EFF Releases Software to Spot Net NonNeutrality

DanielBoz writes in with word of the EFF's new initiative to help consumers detect if their ISP is spoofing packets. From the press release: "In the wake of the detection and reporting of Comcast Corporation's controversial interference with Internet traffic, the Electronic Frontier Foundation has published a comprehensive account of Comcast's packet-forging activities and has released software and documentation instructing Internet users on how to test for packet forgery or other forms of interference by their own ISPs."

Oblig.

Candygram!

[pause]

Wireshark!

If it's Comcast...

...how will the software tell the difference between traffic shaping and Comcast's usual crappy service?

Re:If it's Comcast...

Because the shaped packets coming from Comcast will get to the application more promptly than regular traffic. Traffic generated outside of Comcast will still take half of forever to arrive, if they arrive at all.

Re:If it's Comcast...

If packets start showing up at one end of the connection that were not send by the other, they had to have been added en-route. This can occur naturally, as a result of IP-level fragmentation in the network, or it can be done deliberately, as Comcast and the great firewall of China do. IP-level fragmentation occurs because a packet is too large and it is being cut into fragments to improve performance; as I understand it, in practice on the real internet, it's actually pretty rare. On the other hand, if those packets that mysteriously show up are TCP-resets, then it's (IMO) an entirely reasonable assumption to make that they were put there by someone wishing to interrupt the traffic stream.

Important,

Is there a website where we can post these results? Broadband Reports [broadbandreports.com] comes to mind, but maybe the EFF has a place set up?

Do you trust the EFF?

If X tells something is true and then offers an application that proves that what they say is true there are only two options:

1 - You trust X: No need to check for yourself.
2 - You don't trust X: Why would you believe X's software?

Not tesing is not science

First of all, the EFF may has not tested your ISP. You may trust them that in general ISPs are sending spoofed packets, but still want to know whether your ISP is using the tactic. Beyond that, however, just because you trust them doesn't mean independent verification has no value. Results mean something different if you obtained them yourself. Also, as in regular science, independent confirmation of results gives more than that: more people conducting tests will also give better data.

RTFA

Your post demonstrates unequivocally that you did not read the article or if you did, you didn't understand it.

Take two packet traces, one from you your computer one from a friend while your two computers are talking. Then compare the TCP sessions captured by each for differences. Differences that don't matter are fragmentation and re-ordering, for example. Difference that do matter are TCP resets, ICMP unreachables, TCP FIN's that are received by one side and not sent by the other.

Sheesh, I can forgive not knowing how networking works, but to post inflammatory comments when you are obviously ignorant is, well, ignorant.

Stop misusing "Network Neutrality"

Network Neutrality refers to ISPs double dipping on charging/extorting fees for both users paying for their connections and web sites paying for prioritization of traffic according to origination and destination. It does not refer to protocol-based QoS. It does not mean a flat, unmanaged, unQoS-ed Internet. By repeatedly and deliberately misusing this phrase, its importance is being weakened.

Re:Stop misusing "Network Neutrality"

Network Neutrality refers to ISPs double dipping on charging/extorting fees ... It does not refer to protocol-based QoS.

Unfortunately when it comes to the definition of Net Neutrality, there isn't yet consensus (e.g. see various definitions offered here [wikipedia.org], and associated references). Maybe we need to come up with new terms, like "Strict Net Neutrality" versus "General Net Neutrality" to distinguish between various implications of the term. As usual, though, it's very hard to get people to agree on definitions.

And, of course, the definitions vary in part because people have different opinions on what is "important." Supporters of net neutrality agree that data carriers should at a minimum be source/destination neutral (the version of neutrality you are referring to). However some people do indeed believe that carriers should also be neutral with respect to the devices allowed to connect to the network, and the types of traffic sent over the network.*

So, in short, there is a diversity of opinion about what the term means (or "should" mean, I guess).


[*] As an aside, my mind isn't made up, but I understand the logic for saying that traffic neutrality may be ultimately a good thing. Yes, it prevents certain QoS strategies on shared carrier networks (but not on closed private networks, of course)... but then again, do you trust your ISP (which has its own interests) to pick the QoS strategy that actually works best for you? (Or even for most customers?) Also, any QoS strategy inherently makes a judgment call about what is "important" and what isn't. So, it inherently limits new technologies/protocols we haven't yet dreamed of. And, it would seem inefficient because any QoS which degrades protocols that customers are interested in will be circumvented (e.g. by masking your traffic as a type of traffic that is "approved" for high-speed delivery). Certainly we wouldn't let other carriers discriminate based on the content (e.g. postal service that delivers boxes that contain videotapes slower than boxes that contain paper; phone carrier that delays voice calls to prioritize fax calls...).

