Beta

Slashdot: News for Nerds

×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

An Education In Deep Packet Inspection

kdawson posted more than 5 years ago | from the opening-all-the-envelopes dept.

Privacy 126

Deep Packet Inspection, or DPI, is at the heart of the debate over Network Neutrality — this relatively new technology threatens to upset the balance of power among consumers, ISPs, and information suppliers. An anonymous reader notes that the Canadian Privacy Commissioner has published a Web site, for Canadians and others, to educate about DPI technology. Online are a number of essays from different interested parties, ranging from DPI company officers to Internet law specialists to security professionals. The articles are open for comments. Here is the CBC's report on the launch.

cancel ×

126 comments

piss post (-1, Troll)

Anonymous Coward | more than 5 years ago | (#27496027)

lol hello hi

Re:piss post (-1, Troll)

Anonymous Coward | more than 5 years ago | (#27496229)

Hello, I am a mac using faggot.

-jcr

That title (-1, Offtopic)

Anonymous Coward | more than 5 years ago | (#27496349)

sounds like a porn movie.

Deep inspection up your authorities (5, Funny)

b0ttle (1332811) | more than 5 years ago | (#27496083)

How would the authorities like to be deep inspected?

Re:Deep inspection up your authorities (3, Funny)

Anonymous Coward | more than 5 years ago | (#27496175)

How would the authorities like to be deep inspected?

If there's a Slashdot achievement for getting a +5 on a Goatse link, you just missed your chance at it.

Re:Deep inspection up your authorities (1, Informative)

RiotingPacifist (1228016) | more than 5 years ago | (#27496501)

It wouldn't be the first time [slashdot.org] somebody got +5 for linking to goatse [goatse.cz] m im just waiting for the editors to let it slip into a summary.

Re:Deep inspection up your authorities (2, Insightful)

severoon (536737) | more than 5 years ago | (#27497993)

Is it time for strong encryption of packet payloads yet? ssh? Ostiary [homeunix.net] ? However it goes, I'm good...just need to know the new standard for basic web browsing...

Re:Deep inspection up your authorities (4, Insightful)

causality (777677) | more than 5 years ago | (#27496187)

How would the authorities like to be deep inspected?

That's a good question.

This summary mentions education about deep packet inspection. To me that's a very simple thing that boils down to a few questions:

Do you want your ISP and potential unknown/unaccountable parties to be able to easily monitor, intercept, and record some or all of your Internet traffic? Do you want profiles built on this information that will compromise your privacy and could be used to serve advertisements or to micromanage your Internet usage? Do you feel like QoS, which will be the given reason/excuse, is such a good and desirable thing that it's worth all of these disadvantages?

Like so many things that are not the result of overwhelming customer demand, this is a bad idea that is open to all sorts of abuse.

Re:Deep inspection up your authorities (4, Insightful)

Anonymous Coward | more than 5 years ago | (#27496497)

it's just going to push more and more protocols to use TLS wrappers and to use random "legit looking" ports (like 20, 21, 80, 443, 110), a la Skype and most IM clients nowadays

Good luck deep inspecting that crap

Re:Deep inspection up your authorities (4, Insightful)

causality (777677) | more than 5 years ago | (#27496569)

it's just going to push more and more protocols to use TLS wrappers and to use random "legit looking" ports (like 20, 21, 80, 443, 110), a la Skype and most IM clients nowadays Good luck deep inspecting that crap

That's true. You'd think that "spam vs anti-spam measures" alone or "windows viruses vs windows virus scanners" alone would have taught us, by now, how to recognize an arms race when we're about to start one. This is what I mean when I say that our culture does not value foresight.

Re:Deep inspection up your authorities (2, Funny)

sexconker (1179573) | more than 5 years ago | (#27496725)

Our culture doesn't value foreskin either (aside from grinding it up for use in cosmetics).

Such a thought is sure to put any intact man in your position, causality.

Re:Deep inspection up your authorities (0)

Anonymous Coward | more than 5 years ago | (#27498815)

Check out Bluecoat Systems, http://www.bluecoat.com/ [bluecoat.com] . In any sufficiently important organization (state, government, ISP, HUGE company), they can mandate hidden proxies from Bluecoat systems. Unless you are extremely diligent and verify the cert **every time**, your company may proxy SSL connections and your browser will still show an encrypted connection, just not directly from the site the user thinks. BTW, the product is NOT listed on the website.

A large US-based telecom/ISP deployed DPI in 2006. I don't recall there being any headlines about it.

Re:Deep inspection up your authorities (0)

Anonymous Coward | more than 5 years ago | (#27499277)

You can only proxy SSL connections if you can install a trusted CA on the client. If you control the local trust of CAs, and don't simply ignore the warnings that essentially every SSL/TLS system provides by default, MitM is not plausible.

Re:Deep inspection up your authorities (4, Interesting)

HTH NE1 (675604) | more than 5 years ago | (#27496799)

Do you want your ISP and potential unknown/unaccountable parties to be able to easily monitor, intercept, and record some or all of your Internet traffic? Do you want profiles built on this information that will compromise your privacy and could be used to serve advertisements or to micromanage your Internet usage? Do you feel like QoS, which will be the given reason/excuse, is such a good and desirable thing that it's worth all of these disadvantages?

The Internet will become more like an airport: all your packetages will be subject to inspection without need for a warrant or probable cause and denied travel accordingly.

Re:Deep inspection up your authorities (4, Funny)

memorycardfull (1187485) | more than 5 years ago | (#27496251)

When Larry Craig taps his foot that means he is up for a deep inspection if you are...

