Comcast Forging Packets To Filter Torrents

An anonymous reader writes "It's been widely reported by now that Comcast is throttling BitTorrent traffic. What has escaped attention is the fact that Comcast, like the Great Firewall of China uses forged TCP Reset (RST) packets to do the job. While the Chinese government can do what they want, it turns out that Comcast may actually be violating criminal impersonation statutes in states around the country. Simply put, while it's legal to block traffic on your network, forging data to and from customers is a big no-no."

Can you say "class action" ?

say it ! and add a "lawsuit" to the end. Such "companies" deserve it.

Re:

If they attack any and all Torrents this way, then their users should build a case based on the blocking of major Linux distribution downloads from Fedora, SuSE and Ubuntu and make a class action out of it, certainly! This is a clear violation of their ToS

Re:Can you say "class action" ?

There are a lot of legal bittorrent downloads. Most linux distros are available this way as well as a large number of public domain movies.

http://www.publicdomaintorrents.com/ [publicdomaintorrents.com]
http://www.starwreck.com/download.php [starwreck.com]
http://www.zeitgeistmovie.com/ [zeitgeistmovie.com]

Re:Can you say "class action" ?

and you should have told them they should have invested while they were overselling their lines. it doesnt matter what percentage of p2p is legal or not, the fact is they are not able to provide what they promised. the debate should be on that, not p2p's legality.

Oversubscription vs Keeping P2P Protocols Scalable

First of all, there are different places in a network that can be oversubscribed, and of course they're different for cable, DSL, and other architectures. The two most important points are the Internet Backbone feeds and the neighborhood distribution networks. P2P has much different financial and technical effects in the two environments.

For cable modems and DSL, the local distribution transmission technologies are asymmetric, but the upstream media from the head end or DSLAM on up normally has more slack, so the technology tends to limit the amount of resources P2P can consume. It's obviously better if you're uploading material that's being downloaded by somebody on your local distribution network, but for general applications that's unlikely - too few people want too many different files. (Large Universities are a special case, where the bulk of the traffic is probably for relatively popular material, students have more shared tastes than random neighborhoods, and upstream is usually faster and often symmetric.)

The "backbone" bandwidth, which is what costs broadband companies money based on traffic levels, is going to be more affected financially than technically - it's a small number of locations, and broadband companies can monitor it fairly easily so they can keep up with growth. The scalability issues are really critical here - if people usually upload material to other users of the same carrier and in the same geographical area, they're not touching the backbone for high-volume media, only for tracker support, and since _everybody_ on the consumer broadband networks is primarily an information consumer, not producer, the traffic's more likely to stay local, and the traffic ratios which affect what the broadband company pays for traffic are very skewed and P2P balances them a bit rather than exacerbating them. Overall backbone downstream traffic can still increase, but carriers that care about that should be encouraging their customers to use protocols that download locally when possible, and can put up their own P2P caching servers (i.e. fast user machines) if they want to reduce imports from outside.

Napster had centralized databases tracking who was downloading what songs, so if they wanted to they could easily enough have made sure that users stayed within their local networks whenever possible, especially for universities that had scaling problems. BitTorrent trackers can provide somewhat the same capability, if they want to. The fancy way to do it is to look at BGP autonomous system numbers to determine who's sharing with whom, but even just trying to keep systems in the same /19 or /16 together is a good start. Most of the P2P protocols support a cruder approach - checking ping times or other TCP or UDP packet transmission latencies - and even these are a good start, because local stuff tends to stay local. You can do a bit better for scalability if you weight IP addresses or BGP ASNs as well - usually there's enough correlation that overall performance doesn't change much, and it helps your ISP a lot. There's some variance in that, such as that a fast university user who's networkily near one of the exchange points that your ISP uses may be more attactive than a user who's geographically farther away but on your carrier's network, but in general being crude and greedy isn't as bad as you'd expect.

Re:Can you say "class action" ?

While technically true, perhaps the best kind of true, if the companies cannot deliver their advertised rates, which are quite often !!10 mbps, unlimited*!!! (with all those extra exclamation points, even) then they either advertised falsely or planned poorly.

*Some restrictions apply, but you'll never know about them unless you have a high def TV, and happen to be watching a high def channel when the company's advertisement airs, assuming they bothered to film it in high definition itself.

Re:Can you say "class action" ?

This is slashdot, believe it!

