80 Gbps Deep Packet Inspection Hardware Announced 185
An anonymous reader writes to tell us that Procera Networks is launching a new weapon on the deep packet inspection (DPI) front. At $800,000 these 80 Gbps tanks aren't going to be sitting in everyone's closet, but it could mean that more traffic shaping is on the way. "The PL10000 can handle up to 5 million subscribers and can track 48 million real-time data flows. That's certainly a potent piece of hardware, but larger ISPs will need more. That's why Procera designed the new machines with full support for synchronizing traffic flows where return traffic might be routed to a different PacketLogic machine. The machine receiving the return traffic can make the machine monitoring the outbound traffic aware that it sees the other half of a TCP/IP conversation, for example, giving the devices more accuracy than those which might only have access to one side."
Just in time! (Score:5, Funny)
Comment removed (Score:4, Informative)
$800,000? (Score:5, Insightful)
Math is fun. (Score:5, Insightful)
Expect to see the surcharge in your next bill!!!
Re:Math is fun. (Score:5, Insightful)
Re:Math is fun. (Score:5, Insightful)
Re:Math is fun. (Score:5, Funny)
Re: (Score:3, Insightful)
Would any ISP NOT stoop so low as to try something like that?
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Insightful)
Re: (Score:3, Insightful)
Re: (Score:2, Insightful)
Re: (Score:2, Informative)
Re:Math is fun. (Score:5, Informative)
Re: (Score:2)
So all in all, not so bad.
Re:$800,000? (Score:5, Insightful)
Spend the money on a couple more 40Gb fiber lines instead.
Re:$800,000? (Score:5, Interesting)
Re:$800,000? (Score:4, Interesting)
Re:$800,000? (Score:4, Insightful)
Most ISPs would be geographically distributed. I can't think of to many places where you would actually see this much traffic. You'd need, what, 10 OC-192's to see 80Gb/s? Maybe they add all the GigE ports together and cheat to advertise a big number, but still.
Second, this is the kind of device you want closest to your customers, not down the line where your traffic aggregates. If you want to stave upstream traffic, do it as soon as possible in the network.
Third, it's better in almost every aspect of IT to scale out, not up. Every node would be different. You could have business customers in one CDIR or another and different configurations for each. I'm sure this thing is configurable per port, but I'd think it would be easier and more cost effective to have smaller distributed individually configurable devices only where you need them.
No, I don't think this thing is best suited to do traffic shaping for the typical ISP. If you can do DPI on that much traffic, there's bigger, less benign applications I can think of.
Re: (Score:2)
Pirate Hotel: They check in they don't check out.
It does provide security against your users getting uppity and using what they paid for.
God I hate trying to stick up for ISPs, I'm going back to beig a devil's advocate for Bush and Hitler.
Re: (Score:2)
Re:$800,000? (Score:5, Insightful)
tank (Score:4, Funny)
80 Gbps tanks aren't going to be sitting in everyone's closet
Not until Wrath of the Lich King comes out ... wait, what were we talking about?
cost (Score:2)
DPI - Encrypt (Score:5, Interesting)
Comment removed (Score:5, Insightful)
Re: (Score:3, Informative)
Re:DPI - Encrypt (Score:4, Informative)
Re: (Score:2, Informative)
Re: (Score:2)
Re: (Score:2)
Their netblock is known. Connections to the service for the VPN is a red flag. The system is designed to monitor both directions of a connection and associate them. How many ways can a VPN connection be intercepted by a man in the middle attack where all initial handshakes is known to the man in the middle?
Re:DPI - Encrypt (Score:4, Informative)
Also, a TCP packet contains a lot more than just an encrypted payload: you can tell a lot about a packet from the other parts: source and destination ports, sequence and acknowledgement numbers, header length, reserved ID bits, urgent flag, ACK flag, push flag, RST flag, SYN flag, FIN flag, Window size, checksum, urgent pointer and even the options field. I'm sure that it wouldn't be very difficult to set up a bayesian detection ruleset using this data to identify what protocol is being used. The checksum and flags wouldn't be all that useful, but the port numbers, header length, window size, urgent pointer and seq/ack number progressions can be quite telling.