Re:Deep inspection up your authorities (1, Redundant)

memorycardfull (1187485) | more than 5 years ago | (#27496963)

I got "Troll" for this? I'm honestly sorry if I offended someone, just trying to make a joke...

Re:Deep inspection up your authorities (1, Offtopic)

memorycardfull (1187485) | more than 5 years ago | (#27497565)

I got "Redundant" for this? I wasn't repeating myself, just trying to be polite...;)

Re:Deep inspection up your authorities (1)

spazdor (902907) | more than 5 years ago | (#27498671)

And I am in this thread too!

Re:Deep inspection up your authorities (2, Funny)

Anonymous Coward | more than 5 years ago | (#27499393)

That's why the rest of us, knowing we're posting off-topic to complain about moderation of our posts will do so anonymously, and make the criticism of the moderation sound like it's coming from an impartial third party. :p

Re:Deep inspection up your authorities (0)

Anonymous Coward | more than 5 years ago | (#27501095)

shut the fuck up

Re:Deep inspection up your authorities (2, Insightful)

davidsyes (765062) | more than 5 years ago | (#27497961)

HAHA... this reminds me of the circa 1997/98 near-bust (or was it an actual bust?) of a famous sports player who got caught up in a Mountain View Police raid on a "massage parlor". His plea to the cops to not be cited or charged was that he wasn't there having sex; he was getting "deep tissue therapy"....

In hind site, umm, hind SIGHT, ummm, hell, RETROspect, this may have been a form of "deep PACK IT" inspection. If things were non-condomnable, it might have ended up as a 32-bit insemination, vice inscription....

AND, 32-bit inscription me of CNET Radio, in 99 or 2000 when Desmond Crisis (IIRC) got a call from a lady who had problems with technology. She said something like, "The instructions told me i need a system capable of 32-bit inscription..." Desmond said, "No, Mary, that's 32-bit enCRYPtion. 32-bit inSCRIPtion would be, 'The Lord is my Shepherd'", LOL

Wow, amazing how all this ties into vices (sex, sportsballers & cops) & biblical things and radio....

The description's a little "excited" (4, Insightful)

davecb (6526) | more than 5 years ago | (#27496099)

It's a hacky technology to implement QOS because folks don't like setting the QOS bits and protocol in the headers. Usually because some Microsoft firewall only allows http on port 80 (;-))

It's the use of it by the famous "men of good will but little understanding" that is bad, plus of course the use of it by men of ill will.

--dave

Re:The description's a little "excited" (4, Insightful)

causality (777677) | more than 5 years ago | (#27496285)

It's the use of it by the famous "men of good will but little understanding" that is bad, plus of course the use of it by men of ill will.

The former category is much more dangerous. At least most people recognize ill-will when they see it. By far people with good intentions and no comprehension of the "law of unintended consequences" do more damage to the world than do people with openly evil intentions.

No politician ever increased state power by saying "I'd like to see this nation become a totalitarian state and you should support me because this law will bring it closer to that goal." They do it by saying "this is for your safety" or "this is to stop terrorism" and the people who mean well and don't understand the damage they can do will eagerly eat that shit up. That's true whether or not the politician himself believes anything he is saying.

Re:The description's a little "excited" (2, Interesting)

Red Flayer (890720) | more than 5 years ago | (#27497085)

No politician ever increased state power by saying "I'd like to see this nation become a totalitarian state and you should support me because this law will bring it closer to that goal." They do it by saying "this is for your safety" or "this is to stop terrorism" and the people who mean well and don't understand the damage they can do will eagerly eat that shit up. That's true whether or not the politician himself believes anything he is saying.

Well, that brings up an interesting philosophical question -- assuming the politician in charge IS evil, who, actually, is responsible for the evil of the totalitarian state? Do the people cause the harm, by supporting the disingenuous politician? Or does the evil politician cause the harm?

I'd say the evil politician causes the harm, because but for his actions, the harm would not happen. Ability to prevent harm, and lack of exercise of that ability due to good intentions, does not imply responsibility for causation -- the people who mean well and don't understand the implications are not the cause of the harm.

That doesn't mean that failure to understand the ramifications is an excuse, it just means that the actual cause should be attributed to the person of bad will, not to the people of good will and little understanding.

Re:The description's a little "excited" (2, Insightful)

Anonymous Coward | more than 5 years ago | (#27497283)

Meaning well does not remove you from the causation of harm.

Example:
Just because I don't understand that shooting someone with a gun can kill them doesn't mean I didn't cause that person to die. It just means I am an ignorant fool who killed someone.

Then again if you follow the train back far enough we can just blame *insert how you think the world came about here* for all evil.

Re:The description's a little "excited" (4, Insightful)

causality (777677) | more than 5 years ago | (#27497689)

Then again if you follow the train back far enough we can just blame *insert how you think the world came about here* for all evil.

That's why it makes more sense to look at it in terms of enablers who could have chosen differently. The people could study statecraft and propaganda techniques. They could study dictatorships like the Third Reich or Italy under Mussolini to learn how these leaders came to power by preying on the desperation and the weaknesses of the people. They can familiarize themselves with the sorts of excuses and justifications that are given for the expansion of state power. They can learn argumentation and research so that they are equipped to investigate things on their own instead of requiring that premade conclusions be spoonfed to them. In short, they can shed the naivete and the ignorance that must be present before such horrors can arise.

