NetEnforcer now sniffs out encrypted BitTorrent activity

Looks like ISPs now have another weapon at their disposal to keep all that BitTorrent traffic under control, with Allot Communications updating its NetEnforcer traffic management devices to root out encrypted BitTorrent packets. According to Allot, BitTorrent traffic accounts for some 40-50 percent of ISP bandwidth, with many ISPs already taking steps to throttle it, but until now they've been unable to do anything about the encrypted torrenting that's been possible with the latest clients. To crack that nut, the NetEnforcer uses what Allot calls deep packet inspection technology, which they say lets ISPs "identify and analyze hundreds of applications and protocols, track subscriber behavior, prioritize traffic and shape traffic flows." So, simple traffic management -- we have no idea what else it could possibly be used for. Oh, and Sweden's Pirate Party definitely does NOT endorse this product; go figure.

[Via Monkey Bites]

[Marcos @ Feb 19th 2008 3:07PM]

Fazendo uma analogia: é como comprar um carro novo, e depois que você sai da loja e deseja fazer uma viajem, descobre que o carro só funciona normalmente se estiver dentro de sua cidade, pois quando vai para a estrada, ou ele "morre" ou só anda a 10 km/h.

[CJ @ Aug 31st 2006 7:01PM]

Interesting... the main reason I pay for high speed internet is to do a little file sharing it gets cut I have no reason to continue to pay for their service...

[Sasquatch @ Aug 31st 2006 7:02PM]

I, for one, welcome our bittorrent encrypted sniffing overlords.

i'd like to remind them, that as a trusted engadget reader, I can roundup others to toil in their underground server caves.

[Alex @ Aug 31st 2006 7:06PM]

Gay.

[Scott @ Aug 31st 2006 7:17PM]

Who cares? Only Noobs use Bittorrent.

[khalidur @ Aug 31st 2006 7:24PM]

i pay aol £30 a month for an 8Mb unlimited connection, so why don't they (ISP's in general) allow me to use bittorent limitlessly, for every person that uses the internet so profusely like me theres probably 20 other people on the same connection using only 1Gb a month.

that being said i live in the UK, and i use my aol connection as a replacement for the TV (RSS feed +Azeureus +XBMC=bliss) and i estimate i use more than 60GB a month yet i havn;t recieved any written correspondence from my ISP, so i assume that people in the UK aren't as tech savvy as those in the UK so companies like AOL can afford to support people like me.

[Evilengineer @ Aug 31st 2006 11:37PM]

Well, rumour has it that Canadian ISP Shaw has been using something similar for many a year. I know that something for sure has been funky after a recent speed upgrade, where I used to get 500KB/s down on well seeded torrents- I can barely get 20KB/s... also whether or not it simulates that my line has become saturated is unclear, but even at such weak speeds my other online activities grind to a hault. Your thoughts?

-evil

[Landlocked @ Aug 31st 2006 7:28PM]

So an ISP can break my encryption and inspect my data? Isn't that a violation of privacy and DMCA?

[hankasaurus @ Aug 31st 2006 7:43PM]

why else do you think you sign a contract with your ISP? didnt you know that anytime you sign a contract (or check "yes" on that EULA) you basically hand your soul over to the devil? i hope you werent expecting a plate full of cookies and cupcakes, cos thats not what youre going to get (they sure fooled me!). remember, an ISP is a company, not your friend. once your pen strikes that paper, they can do anything with your data that they want.

[Zach Marshall @ Aug 31st 2006 11:38PM]

hanasaurus, everyone knows that a EULA has no REAL basis and 99% of the time will not hold up in court :)

This definitley sounds borderline violating your rights.

[5ftassassin @ Aug 31st 2006 7:52PM]

I don't see how they would be able to tell the difference between legal and illegal file sharing on bit-torrent. Then again I guess there isn't anything you can do about it, it's their service you use it on their terms or not at all. Now I suppose we'll all have to cough up extra cash for a special service for no-restrictions or some crap like that.

[PAStheLoD @ Sep 1st 2006 4:18PM]

I don't really think that it breaks any encryption at all. This just analyzes a lots of traffic, and when one subscriber's traffic matches a predefined pattern (eg. opens a lots of connections in a very short time, and then starts getting massive amount of data, but no HTTP/FTP.. etc. headers, so it's encrypted.. etc. AND has enermous upload , so it's safe to say it's BT traffic), then this "router" shapes that connection, downgrades its priority... it's not a bad thing, if it's really just priorizing, but if it's shaping down intentionally to turtle speeds, then they're will be executed by the p2p crowd in a very short time. Or at least, I hope so. :)

[hartleyshc @ Sep 1st 2006 12:51AM]

@Sasquatch

i got the reference. nice one.

as for bittorrent, i hardly ever use it. i download most illegal files directly from my isps nntp server.

