Slashdot Log In
An Education In Deep Packet Inspection
Posted by
kdawson
on Tue Apr 07, 2009 04:24 PM
from the opening-all-the-envelopes dept.
from the opening-all-the-envelopes dept.
Deep Packet Inspection, or DPI, is at the heart of the debate over Network Neutrality — this relatively new technology threatens to upset the balance of power among consumers, ISPs, and information suppliers. An anonymous reader notes that the Canadian Privacy Commissioner has published a Web site, for Canadians and others, to educate about DPI technology. Online are a number of essays from different interested parties, ranging from DPI company officers to Internet law specialists to security professionals. The articles are open for comments. Here is the CBC's report on the launch.
Related Stories
Submission: Canadian Privacy Commissioner educates on DPI by Anonymous Coward
[+]
EU Investigates Phorm's UK ISP Advertising System 90 comments
MJackson writes "The European Commission has opened an infringement proceeding against the UK after a series of complaints by Internet users, and extensive communication with UK authorities, about the use of Phorm's behavioural advertising system, which uses Deep Packet Inspection (DPI) technology, by internet service providers. Phorm works with UK ISPs to monitor what websites you visit for use in targeted advertising campaigns, though its methods have raised more than a few fears about invasions of privacy. Similar services in the USA have caused an equal level of controversy."
[+]
BT Drops Phorm, Citing More Pressing Priorities 94 comments
Tom DBA notes a story up at The Register that begins "BT has abandoned plans to roll out Phorm's controversial web monitoring and profiling system across its broadband network, claiming it needs to concentrate resources on network upgrades... BT's announcement comes a day before MPs and peers of the All Party Parliamentary Communications Group are due to begin an investigation of Internet privacy. Their intervention follows the EU's move to sue the UK government over its alleged failure... properly [to] implement European privacy laws with respect to the trials, drawing further bad publicity to the venture." We've discussed Phorm many times in the past.
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Deep inspection up your authorities (Score:5, Funny)
Re: (Score:3, Funny)
If there's a Slashdot achievement for getting a +5 on a Goatse link, you just missed your chance at it.
Re: (Score:2, Informative)
It wouldn't be the first time [slashdot.org] somebody got +5 for linking to goatse [goatse.cz]m im just waiting for the editors to let it slip into a summary.
Re: (Score:3, Insightful)
Re:Deep inspection up your authorities (Score:5, Insightful)
How would the authorities like to be deep inspected?
That's a good question.
This summary mentions education about deep packet inspection. To me that's a very simple thing that boils down to a few questions:
Do you want your ISP and potential unknown/unaccountable parties to be able to easily monitor, intercept, and record some or all of your Internet traffic? Do you want profiles built on this information that will compromise your privacy and could be used to serve advertisements or to micromanage your Internet usage? Do you feel like QoS, which will be the given reason/excuse, is such a good and desirable thing that it's worth all of these disadvantages?
Like so many things that are not the result of overwhelming customer demand, this is a bad idea that is open to all sorts of abuse.
Parent
Re:Deep inspection up your authorities (Score:4, Insightful)
Good luck deep inspecting that crap
Parent
Re:Deep inspection up your authorities (Score:5, Insightful)
it's just going to push more and more protocols to use TLS wrappers and to use random "legit looking" ports (like 20, 21, 80, 443, 110), a la Skype and most IM clients nowadays Good luck deep inspecting that crap
That's true. You'd think that "spam vs anti-spam measures" alone or "windows viruses vs windows virus scanners" alone would have taught us, by now, how to recognize an arms race when we're about to start one. This is what I mean when I say that our culture does not value foresight.
Parent
Re: (Score:3, Funny)
Our culture doesn't value foreskin either (aside from grinding it up for use in cosmetics).
Such a thought is sure to put any intact man in your position, causality.
Re:Deep inspection up your authorities (Score:5, Interesting)
Do you want your ISP and potential unknown/unaccountable parties to be able to easily monitor, intercept, and record some or all of your Internet traffic? Do you want profiles built on this information that will compromise your privacy and could be used to serve advertisements or to micromanage your Internet usage? Do you feel like QoS, which will be the given reason/excuse, is such a good and desirable thing that it's worth all of these disadvantages?
The Internet will become more like an airport: all your packetages will be subject to inspection without need for a warrant or probable cause and denied travel accordingly.