Any literate adult with Internet access can do all of these things. The only obstacle they could encounter would be their own laziness or unwillingness. I would say that we have a responsibility to do these things because everything that is good about the way of life that we presently enjoy depends on an informed citizenry. Our civilization is on the decline because people think this does not apply to them, or they think that someone else will take care of it, or they think that the latest celebrity-worship is more important.

The evil politicians are like organisms in an environment. The environment in which they thrive consists of ignorant people who are far too naive and trusting and do not guard themselves against being deceived. If you set up this sort of environment, those organisms will appear in it and will prosper. Thus, I believe it is the people and their ignorance and lack of priorities that are far more to blame, for they provide fertile soil without which this organism could never succeed. It should be assumed that evil men will come along who will try to take advantage of our way of life to suit their selfish purposes. We should be prepared for this and well-able to deal with it by never rewarding it with the power it seeks to have. We are not. We think our enemies are our friends because they know how to tell us what we want to hear. That is the problem.

Re:The description's a little "excited" (1, Insightful)

Anonymous Coward | more than 5 years ago | (#27499257)

You, my friend, do not understand human nature.

Re:The description's a little "excited" (4, Interesting)

Ungrounded Lightning (62228) | more than 5 years ago | (#27496659)

As I understand it:

ISPs don't implement the QoS (Type of Service) field because (back before THEY needed it for services) Microsoft deployed an IP stack in Windows that "improved" their own file transfers and other IP traffic by demanding high QoS for everything.

Because of that (and the threat of bad guys cheating) the ISPs don't trust the field when coming from a customer. So there wasn't a strong driver for implementing QoS in the ISPs and backbone

IMHO the right solution is for ISPs to:
  - Write service level agreements that guarantee a certain bandwidth of high QoS traffic - for the whole feed to the customer, not per flow.
  - Start honoring the ToS field and policing the data rate at the edge router, and
  - When a packet would be dropped for exceeding the data rate for the enhanced service, instead REWRITE THE ToS FIELD for best-effort delivery (or whatever lower service level seems appropriate) and try to forward it under those terms.

That way:
  - The ISP doesn't have to classify the flow according to traffic type to give the user high QoS for his critical services.
  - The ISP doesn't have to do a packet-recombine if the packet is fragmented to identify the flow for the trailing fragments (which don't carry the TCP/UDP port number).
  - The user / application can specify what special handling he / it wants.
  - Applications that try to "cheat" can only do so up to the bandwidth cap for the special handling. (But the user paid for that. So he can use his bandwidth for whatever he wants. It's not "cheating" any more.)
  - Excess traffic will still go through as well as it does now.
  - A "cheating" application WILL hurt the user's own really-needs-high-QoS service, giving users and applications providers an incentive not to request excessive QoS. (But it won't hurt ANYBODY ELSE's traffic.)
  - Authors of applications that need high QoS will have an incentive to specify it, since doing so will work.

Easy Fix (3, Interesting)

bobbuck (675253) | more than 5 years ago | (#27496957)

Charge more for higher QoS. Give a discount for lower QoS.

Re:Easy Fix (0)

Anonymous Coward | more than 5 years ago | (#27498181)

Charge more for higher QoS quota.

I like it that way.

Re:Easy Fix (2, Interesting)

Ungrounded Lightning (62228) | more than 5 years ago | (#27498225)

Charge more for higher QoS. Give a discount for lower QoS.

That's a given.

I'd expect plans to include some small amount of VoIP quality 2-way high-QoS as standard (about a couple phone calls' worth plus whatever is needed for the plan's special services). Higher amounts could be obtained by subscribing to a higher-priced plan or dynamically-configured as needed - perhaps for a fee (like dialing a toll phone call or subscribing to a pay-per-view).

Want your packets to get reserved bandwidth and better treatment on the backbone? Pay up your fair share (and let the ISPs and backbone providers split the swag according to their contracts). Or take best effort delivery, in competition with file transfers and whatnot, and accept the hiccups when the intertubes get cloggerated.

Re:Easy Fix (1)

Kozz (7764) | more than 5 years ago | (#27499405)

I think you've got the first part right, anyhow. What business have you ever known to reduce price in such a manner? Any "low" QoS traffic will continue to be billed at pre-QoS billing rates.

Re:The description's a little "excited" (1)

Dataovercable (1527065) | more than 5 years ago | (#27498051)

Brilliant! Just Brilliant.... Anybody poke a hole or two in this yet? JR

21st Century Government Work (5, Informative)

mrbene (1380531) | more than 5 years ago | (#27496151)

Taking a quick look through the content at the government site, I must say I'm surprised. CC licensed content, links to external resources, a collection of international points of view. I'd be truly impressed if they'd managed to get all these folks in a room together.

Regardless, kudos to Canada for hitting the 21st century.

And I was doubly impressed to notice the absence of web beacons / analytics scripts.

Re:21st Century Government Work (4, Informative)

snowraver1 (1052510) | more than 5 years ago | (#27496217)

Judging by the things that I have viewed by the Gov't of Canada, that seems par for the Course.

Re:21st Century Government Work (3, Funny)

Nerdfest (867930) | more than 5 years ago | (#27496355)

Well, we do have other problems. ACTA is still on the table, and Bill C-61 is about to pop up again soon. We've recently been blamed by the US as the major source of film piracy.

It's also snowing.

Re:21st Century Government Work (2, Funny)

Anonymous Coward | more than 5 years ago | (#27496421)

We've recently been blamed by the US as the major source of film piracy.

I thought that was China...
no wait.. its Russia...

Can they ever get their facts straight?

