Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

80 Gbps Deep Packet Inspection Hardware Announced

ScuttleMonkey posted more than 6 years ago | from the comcast-on-backorder-for-months dept.

Privacy 185

An anonymous reader writes to tell us that Procera Networks is launching a new weapon on the deep packet inspection (DPI) front. At $800,000 these 80 Gbps tanks aren't going to be sitting in everyone's closet, but it could mean that more traffic shaping is on the way. "The PL10000 can handle up to 5 million subscribers and can track 48 million real-time data flows. That's certainly a potent piece of hardware, but larger ISPs will need more. That's why Procera designed the new machines with full support for synchronizing traffic flows where return traffic might be routed to a different PacketLogic machine. The machine receiving the return traffic can make the machine monitoring the outbound traffic aware that it sees the other half of a TCP/IP conversation, for example, giving the devices more accuracy than those which might only have access to one side."

Sorry! There are no comments related to the filter you selected.

Anonymous Coward (0)

Anonymous Coward | more than 6 years ago | (#23380982)

I'm sure this will work just as well as the others. A waste of money.

Just in time! (5, Funny)

courteaudotbiz (1191083) | more than 6 years ago | (#23380994)

Just in time for the olympic games!

$800,000? (5, Insightful)

Bovius (1243040) | more than 6 years ago | (#23381000)

At almost a million dollars a pop, is it really saving money for ISPs to use these? How many would a major ISP need to shape all of their traffic?

Math is fun. (4, Insightful)

Cedric Tsui (890887) | more than 6 years ago | (#23381266)

$800,000/5 million subscribers = $0.16 per subscriber.

Expect to see the surcharge in your next bill!!!

Re:Math is fun. (4, Insightful)

gnick (1211984) | more than 6 years ago | (#23381514)

$800,000/5 million subscribers = $0.16 per subscriber.
Yeah, but 80Gbps/5 million subscribers = 2kBps. How long can you keep 5 million subscribers with speeds like that?

Re:Math is fun. (5, Insightful)

D'Sphitz (699604) | more than 6 years ago | (#23381832)

assuming every single subscriber is using his connection continuously 24 hours per day, not even stopping to so much as read a webpage or an email ...

Re:Math is fun. (3, Insightful)

morgan_greywolf (835522) | more than 6 years ago | (#23381884)

Who says you need to inspect every packet?

Re:Math is fun. (2, Insightful)

gnick (1211984) | more than 6 years ago | (#23382064)

If you don't route all of the packets through this thing, what device will do the cursory inspection and decide which packets warrant "deep" inspection? (I'm really asking - If somebody has a good answer, I'd be interested.)

Re:Math is fun. (2, Insightful)

Anonymous Coward | more than 6 years ago | (#23382086)

You'd need to see every stream, not necessarily every packet in every stream.

Re:Math is fun. (1, Informative)

dwandy (907337) | more than 6 years ago | (#23382026)

Yeah, but 80Gbps/5 million subscribers = 2kBps. How long can you keep 5 million subscribers with speeds like that?
forever when you're a monopoly, or at best part of a small oligopoly where everyone plays along.

Re:Math is fun. (5, Informative)

Bovius (1243040) | more than 6 years ago | (#23382074)

This is also assuming every single packet that an ISP manages goes through a single physical location. So unless Comcast routes every packet to their headquarters at the top of Mt. Doom for inspection before delivery, they're going to need a lot more of these.

I wish this was more saterical and less true. (1)

theaceoffire (1053556) | more than 6 years ago | (#23382402)

As they have proven, they just blame the slow speeds on hackers and pirates, kick everyone off who complains or uses too much, and then over charge the rest.

Re:$800,000? (0)

Anonymous Coward | more than 6 years ago | (#23381414)

Yep, and how much were computers, originally? The price on these will drop when enough of them are bought.

Re:$800,000? (4, Insightful)

blhack (921171) | more than 6 years ago | (#23381446)

Yep, and how much were computers, originally? The price on these will drop when enough of them are bought.
No it won't. There is realistically only a market for a handful of these worldwide. Not several million of them like PCs. Its exactly like cisco hardware, it has remained astronomically expensive simply because only a very small select group of people (network admins) actually buy them.

Re:$800,000? (5, Insightful)

Deadplant (212273) | more than 6 years ago | (#23381588)

Seriously.
Spend the money on a couple more 40Gb fiber lines instead.

Re:$800,000? (5, Interesting)

sgt scrub (869860) | more than 6 years ago | (#23382262)

Better yet, force the telco's to put up the fiber networks they were awarded huge tax cuts to put up! They don't have bandwidth problems they have accountability problems created by the RIAA et el backed by people desperately trying to find a way to sensor the net.

Re:$800,000? (3, Insightful)

GreggBz (777373) | more than 6 years ago | (#23381938)

At almost a million dollars a pop, is it really saving money for ISPs to use these? How many would a major ISP need to shape all of their traffic?
Not only that but it seems like a dumb technical solution for P2P traffic shaping.

Most ISPs would be geographically distributed. I can't think of to many places where you would actually see this much traffic. You'd need, what, 10 OC-192's to see 80Gb/s? Maybe they add all the GigE ports together and cheat to advertise a big number, but still.

Second, this is the kind of device you want closest to your customers, not down the line where your traffic aggregates. If you want to stave upstream traffic, do it as soon as possible in the network.