Parent
Re:Deep inspection up your authorities (Score:5, Funny)
Parent
Re: (Score:2, Redundant)
The description's a little "excited" (Score:5, Insightful)
It's a hacky technology to implement QOS because folks don't like setting the QOS bits and protocol in the headers. Usually because some Microsoft firewall only allows http on port 80 (;-))
It's the use of it by the famous "men of good will but little understanding" that is bad, plus of course the use of it by men of ill will.
--dave
Re:The description's a little "excited" (Score:5, Insightful)
The former category is much more dangerous. At least most people recognize ill-will when they see it. By far people with good intentions and no comprehension of the "law of unintended consequences" do more damage to the world than do people with openly evil intentions.
No politician ever increased state power by saying "I'd like to see this nation become a totalitarian state and you should support me because this law will bring it closer to that goal." They do it by saying "this is for your safety" or "this is to stop terrorism" and the people who mean well and don't understand the damage they can do will eagerly eat that shit up. That's true whether or not the politician himself believes anything he is saying.
Parent
Re: (Score:3, Interesting)
Well, that brings up an interesting philosophical question --
Re: (Score:2, Insightful)
Meaning well does not remove you from the causation of harm.
Example:
Just because I don't understand that shooting someone with a gun can kill them doesn't mean I didn't cause that person to die. It just means I am an ignorant fool who killed someone.
Then again if you follow the train back far enough we can just blame *insert how you think the world came about here* for all evil.
Re:The description's a little "excited" (Score:5, Insightful)
That's why it makes more sense to look at it in terms of enablers who could have chosen differently. The people could study statecraft and propaganda techniques. They could study dictatorships like the Third Reich or Italy under Mussolini to learn how these leaders came to power by preying on the desperation and the weaknesses of the people. They can familiarize themselves with the sorts of excuses and justifications that are given for the expansion of state power. They can learn argumentation and research so that they are equipped to investigate things on their own instead of requiring that premade conclusions be spoonfed to them. In short, they can shed the naivete and the ignorance that must be present before such horrors can arise.
Any literate adult with Internet access can do all of these things. The only obstacle they could encounter would be their own laziness or unwillingness. I would say that we have a responsibility to do these things because everything that is good about the way of life that we presently enjoy depends on an informed citizenry. Our civilization is on the decline because people think this does not apply to them, or they think that someone else will take care of it, or they think that the latest celebrity-worship is more important.
The evil politicians are like organisms in an environment. The environment in which they thrive consists of ignorant people who are far too naive and trusting and do not guard themselves against being deceived. If you set up this sort of environment, those organisms will appear in it and will prosper. Thus, I believe it is the people and their ignorance and lack of priorities that are far more to blame, for they provide fertile soil without which this organism could never succeed. It should be assumed that evil men will come along who will try to take advantage of our way of life to suit their selfish purposes. We should be prepared for this and well-able to deal with it by never rewarding it with the power it seeks to have. We are not. We think our enemies are our friends because they know how to tell us what we want to hear. That is the problem.
Parent
Re:The description's a little "excited" (Score:5, Interesting)
As I understand it:
ISPs don't implement the QoS (Type of Service) field because (back before THEY needed it for services) Microsoft deployed an IP stack in Windows that "improved" their own file transfers and other IP traffic by demanding high QoS for everything.
Because of that (and the threat of bad guys cheating) the ISPs don't trust the field when coming from a customer. So there wasn't a strong driver for implementing QoS in the ISPs and backbone
IMHO the right solution is for ISPs to:
- Write service level agreements that guarantee a certain bandwidth of high QoS traffic - for the whole feed to the customer, not per flow.
- Start honoring the ToS field and policing the data rate at the edge router, and
- When a packet would be dropped for exceeding the data rate for the enhanced service, instead REWRITE THE ToS FIELD for best-effort delivery (or whatever lower service level seems appropriate) and try to forward it under those terms.
That way:
- The ISP doesn't have to classify the flow according to traffic type to give the user high QoS for his critical services.
- The ISP doesn't have to do a packet-recombine if the packet is fragmented to identify the flow for the trailing fragments (which don't carry the TCP/UDP port number).
- The user / application can specify what special handling he / it wants.
- Applications that try to "cheat" can only do so up to the bandwidth cap for the special handling. (But the user paid for that. So he can use his bandwidth for whatever he wants. It's not "cheating" any more.)
- Excess traffic will still go through as well as it does now.
- A "cheating" application WILL hurt the user's own really-needs-high-QoS service, giving users and applications providers an incentive not to request excessive QoS. (But it won't hurt ANYBODY ELSE's traffic.)
- Authors of applications that need high QoS will have an incentive to specify it, since doing so will work.