Re:21st Century Government Work (4, Funny)

bencoder (1197139) | more than 5 years ago | (#27497239)

Can they ever get their facts straight?

What are you talking about? Everyone knows it's the terrorists. It's always been the terrorists. We will fight them with our allies: Canada, China and Russia.

Re:21st Century Government Work (1)

PReDiToR (687141) | more than 5 years ago | (#27500765)

Yes, but there was never a time when we weren't at war with Eurasia.

I defy you to find a reference to it anywhere in history [archive.org] !

And don't give me that "here is some paper that proves it" crap, everyone knows that paper can be counterfeited. Only the internet [wikipedia.org] can be believed.

Re:21st Century Government Work (1)

JO_DIE_THE_STAR_F*** (1163877) | more than 5 years ago | (#27496451)

Canada Strong and Free

This kind of open and honest debate is what makes me proud to be Canadian. The Office of the Privacy Commissioner of Canada seems to 'get' the technology of DPI and why we should be concerned about it.

On a side note I'm not so proud of the dirty oil being produced here in Alberta. But, at least no one is being killed for our oil. - well except for migratory birds [worldwatch.org] .

Re:21st Century Government Work (0)

Anonymous Coward | more than 5 years ago | (#27496481)

Speaking in heavy generalities, the distinguishing characteristic of Canada is a history of Consensus rather than Conflict. It hasn't been applied perfectly by any means, but the result has been we tend to shoot at each other over minor and major issues a lot less than most countries, and less than any other country I can think of that is such a non-homogeneous mix. An aspect of this difference is our government information services tend to be informative, rather than promotive.

I'd be more impressed ... (1)

Ungrounded Lightning (62228) | more than 5 years ago | (#27496691)

... if they'd managed to build a web site that displayed correctly (or displayed the essay collection AT ALL) on Firefox 2.0.0.8.

obligatory (5, Funny)

Dan667 (564390) | more than 5 years ago | (#27496283)

inspect this! ... askjdkasjdlajsldkjaskl djaksjdklasjdklajsldaskljdaljdaslkdjalkdjalsdj ... \

Re:obligatory (5, Funny)

Em Emalb (452530) | more than 5 years ago | (#27496371)

I did not know you could do that with a kielbasa, you dirty, dirty young man.

Re:obligatory (2, Funny)

Em Emalb (452530) | more than 5 years ago | (#27496613)

Oh come the fuck on, what it is with retards with mod points?

That was a troll?

No, not in the slightest. A troll would be me suggesting that whomever moderated the above as troll go fondle themselves with a razor blade while watching their mother sate the insane raging lust of a Brahma bull.

the above was a joke...*sigh*

Re:obligatory (1)

Dan667 (564390) | more than 5 years ago | (#27496631)

I took it as a joke. Oh well.

Re:obligatory (1)

ushdfgakj (1218112) | more than 5 years ago | (#27497605)

I don't think you understand what constitutes trolling.

Deep Inspection is not the Problem (4, Insightful)

rob_benson (698038) | more than 5 years ago | (#27496369)

D.I. is neither good or bad, it is the illegal or immoral application of the technology that is the problem. I really am amazed that no-one on a technology site noted that the heart of the debate on net neutrality is free speech, not deep inspection.

Re:Deep Inspection is not the Problem (3, Insightful)

causality (777677) | more than 5 years ago | (#27496405)

D.I. is neither good or bad, it is the illegal or immoral application of the technology that is the problem.

It's a technology that almost no one wants except for those who are in a position to abuse it. That makes it difficult or impossible to view it as a "neutral" thing.

Re:Deep Inspection is not the Problem (4, Insightful)

99BottlesOfBeerInMyF (813746) | more than 5 years ago | (#27496583)

It's a technology that almost no one wants except for those who are in a position to abuse it. That makes it difficult or impossible to view it as a "neutral" thing.

I've seen quite a few "good" uses of DPI, from filtering out content trying to contact worm control channels to gathering statistics on Web site usage for academia. You can use DPI to slow down traffic going to any video hosting site not paying you a kickback or you can use it to filter out a DDoS attack on one of your network's clients. The technology is useful today, but we do need legislation to keep it from being abused.

Re:Deep Inspection is not the Problem (1)

myVarNamesAreTooLon (1474005) | more than 5 years ago | (#27496615)

D.I. is neither good or bad, it is the illegal or immoral application of the technology that is the problem.

It's a technology that almost no one wants except for those who are in a position to abuse it. That makes it difficult or impossible to view it as a "neutral" thing.

What about this? http://dpi.priv.gc.ca/index.php/what-is-deep-packet-inspection/ [priv.gc.ca]

DPI has been used for several years to maintain the integrity and security of networks, searching for signs of protocol non-compliance, viruses, malicious code, SPAM and other threats.

Are you suggesting people don't want a less SPAMy, more secure internet? There's more to it than "oh noes, the isp's are spying my internets!"

I'm not saying I want them to, there's just more to it than some people realize.

Re:Deep Inspection is not the Problem (1)

causality (777677) | more than 5 years ago | (#27497143)

D.I. is neither good or bad, it is the illegal or immoral application of the technology that is the problem.

It's a technology that almost no one wants except for those who are in a position to abuse it. That makes it difficult or impossible to view it as a "neutral" thing.

What about this? http://dpi.priv.gc.ca/index.php/what-is-deep-packet-inspection/ [priv.gc.ca]

DPI has been used for several years to maintain the integrity and security of networks, searching for signs of protocol non-compliance, viruses, malicious code, SPAM and other threats.