Third, it's better in almost every aspect of IT to scale out, not up. Every node would be different. You could have business customers in one CDIR or another and different configurations for each. I'm sure this thing is configurable per port, but I'd think it would be easier and more cost effective to have smaller distributed individually configurable devices only where you need them.

No, I don't think this thing is best suited to do traffic shaping for the typical ISP. If you can do DPI on that much traffic, there's bigger, less benign applications I can think of.

Re:$800,000? (1)

Deliveranc3 (629997) | more than 6 years ago | (#23382356)

Route high throughput users onto seperate system, route high throughput users of that system into this thing... kill them.

Pirate Hotel: They check in they don't check out.

It does provide security against your users getting uppity and using what they paid for.

God I hate trying to stick up for ISPs, I'm going back to beig a devil's advocate for Bush and Hitler.

Re:$800,000? (1)

nurb432 (527695) | more than 6 years ago | (#23382614)

Its not about saving money, its 'for the children'.

tank (3, Funny)

BorgCopyeditor (590345) | more than 6 years ago | (#23381016)

80 Gbps tanks aren't going to be sitting in everyone's closet

Not until Wrath of the Lich King comes out ... wait, what were we talking about?

Obligatory (0, Offtopic)

sexconker (1179573) | more than 6 years ago | (#23381058)

How many Libraries of Congress...?

80 Gbps? Almost... 88 mph!

Joining separate incoming and outgoing paths? 5 million subscribers? Deep Packet? Surely the porn industry will invest in this technology.

Also - $800,000 for 80 Gbps? That's just 1 cent per kilobit per second! What a bargain!

Re:Obligatory (1, Funny)

oodaloop (1229816) | more than 6 years ago | (#23381102)

And imagine a Beowolf cluster, and if it ran Linux, etc etc.

Actually... (0)

Anonymous Coward | more than 6 years ago | (#23381662)

It kind of does, actually (at least on some management bits and pieces)

Re:Obligatory (1)

Hal_Porter (817932) | more than 6 years ago | (#23381760)

And imagine a Beowolf cluster, and if it ran Linux, etc etc.
I've just stuck a Post It with "oodaloop" written on it to my voodoo doll and I'm sticking pins in it now. Can you feel anything?

Re:Obligatory (1)

oodaloop (1229816) | more than 6 years ago | (#23381960)

I think I finally messed with someone's OODA Loop [wikipedia.org] .

cost (1)

Kartoffel (30238) | more than 6 years ago | (#23381062)

I guess a handful of these would beat a hojillion racks full commodity servers running pf+altq, but how does the cost really add up?

DPI - Encrypt (5, Interesting)

Unlikely_Hero (900172) | more than 6 years ago | (#23381074)

DPI has only one option when presented with encrypted information however (at least afaik). Give the packet a low priority or pass it through normally (of course, it could also drop it entirely but doing that as a rule would be problematic to say the least). So it would be possible to force a bet. Can the ISPs afford to give encrypted traffic a very low priority?

Re:DPI - Encrypt (5, Insightful)

Shakrai (717556) | more than 6 years ago | (#23381122)

Can the ISPs afford to give encrypted traffic a very low priority?

No, but if they wanted to be pricks they could identify p2p users and give THEIR encrypted traffic a very low priority.

Even if you ran with full encryption and encrypted the communication with the tracker it's still trivial to identify you as a p2p user -- not many VPNs make connections with dozens (or hundreds) of remote hosts.

The only way around that would be to VPN somewhere and use that VPN link to pass all your p2p traffic -- but if you have the means at your disposal to set that up then you likely have the means to find an ISP that doesn't throttle your p2p traffic.

Re:DPI - Encrypt (2, Informative)

Unlikely_Hero (900172) | more than 6 years ago | (#23381306)

quite true, good points all around. One issue with the last part though, the means to find an ISP that doesn't throttle? Sure. To have that ISP be in your area...not so sure.

Re:DPI - Encrypt (3, Informative)

TooMuchToDo (882796) | more than 6 years ago | (#23381338)

https://www.relakks.com/?lang=en [relakks.com] does exactly what you've described. I believe the cost is $10/month US.

Re:DPI - Encrypt (2, Informative)

Hal_Porter (817932) | more than 6 years ago | (#23381836)

Yeah but the connection speeds you get over relakks are lousy if you leave it running for a few hours. They probably throttle too.

Re:DPI - Encrypt (1)

TooMuchToDo (882796) | more than 6 years ago | (#23382042)

For $10/month, I would expect throttling. But the connection is fully encrypted, and can masquerade as a true VPN connection.

Re:DPI - Encrypt (0)

Anonymous Coward | more than 6 years ago | (#23381398)

The only way around that would be to VPN somewhere and use that VPN link to pass all your p2p traffic -- but if you have the means at your disposal to set that up then you likely have the means to find an ISP that doesn't throttle your p2p traffic.

There is services like Relakks https://www.relakks.com/?cid=gb [relakks.com] that will do the job quite well.

Re:DPI - Encrypt (3, Informative)

Em Adespoton (792954) | more than 6 years ago | (#23381482)

It should be trivial to limit any end nodes to a maximum of, say, 8 encrypted connections with unique netblocks on the destination. Any new sessions negotiated after that will automatically be given very low priority.

