it sounds like there are some primitive users. Some tools are only as good as their users.
Sandvine (the Company) has a very strong interest in seeing Comcast and its customers succeed with Sandvine (the P2P Policy Product). If Comcast needs help, I'm positive it is just a telephone call away.

PS: I know that this topic is being regularly read by Comcast and Sandvine insiders -- you guys really should pick up the phone and talk to one another.
Last time I talked to them on the phone (comcast), I was treated very aggressively, almost threatened by the techs. So I don't know what to say.

For those who call comcast, please record your calls. Do remember that when they say "these calls may be recorded for quality assurance" is the neccessary notification to record them as well. I can't find the exact link but here is an Example: »www.voiceprintonline.com/news_fu···le_id=51
reply
anon @ 5th Sep 07:29PM:
Re: Optimize BitTorrent To Outwit Traffic Shaping ISPs

said by Movieman420 :

Thu a vpn or ssh tunnel (works for now at least) ...or spend a little money and get a host for a seed box. :)
Can you give a little more direction, even in the form of a link with info. Several posters above have said they haven't had success with this method (I'm not able to get it working either with SecureIx).

Thanks
reply
Presage @ 6th Sep 08:33PM:
Re: Optimize BitTorrent To Outwit Traffic Shaping ISPs

Use PuTTy and a shell to use SSH and tunnel your bittorrent traffic. Info here: »whalesalad.com/2006/08/27/tunnel···/#eberth

I recommend checking freeshells.info for shells.
reply
koitsu @ 7th Sep 03:10AM:
Re: Optimize BitTorrent To Outwit Traffic Shaping ISPs

And I recommend talking to your shell provider before doing this. It's considered "rude" to blindly siphon network traffic through a shell host like this, since now you're not only using up large amounts of bandwidth yourself, but on your shell providers' uplink as well.

I can tell you that as a hosting provider that offers SSH, if our users started doing that with their shell accounts, I'd be *livid*.
reply
anon @ 7th Sep 04:40AM:
Re: Comcast is using Sandvine to manage P2P Connections

I just moved to Seattle and I am now having problems related to BT with Comcast, which I wasn't having before. Utorrent is constantly dropping the connection, which seems in line with what is being discussed here, but it is not doing it with every tracker.

Is this something tracker related or something Comcast is doing? I can upload elsewhere at the 90 kb/s rate that I get with the 8mbps package.

Seems strange that it is only shaping traffic in regards to particular trackers.
reply
anon @ 7th Sep 10:48AM:
Re: Comcast is using Sandvine to manage P2P Connections

I'm not having the problem descibed, but is this the magic bullet for those that are?

»redhatcat.blogspot.com/2007_09_0···ive.html
reply
funchords @ 7th Sep 04:02PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by Rom :

Utorrent is constantly dropping the connection,
What you will see is, looking at the peer list, is that peers will appear for up to 30 seconds, then disappear. This will happen over and over.

It has nothing to do with the Tracker or your connection with the tracker. It affects the connections with your peers.
--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
Are you affected by Comcast's RST forging? How to test it! -or- Read my original report.
reply
funchords @ 7th Sep 04:04PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by Could Be The Fix :

I'm not having the problem descibed, but is this the magic bullet for those that are?

»redhatcat.blogspot.com/2007_09_0···ive.html
No. The RST packet is sent in both directions -- so even if you ignore the RST, your peer is still going to obey it -- leaving a half-open connection.
--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
Are you affected by Comcast's RST forging? How to test it! -or- Read my original report.
reply
NormanS @ 7th Sep 04:51PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by funchords :

said by Could Be The Fix :

I'm not having the problem descibed, but is this the magic bullet for those that are?

»redhatcat.blogspot.com/2007_09_0···ive.html
No. The RST packet is sent in both directions -- so even if you ignore the RST, your peer is still going to obey it -- leaving a half-open connection.
You have gone to a depth that surpasses my understanding of the way things work...I think. Still, what if I checked on my end (at&t Yahoo! HSI customer) for forged RST packet from Comcast. If I ignored them and the Comcast user ignored them, what would happen?
--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum
reply
koitsu @ 7th Sep 05:16PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by NormanS :

You have gone to a depth that surpasses my understanding of the way things work...I think. Still, what if I checked on my end (at&t Yahoo! HSI customer) for forged RST packet from Comcast. If I ignored them and the Comcast user ignored them, what would happen?
Two things -- both bad -- could happen:

1) You'd have a TCP session that was in an unknown/invalid state. Such can happen in the case of latent networks, or where part of the SYN/SYN+ACK handshake fails. TCP RST is quite valid under normal operation (and happens more often than one thinks), so it's important to respect that.

2) You'd have a TCP session that would never get torn down. What decides how the connection is torn down? Essentially it's up to the application to decide how they want to handle an error condition on recv(3) (I'm talking UNIX here; no idea how Windows' TCP stack works on this).

A fairly ugly/vague explanation is here:

»www.flukenetworks.com/fnet/en-us···pert.htm

A better analysis is here:

»pages.cpsc.ucalgary.ca/~carey/pa···sets.pdf

Your question got me thinking, though:

It *is* possible to write a program that makes some assumptions about the TCP state (that is to say, two programs both written to essentially never induce TCP RST). This means that it *is* possible for someone to write/modify a BitTorrent client to simply ignore RST (by handling the error condition differently), and continue on blindly. However, this situation would have to be negotiated in some way between client/peer and server/seed because you couldn't just blindly assume the TCP session was flawless -- it isn't, which is why TCP is stateful!

Thus brings me to another conclusion:

Why not just use UDP? It's stateless (thus faster than TCP), but has the downside of not having send/receive guaranteed like TCP does. UDP is used by most FPS online games, because if you lose a single packet (due to whatever), that pretty much amounts to a lost bullet, lost step/movement to the right, or whatever else. Chances are less than 1ms later, the client will be sending another one of those anyway (especially in regards to movement), so the lost packet is not a big deal.

If you're an old BBS user, you can consider UDP synonymous with Ymodem-G (known for blazing speeds, but absolutely no data validation, so you took a risk in the case that your modem didn't have EC (or the remote end lacked EC)).

Using UDP datagrams, the clients would have to essentially emulate TCP over UDP (that is to say, do some sort of handshake where one sends a large UDP packet, performs a checksum validation of it, asks the server/seed "is this right?" and have it reply "yes it is" and continue on).

Using this method would work around the Sandvine's interceptor. You might be wondering, "So how could Comcast circumvent *that*?" They'd have to rate-limit or downright block UDP packets altogether -- or, because the Sandvine can do packet analysis, somehow code up an analysis of the stateful-like UDP packets and monitor those, injecting refusals of checksums or whatever else they could do to severe the connection.

Meaning: it would be a matter of time before Sandvine and Comcast worked out a way to deal with using UDP instead of TCP.
--
Making life hard for others since 1977.
I speak for myself and not my employer/affiliates of my employer.
reply
funchords @ 7th Sep 08:06PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by NormanS :

You have gone to a depth that surpasses my understanding of the way things work...I think. Still, what if I checked on my end (at&t Yahoo! HSI customer) for forged RST packet from Comcast. If I ignored them and the Comcast user ignored them, what would happen?
Nothing, the connection would happily continue.

But there is a mildly-bad side effect -- if something happened on one end or another that interrupted your connection before it was properly closed, the loss of the RST flag means that you wouldn't be able to quickly detect and fix it. You'd have to wait for a timeout either from your application or the network stack. Meanwhile, you have no idea why things just died -- you appear to be connected, but you're not.