Are you suggesting people don't want a less SPAMy, more secure internet? There's more to it than "oh noes, the isp's are spying my internets!" I'm not saying I want them to, there's just more to it than some people realize.

You and another person suggested using it to thwart spam or worm attacks. I am replying to you since the other person was more reasonable. That is, he did not say "are you suggesting people don't want a less spamy [sic], more secure internet" as though that's the same thing as criticising another wrong solution that cannot solve our problems. The way you did that reminds me of people who say "you mean you don't want to be safe from terrorists?" when you point out that it's wrong to infringe on civil liberties. It's an intimidation tactic that's designed to shut down healthy debate. It won't work on me or anyone else who can see that for what it is.

I am not a fan of "solutions" that don't address the actual causes of problems. They inevitably open up more problems, many of which can be unanticipated. It may be obvious, but we should get one thing out of the way: the presence of many insecure Windows machines is what enables the modern spam problem and the modern malware problem. If I ever see successful worms thriving "in the wild" for Unix-like operating systems, I'll gladly revise that statement, but for now, that's the reality.

The solution to that is to secure those Windows machines. Any other proposed solution is aimed at symptoms of the problem and not the actual problem which is why it will fail. Whether the users should secure those machines by obtaining a clue or whether Microsoft should do that as part of taking care of its customers is the debatable part. This is the part I want to emphasize: nothing other than securing those insecure machines, and perhaps their users, is going to solve this problem. Our efforts and our ability to create novel solutions should be directed towards that goal. Deep packet inspection is a network operation and does not constitute host security. What you are referring to there is damage control, which is about detection and containment. It is emphatically not security, which is about prevention.

If you start using DPI to target spam and worms, you'll run into all of the problems we currently have with filters and virus/malware scanners. The reason why there is not a final ultimate solution for those problems is that this approach does not address the real cause. It only treats the immediate symptoms of that cause. That's why there isn't going to be a final ultimate solution to those problems. What you will end up with is an arms race where it will be a contest between those who maintain the DPI systems and those who produce spam and malware. The contest will consist of how quickly spammers and malware authors can modify their traffic to be "missed" by the DPI filters and at some point will also consist of how well they can disguise their traffic to make it look legitimate. To be successful, the DPI filters would need to catch every possible spam/malware pattern; to be successful, the attackers would only need to find one that was missed. Thus, this scenario favors the attacker.

The arms race that this will trigger is predictable because it fails to address the real underlying problem. This is easy to foresee and it's trivial to know this ahead of time. Therefore, there is no excuse for allowing it to happen. For those who are perceptive and notice patterns, this is a distinguishing trait of wrong solutions everywhere. It comes from superficial thinking combined with an unwillingness to confront the core problem, which is often more difficult to do than the implementation of these wrong solutions. It's not like it's going to be easy to do something about all of these insecure Windows machines. While that is often more difficult, it is also the only response that's worthwhile. I prefer not to run away from the actual problem in search of refuge that cannot be found.

Re:Deep Inspection is not the Problem (1)

AK Marc (707885) | more than 5 years ago | (#27497369)

It's a technology that almost no one wants except for those who are in a position to abuse it.

It's a technology that everyone except abusers should love, if used well. Think of it this way, when congestion happens, something must be dropped. So, what do you drop? Do you drop random packets? Or do you identify someting that's drop-tolerant and delay-tolerant and drop those first (up to some point where you'll be dropping more)? Personally, I'd think that people would be happy that their VoIP is prioritized over their bittorrent and FTPs. Oh, sure, they have to wait a couple minutes longer for a download to have low-latency and drop-free calls, but that is worth it, right?

Re:Deep Inspection is not the Problem (1, Insightful)

Anonymous Coward | more than 5 years ago | (#27498491)

"Do you drop random packets? Or do you identify someting that's drop-tolerant and delay-tolerant and drop those first?"

There's no need to look into the packet to tell what the priority should be. Check the header, and see what priority the user gave it, but limit the amount of "high priority" traffic per user if there is congestion. The user doesn't gain anything by "cheating" and labeling their bittorrent or FTP as high priority - all they'll do is hurt their VoIP or streaming video.

The TCP headers already have a priority field, which is easy to check and is fair. Why would you want to implement a CPU intensive, privacy-violating scheme like DPI to get around that? Only makes sense if you're a marketer, or in the business of selling expensive routers.

Re:Deep Inspection is not the Problem (1)

smash (1351) | more than 5 years ago | (#27500929)

Why would you want to implement a CPU intensive, privacy-violating scheme like DPI to get around that?

So you'll happily let my malware through at high priority, simply because it puts a high priority in its TCP header?

Cheers dude.

Re:Deep Inspection is not the Problem (2, Insightful)

rob_benson (698038) | more than 5 years ago | (#27498849)

I use it for worm control and attack detection on a corporate network: nothing wrong with that at all. It is completely untrue that the only application of DI is for spying or nefarious activity. Its like blaming bit torrent protocol for piracy. Again, it is use of the tool that is the problem.

Re:Deep Inspection is not the Problem (1)

Anonymous Coward | more than 5 years ago | (#27498881)

The post office reading every letter mailed is the modern day equivalent to DPI.

How in the bloody fuck can you say the post office reading every delivered letter on any terms is good at ANY time for ANY reason?

DPI is the same, there is no legit usage for this tech NONE AT ALL.

Deep Panty Inspection (5, Funny)

SirBitBucket (1292924) | more than 5 years ago | (#27496389)

Oh, must be in the wrong thread...