Oversubscription is what makes it possible for ISPs to offer 10Mbps service under $80. Without it, the same service would cost closer to $200, with $50 of both amounts being the ISP's operating income for the service class. Many ISPs have "reasonable use" clauses in their otherwise "unlimited" service plans and this cap appears to be around 250GB in many cases, which would theoretically allow ISPs to fit roughly 3000 high-bandwidth 250GB/month customers per ~$30k/month OC48. The same OC48 can accommodate little more than 250 wire-burning, non-oversubscribed 10Mbps customers... that would be more than $100/month uplink cost per customer.

Because the top ~5% of customers (ab)uses ~90% of the bandwidth, over-subscription reduces the ISPs' infrastructure costs for typical users by >90%. The recent stories about heavy users getting either kicked off or pushed onto higher-margin business/special service shows that ISPs are starting to push the extra operating costs down to the relevant customers. I have calculated that a fair price for true unlimited access would be ~$150/month: rent for ~1/300th of an OC48 + other operating/service costs and profit.

But none of that quite excuses ISPs from interfering with their customers' traffic unless the customer has specifically requested it.

Re:Can you say "class action" ?

Oversubscription is what makes it possible for ISPs to offer 10Mbps service under $80

Bullshit. The problem is that the US taxpayers have pumped Billions upon Billions of dollars into the internet/telephone/fiber optic infrastructure, and the telephone companies, cable companies and other large companies have wasted that money over the past 30 years, by not using the money as it was intended. Which is why it is cheaper overseas to have faster broadband than in the US.

Re:Can you say "class action" ?

You are correct. I note that a number of phone company shills that have tried to discredit your statement, so I will respond here instead of trying to correct each one.

While it's true that it was not tax dollars that directly went to telecommunications companies, it was still taxpayers that paid the money. The telecoms made promises to invest hugely in infrastructure in return for rules that resulted in huge profit increases. They did not honor those commitments, but pocketed the money instead. They are now in fact threatening again not to build any more infrastructure unless they can get more favorable regulations.

I'm not sure why the shills keep repeating the "it's cheaper overseas due to higher population density". That has been discredited over and over again. I'll repeat the numbers here for completeness:

Country - Broadband Penetration - Population Density
Iceland 26.7 3.0

Korea 25.4 483.0

Netherlands 25.3 399.0

Denmark 25.0 125.0

Switzerland 23.1 179.0

Finland 22.5 15.0

Norway 21.9 14.0

Canada 21.0 3.0

Sweden 20.3 20.0

Belgium 18.3 341.0

Japan 17.6 338.0

United States 16.8 31.0

No correlation. Do not listen to the telecom shills.

Re:Can you say "class action" ?

Major ISP's in the US have told me in meetings that P2P makes up 70-80% of their total traffic. Do you really believe that the majority of this is legal content?

That's not for the ISP to decide.

Re:Can you say "class action" ?

Who said it was the ISP deciding?

Sincerely,
GW

Re:Can you say "class action" ?

"Legitimate" content and "Trusted" sources will get priority. The ISO of your favorite Linux distro is in. The unknown and likely pirated DiVX rip is out. This doesn't have to be BT as you know it. It could be an ISP administered P2P net.

This statement leads me to believe you don't even know how bit torrent works. You are aware, it downloads from peers that have also downloaded from their peers from an original source right? And that aside from a small few bits at the beginning, ALL of the downloads come from (what is going to be essentially from the ISP's point of view) random locations right?

How is it you think they are going to "source" the download? Download it first, then put it on a list?

As someone who has downloaded lots of music illegally, I have NEVER had to resort to bittorrent to get it. It's always some person I know sharing an entire hard drive full or whatever. (Not public sources.) Heck, you can put certain phrases in Google and get the default "directory listing allowed" for common web server software and find TONS of music shared on web servers.

Since it came out, I have probably downloaded 150 gigs of various game patchs, game mods, Linux versions, etc. all of which the users I got them from had a right to distribute and I for which I had a right to download. ZERO percent of my torrent use has been illegal downloading.

Limiting traffic is one thing (just throttle ALL of the heavy users traffic, email, web, games, etc.), saying all torrent downloads are illegal is plain flat out incorrect.

Re:Can you say "class action" ?

There is no legitimate use of BitTorrent. Anything BitTorrent can do, FTP can do better.

There is not legitimate use of FTP. Anything FTP can do rsync can do better.

Re:

I wonder how much of it is legally grey? For example, anime that is not licensed for distribution (completely unavailable) in the US. Yes, it's still copyrighted, but that doesn't mean it's a copyright violation.

Seems like a straightforward case of copyright infringement to me. If the copyright holder has not granted you permission to distribute their work then you simply are not allowed to do so!