Re:Stop misusing "Network Neutrality"

I think how consumers are supposed to select their QoS strategy is with QoS labels. The question is not 'should we have QoS' (I don't know about you, but I would rather have my videoconference packets queued ahead of my ftp packets), it's should the ISP be overriding our choices to satisfy their own policies. This is the same issue as randomly dropped connections: a mechanism to drop connections should exist because the endpoints need it. The carrier should not be invoking it 'on your behalf' and in the face of your desires, or it simply isn't doing what it was paid to do.

There's a secondary issue of whether your operating system provides a good mechanism for QoS policy management at the endpoints (hint: no, it doesn't). But that's something to take up with the O/S vendor, or perhaps—an easier nut to crack—the router in your home. But in any case, it seems reasonably clear that QoS should be honoured or ignored end-to-end, and not randomly messed with in transit to the benefit of third parties.

...Unless I've misunderstood the technical situation completely....

Instead of denying what they are doing...

...why don't they just charge a nominal fee for heavy p2p users?

Re:Instead of denying what they are doing...

Why when you buy a 100GB hard drive does it only have about 96GB available on it? How come my car has a speedometer that is calibrated to 180 but I can't drive at 180MPH? How come when you go to a "all-you-can-eat" restaurant they don't let you stay there for a week and keep eating?

All of this assumes that you are swayed by the advertising and don't really check up on the claims being advertised. Or, it states things in common everyday language that are backed up by the fine print saying something quite different.

There clearly are two kinds of people - those that understand what is being advertised isn't exactly what is being sold and those that have managed to get through life until their 16th birthday without realizing this. Sorry, time to grow up.

I still want to ask the car salesman about the speedometer. And ask if we can check if the car will really go that fast on the test drive.

EFF- thanks, it's the thought that counts

It's nice of the EFF to spend time and money developing software that can detect what we know Comcast (and maybe others) are doing but without some sort of centralized data gathering operation to put together some sort of class action lawsuit what good is it? Knowing your packets are getting pummeled by Comcast allows you to... complain? I can't even get them to give me a clean cable tv signal- does anyone think they would listen to our complaints about packet loss? (does anyone think the average Comcast support rep would know what a packet is?) While others might be able to switch to another provider I think far too many of us (myself inculded)are stuck in monopohell with broadband providers. I'd prefer to see the EFF working on forcing Verizon (et al.) to drop fiber to the premises (after all we've been paying billions in infrastruture taxes for how long now??)

Comcast releases new modem setup diagram

Comcast posted a new cable modem wiring diagram [ripway.com] in response.

Will There Be Fasle Positives?

I work for an ISP. We purposefully craft spoofed packets and send them to our customers. Will we be reported as offenders? Does it matter that we provide service to rural locations that are only accessible through satellite and the "spoofers" are called "accelerators" by the people that sell them, and the spoofed packets are added to correct for windowing issues to increase the speed of Internet connections? If I get a number of customers that complain about our "non-neutrality" I'll be more than happy to turn off TCP acceleration and see how they like the new neutral Internet.

It isn't only for nefarious purposes where providers spoof packets. Will this software be able to identify the good from the bad? Or will it just assume that all are bad, even in the face of legitimate uses?

Test instructions for the few

Having RTFA, I found this:

• 
  Each party participating in the experiment must have all of the following:
  * a computer capable of running Wireshark, with appropriate privileges to install and run it;
  * the ability to connect this computer directly to the Internet, with a public IP address, outside of any firewalls (for example, not via a typical home wireless router);
  * the ability to determine the computer's public IP address;
  * the ability to disable any firewall software running on the computer itself;
  * some application to test, and the ability to configure that application to communicate directly with the other party (by IP address).
  

So you're going to set up a honeypot on the 'net while you're trying to figure out if Comcast is jacking with your packets. How are you going to tell the difference between your system getting hijacked and Comcast slowing your connection?

Re:And why the fuck is it in Python?

I'm under the impression that Java is more common than Python, but no matter, this software is still pretty rudimentary.

Re:Pardon my ignorance, but...

An interesting point. Anyone have any hard info on this?
--
Ask not what your country is doing to you...