Also, a TCP packet contains a lot more than just an encrypted payload: you can tell a lot about a packet from the other parts: source and destination ports, sequence and acknowledgement numbers, header length, reserved ID bits, urgent flag, ACK flag, push flag, RST flag, SYN flag, FIN flag, Window size, checksum, urgent pointer and even the options field. I'm sure that it wouldn't be very difficult to set up a bayesian detection ruleset using this data to identify what protocol is being used. The checksum and flags wouldn't be all that useful, but the port numbers, header length, window size, urgent pointer and seq/ack number progressions can be quite telling.

Re:DPI - Encrypt (1)

Amouth (879122) | more than 6 years ago | (#23381742)

i agree that info is revealing.. but if it is done as a tunnle connection.. the revealing info will look like a point to point tunnle.. all the good stuff is going to be in header info inside the encrypted payload

Re:DPI - Encrypt (3, Informative)

evanbd (210358) | more than 6 years ago | (#23382342)

Freenet runs over UDP with fully randomized ports. It acknowledges messages, but even the ACKs are encrypted. Window sizes are hidden behind the crypto as well. Except for the initial connection, handshaking is done by routing through previously established connections.

I'd like to see them DPI that. The best they can do is traffic analysis and decide it looks like P2P and throttle on that.

Re:DPI - Encrypt (0)

Anonymous Coward | more than 6 years ago | (#23382452)

sorry to disperse your parade here, but in my mdpi [manual dpi] seq/ack #'s in at least the linux world are incremented using a system time scheme for the initial number. In fact this is not something set by the layer-7 application period. As well I haven't seen any p2p program or standard utility (that i've inspected) set TCP options, so headers would be same length. window size--wtf is all i have to say there. Lastly port#...have you ever looked at what local port is used when you connect to a remote ssh? I'll give you a hint, its not port 22 for both machines. Try again, please drive thru.

Re:DPI - Encrypt (1)

mikael (484) | more than 6 years ago | (#23381248)

Can the ISPs afford to give encrypted traffic a very low priority?

Definitely not. If people find that their online web purchases fail to complete because some marketing executron has decided to put shttp protocols in the slow lane, word will soon get round on the consumer newsgroups.

Re:DPI - Encrypt (1)

leuk_he (194174) | more than 6 years ago | (#23381352)

they can, but they will eiterh make false positives, or miss a lot of traffic.

If only a effective QOS standard was applied then users could choose the level of quality they wanted.

Re:DPI - Encrypt (0)

Anonymous Coward | more than 6 years ago | (#23381372)

Exactly. The most expensive gear in the world is instantly defeated with encryption.

the cool part is that there are lots of legitimate uses for encrypted traffic so they either piss off lots of voip and VPN users or they let the new bittorrent guys have a free ride.

Until they can crack RC5 encryption realtime they have no chance in hell stopping or even slowing down P2P.

The cool part is most people that do P2P dont do vpn, so specify your P2P traffic to use VPN ports and you confuse them even more. Or set it for web ports. fun fun!

Re:DPI - Encrypt (2, Interesting)

kriss (4837) | more than 6 years ago | (#23381788)

Actually, the whole idea of DPI is *not* to detect things based on port. There's definitely legitimate uses for encrypted traffic - heck, even encrypted P2P, but it'd be a bit premature to say that you can't separate protocols from each other even if they're encrypted.

It's a bit beside the point though. A sane approach to DPI is just to give some traffic a lower priority than other traffic. If the pipe goes full, you don't want to RED drop some WoW traffic (unhappy user) over some BT traffic (decidedly non-interactive). You might also want to keep web browsing at a better priority than bulk HTTP transfers and P2P, whatnot.

Re:DPI - Encrypt (1)

SiriusStarr (1196697) | more than 6 years ago | (#23382210)

Yes, but the fear is not that it will be used to give BT lower priority (which would rarely have much effect). The fear is that it will be used to block P2P outright. Or at least try; bittorrent will start to look more and more like "legitimate" internet usage with time. ISPs should just face the fact that they are on the reactionary side here; P2P will always have some new development that lets them bypass the latest blocking mechanisms, simply because it's much easier to break a defense than to defend against a future attack, the nature of which is uncertain.

Re:DPI - Encrypt (1)

kriss (4837) | more than 6 years ago | (#23382518)

Oh, it's a tool - could definitely be used for good - or evil (and as a bonus, one mans good is another mans evil). Could you block P2P outright? Pretty much, yes. Would it make sense? Not really, for several reasons (See the collective public happiness about Comcast and BitTorrent blocking for one)

Could you rather use it to allow a decent amount of P2P (keep in mind that you could shape/limit, it rather than outright block it) while keeping the net snappy for the non-filesharers as well? Sure, definitely possible.

It boils down to tools. If you *only* can block stuff, that's a blunt instrument. If you can shape as well, I'd be hard pressed to think of a scenario where blocking would be preferable to an ISP, worms and Windows Messenger Service (Not MSN, rather the popup crud in windows) excluded.

Say you got a pipe of 1Gbps and limit P2P and bulk transfers to 700 Mbps of that, you still allow a lot while keeping interactive stuff.. well, interactive.