Re:Can you say "class action" ?

Interesting thought.

If the copyright holder decides not to prosecute someone is it still a copyright violation? after all many people distribute copyright material they do not explicitly own. Surely a copyright violation can only be deemed to have happened once the rights holder decides to take action.

Re:

I don't know international law that well.

The Berne Convention [wikipedia.org] is an international treaty that sets standard copyright terms and prohibitions and has been ratified by most of the countries you've heard of.

Re:Can you say "class action" ?

If the ISPs filter based on torrent source, then they cease to be common carriers, and lose common carrier protection. Then they immediately become liable for every case of copyright infringement that they are accessory to.

I don't think they'd like that choice.

If they are common carriers, then they are supposed to be indifferent to WHAT they are carrying, like the mail or the phones. If an extortion threat is transmitted by mail, you can't sue the post office. Not just because it's acting as an agent of the govt, but because it's a common carrier. (UPS is just as protected.) They aren't supposed to know or care what they're carrying. If they did, and demonstrated the capability of filtering it by filtering some of it, then they would lose their common carrier status, and become liable as accessories to extortion, e.g.

OTOH, I don't want them pretending to be me. Not at all. That should be grounds for a suit. It should also be grounds for criminal prosecution not only of those who implemented it, but of all of their supervisors, managers, etc. also. Including the boards of directors. It shouldn't have a particular onerous penalty...say 10 days for each separate offense. Cumulative. I'll be generous, and say 1 day per instance. I.e., 1 day per false packet.

Re:Can you say "class action" ?

hmm, this is interesting - I am not familiar with this arguement. Any lawyers out there that can verify this? Everyone knows that ISPs have been filtering the dickens out of traffic since the napster era, why haven't they been called out on this already? Also, the post office won't let me ship a can of gasoline to a friend who lives in small town with high gas prices - they consider this "hazardous." Could isps argue that certain traffic is hazardous to their infrastructure (i.e. clogs up the pipes) and refuse it on those grounds (assuming this whole common carrier thing really applies in the first place)?

Re:Can you say "class action" ?

I believe the WoW patcher uses a bittorrent model, as well.

Not just a bittorrent model, it uses the standard bittorrent protocol. The downloader even complains it can't contact the tracker if your internet connection is down. Ummm, a friend told me that. :P

See the WP [wikipedia.org] for a list of a few things (including WoW updates) that use BitTorrent.

Suure... legal action is possible...

But when these huge companies work with other huge companies AND government agencies like the FBI and CIA, do you think you even have a chance in Hell?

Like many have said before me, we need to go pure encrypted communications to prevent this kind of violation. TOR, WASTE, and Linux based encryption techniques allows us these kind of tools to defend against attackers: our very providers of bandwidth.

Re:Suure... legal action is possible...

do you think you even have a chance in Hell?

Then again, Rosa Parks [wikipedia.org] had no legal right to keep her bus seat from a white guy. And yet, she did.

If you don't stand up and fight for your rights, who else will?

Why do you say that?

First, Spyder was not saying that he was Rosa, but even ignoring that, why do you say with certainty that this is not the same? This is standing up to a MUCH bigger bulley who is trying to take what is not theirs. It was no different than when the geek stood up to a circuit city store and then the police. That is a case that may make a difference, as might this (keeping our rights from those that would gladly steal them). You can bet that at the time of Rosa, the locals just thought it was a silly disturbance.

Re:Why do you say that?

More like buying a car with a speedometer that goes up to 120 only to find out that your tyres have been slashed by the car dealer a week later because he doesn't approve of the roads you drive home from work on as he stalks you every night.

Re:

But when these huge companies work with other huge companies AND government agencies like the FBI and CIA, do you think you even have a chance in Hell?

Cases are won against the Federal Government on a regular basis. The question is, what kind of service should these users expect? They are sold a service that says they get fast downloads, and so they try to download something and it's not only fast, but

Technical merit?

Legal questions aside, is there some technical merit to sending a RST instead of just blocking the packets? Is it less expensive to the ISP or something? I don't understand why they're doing it.

Re:Technical merit?

Blocking bittorrent causes the client to find other open ports (if you are using port-based blocking). As an ISP, by throttling it way back to almost nil, but keeping it as an established connection, you have a better chance at keeping bittorrent traffic from overcoming your own upstream/downstream connection to your provider.

It's better than single-packet blocking.

