Tema: Re: Apie Zebra ir CERT
Autorius: Bone Daddy
Data: 2009-08-11 15:12:53
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content="text/html; charset=utf-8" http-equiv=Content-Type>
<META name=GENERATOR content="MSHTML 8.00.6001.18812">
<STYLE></STYLE>
</HEAD>
<BODY>
<DIV><FONT size=2 face=Arial>"PxYra" &lt;</FONT><A 
href="mailto:nera@nebus.net"><FONT size=2 
face=Arial>nera@nebus.net</FONT></A><FONT size=2 face=Arial>&gt; wrote in 
message </FONT><A href="news:h5rl9l$7r9$1@trimpas.omnitel.net"><FONT size=2 
face=Arial>news:h5rl9l$7r9$1@trimpas.omnitel.net</FONT></A><FONT size=2 
face=Arial>...</FONT></DIV>
<DIV><FONT size=2 face=Arial>&gt; <BR>&gt; daugiau kuo shustresne versija tada 
ir vaidenas visokie leti uzsieniai P2P <BR>&gt; ribojimai ir kitos 
nesamones,&nbsp;<FONT color=#ff0000 size=5>&nbsp; ? ? ?</FONT></FONT></DIV>
<DIV><FONT color=#ff0000 size=5 face=Arial></FONT>&nbsp;</DIV>
<DIV>HOW IT WORKS:<BR><BR>- The Sandvine application reads packets that are 
traversing the network boundary<BR><BR>- If the application senses that outbound 
P2P traffic is higher than a threshold determined by Comcast, Sandvine 
<STRONG><FONT color=#ff0000>begins to interrupt P2P protocol 
</FONT></STRONG>sequences that would initiate a new transfer from within the 
Comcast network to a peer outside of the Comcast network<BR><BR>- The 
interruption is accomplished by sending a perfectly forged TCP packet (correct 
peer, port, and sequence numbering) with the RST (reset) flag set. This packet 
is obeyed by the network stack or operating system which drops the 
connection.<BR><BR>In eDonkey connections, for example, queued UPLOADS (to 
others) will not be honored to some percentage of non-Comcast P2P users. 
<STRONG><FONT color=#ff0000>Immediately</FONT></STRONG> after the peer requests 
ranges to be transferred, <STRONG><FONT color=#ff0000>the connection is dropped 
in the above manner</FONT></STRONG>. Gnutella transfers are similarly affected 
in the same manner.<BR><BR>In BitTorrent connections, the RST message is sent 
well after the handshake, and often after some data has been exchanged. The 
Sandvine filter interferes during lulls (NOOP and HAVE commands) as well as the 
moment of transition from the ending of sending one complete piece. When I am 
not using Comcast, BitTorrent disconnections due to peer resets (RST flag) are 
3%. Using Comcast, 39% of connections are terminated using the RST 
flag.<BR><BR>In Summary: The Sandvine filter has taken steps to try to make the 
filtering experience innocuous (nearly invisible) to the user. Some transfers 
are allowed, the interruption seems to come from the distant peer, and it relies 
on the P2P protocol being used to either find another peer (hopefully a Comcast 
one) or retry that peer later.</DIV></BODY></HTML>