Re:Deep Party Inspection (0)

Anonymous Coward | more than 5 years ago | (#27497421)

In Soviet Russia, Party deep inspect you!

Encryption stops this correct? (4, Insightful)

koan (80826) | more than 5 years ago | (#27496409)

Doesn't a good encryption system stop DPI from giving any useful information?

Re:Encryption stops this correct? (5, Informative)

gsgleason (1241794) | more than 5 years ago | (#27496457)

Yes. If using ssl to secure whatever application is in question, they cannot see past the transport layer.

Re:Encryption stops this correct? (4, Interesting)

green1 (322787) | more than 5 years ago | (#27496599)

They can however arbitrarily assume all encrypted data to be hostile and filter accordingly...

Re:Encryption stops this correct? (0)

Anonymous Coward | more than 5 years ago | (#27496881)

These swines!!!!! >:(

Re:Encryption stops this correct? (0)

Anonymous Coward | more than 5 years ago | (#27498493)

If you mean in the context of an ISP, this would be the point where every customer they have calls them up to complain they can no longer do any online banking.

Re:Encryption stops this correct? (1)

spazdor (902907) | more than 5 years ago | (#27498837)

Oh, don't worry, customer! You can still bank securely using our "Transparent Security Service" man-in-the-middle atta-er, I mean, proxy server! Just click OK to that certificate there. It's safe, I promise.

Re:Encryption stops this correct? (1)

green1 (322787) | more than 5 years ago | (#27499409)

sure you can do online banking, because your bank has paid the filtering company to be on the whitelist...

Re:Encryption stops this correct? (1)

PReDiToR (687141) | more than 5 years ago | (#27500783)

The regulatory bodies would love that.

The answer to so many questions is encryption, "they" would love a way to make it painful to use.

Re:Encryption stops this correct? (4, Insightful)

BitterOak (537666) | more than 5 years ago | (#27496559)

Doesn't a good encryption system stop DPI from giving any useful information?

Any useful information? Sure! There is lots of useful information that can be gleaned even when encryption is used. Who are you communicating with? What protocol are you using? By looking at packet timing and packet sizes, much more information can be obtained than you might think, such as: are you web surfing vs. interactive keyboard login? Are you tranferring large files or reading short web pages? And if the structure of the web pages of the target site is known, the size of the packets transferred might even reveal which pages you were visiting. Some have even reported the ability to make educated guesses about keystrokes in interactive sessions based on timing of packets. Admittedly some of these features will have to wait for the next generation of DPI technology, but even today, a great deal of information can be collected.

Re:Encryption stops this correct? (1)

Chabo (880571) | more than 5 years ago | (#27496617)

Some have even reported the ability to make educated guesses about keystrokes in interactive sessions based on timing of packets.

So that's how the Comcast employee was able to beat me at CS -- he knew my bunny-hopping pattern!

Re:Encryption stops this correct? (1, Insightful)

Anonymous Coward | more than 5 years ago | (#27496661)

Yes, analyzing packet sizes and frequencies can work in theory... until it is put into practice, because then it would be trivial for the encryption users to rewrite their servers and clients to send random-sized encrypted packets at random intervals and mess up any information you may have gained.

Re:Encryption stops this correct? (1)

TheSpoom (715771) | more than 5 years ago | (#27499013)

Why would that mess anything up? The whole point, usually, is to throttle people using P2P software like BitTorrent. All your suggestion would do would be to put a big neon arrow over their heads.

Re:Encryption stops this correct? (0)

Anonymous Coward | more than 5 years ago | (#27496605)

Doesn't a good encryption system stop DPI from giving any useful information?

Not really, they have other methods for looking at the traffic, despite being encrypted, to make a very good guess on what kind of information is in the packets.

Re:Encryption stops this correct? (2, Insightful)

token_username (1415329) | more than 5 years ago | (#27496627)

Slightly off the point from this, but related: QoS mechanisms will probably just default encrypted traffic to a lower service class. That's the quick and easy way to handle it.

Re:Encryption stops this correct? (3, Insightful)

click2005 (921437) | more than 5 years ago | (#27496721)

I was going to say that wont work very well because of VoIP but as most ISPs are phone companies they probably dont want VoIP working too well either.

Re:Encryption stops this correct? (4, Interesting)

gweeks (91403) | more than 5 years ago | (#27496805)

Take a look at:

SSLIA [netronome.com]

Deep packet inspection inside SSL sessions. It's not the only one either.

Re:Encryption stops this correct? (1, Interesting)

Anonymous Coward | more than 5 years ago | (#27497153)

Uh, no, not with some of the new devices comeing along for firewalls. I know my company is preparing to upgrade their firewalling (global presence, 100K+ employees) with such technology explicitly for 2 "big" problem areas as they see it: 1. Intellectual property theft; 2. "Inappropriate" site access (porn, etc.).

As I read the proposal (as part of a wide list of reviewers as potential stakeholders due to my 2-bit role in web administation) I was appalled to realize that this is commercial off-the-shelf technology to instantly decrypt SSL packets, check for the verboten stuff, then pass along the encrypted originals with no hint that your "secure" connection is anything but.

I am not interested in that off-limits stuff, but doing any of my payroll/medical/personal banking stuff on the corporate network with https is now very unappealing to me, but the corporate related "personal" functions have no alternative.

When I mentioned this forthcoming capability to other colleagues at an orientation session after hearing the moderator extol the wonders of doing our HR stuff "securely" online, many were disturbed by my revelation.

Anything for the "bottom line" and "corporate governannce", eh?

Also, this means that the (intentional) bad guys can buy and use this stuff...

