Network Measurement Tool Detects Reset Packets 118
kickassweb writes "If you think your ISP is sniffing packets, or worse yet, sending reset packets to stop torrents, there's now a beta Network Measurement Tool to detect them, courtesy of Lauren Weinstein of the Net Neutrality Squad. It's released under the LGPL, and runs under Win2K, XP, and Vista. Quoting: 'While the reset packet detection system included in this release is of interest, NNSquad views this package as more important in the long run as a development base for a broad range of network measurement functionalities and associated communications and analysis efforts.'"
Slashdotters would laud this, but... (Score:5, Funny)
Re: (Score:2, Insightful)
Re:Slashdotters would laud this, but... (Score:5, Insightful)
Re:Slashdotters would laud this, but... (Score:4, Funny)
Programming C is just not that difficult, especially for anyone who already knows how to code in at least one other language.
Don't know how to code? There are tons of tutorials, books, and more on the Web, at your library, at your local bookstore and from e-commerce vendors everywhere.
If you have a brain, and an IQ of at least, say 115 or so, you have no excuse.
Re:Slashdotters would laud this, but... (Score:5, Insightful)
I would like to give the benefit of the doubt to the original poster and interpret his comments this way:
If there was a ready made package for me to use, I would gladly help the monitoring effort. However, I find the mantra "just port it" not only a reactionary response, but also totally unrealistic.
I find this totally hilarious and would have modded you funny if I had the points to give. You are a comic genius using the absurd to humorously make a point...
I mean it's like saying "If you are capable of reading all the books available on construction and building codes, then there is no excuse for you not being able to build your own house."
Of course I could be wrong and misinterpreted both of your responses, in that case nevermind...
Re: (Score:2, Funny)
It's just plain common sense. The grandparent is just such an idiot that next to him, the frothings of a half-blind raccoon in the later stages of rabies would appear insightful, let alone someone who can string a sentence together.
(And do I get Insightful, Troll, or Funny? Or just ignored? I'll be interested to see...)
Re:Slashdotters would laud this, but... (Score:5, Insightful)
Re: (Score:1)
Re: (Score:3, Insightful)
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
http://www.art.net/~hopkins/Don/unix-haters/whinux/your-time.html [art.net]
Linux is Only Free If Your Time is Worthless
Re: (Score:2)
"Windows is only $199 if your time is worthless."
So what's your point?
Re: (Score:1)
Weeping (Score:2)
I weep for the future if 25-50% of people are incapable of learning.
Re: (Score:1)
It's an issue of symantics...
If Slashdotters took time to learn C,
then they wouldn't have time to monitor Slashdot.
Therefore, they wouldn't be Slashdotters.
Re:Slashdotters would laud this, but... (Score:5, Insightful)
Seriously, it is this sort of mentality that is killing tech. You DO have to be extremely smart/dedicated to do really low level CS work. You DO have to have a pretty heavy mathematics background to do any really serious code work and it is NOT something that you can "Learn in 7 days" no matter what the books you bought at borders are telling you.
Re: (Score:1)
Re: (Score:2)
Re: (Score:2, Insightful)
Exactly.
But we weren't talking about that, and understanding those algorithms isn't necessary to port this tool.
If no one else is gonna do it, either do it yourself or a hire a programmer to do it for you.
I swear to the gods, non-programmers are some of the whiniest users of open source.
Re: (Score:2)
Re: (Score:2)
When? Most of us have jobs, schoolwork or other things that take up most of our time. Do you expect us to spend several months worth of our Copious Free Time learning all the programming skills needed for this one job, especially when most Slashdotters will never need those skills again? I don't know what world you live in, but it's certainly not mine!
Re: (Score:2)
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
Then they can HIRE someone to port it. Perhaps a few people in the same boat can chip in together to pay for it to be ported.
The tool is probably written for Windows because Linux already has decent network analysis tools as part of most distros.
Re: (Score:1)
Then there is also this on line 65:
tcpdump is much easier.
stricmp vs. strcasecmp: Who got there first? (Score:2)
That comment about stricmp is interesting. I assume it's bridging the difference between strcasecmp and stricmp. strcasecmp has been around for quite a long time [sunmanagers.org] and predates Linux. It's part of SuS.