There are other, less bad, side effects. For example, "Connection Refused" wouldn't be detected anymore, but the timeouts in that state are generally a lot shorter.
--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
Are you affected by Comcast's RST forging? How to test it! -or- Read my original report.
reply
anon @ 8th Sep 06:20AM:
Re: Comcast is using Sandvine to manage P2P Connections

said by funchords :

Nothing, the connection would happily continue.

But there is a mildly-bad side effect -- if something happened on one end or another that interrupted your connection before it was properly closed, the loss of the RST flag means that you wouldn't be able to quickly detect and fix it. You'd have to wait for a timeout either from your application or the network stack. Meanwhile, you have no idea why things just died -- you appear to be connected, but you're not.

There are other, less bad, side effects. For example, "Connection Refused" wouldn't be detected anymore, but the timeouts in that state are generally a lot shorter.
Also not all RST set packets have zero length data. Many have data we need because they are actually sabotaging needed packets and not just inserting standalone RST packets into the stream thus increasing packet count.

In my testing just blocking on both sides works only so so. it is much better to re forge (unset the RST flag) packets that are NOT zero length data, then let them through. So if zero length data just block it. if NOT zero length data unset the RST flag and let it through.

Another thing that could be tried is to just delay your response action to RST and then watch to see if any legit peer packets come in right behind it. If they do then odds are that RST was BOGUS and did not come from the peer. What to do next is obvious :)


reply
ztmike @ 8th Sep 06:52AM:
Re: Comcast is using Sandvine to manage P2P Connections

Well it looks like my ride is over for seeding as well.

Im currently trying to seed but its seeding around 3.0 to 5.5kb/s and then sometimes it jumps higher..i don't know if its just nobody is downloading or what.

Kinda weird though.. i got an email from some myspace guy that lives in Valpo (A town not far from me) asking if my bit torrent seeding speed has dropped to nothing. I told him no and gave him the link to this topic, after i sent that back to him my seeding speed dropped..

I'll update later if this "Sandvine" is really in effect.
reply
anon @ 8th Sep 10:10AM:
Re: Optimize BitTorrent To Outwit Traffic Shaping ISPs

"What would I be looking for to see if the rst's are being sent. I have a network sniffer and saw quite a bit of action coming from Comcast and going to the port I have opened for bittorrent"

I didn't have my port open, don't use or even have BitTorrent and I saw the same thing you did. Someone posted in reply to me last weekend that I either had someone on my wireless router (sorry, there's no joy there, it's WEP and MAC filtered/restricted for that very reason) and I was seeing P2P afterglow and alas too, not the case. Instead, this was loop back traffic from a specific network router locally affected in conjunction with Comcast's filtering implementation in this area - they cleared it up this past Sunday night and I no longer have any of the issues that I had before. I might also mention that when calling Comcast last weekend, I was told by the 3 folks to whom I spoke that the call center's own network was intermittently degraded or completely down while this work was taking place.

It is no surprise that Comcast (or any other ISP/broadband provider for that matter) would be attempting to throttle excessive bandwidth consumption based on their published TOS and advertised service packages you can purchase. Sorry folks, I can also say that since this all took place, my service is better than it ever has been before - and I am glad.

To the poster who mentioned UDP - good luck. UDP is notoriously unreliable even though it's lighter and quicker and my bet is you'll have the same issues you are now and perhaps worse. Especially on Comcast's network - at least in my area, my employer wanted us use UDP as the default protocol for VPN into their network and I tested it for them from both Cox and Comcast connections. It was so bad (frequent drops, hanging out there in the ether) that the UDP "standard" idea was abandoned after 3 weeks of testing.
reply
StuartA67 @ 8th Sep 11:02AM:
Re: Optimize BitTorrent To Outwit Traffic Shaping ISPs

I just heard (from an undisclosed source) that Comcast is not throttling as much those on the higher speed package (8mbs). Not sure if this is a fact or not but curious to know if others are noticing this distinction.

S
reply
funchords @ 8th Sep 03:57PM:
Tests and Results-RSTs are set in both directions

Regarding these Posts and similar:
»redhatcat.blogspot.com/2007/09/b···pfw.html
»redhatcat.blogspot.com/2007/09/b···les.html

Several have mentioned that it is possible to defeat the injected/forged RST packets by ignoring them at a firewall. I tested that theory earlier »Re: Comcast is using Sandvine to manage P2P Connections but the rumor persists. "Redhatcat" claims first-hand knowledge that a forged RST is not sent from the Comcast network.

»digg.com/linux_unix/Linux_iptabl···_Killing
quote:
Comcast does not kill non-Comcast connections. I only know from personal experience.

I believe they choose to not do this to avoid lawsuits from other ISPs, as that behavior could be seen as a DoS attack on their customers/networks. That's not to say what they are doing to their customers now is not a DoS attack, but they are less afraid of lawsuits from individuals than other ISPs most likely.


Unfortunately, he is incorrect.

The following are two Wireshark copies of the same TCP conversation -- one from a Comcast system that is seeding a BitTorrent file, one from a Non-Comcast system that is trying to download it. The connection is torn down by forged RST packets about 30 seconds after it starts:



Conclusion: The RST is sent to both the Comcast and Non-Comcast sides of the connection.

If only one side respects the RST flag, the connection will be left in a half-open state. To one side, the TCP connection will appear to be valid and open. To the other, the TCP connection will have been ended. A half-open TCP connection is useless for exchanging data.

Comcast users should not modify their firewalls to drop RST packets as it is not an effective defense against the injected RST packets.

--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
Are you affected by Comcast's RST forging? How to test it! -or- Read my original report.
reply
ztmike @ 8th Sep 04:08PM:
Re: Comcast is using Sandvine to manage P2P Connections

I have a question..Will this Sandvine affect xbox 360 users who try to host a game?

I don't have a 360 but was thinking about picking one up later on down the road.
reply
koitsu @ 8th Sep 04:16PM:
Re: Comcast is using Sandvine to manage P2P Connections

At this time, no, it shouldn't affected game hosting on a 360 or otherwise. It appears specific to BitTorrent traffic. No 360 games (AFAIK) use BT. Most use UDP, from what I've seen (I sniffed Two Worlds' traffic, to see if the claims of "servers being in Germany" was true or not. Private games appear to be peer-to-peer, and use UDP only.)
reply
ztmike @ 8th Sep 04:20PM:
Re: Comcast is using Sandvine to manage P2P Connections

Can anyone confirm this? That has actually tried it..and has this crap Sandvine on their line?
reply
koitsu @ 8th Sep 07:25PM:
Re: Comcast is using Sandvine to manage P2P Connections

Yes -- ME!
reply
anon @ 8th Sep 11:10PM:
msg deleted

deleted by a moderator
reply
ztmike @ 9th Sep 12:33PM:
Re: Comcast is using Sandvine to manage P2P Connections

Strange..my upload speed is back on utorrent, currently pegging my 384upload on torrent that has been done for awhile now.
reply
funchords @ 9th Sep 01:44PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by ztmike :

Strange..my upload speed is back on utorrent, currently pegging my 384upload on torrent that has been done for awhile now.
yeah, they're messing with things. My test results differ one day to the next.

They are also closely monitoring this forum (both Sandvine and Comcast). A few insiders have contacted me (robb at funchords dot com) -- I'll never disclose who. But clearly, this matter is getting some "underground" attention.