FWIW,
RO

Re:Encryption stops this correct? (3, Informative)

AK Marc (707885) | more than 5 years ago | (#27497285)

Doesn't a good encryption system stop DPI from giving any useful information?

Mostly. However, many DPI boxes are now including heuristics as well. Encrypted stream of 20k in and out to a single IP? Sounds like VoIP to me, toss it in that bucket. Encrypted 10k out and 1M in to a single IP? Sounds like a file download, toss it in that bucket. Encrypted 10k in from 20 hosts and 5k out to 15 hosts? Sounds like P2P, toss it in that bucket. If I can make such guesses easily, someone smarter than me has already coded those in and knows what your encrypted data is. Not what it contains, as that's never the goal of DPI, but what you are using it for. So encrypt it all you want. They'll know what you are up to anyway. Unless you do someting like Tor downloads and then it'll look more like P2P and you'll get even worse performance. Or, as someone else mentioned, if it isn't easily identifiable encryption, then they treat it like the least desired traffic. Hide all you want and they can still get you for it.

Your Action, My Reaction (4, Interesting)

Nom du Keyboard (633989) | more than 5 years ago | (#27496523)

You go for DPI.
I go for encryption, SSL, and HTTPS. Even my slowest home system can easily handle this.

Re:Your Action, My Reaction (1)

jfclavette (961511) | more than 5 years ago | (#27497067)

If my DPI reveals encrypted data, I give you the lowest QoS. What's your reaction now ?

Re:Your Action, My Reaction (0)

Anonymous Coward | more than 5 years ago | (#27497277)

Steganography will bypass your DPI easily.

Re:Your Action, My Reaction (0)

Anonymous Coward | more than 5 years ago | (#27497315)

Stenography and lots and lots of pigeons.

Re:Your Action, My Reaction (0)

Anonymous Coward | more than 5 years ago | (#27497559)

Honestly? Go to the IT guy and legal at work, and have them rake you over the coals for deliberate interference with the corporate VPN on any grounds they can think of ...legitimate or not. Oh...it's in your AUP that you can do that and nobody *actually* has grounds to sue? Do you want the company to announce that all home/VPN users will have to change ISPs to your competitor, and advise all of our customers do the same to avoid your willful interference with delivery of our secure site to the users...

It'd require a message of the day, a whitepaper for IT departments of the resellers... possibly even a few guides on how to find a new ISP with a list of ones we know will work better but don't endorse.

Seriously--how long do you think comcast/local DSL provider of choice would last with QoS on crypted traffic? Every single corporate home user on the planet would be crying foul when they could no longer VPN into the office effectively. They might try to upsell to "VPN edition" or some such crap, and it might work until the moment they complained to any IT department that just told them to change ISPs.

And don't get me started about users wanting to do online banking...

Re:Your Action, My Reaction (0)

Anonymous Coward | more than 5 years ago | (#27497591)

Now you have business class lawsuits from companies that depend on high-traffic SSL. What's their reaction now?

Re:Your Action, My Reaction (1)

Hal_Porter (817932) | more than 5 years ago | (#27500079)

Tell them that they are welcome to pay more for an "enterprise class" connection, at which point I disable the check.

Re:Your Action, My Reaction (1)

domatic (1128127) | more than 5 years ago | (#27497601)

Arms race of course as various and ever changing schemes are used to make the encryption appear to be something else.

Re:Your Action, My Reaction (0)

Anonymous Coward | more than 5 years ago | (#27500463)

My reaction: I will put a fake innocent looking wrapper around that data, to keep the QoS up.

Re:Your Action, My Reaction (1)

Antique Geekmeister (740220) | more than 5 years ago | (#27499111)

And luring you into accepting a man-in-the-middle SSL key is.... how difficult? Or stealing your target website's keys, aor getting them with a warrant-free patriot act request?

Your reaction, my re-reaction (0)

Anonymous Coward | more than 5 years ago | (#27497089)

You go ssl.

I go man in the middle. I handle your connections and key exchanges between both ends and look at your unecrypted traffic before I forward it on encrypted.

Re:Your reaction, my re-reaction (3, Interesting)

GravityStar (1209738) | more than 5 years ago | (#27497941)

MITM's. The answer to this is SSL ofcourse, and "don't allow SSL exceptions". (Don't run with scissors)

But there has to be a better way for establishing the 'CA - domain' trust. Why isn't the trust chain 'ICANN CA - country domain operator CA - registrar CA - domain'?

But first you need DNSSec anyway, otherwise you can validate the PKI chain, but not that everybody is who they say they are. (For example: Registrar CA's should only be valid on DNS records where they are listed as the Registrar.)

After that, default to https and deprecate http for bonus points.

Question... (1)

SuperCharlie (1068072) | more than 5 years ago | (#27497481)

If an ISP decides to inspect all traffic, doesn't this make them responsible for the traffic? As in... you are not a common carrier, you do not have the "I didnt know" defense and now anything (virus's, copyright,child porn, etc..) that goes through you is your responsibility? I assume there is a money solution to this that will make this problem disappear, like buying a few laws or stacking some judicial BB's somewhere.. but I thought you either let it all go or you buy the responsibility..

Re:Question... (1)

John Hasler (414242) | more than 5 years ago | (#27497633)

> If an ISP decides to inspect all traffic, doesn't this make them responsible for the
> traffic?

No.