(The reference above is the oldest I could find with a quick Google search.)
Re:porting, a hardware solution is cheaper (Score:1)
Re:Slashdotters would laud this, but... (Score:4, Insightful)
tcpdump 'tcp[13] & 4 != 0'
Re: (Score:2)
netstat -sp tcp
since these packets are spoofed anyways, I don't think seeing the packet will do much good, but a count helps.
Re: (Score:2)
Re: (Score:2)
Re: (Score:1)
Also, I think one guy uses BSD.
No need to invoke Satan (Score:3, Insightful)
Not really. It's just the work of somebody who doesn't hold portability as an important requirement.
Sometimes this happens because they don't have the means to test on other platforms. Sometimes it's because they're so narrowly focussed that they're not even aware that there's more to computing than their own platform. Some people are simply too lazy, or lacking in computing skills, to write portable applications. And quite frequently it's t
Re: (Score:2)
Re: (Score:1)
Consider:
-- 5% of windows users use it.
-- 75% of linux users use it.
Assuming that the linux version could easily be converted to BSD, Unix, MacOS, etc. that means that:
Total computer users using windows + application would be 4.25%
Total computer users using *nix, etc + application would be 11.25%
That is 2.6 times as many people.
My math is good, however my original numbers
Re: (Score:1)
-JB-
Re: (Score:2)
http://en.wikipedia.org/wiki/SATAN">SATAN ran just fine on Linux. But it didn't sniff for forged RST packets.
Ignoring reset packets? (Score:2, Interesting)
Of course the ISPs shouldn't be allowed to spoof any packets, but what would be the consequence of ignoring all reset packets on a home network?
Re: (Score:1)
RST blocking? (Score:5, Interesting)
Re:RST blocking? (Score:5, Interesting)
Re: (Score:1, Informative)
Neither of which really matter - after all packets get dropped often enough anyway, the internet doesn't come to a screeching halt when an RST packet happens to be dropped somewhere...
Re: (Score:2, Informative)
the internet doesn't come to a screeching halt when an RST packet happens to be dropped somewhere...
No, because there's a timeout in the TIME_WAIT state. As far as I can tell RST packets are a way to break the connection and allow the TCP/IP stack to know that the socket is no longer in use.
I think if you ignored RST packets you'd end up with more sockets stuck in TIME_WAIT rather than being closed. Of course you could just increase the size of the socket table to compensate for entries getting stuck in TIME_WAIT or decrease the timeout or both.
But actually I found another problem. The forged RST packets
Re: (Score:2, Informative)
Point is, if your ISP spoofs RST packets, you cannot know when the remote host is legitimately closing the connection. If you get such a packet it could be genuine or it could be a fake. So it doesn't tell you much. You need some means for the remote host to sign every packet it sends out so they can't be spoofed, or else stop trusting them.
Re: (Score:1)
Re: (Score:2, Interesting)
The net result of IPSec (or TLS) without strong authentication of both parties is that each packet consumes considerably more energy on the transmit and receive end systems,
Re: (Score:2)
Re: (Score:3, Informative)
Re: (Score:2)
Oh, I know, wait for the second RST. When you get one, ignore and respond with an ACK or keepalive. IIRC, if the other side did close the connection, any extra packet is answered with another RST (Not sure about an empty ACK though).
If you receive a packet with a higher sequence number, the original RST was fake. If you get a second RST you acknowledge and close.
I'm not sure if you could do this at the firewall level or if you'd need to mod
Re: (Score:1)
Re:RST blocking? (Score:5, Interesting)
Re:RST blocking? (Score:4, Insightful)
Re: (Score:2)
Re: (Score:1)
Re: (Score:1)
Re: (Score:2)
Re: (Score:1)
tcpdump? (Score:1, Interesting)
http://www.tcpdump.org/ [tcpdump.org]
Re: (Score:3, Interesting)
Re: (Score:3, Informative)
Re: (Score:2)
The evolvong nature of "open" (Score:3, Interesting)
I believe new software will appear that works around the next attempt to block torrents, and new software to go arround the one after that
If there is a big-enough interest in code/protocol changes, and the code / protocol is open, you can't "put a stop" to it.