I'm not sure if the day-by-day changes are a result of the feedback we're getting, or if they're tuning, or what. But, I agree with you -- it behaves strangely.
--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
Are you affected by Comcast's RST forging? How to test it! -or- Read my original report.
reply
ztmike @ 9th Sep 02:19PM:
Re: Comcast is using Sandvine to manage P2P Connections

What feedback?

As far as Comcast watching this thread, I have one thing to say to them, kiss my white ass.

This "Sandvine" should be reported to a news agency say..CNN or MSNBC, its obvious Comcast is doing this and should get coverage, Since Comcast failed at telling their own paying customers a lie, And if its against some laws in states im surpised their still expanding the coverage of sandvine.

Comcast as far as big companys go are now worse than Microsoft in my book.
reply
hobgoblin @ 9th Sep 06:00PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by ztmike :

Comcast as far as big companys go are now worse than Microsoft in my book.
cancel your service.

Goodbye

Hob
--
"A foolish consistency is the hobgoblin of little minds."
- Ralph Waldo Emerson

reply
EG @ 9th Sep 09:47PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by ztmike :

What feedback?

As far as Comcast watching this thread, I have one thing to say to them, kiss my white ass.

This "Sandvine" should be reported to a news agency say..CNN or MSNBC, its obvious Comcast is doing this and should get coverage, Since Comcast failed at telling their own paying customers a lie, And if its against some laws in states im surpised their still expanding the coverage of sandvine.

Comcast as far as big companys go are now worse than Microsoft in my book.
Do you really think that they would invest money in an app such as Sandvine without having first done their homework ??
reply
Selenia @ 9th Sep 10:03PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by hobgoblin :

said by ztmike :

Comcast as far as big companys go are now worse than Microsoft in my book.
cancel your service.

Goodbye

Hob
It might be reasonable advice if they have decent alternatives. Some areas don't. I seen you make apathetic comments to this effect before. While one of them is true that "they have the right to manage their networks" leaving out the "as they see fit" part because as they see fit could literally mean anything, these people have the right to bitch. The ISP has gone beyond managing their network and to infringing rights in 2 ways. 1) They don't seem to limit sharing files with who you choose, they seem to outright kill it! and 2) This is the big one. They have NO RIGHT to lie to their customers. That's just false advertising and they could be sued for it if they can prove this Sandvine shaping and record calls with Comcast denying it. Comcast by denying it, in effect, is telling you that you will have an uninhibited connection, provided you do not violate the excessive bandwidth clause, which is fuzzy in itself and could result in legal action someday making them disclose what the customer is getting for limits. This in itself, denies the consumer the right to make an educated choice about their service.

If you're wondering why I'm standing up for these people, it's because this kind of hits home. It took alot of effort to get Rogers to admit what they are doing, but they came out much quicker than Comcast seems to want to. It's also about net neutrality and peoples' right to choose. Would you like it if Comcast blocked dslreports in favor of a competitive site? Well them and other ISPs are playing that same game, only with protocols.
reply
hobgoblin @ 9th Sep 10:12PM:
Re: Comcast is using Sandvine to manage P2P Connections

This has nothing to do with Net Neutrality, nothing.

The customer has a right to choose. He can choose to use the service..or not to.

Define decent alternatives?

"Would you like it if Comcast blocked dslreports in favor of a competitive site? Well them and other ISPs are playing that same game, only with protocols."

Unfortunately that is complete bollocks. That is not what is happening. They are not discriminating, according to this thread its all network impacting traffic.

Hob
--
"A foolish consistency is the hobgoblin of little minds."
- Ralph Waldo Emerson

reply
Selenia @ 9th Sep 10:18PM:
Re: Comcast is using Sandvine to manage P2P Connections

This is all about neutrality because many programs and such are distributed using these specific protocols from developers with little money but maybe a great mind, which includes those who put together open source projects. Meanwhile, Microsoft has no issue with buying all these huge http servers and distributing things that way. Obviously Mr. small torrent-app-distributer who can't afford these servers is very hurt by this but companies like Microsoft aren't. How do you figure that being neutral?
reply
CableConvert @ 10th Sep 12:20AM:
Re: Comcast is using Sandvine to manage P2P Connections

actually...that is whats happening. They are specificly going after torrent traffic, thus the protocol argument is valid. It is their network as well to do with as they please. If they want to block or use QOS type traffic shaping, it is their right to do so over their network. I have a problem with them sending you rst packets masked as someone else's and falsely severing a connection between two willing peers. I'm sorry, that is fraud, and it is illegal. Look it up in websters dictionary...its quite plainly there. Not sure what the hell 'bollocks' is but my guess is you are full of it
reply
NormanS @ 10th Sep 12:38AM:
Re: Comcast is using Sandvine to manage P2P Connections

said by CableConvert :

I have a problem with them sending you rst packets masked as someone else's and falsely severing a connection between two willing peers. I'm sorry, that is fraud, and it is illegal. Look it up in websters dictionary...its quite plainly there.
So file charges against Comcast. All you need do is take the evidence presented in this thread to your DA, or AG and make the complaint.
--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum
reply
espaeth @ 10th Sep 12:52AM:
Re: Comcast is using Sandvine to manage P2P Connections

said by Selenia :

This is all about neutrality because many programs and such are distributed using these specific protocols from developers with little money but maybe a great mind, which includes those who put together open source projects. Meanwhile, Microsoft has no issue with buying all these huge http servers and distributing things that way. Obviously Mr. small torrent-app-distributer who can't afford these servers is very hurt by this but companies like Microsoft aren't.
That would be a better argument if web hosting wasn't cheap as hell. For $4/mo or even cheaper you can get a few GB of web hosting space and several GB of transfer. The more popularity a project gains (ie, Linux distros) the more donated hardware and bandwidth get thrown at a project. P2P is definitely a viable option for distribution of such projects, but it is clearly not the only option.

I'm sure Comcast is looking at this from a protocol/abuse complaints ratio. They've done this with TCP port 25 blocks to mitigate spam complaints as most people don't need outbound port 25 access. Now I'm sure they're looking at how many DMCA notices they have to deal with, how much of it is P2P related, and how much P2P traffic screws with their oversubscription ratios that make providing service at these prices feasible.

-Eric
reply
espaeth @ 10th Sep 12:55AM:
Re: Comcast is using Sandvine to manage P2P Connections

said by NormanS :

said by CableConvert :

I have a problem with them sending you rst packets masked as someone else's and falsely severing a connection between two willing peers. I'm sorry, that is fraud, and it is illegal. Look it up in websters dictionary...its quite plainly there.
So file charges against Comcast. All you need do is take the evidence presented in this thread to your DA, or AG and make the complaint.
Make sure you provide a list of legal content it prevented you from obtaining at the same time. ;-)

-Eric
reply
deblin @ 10th Sep 01:50AM:
Re: Comcast is using Sandvine to manage P2P Connections

said by espaeth :

Make sure you provide a list of legal content it prevented you from obtaining at the same time. ;-)

-Eric
Zing! I guess in this case, it's affecting all torrents, so hopefully one would be smart enough to collect data for a legal torrent such as a Linux distro or something ;)
--
"The Dude abides."
reply
Movieman420 @ 10th Sep 06:21AM:
Re: Comcast is using Sandvine to manage P2P Connections

I believe comcast IS 'tuning' sandvine. As of a week or so ago, I went from the FORGED rsts preventing me from seeding at all to being able to seed once again.
The RST counting script in this thread now consistently shows me at EXACTLY 20% resets...no matter when I test...

BUT...as stated earlier by CableConvert...

*****************************

I have a problem with them sending you rst packets masked as someone else's and falsely severing a connection between two willing peers. I'm sorry, that is fraud, and it is illegal. Look it up in websters dictionary...its quite plainly there.