Re: (Score:2)
Re:DPI - Encrypt (Score:4, Informative)
Freenet runs over UDP with fully randomized ports. It acknowledges messages, but even the ACKs are encrypted. Window sizes are hidden behind the crypto as well. Except for the initial connection, handshaking is done by routing through previously established connections.
I'd like to see them DPI that. The best they can do is traffic analysis and decide it looks like P2P and throttle on that.
Re: (Score:2)
Re: (Score:2)
Definitely not. If people find that their online web purchases fail to complete because some marketing executron has decided to put shttp protocols in the slow lane, word will soon get round on the consumer newsgroups.
Re: (Score:2)
If only a effective QOS standard was applied then users could choose the level of quality they wanted.
Re:DPI - Encrypt (Score:4, Interesting)
Re: (Score:3, Informative)
Re: (Score:2)
Re: (Score:2)
Encrypted BT traffic looks nothing like any other traffic, so it can still be picked out of the traffic flows and thrown into another QoS bracket.
Because nobody has bothered to make it look like other traffic yet.
Using SSL for BT would also be stupid, because SSL(the key exchange in partciular) is computationally expensive.
That's funny, I don't recall my low powered computers having any trouble setting up an SSL connection. Usually when people talk about SSL being "computationally expensive" they're talkin
Re: (Score:2)
Re: (Score:2)
BT opens sockets constantly, and the key exchange is the expensive part, not the AES that comes after.
I've used BT. It doesn't open/close hundreds of connections a minute. It might open tens of connections an hour. Big deal.
Even if it did, you'd just have to do a little re-design on the bittorent protocol.
There's another option (Score:2)
Remember when the internet was supposed to be a "dumb" network that could therefore be easily and seamlessly improved by just improving the software at the endpoints? Those were good times.
Re: (Score:2, Interesting)
It's a bit beside the point though. A sane approach to DPI is just to give some traffic a lower priority than other traffic. If the pipe goes full, you don't want to RED drop some WoW traffic (unhappy user) over some BT traffic (decidedly non-
A waste? (Score:3, Insightful)
Even if improving the capacity costs a fair bit extra the space for more customers at higher speeds and more consistent service for existing customers will surely increase their profits by offering more than their competition right?
Re:A waste? (Score:5, Insightful)
Re: (Score:2)
Ok... I have a question... (Score:4, Insightful)
Anyone else getting this same riff??
?? subscribers @ 80gbps (Score:2, Interesting)
Welcome to Comcast - our new TOS allows you to view text-only web pages with your *high speed* internet connection!
Re: (Score:3, Informative)
Re: (Score:2)
> be using it again until I hit the submit button.
You underestimate: youtube, p2p, pr0n, online gaming, apt-get dist-upgrade...
Lots of Issues (Score:2)
First big customers: Comcast, Rogers, Bell Canada, AT&T, and the others that we love to hate.
The FCC needs to investigate this thing NOW. It's a monopoly-maker in just 12U.
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Interesting)
Of course it can be used for good or evil. But the fact of the matter is that DPI is in the mix as one approach to provide QoS for real time internet applications like streaming video and audio that don't play well with the 'best effort' delivery paradigm that packet switched ne
Re: (Score:2)
What's ev
Re: (Score:2)
Yes. And it's a good thing for your ISP to know you are, for example, on VoIP to really *slowdown* the packets associated with the call so they can push through your throat their "premium service for VoIP" which is just de-capping again your VoIP calls.
Oh! and *they* -not you, are the owners of the device so, what of those two "good things" do you thing you
Re: (Score:2)
Yeah, and the bad fairies might come in the night, steal your firstborn and replace it with a gollum.
Your scenario is a paranoid fantasy.
slashdot likes to whine about big brother (Score:2)
those are just stunts, it is propaganda and hysteria to overinflate the significance of those developments
but this massive dpi stuff, this is big brother for real
but its not as sexy a lightning rod visceral symbolic issue like ankle bracelets on truants. so it won't experience the same outcry
I've decided: this is evil. (Score:5, Interesting)
in general, it was setup to pass packets and ideally to keep them in the same order and not drop them. beyond that, the upper layers (tcp and udp) did any higher level functions.
this worked! for the longest (damned) time, it worked.
and now, ISPs (and large networks) are starting to try to break out the 'cable is a bunch of bits' into discrete 'services' and then try to re-order things, drop things, queue them differently or somehow treat things non-uniformly.