Well
Not sure what the point is (Score:5, Insightful)
What would happen on a closed proprietary protocol? (E.g., let's imagine that MS had pursued their initial idea of makingt a MS net instead of the Internet, or that AOL/Compuserve/whatever had never gone TCP/IP and managed to win on their own, or that we all were on the French minitel. Or, heck, that each ISP had their own protocol and proprietary browser, and just converted to and from it. At least one did try to convert the graphics like that, and at least one is currently re-encoding movies, so it's not a huge stretch of imagination.)
Well, then you'd be pretty much in the hands of whoever owns the protocol, i.e., most likely the ISP. If you were on, say, a proprietary AOL network, which works only with proprietary AOL software, and uses AOL's own proprietary protocols, then you're completely at their mercy. If they want to reset your connections, or whatever else, what are you going to do about it?
Of course, you could reverse-engineer their protocols and patch their programs, which is a hell of a lot more expense and effort than with the open protocols. Except then they could:
1. Just change the protocol from one version to another, to break your changes. (AOL actually did this for a while to keep breaking MS's attempts of making their Windows Messenger interoperable with AIM.)
2. Sue you under DMCA for hacking into their network and bypassing their checks. (Seriously, much smaller attempts at reverse-engineering a protocol resulted in DMCA lawsuits.)
So basically at best you'd have to bet a _lot_ on, well, how sympathetic a judge would be to your view that you have a right to bypass the usage or access restrictions on privately owned servers, to download more than you've bought, and to hack their software to that end. I wouldn't take it as a given.
So basically open software at least gives you a fighting chance at all. Yes, they can keep modifying their implementation, but so can you. In the closed version, they own the software and the protocol, they can change it, but _you_ can't.
Open standards even put a limit on how far they can take technique #1 above, because at the end of the day, they still have to remain compatible with a metric buttload of software and hardware that they don't control. In the all proprietary version, if they want to change the protocol and software _completely_, and leave the old channel open just for downloading the new software, they can.
Re: (Score:2)
It's a good thing: due to the open nature of the torrent protocol, I think we will see changes in the torrent clients, that will make the current sabotage attempts obsolete.
Grammar? (Score:2, Insightful)
Aside from that, it's great the people develop tools like this, but very surprising to see this be Windows-only.
Re:Grammar? (Score:4, Interesting)
Special thanks to John Bartas for all of his diligent and continuing work on this software for NNSquad.
Re: (Score:2)
Re: (Score:2)
Re:But this one goes to 11 (Score:1)
Re: (Score:1)
Satan Prevails - A distributed Get Your Hands Off (Score:3, Funny)
A distributed Get Your Hands Off My Network. This information can be used to provide Objective Evidence for Court Cases Against Aggressive ISP and Those Who Pretend To Be The Governments And Homeland Security Departments of The ~192 Imagined Countries Around The World. It's about time that these pretenders, who do real harm to other people in the world to, know that they are not the only ones with some power. We tech geeks say hands off our Internets and we are watching and reporting on YOU BIG BROTHER!
Power the the Geeks.
Network Measurement Tool Detect Reset Packets (Score:5, Informative)
Re: Network Measurement Tool Detect Reset Packets (Score:5, Interesting)
The race is on (Score:4, Insightful)
Re: (Score:3, Interesting)
Im becomming suspicious of my ISP for that reason, aside from obvious traffic shaping (which I usually dont mind too much), they also just drop the internet entirely but leave the network intact, so any computers still think there is internet but it goes no further than the ISP, upon which I start fucking with their servers until I get internet back. (you know, 'boredom')
Re: (Score:2)
Because, of course, ISPs could also forge legitimate looking TCP RST packets.
If you read the methodology [nnsquad.org] page, you'll learn that:
It's much harder to fake the timing of a spoofed reset.
This round trip time (RTT) is tracked internally by TCP protocol layers, however it can also be measured by external monitoring devices or software at the endpoints.
When sending bulk data during a TCP connection, the RTT between two TCP endpoints usually settles into a narrow, predictable range. Spoofed resets which are injected into the stream will usually have an RTT well below the measured average.