*****************************
btw...comcast is forging resets BOTH ways! Sending them to you AND your peers..each appearing to come from the other!

The least they could do is stop LYING to their customers about using sandvine...that would be a start..honesty, imagine that. I doubt comcast will ever admit to sandvine...then they would have to deal with possible legal proceedings related to this flavor of fraud and deception.
Comcast....is your network, your pipes..true enuff. BUT you went about this whole traffic shaping thing terribly wrong. You should have openly declared it and furnished support for those customers having excessive trouble cuz YOU didn't implement sandvine properly (meaning you having done your homework AND testing before shaking the faith of scores of your customers..most of whom pay extra for the premium connection!!)
/rant
reply
ztmike @ 10th Sep 07:17AM:
Re: Comcast is using Sandvine to manage P2P Connections

I have a question, For those people that have Blast tiers, is Comcast adding sandvine to their connection also? My guess..is no because if they did most of them would probably drop comcast like a hot potato if they have the FiOS option..and comcast knows that. Just curious though..

O and i also sent this link about sandvine to NBC 5 in Chicago and ill also be sending it to other big name news station, its worth a try i guess. ;)
reply
Roundboy @ 10th Sep 08:49AM:
Re: Comcast is using Sandvine to manage P2P Connections

Yes and no according to the info in this thread.

Yes, as in I can't seed anything, and I see connections start off strong and then blink out. downloading is just fine though.

No, as in according to the output of the batch file on my Vista 64 system... I am dropping exactly ZERO connections. I just never took the time to see if its using the proper lines in my netstat output.
--
[spoiler]Steve the pirate DIES![/spoiler]
reply
funchords @ 10th Sep 03:10PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by ztmike :

I have a question, For those people that have Blast tiers, is Comcast adding sandvine to their connection also?
Someone with Blast! will have to answer that.

I did come up with a marketing name for Comcast's implementation of Sandvine's P2P Application:

Comcast PowerBoot!


eh? :D

said by ztmike :

O and i also sent this link about sandvine to NBC 5 in Chicago and ill also be sending it to other big name news station, its worth a try i guess. ;)
It's going to be hard to explain this one to the masses in the 45 seconds a TV story allows. It might be possible.

It might be an idea to call up a newspaper reporter who has written about Comcast before (on a somewhat technical thing like NetNoot or Invisible Caps) who can sift through this and pull out the interesting story.
--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
Are you affected by Comcast's RST forging? How to test it! -or- Read my original report.
reply
kcblack @ 10th Sep 04:55PM:
Re: Comcast is using Sandvine to manage P2P Connections

I still think this packet forging is a violation of the ECPA(Electronic Communications Privacy Act). I'm not a lawyer, but it seems to violate both the letter and the intent for the law.

It is specifically an interception of a lawful communication, which a linux distro, is for example.

There are pretty specific penalties and since it could be considered that they are "profiting" from the interception, looks like they could be in trouble if someone reports them to DOJ (Department of Justice).

--Edited to expand acronyms for those who have been living under a rock for the last twenty years or the comcast trolls.--

--
"Because we've invested over $4 billion in building our MegaBand network so you can enjoy the internet the way it was intended to be: fast and uncapped." (RCN marketing Promo)
reply
koitsu @ 10th Sep 05:53PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by kcblack :

I still think this packet forging is a violation of the ECPA. I'm not a lawyer, but it seems to violate both the letter and the intent for the law.
I have the same opinion as you, but I have no idea what I can actually *do* about it. Changing ISPs is the most logical option, but as already I've mentioned in this thread, changing ISPs sometimes isn't an option (ex. only two choices and the competitor is worse).

I'll again point out that I'd rather Comcast do what ISPs are supposed to do -- provide unaltered transit -- but if they absolutely must throttle torrent seeding somehow, I'd rather they use Sandvine to rate-limit and not inject falsified packets.

As someone fairly technical, I just happen to have a lot of concerns over a "governing body" (in this case an ISP) tinkering with a stateful protocol like TCP.
--
Making life hard for others since 1977.
I speak for myself and not my employer/affiliates of my employer.
reply
ztmike @ 10th Sep 05:58PM:
Re: Comcast is using Sandvine to manage P2P Connections

Whats the DOJ?
reply
Movieman420 @ 10th Sep 06:26PM:
Re: Comcast is using Sandvine to manage P2P Connections

United States Dept of Justice...
reply
NormanS @ 10th Sep 11:19PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by kcblack :

I still think this packet forging is a violation of the ECPA...
Evangelical Christian Publishers Association?
European Crop Protection Association?

Okay. I just refined my search and scanned four links before finding the, "Electronic Communications Privacy Act". I am good, now.
There are pretty specific penalties and since it could be considered that they are "profiting" from the interception, looks like they could be in trouble if someone reports them to DOJ.
Well, you have the evidence, what's holding you back?

--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum
reply
dfxmatt @ 11th Sep 12:57AM:
Re: Comcast is using Sandvine to manage P2P Connections

I would love to work on this in illinois as it is a fraud case and other news sites have shown it, but where am I supposed to find funding? I'd suggest someone goes to the EFF if they haven't already (I will tonight).
reply
espaeth @ 11th Sep 03:02AM:
Re: Comcast is using Sandvine to manage P2P Connections

I don't think the legal argument is quite the slam dunk people seem to be implying. Go lookup your IP address at ARIN and see who the legal owner of the space is. (hint: it's not you) Your use of the service is governed by the Terms of Use and Acceptable Use Policy documents. Those documents have all sorts of fun provisions like this one (Paragraph 2 under Violoation of Acceptable Use Policy):
Comcast prefers to advise customers of inappropriate behavior and any necessary corrective action. However, if the Service is used in a way that Comcast or its suppliers, in their sole discretion, believe violate this AUP, Comcast or its suppliers may take any responsive actions they deem appropriate. These actions include, but are not limited to, temporary or permanent removal of content, cancellation of newsgroup posts, filtering of Internet transmissions, and the immediate suspension or termination of all or any portion of the Service. Neither Comcast nor its affiliates, suppliers, or agents will have any liability for any these responsive actions. These actions are not Comcast's exclusive remedies and Comcast may take any other legal or technical action it deems appropriate.


Everybody here who has Comcast service agreed to these provisions when they signed up.

-Eric
reply
kcblack @ 11th Sep 10:25AM:
Re: Comcast is using Sandvine to manage P2P Connections

Norman:

I'm not a comcast customer. If I was, I'd be one of the first on a Class action suit if it impacted my upload/download abilities. I have RCN cable modem service and they do throttle, but they don't falsify packets to do it...There are many workarounds for the way they throttle so its not worth my while..if they did it the same way comcast did it, I'd be one of the first reporting their activities to the DOJ. I'm reasonably satisfied since I get 20MB down/2 MB up.

I was just pointing out the possible ECPA violations. Comcast customers feel free to investigate :0

Kevin
--
"Because we’ve invested over $4 billion in building our MegaBand network so you can enjoy the internet the way it was intended to be – fast and uncapped." (RCN marketing Promo)
reply
kcblack @ 11th Sep 10:32AM:
Re: Comcast is using Sandvine to manage P2P Connections

Federal law trumps any TOS and Comcast can say that they don't have any legal liability all day if they want...doesn't make it true :)

Ask any company who has been on the receiving end of a federal lawsuit or class action suit.

As far as ownership of IP space goes...Comcast doesn't even own the IP space they use, so thats sort of an moot point.