Re:DPI - Encrypt (3, Interesting)

Shadow-isoHunt (1014539) | more than 6 years ago | (#23381566)

The problem with this whole "it's encrypted so they'd have to throttle SSL too" idea is that bittorrent doesn't use SSL, and lacks a Diffie Hellman exchange. Encrypted BT traffic looks nothing like any other traffic, so it can still be picked out of the traffic flows and thrown into another QoS bracket. Using SSL for BT would also be stupid, because SSL(the key exchange in partciular) is computationally expensive. You'd peg your CPU at 100% the whole time you were grabbing your porn.

Re:DPI - Encrypt (2, Informative)

InlawBiker (1124825) | more than 6 years ago | (#23382314)

That's what all the new-fangle dual core CPUs are for. One to download the porn the other to watch it.

Re:DPI - Encrypt (1)

Shadow-isoHunt (1014539) | more than 6 years ago | (#23382484)

Rapid key exchanges can bring quad cores to their knees with ease. There's a reason there's coproccessors for SSL acceleration.

Order Requisition From +1, TOP SECRET (-1, Offtopic)

Anonymous Coward | more than 6 years ago | (#23381106)

The Office of President-VICE

Please deliver 1,000 units to my bunker-bomb resistant bomb shelter at the U.S. Naval Observatory.

As you are aware, while domestic spying has increased, prosecutions have dropped.

Wait until McCain is the Fake President.

DemoRATS will then know what prosecution is.

Criminally Forever,
President-VICE Richard B. Cheney [whitehouse.org] .

Will be obsolete... (1, Insightful)

Anonymous Coward | more than 6 years ago | (#23381108)

in a few years when every client does opportunistic point-to-point encryption. We are headed that way, right?

Re:Will be obsolete... (1)

Kartoffel (30238) | more than 6 years ago | (#23381222)

Encryption is a good idea, but ISPs can still detect undesirable content by the handshaking and unencrypted header info. Maxwell Smart's communications might be ultra-secure, but nearby KAOS agents still hear whenever his shoe rings, y'know?

Cue existential question: (1, Funny)

Anonymous Coward | more than 6 years ago | (#23381336)

Maxwell Smart's communications might be ultra-secure, but nearby KAOS agents still hear whenever his shoe rings, y'know?

But if Agent 86's shoe phone rings while he is inside the Cone of Silence, does KAOS stll hear it?

Re:Will be obsolete... (1)

penix1 (722987) | more than 6 years ago | (#23381458)

We could resort to the always reliable Cone of Silence [wikipedia.org] . It should prove to be about as reliable as this technology...

Re:Will be obsolete... (1)

Kartoffel (30238) | more than 6 years ago | (#23382324)

Why that's the second best idea I've ever heard. Good thinking!

Re:Will be obsolete... (4, Interesting)

evanbd (210358) | more than 6 years ago | (#23381686)

Heck, to defeat this you could just use AES with a default key. Everyone can use the same key, and have it be publicly known. It's fine because this thing doesn't have the compute power to decrypt in real time, even if it knows what it needs to be decrypting and what the key is. Screw handshaking, key management, etc -- just make the CPU cost nonzero and you're done.

Re:Will be obsolete... (1)

irc.goatse.cx troll (593289) | more than 6 years ago | (#23382098)

I doubt my bank will use that, so does it really matter? Anybody using this encryption to circumvent filtering gets prioritized.

For that matter as pointed out elsewhere, theres more to track than l7 content. If your ip has more than N encrypted connections, or sent more than N bytes, you get deprioritized. I can't think of any legit real world use for sending >500MB a day of https traffic. Even >100MB really. Or more than 50 new encrypted peers per hour.

We're not even talking dropping packets, just sending other packets in front of them. A false positive means loading your banks page might take 5 seconds longer if you load it at a really badly timed time. Hardly something most customers would notice.

Re:Will be obsolete... (1)

znerk (1162519) | more than 6 years ago | (#23382578)

I can't think of any legit real world use...
Yeah, cuz no one has more than one pc in their home, or seeds BT streams for linux isos, or pulls down huge wads of F/OSS software... none of that's "legit", anyways...

You might wanna get offa yer high horse, there, and take a peak at the world around you. We'd hate to leave someone as short-sighted as yourself behind, eh?

Oh, yeah... you might wanna check the amount of data you transmit just playing an online MMORPG, or some of the better FPS games out there... or are they not "legit" reasons for sending/receiving gobs and gobs of packets to/from multiple hosts?

A waste? (3, Insightful)

Nimsoft (858559) | more than 6 years ago | (#23381190)

Surely that money could be better spent improving their capacity by purchasing new equipment with better signaling methods or even extra lines rather than on equipment to inspect and shape (i.e. selectively throttle) traffic?

Even if improving the capacity costs a fair bit extra the space for more customers at higher speeds and more consistent service for existing customers will surely increase their profits by offering more than their competition right?

Re:A waste? (5, Insightful)

Kartoffel (30238) | more than 6 years ago | (#23381330)

Investing in more capacity means a linear increase in customers and profits. Investing in network anti-neutrality, OTOH, means new and lucrative pricing structures for various services. They're just putting money where it stands to return the greater profit.

Re:A waste? (0)

Anonymous Coward | more than 6 years ago | (#23382300)

Installing more capacity doesn't help with congestion when all of the P2P apps on the network automatically increase their bandwidth consumption in response to the increase in available bandwidth. TCP, by design, will keep increasing its bandwidth usage as long as it has data to send and it's not seeing packets get dropped by the network due to congestion. The trouble is that congestion is bad for latency(and thus latency-sensitive applications like VoIP, online gaming or streaming media).