Reset packet spoofers could attempt to evade this detection technique and improve their "stealthiness" by first measuring the RTT of a connection that they are planning to disrupt, then delaying the transmission of their spoofed reset until timing falls within the "expected" RTT. The problem with this approach is the significant risk that the spoofed reset will arrive too late from the standpoint of the receiving endpoint.
In short, spoofed resets have only a relatively narrow time window in which they can be both effective at disrupting connections and simultaneously be resistant to detection as potentially anomalous events.
So yeah, in theory the ISP could, but anomalies are detected in a way that's hard to get around and still work.
Cool (Score:1)
Re:Cool (Score:4, Informative)
wget -c <URL>
to download large files. Even when your ISP is on the up and up, you'll get a RST occasionally if the remote computer sends it. Using wget to continue an almost completed download of an iso or XPSP3 is really handy.
Throttling should not use RESET (Score:4, Interesting)
The correct (and difficult to detect) way of throttling is by delaying ACK packets a few ms. Then normal TCP congestion control does all the nice throttling for you.
The ethics of throttling are a different matter: one side says they've been promised unlimited, and the other wants to be fair to all customers.
Re: (Score:1)
other solution to reset packets against p2p (Score:1)
Not directly relevent, (Score:1, Interesting)
He says it's just three guys (only one on at a time afaik) and when they see someone using to much bandwidth, they phone them up and tell them to settle down with the downloads.
Re: (Score:3, Interesting)
A good friend of mine works for Shaw Cable... He says it's just three guys (only one on at a time afaik) and when they see someone using to much bandwidth, they phone them up and tell them to settle down with the downloads.
I got one of those calls, and the guy I spoke with couldn't tell me what "grey zone" I'd wandered into, or why my unlimited account... wasn't. I asked him what I should cap my d/l rate to, so I wouldn't get these calls, and he said there wasn't a limit "per se". So I asked him why he was calling me with a vague request to stop using so much of a service he couldn't define for me. No answer.
I've since switched to Sasktel. While it's a lower max bandwidth, I don't have to share, and I don't get a phone ca
Re: (Score:2)
I'm not sure when this might have been, but shaw has defined limits on their website.... It's possible the guy you spoke to was new and didn't know what the defined limits are. My friend says they don't call unless you cross over those defined limits. I guess my friend can only speak for Shaw Cable in the city he works for though.
This was a few years ago, before they set up their limits. He was just harassing me for "hogging the node", but Shaw marketing hadn't defined what the "limit" was yet. So he really had nothing to guide me with.
When I called Sasktel, I spoke to a tech, and asked him if there were any limits to how much I could download in a month. He was confused by the question, because Sasktel is DSL, so you don't share it at all. If you max out your "tube" 24/7, they don't care, because you paid for all of it. So I swit
Re: (Score:2)
I just love it when people say BS like this. You honestly have no clue, do you? It's ALL shared at some point, and yes DSL providers DO have limits and care when you go over them. All your conversation with the Sasktel rep proved was that they are an idiot.
I know what he meant. He meant I don't share it with people in my neighborhood, like cable companies do it. It's shared at the central office, where all the lines come together.
The point was that Sasktel won't call me up and bitch at me for "hogging" the node. I can't "hog" it, because I'm not sharing it. I get 1.5Mbps, period. I can't download any faster, because I'm not borrowing bandwidth from my neighbors to do it.
Re: (Score:2)
Re: (Score:2)
Already a decent Linux tool (Score:2)
Huh... (Score:1)
'dotted. (Score:2)
can't get there from my comcast connection.... (Score:1)
problematic detection methodology? (Score:1)
spoofed resets have only a relatively narrow time window in which they can be both effective at disrupting connections and simultaneously be resistant to detection as potentially anomalous events.
The question is what prevents the ISP from sending the packet within the said "narrow time window" and thereby avoid detection?
Interesting effect on my downloads. (Score:1)
After about 5GB of initial downloads, my download rate went from approx. 100kB/s to about 15-20kB/s while maintaining about 100kB/s upload at all times during seeding. These speeds have been my usual speed for weeks now. NOTHING I did restored my initial 100kB/s download speed.
Perusing Slashdot, I read this article and decided to try it out and see if I could glean some useful information from it. Nothing in particular caught my attention. I let a download cruise along
Welcome back to 1990! (Score:2)