Kevin
--
"Because we’ve invested over $4 billion in building our MegaBand network so you can enjoy the internet the way it was intended to be – fast and uncapped." (RCN marketing Promo)
reply
kcblack @ 11th Sep 10:38AM:
Re: Comcast is using Sandvine to manage P2P Connections

You could file a complaint (for free) with the DOJ (Department of Justice) and see if they would bite.

Kevin
reply
anon @ 11th Sep 10:48AM:
Re: Comcast is using Sandvine to manage P2P Connections

I have a question..if RCN cable is offering 20/2 speeds in Chicago..why isn't comcast offering anything near that?
reply
dfxmatt @ 11th Sep 10:57AM:
Re: Comcast is using Sandvine to manage P2P Connections

because you can't get RCN where you can get comcast. Viva le monopoly.

Anytime I look for RCN for available services where I have lived in and near chicago, it always points me to comcast.
reply
kcblack @ 11th Sep 11:35AM:
Re: Comcast is using Sandvine to manage P2P Connections

Actually, I can get both, but I'm in a cherry picking neighborhood...

Kevin
reply
ztmike @ 11th Sep 11:49AM:
Re: Comcast is using Sandvine to manage P2P Connections

Got an email today from NBC 5 in Chicago

Hi Michael, Thank you for sharing this information with us, and we will continue to do research into the matter, as well as complaints we receive regarding comcast. We will contact you should we need more information.

Thank you,

Marcy FarreyTarget 5 Researcher
reply
ajax25 @ 11th Sep 12:33PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by espaeth :

I don't think the legal argument is quite the slam dunk people seem to be implying. Go lookup your IP address at ARIN and see who the legal owner of the space is. (hint: it's not you) Your use of the service is governed by the Terms of Use and Acceptable Use Policy documents. Those documents have all sorts of fun provisions like this one (Paragraph 2 under Violoation of Acceptable Use Policy):
Comcast prefers to advise customers of inappropriate behavior and any necessary corrective action. However, if the Service is used in a way that Comcast or its suppliers, in their sole discretion, believe violate this AUP, Comcast or its suppliers may take any responsive actions they deem appropriate. These actions include, but are not limited to, temporary or permanent removal of content, cancellation of newsgroup posts, filtering of Internet transmissions, and the immediate suspension or termination of all or any portion of the Service. Neither Comcast nor its affiliates, suppliers, or agents will have any liability for any these responsive actions. These actions are not Comcast's exclusive remedies and Comcast may take any other legal or technical action it deems appropriate.


Everybody here who has Comcast service agreed to these provisions when they signed up.

-Eric
Comcast is also sending forged packets to parties who do not have Comcast as an ISP and who did not agree to the Comcast service agreement.
reply
dfxmatt @ 11th Sep 02:54PM:
Re: Comcast is using Sandvine to manage P2P Connections

I have spoken to EFF, and received their okay to re-post the email I got from them. I showed them this thread, the news thread on dslreports.com, and also the news sites talking about the illegal nature of things. Filtering is one thing, but this is more along the nature of false impersonation/fraud. We agree to filtering, they can DO that (aka block bittorrent completely). Simply blocking upload I would assume they can do as well. But saying "I am dfxmatt, I reset this connection", and also saying "I am the person dfxmatt is uploading to, I reset my connection to dfxmatt", is impersonation and illegal.

This was what the EFF said to me verbatim:

Hi Matthew,

Thanks for contacting EFF. My name is Richard and I am the referral
coordinator for the Electronic Frontier Foundation. We're certainly
keeping an eye on this issue. At this point, we've noted that on the
non-technical front, Comcast has denied that BitTorrent is being
blocked, but we're certainly looking further into the technical aspects
of the issue. Your links should help give us some additional context to
what we're investigating.

If we do discover something significant or unique, we will likely make a
post about it on the Deep Link portion of our site. You can stay tuned
there for news if we find anything. Thanks again for letting us know
some additional information about the Comcast issue.

Regards,
Richard
(signature truncated/removed to prevent bot-spam).
reply
espaeth @ 11th Sep 03:27PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by kcblack :

As far as ownership of IP space goes...Comcast doesn't even own the IP space they use, so thats sort of an moot point.
Validation of netblock ownership through ARIN is one of the requirements for having your address range permitted to be advertised into a carrier network.

The argument on packet manipulation being fraud is extremely weak; these are actions being taken to mitigate "abusive" traffic using standard constructs of the TCP protocol. For P2P you originate the connection to the tracker and then the machines deal with brokering the data flow connections. The connections being shutdown are created without direct human intervention. Splitting hairs? Perhaps, but not more than the premise of the argument. Inserting reset packets to restrict "abusive" traffic is no less dishonest than a NAT gateway performing packet manipulation to create the appearance of an entire network originating from a single IP.

Using the argument of "Linux Distributions" as a justification of P2P use is also ill conceived. There are more HTTP / FTP mirrors for Linux distributions than just about any other software out there. P2P is *a* mechanism for distributing content, not *the* mechanism.

Residential broadband networks are based around massive oversubscription and the concept that there will be a sufficient number of people using small amounts of bandwidth that a few "power users" can be tolerated. P2P as a protocol is designed to make use of "idle network capacity" to promote the distribution of content. These are violent opposites; you can't maintain the broadband network design and subscription pricing model if your number of end users saturating links grows sufficiently large.

There's only a few possible actions to take in dealing with the growing burden of P2P traffic:

1) Reduce access speeds
2) Publish and enforce low usage caps
3) Raise prices to grow the network / reduce oversubscription
4) Deploy mitigation techniques to control "problem" traffic, leaving 95+% of your consumer base completely unaffected.

Some of those options affect the entire customer base, some of them only affect those causing problems. If it were up to the entire subscriber base of 10 million Comcast broadband Internet subscribers, I think it would be clear how they'd vote.

I think to win the PR battle on this all Comcast would have to do is submit a list of filenames to the press that they are using Sandvine to mitigate distribution. Sure, P2P options like BitTorrent can certainly be used to distribute legal content... but the overwhelming majority of the use is DMCA fodder.

said by ajax25 :

Comcast is also sending forged packets to parties who do not have Comcast as an ISP and who did not agree to the Comcast service agreement.
It's still Comcast's IP space in that conversation. If you want to make that argument that also means we'll have to go after the satellite Internet providers, because they spoof TCP ACKs on their terrestrial network connection to allow their subscribers to overcome the hurdle of 800ms round-trip latency via satellite. Without ACK spoofing you would never get TCP flows of more than a few KB/sec over satellite Internet.

-Eric
reply
ztmike @ 11th Sep 03:27PM:
Re: Comcast is using Sandvine to manage P2P Connections

Best bet would probably be for someone to contact the DOJ

»www.usdoj.gov/

"There's only a few possible actions to take in dealing with the growing burden of P2P traffic:

1) Reduce access speeds
2) Publish and enforce low usage caps
3) Raise prices to grow the network / reduce oversubscription
4) Deploy mitigation techniques to control "problem" traffic, leaving 95% of your consumer base completely unaffected."

And Comcast does every single one of those. besides publish the cap rate.

If im not mistaken..Comcast has reported record growth as far as income goes. So there is no way they can't add on more nodes or whatever you have to do..
reply
kcblack @ 11th Sep 03:52PM:
Re: Comcast is using Sandvine to manage P2P Connections

There's a big difference between spoofing packets to facilitate communication and spoofing packets to hinder communication which is the gist of the ECPA violation in my opinion...again, if they were not making any profit and the business was being run into the ground by their network being saturated with P2P traffic then I'd be on their side...if fact most of their models are based on you not using your share of the node and when you do by watching videos or downloading linux distros or watching joost or any other legitmate use of the bandwidth you pay for, you are now the bad guy. Thats why I think network neutrality is so important. Comcast or anyone shouldn't have the right to say what you want to do with your bandwidth. As long as you aren't breaking any laws, then tough. There are things that they can do to mitigate the load by storing popular content within their network to cut down on traffic going outside their network...