Yeah, it works better. Sending a RST packet closes the TCP connection. Just eating the packet would cause the computer to resend it, creating more traffic on the network. The forged-RST attack is "fire and forget." You identify a TCP connection that has bad traffic in it, and then you target the connection. It doesn't require matching every packet, you can instead look for patterns of packets that indicate types of traffic you dislike, and then just terminate it, and move on to the next connection. It may use deep-packet inspection, but it's not a 'packet blocking' attack. It's better, because it avoids having the computers retransmit packets that just contribute to the traffic you need to screen.

It's a fairly insidious way to block traffic, which is why the Chinese do it. Frankly it's a fundamental weakness of TCP: it wasn't really designed to cope with hostile intermediate nodes. (Flaky ones, sure, but not hostile ones.) You could configure your computer to reject RST packets, but then you'd end up leaving connections open all over the place and cause all sorts of other problems. It's not something that you can trivially work around.

Re:It's better than single-packet blocking.

You could configure your computer to reject RST packets, but then you'd end up leaving connections open all over the place and cause all sorts of other problems. It's not something that you can trivially work around.


How about just wait until some specified timeout and see if you receive any other packets? If someone sends RST, but you receive a bunch more packets, there's a very good chance the RST was faked. Better yet, wait for timeout1, then wait timeout2 for any more packets. (Since packets can be received out of order). Then if you receive more packets during timeout2, ignore the RST. I'd say that's pretty trivial. It could even be implemented on a NAT router so you wouldn't even have to modify your OS.

Forged RST packets

We use a popular web content filter. The way it works is by doing the same thing. So when we are blocking traffic, we block it by issuing a forged RST. It's either do this, or place the content filter inline ACTIVE. Right now it is passive It does packet capturing and RST to block. If it's down, then traffic still flows. If it were active, we could simply drop the traffic and not forge the RST. But performance and uptime are horrible on many products when these are inline.

Initially this sounded a lot worse to me.

Re:Forged RST packets

The difference is most likely that you're the endpoint of the traffic. When traffic comes to me, it's my business what I send in reply. A RST, nothing or a "thanks for sexual services".

Comcast is the carrier. They have no business sending RST packages. Their business is to transfer packets to and from you. If you allow them to manipulate your packets (which this essentially is, injection of packets is by no means different from altering them, it changes the data stream and the information transmitted), you can never be sure that what you sent is what arrived on the other end.

Evidence is already out there

take a look at http://www.dslreports.com/forum/comcast [dslreports.com] and you will note that plenty of examples of this impersonation exist. They disconnect by impersonation after about 10 seconds of seeding, and it seems to be courtesy of Sandvine. Gotta love lack of net neutrality here, although I am not in favor of extreme net neutrality, some would be, well, nice.

EXTREME Neutrality

Just curious, but what is extreme network neutrality?

Network neutrality, enforced by roving bands of ninjas.

It didn't escape attention on Slashdot!

Last time this piece of news was discussed [slashdot.org], someone helpfully posted a solution [slashdot.org] for your Linux firewall.

read the rest of that thread

That solution as written doesn't work [slashdot.org], and even if it did, might still screw up the connection [slashdot.org] (because you want to un-set the RST flag, not throw away the whole packet). Also, some people have indicated that Comcast is doing more than just forging RSTs, t

But, this is awsome

I'm so glad I live in Canada.

Re:But, this is awsome

I'm so glad I live in Canada.

Why, because of the weather? It can't be because of your traffic-throttling happy ISPs:
http://torrentfreak.com/rogers-fighting-bittorrent -by-throttling-all-encrypted-transfers/ [torrentfreak.com]

Good heavens...

...forging data to and from customers is a big no-no...

I realize that to the nerdish mind falsifying the sender of an IP packet is equivalent to "impersonating another", but no sane prosecutor would ever make such a case.

Standard Approach

This method is how most content filters do their jobs. Why not just drop the traffic you ask? Well here's why.. if you don't reset the connections, both sides will just continue trying to communicate with one another by retransmitting the packets. That's why it's TCP and not UDP.. the whole trying to guarantee the delivery thing. Now, they're not just blocking on IP addresses. If that was the case they could just drop the traffic altogether and not need to "forge" anything. However, since it's discovering the traffic is P2P related later on, it does it in such a fashion.

Now the other thing is that the IP addresses being used are owned by the ISP. I am not so sure this is really forging something on behalf of the customer that's breaking laws. The customer doesn't own that IP. On top of that (and I am ASS-U-MING HERE) they are probably breaking the acceptable use policy for the ISP. If they don't allow P2P stuff, you're in violation. They could do a lot worse stuff to be a PITA than just reset your connections. :)

Actaul chat session dialog.