Parent
Easy Fix (Score:4, Interesting)
Parent
Re: (Score:3, Interesting)
Charge more for higher QoS. Give a discount for lower QoS.
That's a given.
I'd expect plans to include some small amount of VoIP quality 2-way high-QoS as standard (about a couple phone calls' worth plus whatever is needed for the plan's special services). Higher amounts could be obtained by subscribing to a higher-priced plan or dynamically-configured as needed - perhaps for a fee (like dialing a toll phone call or subscribing to a pay-per-view).
Want your packets to get reserved bandwidth and better treatme
21st Century Government Work (Score:5, Informative)
Taking a quick look through the content at the government site, I must say I'm surprised. CC licensed content, links to external resources, a collection of international points of view. I'd be truly impressed if they'd managed to get all these folks in a room together.
Regardless, kudos to Canada for hitting the 21st century.
And I was doubly impressed to notice the absence of web beacons / analytics scripts.
Re:21st Century Government Work (Score:5, Informative)
Parent
Re:21st Century Government Work (Score:4, Funny)
It's also snowing.
Parent
Re: (Score:2, Funny)
We've recently been blamed by the US as the major source of film piracy.
I thought that was China...
no wait.. its Russia...
Can they ever get their facts straight?
Re:21st Century Government Work (Score:5, Funny)
Can they ever get their facts straight?
What are you talking about? Everyone knows it's the terrorists. It's always been the terrorists. We will fight them with our allies: Canada, China and Russia.
Parent
I'd be more impressed ... (Score:2)
... if they'd managed to build a web site that displayed correctly (or displayed the essay collection AT ALL) on Firefox 2.0.0.8.
obligatory (Score:5, Funny)
Re:obligatory (Score:5, Funny)
I did not know you could do that with a kielbasa, you dirty, dirty young man.
Parent
Re: (Score:2, Funny)
Oh come the fuck on, what it is with retards with mod points?
That was a troll?
No, not in the slightest. A troll would be me suggesting that whomever moderated the above as troll go fondle themselves with a razor blade while watching their mother sate the insane raging lust of a Brahma bull.
the above was a joke...*sigh*
Re: (Score:2)
Deep Inspection is not the Problem (Score:4, Insightful)
Re:Deep Inspection is not the Problem (Score:4, Insightful)
It's a technology that almost no one wants except for those who are in a position to abuse it. That makes it difficult or impossible to view it as a "neutral" thing.
Parent
Re:Deep Inspection is not the Problem (Score:5, Insightful)
It's a technology that almost no one wants except for those who are in a position to abuse it. That makes it difficult or impossible to view it as a "neutral" thing.
I've seen quite a few "good" uses of DPI, from filtering out content trying to contact worm control channels to gathering statistics on Web site usage for academia. You can use DPI to slow down traffic going to any video hosting site not paying you a kickback or you can use it to filter out a DDoS attack on one of your network's clients. The technology is useful today, but we do need legislation to keep it from being abused.
Parent
Re: (Score:2)
It's a technology that everyone except abusers should love, if used well. Think of it this way, when congestion happens, something must be dropped. So, what do you drop? Do you drop random packets? Or do you identify someting that's drop-tolerant and delay-tolerant and drop those first (up to some point where you'll be dropping more)? Personally, I'd think that people would be happy that their VoIP is priori
Re: (Score:2)
It's a technology that almost no one wants except for those who are in a position to abuse it. That makes it difficult or impossible to view it as a "neutral" thing.
What about this? http://dpi.priv.gc.ca/index.php/what-is-deep-packet-inspection/ [priv.gc.ca]
DPI has been used for several years to maintain the integrity and security of networks, searching for signs of protocol non-compliance, viruses, malicious code, SPAM and other threats.
Are you suggesting people don't want a less SPAMy, more secure internet? There's more to it than "oh noes, the isp's are spying my internets!" I'm not saying I want them to, there's just more to it than some people realize.
You and another person suggested using it to thwart spam or worm attacks. I am replying to you since the other person was more reasonable. That is, he did not say "are you suggesting people don't want a less spamy [sic], more secure internet" as though that's the same thing as criticising another wrong solution that cannot solve our problems. The way you did that reminds me of people who say "you mean you don't want to be safe from terrorists?" when you point out that it's wrong to infringe on civil libe
Deep Panty Inspection (Score:5, Funny)
Encryption stops this correct? (Score:5, Insightful)
Doesn't a good encryption system stop DPI from giving any useful information?