Its sort of like an all you can eat food place. You either are or you aren't. If you advertise as all you can eat, then you have to make sure you live up to that advertising and provide the service you promise without all the asterisks and fine print. Its like the airlines too....they overbook and count on a certain percentage of people not making the flight. If they overbook, they have to pay for it.

I imagine that their will be legal action and class action law suits. I hope the customers win and comcast has to provide the service that they advertise. They are doing it to make MORE profit by not having to invest in the infrastructure to support what they sell.

Kevin
--
"Because we’ve invested over $4 billion in building our MegaBand network so you can enjoy the internet the way it was intended to be – fast and uncapped." (RCN marketing Promo)
reply
espaeth @ 11th Sep 06:16PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by kcblack :

There's a big difference between spoofing packets to facilitate communication and spoofing packets to hinder communication which is the gist of the ECPA violation in my opinion...
Spoofing is either fraud or it's not, you can't have it both ways. "Spoofing is fraud, except when I benefit from it" is not a valid legal argument.

said by kcblack :

again, if they were not making any profit and the business was being run into the ground by their network being saturated with P2P traffic then I'd be on their side...if fact most of their models are based on you not using your share of the node and when you do by watching videos or downloading linux distros or watching joost or any other legitmate use of the bandwidth you pay for, you are now the bad guy. There are things that they can do to mitigate the load by storing popular content within their network to cut down on traffic going outside their network...
I honestly think if you were limited to bandwidth you could consume while your butt was planted in a chair in front of the computer the scales would be a lot more even. It's not a matter of fair use, it's a problem of people using 1000+% more than what the average consumer does. That they have to keep churning out DMCA notices probably isn't helping things. It doesn't take long before someone at the top takes notice and starts asking why they even allow that traffic to begin with.

Bringing content into the network is a great idea; too bad that concept doesn't work with P2P or in particular the content being fetched. I'm sure people would love it if Comcast would host Telesync screeners, DVDs, and warez though.

said by kcblack :

I imagine that their will be legal action and class action law suits. I hope the customers win and comcast has to provide the service that they advertise. They are doing it to make MORE profit by not having to invest in the infrastructure to support what they sell.
The consumer never wins in class action law suits. The company loses, the consumer gets meager compensation (I didn't even claim my $0.55 from the Micron lawsuit), and the lawyers make a killing. Assuming the impossible happens and a class action lawsuit is won, Comcast still has the problem of oversubscription and will be forced to cut service or raise prices, punishing the entire customer base for the actions of a few.

-Eric
Edit: just fixing a spelling error I saw
reply
espaeth @ 11th Sep 06:31PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by ztmike :

"There's only a few possible actions to take in dealing with the growing burden of P2P traffic:

1) Reduce access speeds
2) Publish and enforce low usage caps
3) Raise prices to grow the network / reduce oversubscription
4) Deploy mitigation techniques to control "problem" traffic, leaving 95% of your consumer base completely unaffected."

And Comcast does every single one of those. besides publish the cap rate.
I just updated my Comcast review from 2004 and went back to look at the bills. I'm paying the same price now as I did in 2003/2004, I went from 4/384 to 8/768, and I get powerboost where I regularly see 20+mbit on downloads. If you factor in inflation that means you are really paying less while provisioned bandwidth went up.

I agree reality doesn't help you make your argument though.

-Eric
reply
NormanS @ 11th Sep 06:45PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by kcblack :

Its sort of like an all you can eat food place. You either are or you aren't. If you advertise as all you can eat, then you have to make sure you live up to that advertising and provide the service you promise without all the asterisks and fine print.
You can cite case law that no asterisks and fine print are allowed?
I imagine that their will be legal action and class action law suits. I hope the customers win and comcast has to provide the service that they advertise.
Or maybe they will advertise the service that they provide?
They are doing it to make MORE profit by not having to invest in the infrastructure to support what they sell.
They are selling a fast connection to the Internet. They are not selling "all you can download" Internet. They aren't even advertising it, that I can tell.
--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum
reply
ztmike @ 11th Sep 06:46PM:
Re: Comcast is using Sandvine to manage P2P Connections

Ok..well look at the price of the Blast tier, then come back to me.
reply
rody_44 @ 11th Sep 08:40PM:
Re: Comcast is using Sandvine to manage P2P Connections

i just wanted to chime in and say good job comcast. i dont want p2p users slowing my connection.
reply
jig @ 11th Sep 09:21PM:
Re: Comcast is using Sandvine to manage P2P Connections

but if you don't use p2p, then all you need is dialup, right?

(oh, forgot, windows updates)
reply
hobgoblin @ 11th Sep 09:53PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by jig :

but if you don't use p2p, then all you need is dialup, right?

(oh, forgot, windows updates)
Fortunately the world does NOT revolve around p2p. There are many uses for a high speed connection that do not revolve around downloading and uploading other peoples work.

Hob
--
"A foolish consistency is the hobgoblin of little minds."
- Ralph Waldo Emerson

reply
funchords @ 11th Sep 09:54PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by espaeth :

Perhaps, but not more than the premise of the argument. Inserting reset packets to restrict "abusive" traffic is no less dishonest than a NAT gateway performing packet manipulation to create the appearance of an entire network originating from a single IP.
No, no, no. These are two different things, entirely.

NAT is described by nearly a dozen RFCs. Changing a private IP address to a Public IP is THE ACCEPTED STANDARD by which private and public internet traffic meet. Network Address Translation and Application Layer Gateways/Relays are described in major RFCs such as RFC 1918 and 1631.

In hundreds of messages on this subject, I've seen less that 5 that think a man-in-the-middle attack using forged/injected RST flag is the appropriate way for a carrier to behave. In other words, it is NOT STANDARD and NOT ACCEPTED.
--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
Are you affected by Comcast's RST forging? How to test it! -or- Read my original report.
reply
Roundboy @ 11th Sep 10:27PM:
Re: Comcast is using Sandvine to manage P2P Connections

I came from RCN, and while they had attempts at stoppin bittorrent traffic, they took a much more balanced approach..

While you were downloading, you had 100% of your upload speed available..

If you were not pulling down anything on bittorrent ports, your upload was throttled to a percentage of your total upload FOR BITTORRENT only. I forget the number, lets just say 50%

You took longer to meet ratios, but it freed bandwidth. Much better solution then forging packets.
reply
espaeth @ 11th Sep 11:12PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by funchords :

No, no, no. These are two different things, entirely.
I wasn't trying to equate them in a technical sense. Most people didn't care about NAT until they figured out they could skirt the "one computer" policy that was previously common with broadband providers. Cable customers played with packet manipulation (albeit a very different form) to their advantage before, now the cable companies are leveraging stupid TCP tricks to serve their agenda.

said by funchords :

In hundreds of messages on this subject, I've seen less that 5 that think a man-in-the-middle attack using forged/injected RST flag is the appropriate way for a carrier to behave. In other words, it is NOT STANDARD and NOT ACCEPTED.
It's adhering to RFC793 which set out the definition of TCP in 1981; you see a RST you have to shut down the connection.