I think this is Evil(tm).
I've been in the networking field for a few decades (really) and I've seen traffic shaping (what a euphemism, btw!) try to argue its case over and over again. but I keep getting back to the basic design principles of ethernet (csma-c/d) and tcp/udp-ip and when you have large enough pipes, you don't NEED a 'fast lane' or diamond lane, so to speak. it just mucks up the works, makes things harder to design and manage and really isn't helpful since you still need large pipes and all the shaping in the world won't CURE that, it only DEFERs things. that's not a cure.
data should be 'opaque' and first-come first-served. equal access. standard layer (phys, dl, network) rules should still apply.
ISPs who employ shaping are simply RIPPING OFF customers from their rightful bandwidth and also passing along the COST of the packet snooping hardware to us, the users. (don't think they'll just spring for the hardware on their own; they'll pass the costs of this stuff to us, to be sure).
I think its evil. once you look at it from enough angles, you see that its not at all a good thing.
Re: (Score:3, Interesting)
DPI is not evil so long as it is used to make the network better as a whole. As with anything it can be bent to the will of evil, but I disagree with that completely. I believe
Re: (Score:3, Insightful)
you can avoid the network management complexity if you simply let networks 'work' as they always have.
are you running into a lot of dropped packets? simple: you are over-selling. there is an EASY way to fix that.
oh, and an evil way. guess which one most ISPs and large public networks pick?
by the time you factor in the cost of the snooper silicon, all its overhead and the training/support ove
Re: (Score:2)
if the wan is overburdened, again, they must be over-selling! its really that simple.
power users are willing (or should be willing) to pay for their high network usage. light users (email and light browsing) should pay a lower rate.
but choking data because you have 'trouble' doing the money maths right is NOT the right way, my friend! its an easy out but its the wrong 'out', imho.
fix your pricing levels so t
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
e.g., Based on total data transferred within the last 24 hours:
0-2 Gigs -> 12 Mbps
2-4 Gigs -> 6 Mbps
4+ Gigs -> 3 Mbps
Re: (Score:2)
but I keep getting back to the basic design principles of ethernet (csma-c/d) and tcp/udp-ip and when you have large enough pipes, you don't NEED a 'fast lane' or diamond lane, so to speak. it just mucks up the works, makes things harder to design and manage and really isn't helpful since you still need large pipes and all the shaping in the world won't CURE that, it only DEFERs things.
ISPs will never actually purchase enough bandwidth to come close to meeting their customers' needs in a 1:1 fashion. More importantly, the problem is that P2P will expand to fill up whatever bandwidth is available.
So the ISPs have two choices:
1. Buy ABC more bandwidth, multiplied by forever, to serve a fixed number of users, thus raising their fixed costs without adding new customers
2. Buy XYZ worth of traffic shaping equipment, multiplied by once
From a business standpoint, it makes a lot of sense to try a
Re: (Score:2)
The question then is, what happens when you exceed that?
I think if you exceed it, then traffic shaping is reasonable (the alternative is to pay per byte- that's normally simply begging to be massively overcharged, don't do that).
The question then is, what type of traffic shaping?
I think that you should be given budgets, X high priority, Y low priority. A
No matter how you read it (Score:2)
I've said it before, I'll say it again (Score:5, Insightful)
The entire concept of the DMCA safe harbor clause was founded on the understanding that it would be virtually impossible for providers to monitor and filter illegal or unlawful activities and data. However, now it has become perfectly reasonable that they can identify and reroute or slow this traffic. This clearly nullify's the safeharbor provisions.
The ISP's need to realize they cant have it both ways.
Re: (Score:2)
Re: (Score:2)
> understanding that it would be virtually impossible for providers to monitor
> and filter illegal or unlawful activities and data.
No. The "safe harbor" provision of the DMCA is founded on the understanding that it would be virtually impossible for providers to reliably identify material that infringes copyrights. It has no relevance to any other activity.
Re: (Score:2)
If they are inspecting packets to this level, they can readily compare that information to a database provided by the RIAA/MPAA/Microsoft/Apple etc..
They CAN easily identify materials that are copyrighted.
Somethng Wicked This Way Comes (Score:5, Insightful)
It looks like a disaster in a box to me: not only does it allow anyone with the price of the machine to monitor and inspect each and every packet you exchange, it also is capable of destroying the legal protections that ISPs currently enjoy.