No economical amount of available bandwidth can alleviate this.

Re:A waste? (1)

Shakrai (717556) | more than 6 years ago | (#23382456)

Installing more capacity doesn't help with congestion when all of the P2P apps on the network automatically increase their bandwidth consumption in response to the increase in available bandwidth

It does if you invest in more capacity without increasing the speeds available to your end-users. Put another way, my torrent seeding at 768k might be consuming 1% of a backhaul link -- if they triple the speed of that link without increasing my upstream bandwidth then I'm only using 0.33% of it.

If you can't supply 10mbit speeds to your customers then stop offering them.....

Re:A waste? (1)

Nimsoft (858559) | more than 6 years ago | (#23382708)

If you can't supply 10mbit speeds to your customers then stop offering them.....
Exactly, I'd much rather have the ISP sell me a fixed amount of bandwidth and that's what I get to use before paying extra. I'm sick of all this Unlimited!!!* (*Until we decide you've had to much and stick you with extra charges or disconnection) or 20mbps!!!* (*Unless you transfer a few GBs, then it's 6mbps until tomorrow! Oh, and BitTorrent is always 512kbps!)

I think it should be illegal to advertise packages in such a confusing and downright misleading way.
My old ISP used to clearly state you get 500GBs a month else you get throttled, right there next to the price, and newhere did is say unlimited, because it's not! That's how it should be!

Ok... I have a question... (3, Insightful)

jskline (301574) | more than 6 years ago | (#23381198)

How much of this advertised speed is more or less advertising hype more than anything else??? We all know what it takes to do packet inspection and rules table lookups, so to me, this number seems a bit on the hyped up side...

Anyone else getting this same riff??

Re:Ok... I have a question... (1)

KnightElite (532586) | more than 6 years ago | (#23381756)

It seems possible to me. I'm a computer engineer who specializes in HDL (I design custom logic that runs in FPGAs, basically). For a project I've worked on, with a relatively mid-range FPGA I've done real time MPEG packet analysis as well as UDP checksums, etc... on a 12.8 Gbps datastream. What I've done isn't the same as what Procera is doing, but it's at least similar enough that I don't doubt that they're also using FPGAs to do this. That also gives them the ability to upgrade to detect new protocols, which the article mentions. When you're dealing with FPGA fabric, doing analysis on multiple gigabits of traffic going through the device simultaneously with minimal latency isn't anything that's beyond the capability of modern devices.

Re:Ok... I have a question... (0)

Anonymous Coward | more than 6 years ago | (#23382420)

I would agree. These are most likely switch numbers, where the hardware just forwards packets. Let see some applications on there, that actually do DPI and then give out what the real numbers are.

Let the encryption wars commence. (1, Interesting)

Anonymous Coward | more than 6 years ago | (#23381200)

Sounds like strong encryption needs to become the norm for everything. Encrypt everything and they have to fight harder to inspect it. It'll turn into a ridiculous arms race, but they're firing the first volley with this, and to do nothing is giving in to it.

I also think that stronger net privacy laws won't be enough to really stop it, since it's not just our government (Or indeed, not just governments in general,) that'll be using these.

?? subscribers @ 80gbps (1, Interesting)

imunfair (877689) | more than 6 years ago | (#23381218)

only 80Gbps with 5 million subscribers? If my math isn't way off, that's about 16kbps - which is pretty pitiful speed. You'd have to throttle a lot just to be able to use one of these machines at max subscribers per machine.

Welcome to Comcast - our new TOS allows you to view text-only web pages with your *high speed* internet connection!

Re:?? subscribers @ 80gbps (2, Informative)

blhack (921171) | more than 6 years ago | (#23381512)

only 80Gbps with 5 million subscribers?
Those 5 million subscribers are not all using their connections concurrently. Think about what just happened when I loaded this webpage: it downloaded a text file full of HTML/CSS/Javascript/Whatever else slashdot uses, and now it sits here while I type this comment. I'm not using my connection right now, and won't be using it again until I hit the submit button.

Re:?? subscribers @ 80gbps (1)

harry666t (1062422) | more than 6 years ago | (#23382132)

> I'm not using my connection right now, and won't
> be using it again until I hit the submit button.

You underestimate: youtube, p2p, pr0n, online gaming, apt-get dist-upgrade...

ohh common (1)

Durdenator (1288094) | more than 6 years ago | (#23381224)

wtf is the point? p2p isn't going to slow down. It would also be hard to deal with encrypted p2p as instant messaging applications are using encrypted communication too, not to mention gov networks and credit networks.

I'm waiting for an ISP to use one of these so someone can sue the shit out of them for throttling their data connection.

Re:ohh common (1)

chrisjwray (717883) | more than 6 years ago | (#23381540)

This is exactly what Bell Canada are doing right now, except they are also doing it to their competition!!

Re:ohh common (1)

Tuzanor (125152) | more than 6 years ago | (#23381570)

They can limit each encrypted bank or IM connection to 10-20KB/sec and you wouldn't even notice. You would notice your torrents slowing down though. Many ISPs are already using deep packet inspection. Hell, rogers in canada is playing around with inserting messages into websites [thestar.com] ! I can only hope that it pushes more of the web to https.