I would agree that it's not the way for a carrier to behave, but I suspect when it comes to Comcast that's where you and I will disagree. Comcast is a residential broadband provider and not a full fledged carrier; the governance of operations is completely different. They're packaging a connection that isn't what you would get from a true carrier; it's a private network that has upstream Internet carrier connectivity. The oversubscription is higher, the ToS/AUP isn't as flexible, but in return you also pay significantly less than you would for a real carrier circuit.

Reset injection is not something all that flashy and new; our 8E6 content filters have been doing this for a couple years now. The key benefits from a network infrastructure standpoint are huge: less devices in-path and simpler firewall rules. While I agree that filtering is a cleaner solution, it's not always the most practical to implement. With the 8E6 filters I can have a simple Checkpoint firewall cluster sitting behind an Internet router with a very simple/easy-to-manage ruleset. Not having to worry about the complexity of a full content filtering ruleset makes life much easier for ongoing firewall management, not to mention the 8E6 can be have signatures updated throughout the day without incurring some of the nasty issues that can result during firewall rule updates. For client traffic filtering I just setup a span session from the Internet router to the 8e6 and it watches for URLs and sends resets on inappropriate content fetches. It stops the connection and I don't have to have another point of failure in my connection path.

Since we're back to talking technical details -- what do you propose for a better solution? Most of the filtering that Comcast does today happens at the cable modem, so the port 137-139 blocks, and the port 25 block if they put it in place happens well before things get upstream. With the dynamic ports used by BitTorrent clearly that isn't a solution.

Even throttling is tricky in that you'd need to identify the traffic so it can be queued appropriately. That means that some device in path would need to be able to recognize P2P traffic and mark the packets appropriately so that the packets could be filtered into the correct throttled queue. That means they can try to make this happen on their existing routing platforms if thats even possible, or they can introduce another box in-line to do the classification and inject another point of failure into the system. Even if they do this they'd have to deal with a significantly more complex queue structure than they have now.

I think if there were easy answers to this problem we wouldn't be 20+ pages into this thread.

-Eric
reply
koitsu @ 12th Sep 12:35AM:
Re: Comcast is using Sandvine to manage P2P Connections

said by espaeth :

Even throttling is tricky in that you'd need to identify the traffic so it can be queued appropriately. That means that some device in path would need to be able to recognize P2P traffic and mark the packets appropriately so that the packets could be filtered into the correct throttled queue.
This is specifically one of the things Sandvine does -- deep packet inspection. The issue described here happens no matter what source or destination TCP port # is used (on either end).

It looks as if Sandvine is analysing established TCP sessions, looking for specific signature bytes (you touched base on this, re: your 8E6). I'm also under the impression that they look for signature bytes in the response packet. Upon matches in both cases (since the inspector is now aware of the TCP state on both ends), injects RST both directions (to the peer/client and the seed/server). That's been confirmed by funchords.

So, based on the methodology they're using for packet analysis, I would say that throttling/rate-limiting would be quite possible. But instead they opted for man-in-the-middle packet injection, which of course, really pisses me off. :)

Edit: Clarification on port #s
reply
espaeth @ 12th Sep 12:49AM:
Re: Comcast is using Sandvine to manage P2P Connections

said by koitsu :

So, based on the methodology they're using for packet analysis, I would say that throttling/rate-limiting would be quite possible. But instead they opted for man-in-the-middle packet injection, which of course, really pisses me off.
Sure it's possible, but only if the Sandvine box is directly in-line of the conversation path so that it can touch/mark the packets. By doing the reset injection the Sandvine box doesn't have to physically reside in the middle of the communication path, it just needs a span session directed to it so it can see copies of what traffic is flowing through the router and it can issue the resets completely out of band. If the Sandvine box kacks it won't take out the network, only P2P throttling will be broken.

-Eric
reply
koitsu @ 12th Sep 12:54AM:
Re: Comcast is using Sandvine to manage P2P Connections

That's very true, and something I didn't consider. You're quite right -- rate-limiting would require the Sandvine unit to be sitting in the middle of the network path.
reply
koma3504 @ 12th Sep 02:28AM:
Re: Comcast is using Sandvine to manage P2P Connections

Hmm Glad i ran accros this thread it goes right along what i have noticed and posted over here.

»netmeeting
reply
NormanS @ 12th Sep 03:26AM:
Re: Comcast is using Sandvine to manage P2P Connections

said by jig :

but if you don't use p2p, then all you need is dialup, right?
High Speed Internet is useful for a number of activities other than P2P. I was using HSI for two, or three years before I found BitTorrent fansub anime downloads; and I was a latecomer to the HSI party.
--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum
reply
deblin @ 12th Sep 10:37AM:
Re: Comcast is using Sandvine to manage P2P Connections

Interesting, I am not on Comcast, but I believe I just inadvertently found evidence of this Sandvine behavior. I was debugging my firewall rules and I saw this packet get dropped:

44. 715536 rule 11/0(match): block in on em0: 69.252.A.B.36881 > 71.162.C.D.6900: R 1765380375:1765380375(0) win 0

This is during an active torrent download, and I've verified with sockstat that I have an established connection with this host. Note the R there. My firewall dropped this packet, I guess somehow pf knows this RST packet was not part of the existing established connection. I'm a bit rusty on TCP/IP, but doesn't the RST packet need to honor the existing TCP sequence numbers? If not, it appears as though Sandvine is just sending an RST without a valid TCP sequence number. So smart firewalls should ignore these. If more people ran firewalls that were "smart", it would minimize the effect on you Comcast folks I think. :)
--
"The Dude abides."
reply
dfxmatt @ 12th Sep 12:02PM:
Re: Comcast is using Sandvine to manage P2P Connections

there are also legitimate uses to P2P
at colleges for example people share things with eachother, this can be scientific data or legitimate classwork that is shared via torrent. Are you going to say the "some torrents can be used badly, therefore all torrents are bad" argument?

The world does revolve around P2P in one form or another. Bittorrent, limewire, kazaa, bearshare, these are just false excuses to label the network bad. What about the artists that wish to distribute free music over said networks? Should they be equally burdened with the "torrents can be used badly, all torrents are bad" argument as well?
reply
dfxmatt @ 12th Sep 12:03PM:
Re: Comcast is using Sandvine to manage P2P Connections

re: RCN 50% upload

this I would actually find wholly acceptable, in fact I'd actually appreciate it (it would save me from having to do QOS/bandwith limiting myself)
reply
espaeth @ 12th Sep 05:07PM:
Re: Comcast is using Sandvine to manage P2P Connections

Double post.
reply
espaeth @ 12th Sep 05:14PM:
Re: Comcast is using Sandvine to manage P2P Connections

Nevermind. Misread and responded incorrectly.
reply
Roundboy @ 12th Sep 07:01PM:
Re: Comcast is using Sandvine to manage P2P Connections

it worked out pretty well for me... it didn't take long to seed a good ratio at all...
reply
dfxmatt @ 12th Sep 10:38PM:
Re: Comcast is using Sandvine to manage P2P Connections

yes but were they comcast members?

how many were dropped about 15secs after connection?
reply
funchords @ 12th Sep 10:53PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by espaeth :

Reset injection is not something all that flashy and new; our 8E6 content filters have been doing this for a couple years now.
Then you're a bad player, stop doing that! -- There are solutions. Read this informative RFC:

RFC 3360: Inappropriate TCP Resets Considered Harmful

RST abuse is relatively new. The author of that RFC was talking about this:

said by »list.nfr.com/pipermail/firewall-···672.html :
Of 24,000 or so web servers that we tested as part of the TBIT project, only 300 or so were behind firewalls that send TCP resets in this case, so clearly most of the world seems to be maintaining reasonably adequate security without sending TCP Resets in this case.