[TheGuy @ Aug 31st 2006 9:24PM]

"Who cares? Only Noobs use Bittorrent."

Are you kidding me? Bittorrent is awesome. A healthy torrent is a lot faster than using a file-host site (rapidshare, megauplaod, ect.). Although, I don't use the Bittorrent client anymore. Utorrent is better.

[Heborah @ Aug 31st 2006 9:37PM]

@TheGuy, nice job taking the troll bait. On another note, i'll give it a week before clients include another loophole.

[rob @ Sep 1st 2006 9:16AM]

Let me tell you why this is exciting news - I want to get movies, TV shows, games etc and pay only for what I get. Really, the Internet is a utility just like gas, electric or water - you should pay for precisely what you use. Now getting back to this tech - I won't have to pay for large blocks of TV channels (or Internet or games) that I don't watch just to get those I do and my content will be mine. As I move content from one device to another, the "sniffer" should realize that I've already paid for it - I can put it in my car, on my portable videe, wherever I want it. No more of this "you have 24 hrs to watch this movie before it does the Mission Impossible thing" or take your music off this network and you lose it. To my friends who fulfill using Bittorrent - push it to the max. To the sniffers, follow the trail as best you can. Thank you all for building out a business model where artists and providers get paid and consuers pay ONLY for what they access.

[Chris @ Sep 1st 2006 12:14AM]

I use bittorrent quite a bit for legal file sharing (linux iso's, music that the creator allows to be shared, etc) and I'd be pretty pissed if my ISP started to limit what I downloaded legally.

[Robotron @ Aug 31st 2006 11:52PM]

Hey Evilengineer I'm on that Shaw pipeline.
I get about 10MB/s with the latest upgrade so I'm happy.
Really happy.
I never have used torrents (don't know why anyone would).
There are better ways people (no, not file-host sites).

[adaminc @ Aug 31st 2006 11:56PM]

I'm in Canada with Rogers, which pretty much has a monopoly on cable internet in.... well... all of Canada, everyone in canada seems to buy there service directly from them, or through another company which buys from them, including Shaw, and they do throttle bittorrent, but there are ways to get around it (change ports and encrypt), but as far as I know, they havent been able to get around it yet, I dont think they will either, i'm sure that decrypting, intentionally encrypted data, is a federal offense, just like opening someones mail, although it might not be, since canada doesnt have any official federal privacy laws.

[Murc @ Sep 1st 2006 12:24AM]

I think my ISP has been making my BT DL's slower. I can DL something from a site with around 600kbs...but using bittorent, its around 20kbs.

Limit you...they can.

But they have no idea what your DL'ing, there tons of stuff out there thats 100% legal.
BT is the best P2P network out there.
Theres so many sites, and servers in different countries...that I dont see them ever stopping it.
But if they succeed in a coming years...there is always another option.

[stanley jobson @ Sep 1st 2006 12:36AM]

Rogers doesn't throttle your bandwidth. If you're getting slow torrent DL's then you should check how you configured utorrent.

This stupid thing they have there is retarded. All the research for what? Even if they monitor it there is a total absence of legislation governing the internet in Canada.

And even if they do find a way to get you in trouble for DLing...3 days later something new will pop up and they'll be back to square one pushing the boulder up the hill again.

For those who seem to have this mystery way that works better than torrents how about you share? I'm sure we'd all like to know.

From what I've seen aside from IRC, torrents are the best alternative.

[tekdemon @ Sep 1st 2006 2:21AM]

lol considering that legitimate files are often distributed by BitTorrent (All the World of Warcraft patches happen to be distributed via BT and they're humongous files), if all the ISPs began to throttle BT it's just going to piss a lot of non-pirates off.

Seriously if I played WoW and my ISP started throttling BT, I *would* cancel and switch to another broadband provider, simply because the patches take long enough to download as it is even without throttling lol.

[Frederik @ Sep 1st 2006 2:52AM]

They should be thankful for BitTorrent. A lot of people wouldn't pay for such fast Internet connections if it hadn't been for BT.

[Adam Davis @ Sep 1st 2006 5:04AM]

Speaking from an ISPs point of view (no, I won't tell you which one), we love Bittorrent and don't cap or throttle it. Why? Well, that's the whole point of an internet connection - you buy bandwidth, you use bandwidth, you want more - we sell you more! Everyone happy.

[Enrico Fermi @ Sep 1st 2006 1:40PM]

couldn't you force the isp's with these to stop using them by encrypting all your traffic up and down? and secondly, dosen't this violate all the net nutrality rules that we have?

[oxxiox @ Sep 1st 2006 8:55AM]

> Who cares? Only Noobs use Bittorrent.

Even if you were trolling, you're actually compeletely correct. To the guy who says BT is better than rapidshare, you're so far from having a clue it makes me grateful that so many filesharers really have no idea where it's at, allowing me to retain blazing fast speeds for whatever methods I use.