Lots of Issues (1)

postbigbang (761081) | more than 6 years ago | (#23381314)

Privacy is the big one. I can see a justification for finding DDoS attacks and zero-second malware propagation, this machine is nothing more than a net-neutrality killer of the highest order.

First big customers: Comcast, Rogers, Bell Canada, AT&T, and the others that we love to hate.

The FCC needs to investigate this thing NOW. It's a monopoly-maker in just 12U.

Re:Lots of Issues (1)

the eric conspiracy (20178) | more than 6 years ago | (#23382048)

Sometime traffic shaping can be a good thing. For example, on a VOIP call you really do want to give priority to the packets associated with the call so that the codecs will be able to reconstruct a reasonable facsimile of a voice.

Re:Lots of Issues (1)

postbigbang (761081) | more than 6 years ago | (#23382332)

QoS issues and those that depend on connection latency need to be addressed, but deep-diving packets is unnecessary to do this. You need only look to the header, find that it's TCP and the service requested to accept or reject latency. The remaining issues are handled by various protocols. This is like swatting a fly with a freight train.... an eight hundred thousand dollar monopoly building freight train.

ISP's motive (1)

d3l33t (1106803) | more than 6 years ago | (#23381358)

ISPs will spend money on DPI/traffic shaping whether i like it or not, so might as well make it efficient.

slashdot likes to whine about big brother (1)

circletimessquare (444983) | more than 6 years ago | (#23381386)

in ankle bracelets on truants, cameras around london, etc.

those are just stunts, it is propaganda and hysteria to overinflate the significance of those developments

but this massive dpi stuff, this is big brother for real

but its not as sexy a lightning rod visceral symbolic issue like ankle bracelets on truants. so it won't experience the same outcry

Porn #1 (0, Offtopic)

Durdenator (1288094) | more than 6 years ago | (#23381444)

I'm pretty sure porn will get 1st priority!

I've decided: this is evil. (5, Interesting)

TheGratefulNet (143330) | more than 6 years ago | (#23381456)

think about the original definition of ethernet and of IP, in general.

in general, it was setup to pass packets and ideally to keep them in the same order and not drop them. beyond that, the upper layers (tcp and udp) did any higher level functions.

this worked! for the longest (damned) time, it worked.

and now, ISPs (and large networks) are starting to try to break out the 'cable is a bunch of bits' into discrete 'services' and then try to re-order things, drop things, queue them differently or somehow treat things non-uniformly.

I think this is Evil(tm).

I've been in the networking field for a few decades (really) and I've seen traffic shaping (what a euphemism, btw!) try to argue its case over and over again. but I keep getting back to the basic design principles of ethernet (csma-c/d) and tcp/udp-ip and when you have large enough pipes, you don't NEED a 'fast lane' or diamond lane, so to speak. it just mucks up the works, makes things harder to design and manage and really isn't helpful since you still need large pipes and all the shaping in the world won't CURE that, it only DEFERs things. that's not a cure.

data should be 'opaque' and first-come first-served. equal access. standard layer (phys, dl, network) rules should still apply.

ISPs who employ shaping are simply RIPPING OFF customers from their rightful bandwidth and also passing along the COST of the packet snooping hardware to us, the users. (don't think they'll just spring for the hardware on their own; they'll pass the costs of this stuff to us, to be sure).

I think its evil. once you look at it from enough angles, you see that its not at all a good thing.

Re:I've decided: this is evil. (3, Interesting)

gzerphey (1006177) | more than 6 years ago | (#23381774)

You are absolutely correct. For the longest (damn) time this did work. The problem is now the traffic doesn't burst like it used to. It's more sustained and oversubscription rules are breaking. Most ISPs are honestly trying to play a game of self-preservation so they can keep their service alive without being cost prohibitive.

DPI is not evil so long as it is used to make the network better as a whole. As with anything it can be bent to the will of evil, but I disagree with that completely. I believe in certain forms of limiting so long as it doesn't degrade the internet experience as a whole.

And yes, I consider myself a backer of net neutrality. All I can say is, I am a realist.

Re:I've decided: this is evil. (2, Insightful)

TheGratefulNet (143330) | more than 6 years ago | (#23381948)

when you simply pass traffic as you get it, you can avoid paying (in real dollars) for equipment that looks inside.

you can avoid the network management complexity if you simply let networks 'work' as they always have.

are you running into a lot of dropped packets? simple: you are over-selling. there is an EASY way to fix that.

oh, and an evil way. guess which one most ISPs and large public networks pick?

by the time you factor in the cost of the snooper silicon, all its overhead and the training/support overhead, I argue that simply just upping the network pipes would have been cheaper and generated more goodwill and user satisfaction.

sometimes, I am in disbelief as to why the most simple solutions are side-stepped in favor or more expensive and more complicated ones!

charge for bit-rates, but please stop trying to carve them out into sub-channels. its wrong, its against the whole idea of a shared network (up and down the layers) and people will still try to find ways around your 'ways'. its an arms race. HOWEVER, if you stop the arms race and simply let people pay for their rate of data, you avoid all this nonsense.

the simple solution evades. yet again. why am I not surprised ;(

Re:I've decided: this is evil. (1)

gzerphey (1006177) | more than 6 years ago | (#23382174)

Again though, its not feasible to have a 1:1 ratio of bandwidth at the WAN. Unless you want to play T1 prices, or more, for guarantied bandwidth there has to be something put in place for control. People are not going to just regulate themselves, nor should they have to.