--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
Are you affected by Comcast's RST forging? How to test it! -or- Read my original report.
reply
funchords @ 12th Sep 11:15PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by espaeth :

Since we're back to talking technical details -- what do you propose for a better solution?
Well, let's get one thing perfectly straight: the RST forgery/injection is wrong and must be stopped -- even if there is no other solution to replace it.

But there are solutions:

- Be public about the problem, and enlist the customers' assistance in solving it. "This is a shared service and heavy uploading by one or two customers impacts the entire neighborhood." That's not hard to say -- Wireless ISPs and Satellite ISPs make this fact very clear to their customers. The reason they're not being public about the problem is because they have to compete with DSL and FIOS, which balances a lot more bandwidth across a much larger field of customers. As a result, DSL/FIOS can tolerate a larger percentage of heavy uploaders before their other customers begin to be affected.

- Those that do not cooperatively manage their usage can be put in a penalty box, like the port 25 issue is handled on Comcast. If the account is uploading at a sustained rate over 60%-80% of his tier for two hours, then limit the account to an upload of 128 kbps and send an e-mail to account holder. The account holder gets a Computer-Based Training lesson about about "fair use" of a "shared connection," clicks a link, and he is restored to full service by noon the next day.
--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
Are you affected by Comcast's RST forging? How to test it! -or- Read my original report.
reply
hobgoblin @ 12th Sep 11:24PM:
Re: Comcast is using Sandvine to manage P2P Connections

"Those that do not cooperatively manage their usage can be put in a penalty box, like the port 25 issue is handled on Comcast. If the account is uploading at a sustained rate over 60%-80% of his tier for two hours, then limit the account to an upload of 128 kbps and send an e-mail to account holder. The account holder gets a Computer-Based Training lesson about about "fair use" of a "shared connection," clicks a link, and he is restored to full service by noon the next day."

Then we can have a 20 page thread about that eh?
Hob
--
"A foolish consistency is the hobgoblin of little minds."
- Ralph Waldo Emerson

reply
funchords @ 12th Sep 11:25PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by deblin :

44. 715536 rule 11/0(match): block in on em0: 69.252.A.B.36881 > 71.162.C.D.6900: R 1765380375:1765380375(0) win 0

This is during an active torrent download, and I've verified with sockstat that I have an established connection with this host. Note the R there. My firewall dropped this packet, I guess somehow pf knows this RST packet was not part of the existing established connection. I'm a bit rusty on TCP/IP, but doesn't the RST packet need to honor the existing TCP sequence numbers? If not, it appears as though Sandvine is just sending an RST without a valid TCP sequence number.
Sandvine determines and then forges in the correct sequence number, so that wasn't Sandvine. Stateful firewalls often generate a lot of unnecessary RST responses to the closing of a previous connection. (They RST the last FIN,ACK of a 3-way handshake, for example.) We would have to see more about that packet in the context of a conversation before we could say for sure why it happened.
--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
Are you affected by Comcast's RST forging? How to test it! -or- Read my original report.
reply
funchords @ 12th Sep 11:28PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by hobgoblin :

Then we can have a 20 page thread about that eh?
Yeah, exactly! :) This one, probably: »Comcast Bandwidth Abuse/Limits - Discuss here only
reply
deblin @ 12th Sep 11:28PM:
Re: Comcast is using Sandvine to manage P2P Connections

Understood, but in watching the traffic for a good half hour on a busy torrent, that was the only RST packet I saw destined for the port I was running rtorrent on. Could just be coincidence, but that it was a Comcast IP made me think of this thread.
--
"The Dude abides."
reply
funchords @ 12th Sep 11:32PM:
Re: Comcast is using Sandvine to manage P2P Connections

said by deblin :

Understood, but in watching the traffic for a good half hour on a busy torrent, that was the only RST packet I saw destined for the port I was running rtorrent on. Could just be coincidence, but that it was a Comcast IP made me think of this thread.
With apologies, I have to retract. It could be Sandvine. I almost always get 2 RST packets from Sandvine -- one that has the right Sequence Number (which does tear down the connect), followed by one that has a Sequence number that is completely strange.

If your firewall does track sequence numbers, it would have passed the first one through and rejected the second one.

My apologies -- it's definitely possible that was a Sandvine RST.
--
Robb Topolski -= funchords.com =- Hillsboro, Oregon USA
Are you affected by Comcast's RST forging? How to test it! -or- Read my original report.
reply
deblin @ 12th Sep 11:49PM:
Re: Comcast is using Sandvine to manage P2P Connections

No worries, you could be absolutely right, it certainly could have been a coincidence :) Just thought it funny...happened to see the R, and thought "hmm, I wonder..." and sure enough it was a GA Comcast address.
--
"The Dude abides."
reply
espaeth @ 13th Sep 09:10AM:
Re: Comcast is using Sandvine to manage P2P Connections

said by funchords :

Then you're a bad player, stop doing that! -- There are solutions. Read this informative RFC:

RFC 3360: Inappropriate TCP Resets Considered Harmful
That RFC has very little to do with this discussion. It was drafted largely in response to packets with non-zero reserved bits in the TCP header being rejected by firewalls. Specifically he was concerned with firewalls blocking traffic with hosts that decided to try to implement explicit congestion notification. He did include commentary stating
"We would recommend that the TCP reset not be used as a congestion control mechanism, because this overloads the semantics of the reset message, and inevitably leads to more aggressive behavior from TCP implementations in response to a reset. We would suggest that simply dropping the SYN packet is the most effective response to congestion. The TCP sender will retransmit the SYN packet, using the default value for the Retransmission Timeout (RTO), backing-off the retransmit timer after each retransmit."


There's a bit of an issue with that statement; the goal of Sandvine is to shut down connections, not throttle them. For Sandvine to work transparently it should seem like the host port is closed for connections, and the standard TCP/IP stack response to closed ports is to send a reset! Everybody seems to forget this because nearly everything (including Windows) comes with a firewall these days with a Draconian ruleset that still seems to foster the idea that obscurity has some relation to security. Disable your windows firewall or flush IPtables and try to connect to a closed port -- you'll get a nice RST back indicating the port is not available. From a debugging standpoint this is what you want to see -- some response that will help you determine why things aren't working.

The RFC author's main concern was that TCP implementations would get more aggressive in response to RST packets and start spewing SYNs (he cited the example of a stack that generated 4 connection attempts even after receiving RST responses). It's 5 years later now, and there's no indication that was really a valid concern.

It's important to keep in mind that all RFCs are not standards in and of themselves. Some do gain general acceptance as standards, but anyone can bring forth a document for review. You have to look at RFCs like 1149 or 968 to see that pretty much anyone can submit an RFC about anything, and it doesn't necessarily mean it's right.

said by funchords :

said by espaeth :

Since we're back to talking technical details -- what do you propose for a better solution?
Well, let's get one thing perfectly straight: the RST forgery/injection is wrong and must be stopped -- even if there is no other solution to replace it.
Is it mean? Sure. Is it tricky? Absolutely. Is it wrong? It depends on how you define wrong. We're talking about using valid TCP constructs to initiate the shutdown of a connection.

If Comcast were a carrier this would be a different discussion, but they're not. Carriers don't have to worry about things like DMCA notices because the responsibility for mitigation falls on the networks that represent the endpoints of the conversation. Comcast doesn't have that same luxury, as they are often one of those end-point networks. This