Re:Encryption stops this correct? (Score:5, Informative)
Parent
Re:Encryption stops this correct? (Score:5, Interesting)
They can however arbitrarily assume all encrypted data to be hostile and filter accordingly...
Parent
Re:Encryption stops this correct? (Score:5, Insightful)
Doesn't a good encryption system stop DPI from giving any useful information?
Any useful information? Sure! There is lots of useful information that can be gleaned even when encryption is used. Who are you communicating with? What protocol are you using? By looking at packet timing and packet sizes, much more information can be obtained than you might think, such as: are you web surfing vs. interactive keyboard login? Are you tranferring large files or reading short web pages? And if the structure of the web pages of the target site is known, the size of the packets transferred might even reveal which pages you were visiting. Some have even reported the ability to make educated guesses about keystrokes in interactive sessions based on timing of packets. Admittedly some of these features will have to wait for the next generation of DPI technology, but even today, a great deal of information can be collected.
Parent
Re: (Score:2)
Some have even reported the ability to make educated guesses about keystrokes in interactive sessions based on timing of packets.
So that's how the Comcast employee was able to beat me at CS -- he knew my bunny-hopping pattern!
Re: (Score:2, Insightful)
Re:Encryption stops this correct? (Score:4, Insightful)
I was going to say that wont work very well because of VoIP but as most ISPs are phone companies they probably dont want VoIP working too well either.
Parent
Re:Encryption stops this correct? (Score:4, Interesting)
Take a look at:
SSLIA [netronome.com]
Deep packet inspection inside SSL sessions. It's not the only one either.
Parent
Re:Encryption stops this correct? (Score:4, Informative)
Mostly. However, many DPI boxes are now including heuristics as well. Encrypted stream of 20k in and out to a single IP? Sounds like VoIP to me, toss it in that bucket. Encrypted 10k out and 1M in to a single IP? Sounds like a file download, toss it in that bucket. Encrypted 10k in from 20 hosts and 5k out to 15 hosts? Sounds like P2P, toss it in that bucket. If I can make such guesses easily, someone smarter than me has already coded those in and knows what your encrypted data is. Not what it contains, as that's never the goal of DPI, but what you are using it for. So encrypt it all you want. They'll know what you are up to anyway. Unless you do someting like Tor downloads and then it'll look more like P2P and you'll get even worse performance. Or, as someone else mentioned, if it isn't easily identifiable encryption, then they treat it like the least desired traffic. Hide all you want and they can still get you for it.
Parent
Your Action, My Reaction (Score:5, Interesting)
I go for encryption, SSL, and HTTPS. Even my slowest home system can easily handle this.
Re: (Score:2)
Re: (Score:3)
I go for encryption, SSL, and HTTPS.
Then how do you log in on slashdot?
It takes two paranoid people to use encryption. We really need everyone to be paranoid, which is a hard sell.
Even my slowest home system can easily handle this.
Can the server you're slashdotting handle one thousand (or million) times what your home PC can handle?
Sometimes, when I'm transferring stuff around at home, ssh (sshfs) or kcryptd is the bottleneck, not the disk/wire.
Damn, that makes me sad :(
No Tales from the Encrypt (Score:3, Interesting)
Unencrypted data will always get you in trouble. There is no reason in the year two thousand and nine to send or receive anything over the internet without encapsulating it in a SSH or SSL tunnel. Whine all you like about performance hits, but if the technology has reached the point where your residential ISP can look inside every packet you send to see what's there - in real time - then the point has come to spend some processing power on protecting your data in mid-flight, or invest in some encryption hardware.
I'm more than half convinced that this is how everything =inside= a LAN should communicate with each other, too. The firewall should allow port 22, port 443, and drop the rest.
While we're at it, everything should be firewalled right at the VLAN, on the switch.
Re: (Score:3, Funny)
The obvious solution is to block or severely slow down all encrypted traffic (that is, all traffic the ISP can’t interpret). This would have the obvious effect on online banking, which could be solved by the ISP’s computers handling it: The SSL tunnel stops at your ISP, which inspects the decrypted packets before handing them to you. You know the ISP isn’t going to do anything bad with the information because they told you so (in specific, there’s both a contract and fraud laws stopp
Re: (Score:3, Interesting)
But there has to be a better way for establishing the 'CA - domain' trust. Why isn't the trust chain 'ICANN CA - country domain operator CA - registrar CA - domain'?
But first you need DNSSec anyway, otherwise you can validate the PKI chain, but not that everybody is who they say they are. (For example: Registrar CA's should only be valid on DNS records where they are listed as the Registrar.)
After that, de