The ISPs are treated like common carriers and are exempt from many liabilities because they carry all traffic equally and don't know or control the content of that traffic. Now that they're insisting that they need to "prioritize" some traffic at the expense of others, monitor and drop traffic because of its content, and are installing machines like these that further refine their ability to monitor and control what traffic you'll be allowed to transmit - well, their "safe harbor" exemptions are based on them not doing any of this.
Just the existence of this machine will be the undoing of many...
What do they think it's for? (Score:2)
Don't say that he's hypocritical
Say rather that he's apolitical
"Once the rockets are up, who cares where they come down
That's not my department," says Wernher von Braun -- Tom Lehrer
RTFA:Encryption barely slows this thing down. (Score:2)
Repeat after me: encryption isn't a panacea.
Re: (Score:2)
OTOH, IPsec can deprive them of knowing the port number and few other things.
Re: (Score:2)
Your $800K machine is no match for my puny skills (Score:3, Insightful)
Encryption? Just the first salvo. Others have pointed out that p2p makes a lot of connections. That's fine, just create a secure queuing system where people wait their turns (and don't have multiple data streams). Or, a repeater system where you get one or two data feeds in, and feed to one or two other people. There's no reason why a p2p system has to have 50 different connections to different people. Start looking at the data itself and see if it's http-like? Okee-doke, just create an http wrapper around your data so it looks like http. These are just the dumb ideas I came up with on the fly. Real solutions would be a lot better.
This kind of asymmetric "war" has been fought before, namely with copyright protection in the 80s. The result? Cracked programs are more valuable than non-cracked programs (oh, and all copyright protection schemes were cracked)
In a system with untrusted intelligent nodes, you can't really create a priority system without some people making their non-priority data look like priority data. The internet was designed for the end nodes to be smart, and the network to be dumb. (The exact opposite of the phone system). It seems to me this is just a basic design principle of the internet.
Re:Your $800K machine is no match for my puny skil (Score:2)
Still want to play? If this sounds unfair then consider how this machine will be deployed...
PS You still haven't defeated the encryption fingerprints that the DPI uses but there is something much more obvious that identifies your traffic as p2p
Re: (Score:2)
I'm not going to tell you how, you have to guess and experiment.
You obviously have underestimated peoples tenacity at solving puzzles. The is FUN to a lot of people, and all it takes is one guy to find out your secret.
but there is something much more obvious that identifies your traffic as p2p
I'm sure there is, and the P2P guys will work around that problem. Are you (the ISP) will to continue shoveling money into the companies that develop this, or would you rather just either buy more bandwidth, or estab
Use IPsec (Score:3, Insightful)
With IPsec, they won't even be able to see what protocol is being used. The more we use IPsec for everything, the less these things will look like an attractive way to spend money that would otherwise go to expanding capacity.
Cloudshield has had similair capabilities (Score:2)
Re: (Score:2, Funny)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re:Will be obsolete... (Score:5, Interesting)
Re: (Score:2)
For that matter as pointed out elsewhere, theres more to track than l7 content. If your ip has more than N encrypted connections, or sent more than N bytes, you get deprioritized. I can't think of any legit real world use for sending >500MB a day of https traffic. Even >100MB really. Or more than 50 new encrypted peers per hour.
We're not even talking dropping packets, just se
Re: (Score:2)
You'd need to be housing dozens of people all of which are doing MASSIVE online banking to hit the numbers I mentioned, and frankly if you have enough computers on the one connection your isp would probably care just as much -- i.e one cable connection being resold to everyone in your appartment building or similar.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
That or to IPsec, or maybe both. They'll still at least see what IP address the traffic is going to, so they could still try to hussle the other site for some bandwidth favoritism money.
Re: (Score:2)
Maybe it's because they want to do more than just monitor traffic volumes. One of the potential evils of this thing is that it can, for non-encrypted traffic like web access, track your web visits, see what you like, and report the top ten keywords for you to their spammer partners.
Re:Monopoly Markets (Score:2)
You are lucky and in the minioriy who can choose from several broadband providers. I have a choice also.
It's Comcast of any of several dial-up offerings in the area.
Have you tried to do P-P on 0.3 Kbs dial-up lately?