Again, I am not advocating tearing down the broadband experience, but there is no reason that the ISP has to let the system destroy the network for everyone. Lets be realistic, completely unregulated P2P CAN destroy a network for ALL users.

Re:I've decided: this is evil. (1)

TheGratefulNet (143330) | more than 6 years ago | (#23382622)

using a tech solution to avoid giving actual bandwidth to paying customers is still SIDE-STEPPING.

if the wan is overburdened, again, they must be over-selling! its really that simple.

power users are willing (or should be willing) to pay for their high network usage. light users (email and light browsing) should pay a lower rate.

but choking data because you have 'trouble' doing the money maths right is NOT the right way, my friend! its an easy out but its the wrong 'out', imho.

fix your pricing levels so that you don't HAVE to gyp people out of their power-user experience. be fair and the users will be fair. I've always found that to be the case - treat people with respect and you generally get respect.

either the pricing is wrong or the pipes are too thin (or both). fix the right problem but please stop trying to invent new ways to cut IP packets into pieces. that's just a crying shame and its Wrong with a capital W.

Re:I've decided: this is evil. (1)

Shakrai (717556) | more than 6 years ago | (#23382696)

Again though, its not feasible to have a 1:1 ratio of bandwidth at the WAN

You don't have to have a 1:1 ratio. You just have to have a decent enough ratio that on the typical day your customers aren't competing for bandwidth with one another. Obviously there will be times that they do (a WAN link goes down, some event/disaster happens that causes a spike in traffic, etc, etc) but if that's happening more than occasionally then you need to consider investing in some network upgrades.

People are not going to just regulate themselves, nor should they have to.

Maybe the ISPs should invest in backhaul upgrades without raising the speed level delivered to the end users? Seems like that would solve the problem. What's the point in offering 10-15-20mbit speeds if your customers can only achieve them at 3AM?

Lets be realistic, completely unregulated P2P CAN destroy a network for ALL users.

Not a well designed network.

Re:I've decided: this is evil. (1)

Shakrai (717556) | more than 6 years ago | (#23382572)

The problem is now the traffic doesn't burst like it used to. It's more sustained and oversubscription rules are breaking

Cry me a river. Even ignoring the rise of p2p, did anyone seriously believe that the same oversubscription ratios that worked in the early 90s were still going to be valid in the 21st century? It's not like people didn't foresee the rise of streaming video and online content distribution.

Most ISPs are honestly trying to play a game of self-preservation so they can keep their service alive without being cost prohibitive.

"so they can keep their service alive without reducing dividends to the shareholders", there, fixed that for you.

Re:I've decided: this is evil. (1)

gzerphey (1006177) | more than 6 years ago | (#23382682)

"so they can keep their service alive without reducing dividends to the shareholders", there, fixed that for you.

So what is wrong with running a business. These guys are not a non-profit and they are frankly not oversubscribing nearly as much as you think they are. I can say that its self-preservation until I am blue in the face, but chances are good you wont believe me.

So there we have it. I believe we will have to agree to disagree.

No matter how you read it (1)

koan (80826) | more than 6 years ago | (#23381490)

It's bad for the end user and good for the "corps" nothing good will come from this from my perspective, and not just because I am a p2p user.

Re:No matter how you read it (0)

Anonymous Coward | more than 6 years ago | (#23381964)

If you read the article, they mention a few beneficial uses. Activities such as (D)Dos and worms can be detected and quarantined in real time.

Although these abilities will by no means be their primary function.

I've said it before, I'll say it again (5, Insightful)

Aranykai (1053846) | more than 6 years ago | (#23381596)

If my ISP is going to inspect my packets to the point of identifying their content as p2p, then they should be 100% responsible for any and all illegal activities I may or may not conduct on their connections.

The entire concept of the DMCA safe harbor clause was founded on the understanding that it would be virtually impossible for providers to monitor and filter illegal or unlawful activities and data. However, now it has become perfectly reasonable that they can identify and reroute or slow this traffic. This clearly nullify's the safeharbor provisions.

The ISP's need to realize they cant have it both ways.

Re:I've said it before, I'll say it again (2)

Osurak (1013927) | more than 6 years ago | (#23381716)

Ah, but they *can* have it both ways, as long as they keep their friendly neighborhood congress-critter on their payroll.

Re:I've said it before, I'll say it again (1)

John Hasler (414242) | more than 6 years ago | (#23382512)

> The entire concept of the DMCA safe harbor clause was founded on the
> understanding that it would be virtually impossible for providers to monitor
> and filter illegal or unlawful activities and data.

No. The "safe harbor" provision of the DMCA is founded on the understanding that it would be virtually impossible for providers to reliably identify material that infringes copyrights. It has no relevance to any other activity.

Somethng Wicked This Way Comes (4, Insightful)

Whuffo (1043790) | more than 6 years ago | (#23381640)

This is quite the impressive machine they're talking about. But what they don't seem to cover very well are the legitimate uses for such a device. Just because they call "monitoring your communications" deep packet inspection doesn't make it right.

It looks like a disaster in a box to me: not only does it allow anyone with the price of the machine to monitor and inspect each and every packet you exchange, it also is capable of destroying the legal protections that ISPs currently enjoy.