Advertisers (1)

Stan92057 (737634) | more than 5 years ago | (#27497779)

On what grounds do advertisers have the right to spy on anyone? to make a bigger dollar. Of all the reasons this DPI is bad,allowing advertisers to use this is out right criminal. and if anyone would would abuse it the advertisers would be the first. DPI is nothing more then wire tapping and the last time i hurd you need a warrant to wire tap anyone. And that the only reason it should be used,with a warrant

Anonymous (0)

Anonymous Coward | more than 5 years ago | (#27497783)

"The articles are open to comment"

But if you disagree with us, we'll inspect all your pron out of existence.

I would worry slightly less. (0)

Anonymous Coward | more than 5 years ago | (#27498325)

As has been mentioned here before, this is a new arms race. And while there MAY be some DPI's that work, but my previous employers' was pretty unreliable. Because we, in support, were not privy to even a hint on how this black-box part of the software worked, the failures I saw left me wondering if any of it worked at all.

The signatures must be pretty hardware-dependent: if your DSP's are not fast enough, you're going to be limited to port and maybe a teeny amount of header info. We were told our DSPs (IBM's) were more than fast enough to do the active signatures (a subset of the total) and service 1gig ethernet. And "deep" seemed to be pretty shallow, "port + header" seemed to be a major part of it. "Encrypted" torrents simply obfuscated the header a little and changed port-behavior and we totally lost track of it.

So having said all of this, I would wager that we have the upper hand, albeit slightly, in this arms race. (Witness torrent traffic, and virtually everything P2P in China.) So support the FOSS of your choice to keep ahead. Ultimately, the big ISPs will be hardest pressed to catch stuff because the volume of traffic, the economic slowdown, and pressures to NOT spend money. I'd worry more about the small & medium tier simply because they can benefit from having 1 smart person being listened to. That's where an asymmetrical leap might happen.

My 2 cents, sorry to post anonymously.

No Tales from the Encrypt (2, Interesting)

SoupIsGood Food (1179) | more than 5 years ago | (#27498889)

Unencrypted data will always get you in trouble. There is no reason in the year two thousand and nine to send or receive anything over the internet without encapsulating it in a SSH or SSL tunnel. Whine all you like about performance hits, but if the technology has reached the point where your residential ISP can look inside every packet you send to see what's there - in real time - then the point has come to spend some processing power on protecting your data in mid-flight, or invest in some encryption hardware.

I'm more than half convinced that this is how everything =inside= a LAN should communicate with each other, too. The firewall should allow port 22, port 443, and drop the rest.

While we're at it, everything should be firewalled right at the VLAN, on the switch.

Re:No Tales from the Encrypt (2, Funny)

Derleth (197102) | more than 5 years ago | (#27499577)

The obvious solution is to block or severely slow down all encrypted traffic (that is, all traffic the ISP can’t interpret). This would have the obvious effect on online banking, which could be solved by the ISP’s computers handling it: The SSL tunnel stops at your ISP, which inspects the decrypted packets before handing them to you. You know the ISP isn’t going to do anything bad with the information because they told you so (in specific, there’s both a contract and fraud laws stopping them). This might hinder the adoption of new streaming video codecs and the like, but it’s a small price to pay for increased profits.

Re:No Tales from the Encrypt (1)

Hal_Porter (817932) | more than 5 years ago | (#27500097)

Actually it should work like this

1) Measure the bandwidth usage of encrypted data per month.
2) If it is over some limit, throttle the speed.

That way torrents will work for a while and then slow down. Even a throttled connection should be able to handle online banking. This is only on the cheap service.

I'd also sell a more expensive service with higher limits, static IP addresses and less contention. In fact I'd have a load of options, at the top of which you'd basically be able to max out the connection 24x7. Cheaper connections would have published limits and would throttle speed once people went over them. Actually, who cares what the data is, just count the bits.

Re:No Tales from the Encrypt (1)

PReDiToR (687141) | more than 5 years ago | (#27500823)

Here in the UK on Virgin's (possibly Phorm [phorm.com] -laced offering we have that on a daily basis.

There are currently two "prime time" zones in the day and if you use too much bandwidth during those times you get your service cut in half until midnight.

Sure, they are giving us a free upgrade in speed, but it's totally asynchronous and potentially Phorm riddled.

On the upside, they are reliable (once you have it working), cheap (enough), let you have any port you want all the time and don't throttle BitTorrent.

Re:No Tales from the Encrypt (0)

Anonymous Coward | more than 5 years ago | (#27501123)

Hm....

So, all my friends who do not feel like being this paranoid, I should get rid of those right ? Cause "there is no reason ...". And all the servers I use that don't support encryption, I should stop visiting those right ? Cause "there is no reason ...". Now, of course, all my friends also run normal machines (not very secure) and typically use email servers, either owned by their ISP or a third party. So can I trust that nobody breaks into their computer, thereby being able to read all our communication ? Can I be sure that our 3.rd party email provider does not itself read my email and that it is secure enough to stop others from doing it ?

All this is assuming I have the knowledge and time to keep my own computer completely safe.

The point here is, if they get into any of these places, the whole security setup was for nothing. They get to read the data anyway. And the cost of what you suggest is far from negligible given all maintentance and other costs together. And all the servers I cannot use anymore.

To sum up, security in 2009 is a complete mess. And I think the only reason why you don't see this is that you have a geek mindset, thinking of technology and not cost.

How is it protected? (2, Insightful)

anonymous cowshed (1503301) | more than 5 years ago | (#27500639)

As the DPI box has access to, and holds records of, an extroardinary stream of data that mnust make it an incredibly tempting target for hackers. What have they put in place to prevent it being compromised?
Load More Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Create a Slashdot Account

Loading...