[Rishard Chapoteau @ Sep 1st 2006 9:45AM]

I've used both Paketeer and Netenforcer, and I actually think the Packeteer has better support.

Its about time they gave us something interesting for the Netenforcer. It will be interesting to see how this happens.

[Perrey Z. @ Sep 1st 2006 11:26AM]

So... this is the back or the front of this thing?

[jim @ Sep 1st 2006 11:53AM]

This could encourage people to look for other providers. Hmmm if my DSL provider uses it and my cable company doesn't - which one do you think I'll choose for my ISP?

I'll bet the first company to put it in place will be the first company to rip it out and fire the person responsible for putting it in their system.

[Robby @ Sep 1st 2006 7:53PM]

Even if I sign a EULA with my ISP, that doesn't allow them the liberty of breaking the DMCA and bypassing my legal software's security.

If I can get in trouble for watching a DVD on my linux box (under the DMCA), than sniffing through a programs security (encryption) should surely get an ISP in trouble.

[Gumjo @ Sep 1st 2006 10:18PM]

Rogers in Canada IS throttling the internet connection of their users. Just make one search on Google and you will see how widespread the problem is. Some people who have looked further into it actually found that you cannot blame Rogers for it, for two reasons. One: they do not admit to doing it. They started throttling networks gradually, from place to place, and now there is a huge problem with Bittorrent users who subscribe to Rogers ISP. If you call them they flat out deny any throttling, even though speeds have been seriously dragged down by Rogers. Two, even if some person is able to point out that Rogers does throttle their net service, then there is a statement in their user agreement contract which enables them to do as they wish. In the end Rogers users are left with no choice but to bear with it. Even other ISPs like Bell and Shaw reportedly do the same.

Also some users found a way to workaround Roger's throttling, by switching data ports to a specific port that allows people to do video conferences. That fixed the speed for a while but Rogers discovered that and now that workaround is useless. Even though new Bittorrent clients claim to use encrypted packs it is really easy to discover and discard data packets coming from unidentified or masked clients. That and with the advent of these kind of devices only spells doom for many Bittorrent users.

[Conodo @ Sep 1st 2006 5:16PM]

I've seen this product and for the money (and the better technology) Procera's PacketLogic is the way to go. I have in my network and have been looking at BitTorrent traffic ever since. I can also see Skype calls. Check 'em out : http://www.netintact.com

[Kris Lee @ Sep 1st 2006 4:30PM]

THIS IS AGAINST FREE SPEECH!!!

[Magus @ Sep 5th 2006 10:53AM]

hmm thinking this is more applicable to those with limited connections. Places that realy have no intention of you using bt. A scholl campus, buisness network, or a library network.
Theyre paying for bandwith which they can do as pleased. If they decide they dont want filesharind trafic to overtake regular usage then just pop one of those in.
btw packeteer is usless if your admin is an idiot.

[JB @ Sep 6th 2006 9:06PM]

There are still people that use AOL for an ISP? Holy hell....

[DJ @ Sep 13th 2006 7:20PM]

It isn't just BT that Shaw are throttling. Our web conferencing software gets killed by shaw throttling it. It starts off okay, but after a few minutes of activity it slows to a crawl and you can't reconnect. I did some investigation using tcptraceroute and discovered that one of their routers in Calgary (2 hops away from my home machine) was randomly discarding about 50% of outbound tcp packets on the tcp port our software uses (other ports were unaffected). If you leave it a few minutes, it starts working normally again. Changing the port doesn't help things. I assume that their router is just looking for particular traffic patterns, so encrypting your data wouldn't do much good. It basically just kills anything that looks remotely like file sharing, whether or not it actually is.

I spoke to Shaw tech support and they said that they do throttle file sharing in Calgary, and that is almost certainly what is happening to us. I told him that they will need to fix it because it means that Shaw customers can't use our software. He said there is nothing they would do about it. Is this legal?

[Gus @ Sep 22nd 2006 7:58PM]

It's a little curious to me how this is presented as "a good thing". I understand that due to the popularity of the BitTorrent protocol, it now accounts for a large portion of internet traffic; but why must this be stopped?

If ISPs can't support this kind of traffic, shouldn't they either stop advertising a service they can no longer realistically support, or perhaps beef up their network so they CAN cope with the added demands?

Is it really worth fighting a "I know we advertise it, but you can't have it" war against such a large (and growing) user base? Wouldn't it be simpler to revise how broadband is marketed to begin with?

I may not be completely "in the loop" with regards with BT technology, but it seems to me that this kind of practice is a futile attempt at trying to tell people what (not) to do. The simple fact that ISPs believe they have a *need* for the advertised NetEnforcer gadget seems to speak -- to me anyway -- as to the irrationality of this whole situation.