The ISPs are treated like common carriers and are exempt from many liabilities because they carry all traffic equally and don't know or control the content of that traffic. Now that they're insisting that they need to "prioritize" some traffic at the expense of others, monitor and drop traffic because of its content, and are installing machines like these that further refine their ability to monitor and control what traffic you'll be allowed to transmit - well, their "safe harbor" exemptions are based on them not doing any of this.

Just the existence of this machine will be the undoing of many...

ISPs are not common carriers (0)

Anonymous Coward | more than 6 years ago | (#23382266)

This is quite the impressive machine they're talking about. But what they don't seem to cover very well are the legitimate uses for such a device. Just because they call "monitoring your communications" deep packet inspection doesn't make it right.


It looks like a disaster in a box to me: not only does it allow anyone with the price of the machine to monitor and inspect each and every packet you exchange, it also is capable of destroying the legal protections that ISPs currently enjoy.


The ISPs are treated like common carriers and are exempt from many liabilities because they carry all traffic equally and don't know or control the content of that traffic. Now that they're insisting that they need to "prioritize" some traffic at the expense of others, monitor and drop traffic because of its content, and are installing machines like these that further refine their ability to monitor and control what traffic you'll be allowed to transmit - well, their "safe harbor" exemptions are based on them not doing any of this.


Just the existence of this machine will be the undoing of many...

As said many times here, in the USA, an ISP is not, repeat. not. a. common. carrier.

Fails (1)

edivad (1186799) | more than 6 years ago | (#23381786)

Like all regex/NFA/DFA based inspection engines, they all fail when malware hides inside archive files.

What do they think it's for? (1)

argent (18001) | more than 6 years ago | (#23381922)

But Brear and Lindén made the case that this shouldn't be seen as a looming consumer nightmare, nor should it be seen as having anything to do with network neutrality.
What ELSE do they think it's for?

Don't say that he's hypocritical
Say rather that he's apolitical
"Once the rockets are up, who cares where they come down
That's not my department," says Wernher von Braun
-- Tom Lehrer

Its official (1)

LameAssTheMity (998266) | more than 6 years ago | (#23382022)

From the people that brought you the War on Drugs and the War on Terror, its the War on Privacy!

Re:Its official (1)

gzerphey (1006177) | more than 6 years ago | (#23382280)

DPI != spying.

DPI is mostly used for the sake of bandwidth control rather then seeing what the customer is doing. And yes, we can debate as to the nature of bandwidth controls, but to give a blanket DPI == spying is the same as saying P2P == illegal music downloads.

My 2 cents...

Re:Its official (1)

LameAssTheMity (998266) | more than 6 years ago | (#23382558)

Perhaps DPI as a rule isn't used for spying, but in the context of stopping or slowing P2P, it is only a matter of time before your ISP is on the RIAA/MPAA payola and is producing DPI spreadsheets for the said spying.

Personally, I'm against my ISP doing anything other than providing a cable to my house.

RTFA:Encryption barely slows this thing down. (1)

foo fighter (151863) | more than 6 years ago | (#23382302)

To everyone saying, well, I'll just encrypt everything: That's great, but this thing falls back on service fingerprints to identify traffic if it can't inspect packet contents. This is a similar concept to nmap's service and OS fingerprinting tech. Idiosyncracies of timings, handshake protocols, header flags, and traffic patterns can give away that a packet contains p2p content.

Repeat after me: encryption isn't a panacea.

Your $800K machine is no match for my puny skills (2, Insightful)

Vellmont (569020) | more than 6 years ago | (#23382386)

I'll bet in the war against p2p, making p2p data look like normal "priority" data is going to be far easier, and far cheaper than the ISPs trying to identify and block/slow the data they don't like. Consider that hiding p2p data takes one person with a keyboard and some smarts. In a month this guy will work around any solution the $800K machine guys have put together, and the next machine will be 8 million dollars to do the same job.

Encryption? Just the first salvo. Others have pointed out that p2p makes a lot of connections. That's fine, just create a secure queuing system where people wait their turns (and don't have multiple data streams). Or, a repeater system where you get one or two data feeds in, and feed to one or two other people. There's no reason why a p2p system has to have 50 different connections to different people. Start looking at the data itself and see if it's http-like? Okee-doke, just create an http wrapper around your data so it looks like http. These are just the dumb ideas I came up with on the fly. Real solutions would be a lot better.

This kind of asymmetric "war" has been fought before, namely with copyright protection in the 80s. The result? Cracked programs are more valuable than non-cracked programs (oh, and all copyright protection schemes were cracked)

In a system with untrusted intelligent nodes, you can't really create a priority system without some people making their non-priority data look like priority data. The internet was designed for the end nodes to be smart, and the network to be dumb. (The exact opposite of the phone system). It seems to me this is just a basic design principle of the internet.

Why don't ISPs just monitor bandwidth? (0)

Anonymous Coward | more than 6 years ago | (#23382526)

Why don't ISPs just monitor bandwidth and just throttle people who consume too much. All this packet inspection crap is easily overcome through encryption but bandwidth usage is transparent.

Use IPsec (2, Insightful)

Skapare (16644) | more than 6 years ago | (#23382688)

With IPsec, they won't even be able to see what protocol is being used. The more we use IPsec for everything, the less these things will look like an attractive way to spend money that would otherwise go to expanding capacity.

Load More Comments
Slashdot Login

Need an Account?

Forgot your password?