Christopher(Tue Sep 04 2007 17:54:47 GMT-0400 (Eastern Daylight Time))>

Please provide me with a complete list of TCP/IP ports which Comcast actively blocks/filters/or limits traffic to users??

analyst Tallilee.7304 has entered room

Tallilee.7304(Tue Sep 04 2007 17:54:50 GMT-0400 (Eastern Daylight Time))>

Hello Christopher_, Thank you for contacting Comcast Live Chat Support. My name is Tallilee.7304. Please give me one moment to review your information.

Christopher_(Tue Sep 04 2007 17:55:23 GMT-0400 (Eastern Daylight Time))>

Hi

Tallilee.7304(Tue Sep 04 2007 17:55:18 GMT-0400 (Eastern Daylight Time))>

The only ports that may be actively blocked on the Comcast network are 67, 68, 135, 137, 138, 139, 445, 512, 520, and 1080 at this time. Any ports that are blocked will not be unblocked. If the port you would like to use is on this list, please select another port to use with your software. There are over 10,000 ports available for use. Please be advised that Comcast reserves the entitlement to block any ports on the network without prior notice. We thank you for understanding this security policy.

Christopher_(Tue Sep 04 2007 17:56:14 GMT-0400 (Eastern Daylight Time))>

I have read that Comcast is now actively retarding bittorrent traffic.

Tallilee.7304(Tue Sep 04 2007 17:56:09 GMT-0400 (Eastern Daylight Time))>

That is not a true statement.

Block Comcast Customer From Everything

Slap a filter on all your web sites and torrent trackers that keep Comcast customers out.

Give the reasons that all the bogus resets cause wasted connections and time and deny legitimate users from using the service effectively.

That's just the technical end. No effective net changing strategy will work on only that basis. It requires social fixes also.

Notify Comacst customers what's happening and why. Tell them the action is against Comcast, not them, that you're sorry for them, but have no other choice due to Comcast's actions. Tell them to contact Comcast to tell them to either remove the block or they'll change services or call a class action suit.

The Comcast users become collateral damage. It's a sad thing, but it's what happens sometimes. If it's presented to them in the right way, they'll become and loyal and effective allies.

It's worked before. Against Worldcom/UUNet, PSINet, the pipe into India via their country's long distance, network and satellite company affecting 90% of India, and others. It was called the Usenet Death Penalty. Look it up. It made news stories all over the world. The biggest, against Worldcom, was launched on a Friday evening so they couldn't react until Monday, and by Thursday afternoon John Sidgemore made them change their corporate policy to cut off their downstreams that were major spam sources (which was the reason all these were done). In all cases I/we got many emails from effected customers decrying the need for this, but supporting the action and us, most of them promising to step up complaints against the company involved.

A key is to get individuals participating in doing this based on a publicized suggestions from someone who doesn't participate. That makes the people doing it a temporary autonomous group, not an official body or organized group with a membership or leadership. The result of that is each individual has to be pursued one by one, and they can just drop off if and when they need to, and come back on at another point. Best way is to set aside a few people who aren't participating themselvess, but are holding forth the whys and wherefores, and acting as contacts for the affected users, the press, and inevitably the company.

It works, oh my yes. Combine technical and social tactics, and you'll have them by the nadgers. As big and bullying and rich and litigious as the companies are, they all rely on a user base. When that base threatens to jump ship, they listen and things get done.

The 70% to 80% figure doesn't hold water. The same was said about the increase in traffic on usenet binaries groups, and that was fought off in some cases and gave rise to companies advertising specifically to provide them in others. There's nothing in their TOS that says what sort of programs the users can and can't use, just as when they decided to start dropping and blocking alt.binaries.*. There's stuff about illegal activities which is good and for a good reason, but it's up to the company to prove that's going on. If they don't, forcing their customers to drop P2P connections regardless of content is denial of service, and that's illegal. Since their doing it to people who are paying them to provide the service their denying, it's also fraud. With those points made to the media prior to and during the action, and with some affected but supporting Comcast members having their word in, it'd be damn hard for Comcast to defend itself without looking like thugs, and if they don't defend themselves they look like hypocritical and greedy thieves.

I'm serious. This works a charm. Set up and laid out properly, its the perfect media fodder to garner support -- the little guys inside and out fighting the awful corporate ogre to take back the net. And, it stirs up righteousness more of the affected users, bring them on board, and it's enormous fun for those doing the actual fighting against the suits.

Not planned and executed properly, it falls apart when the press is able to make the action look like a blackmail attempt. P