Crystal Web ADSL performance feedback thread Part 3...

Status
Not open for further replies.
SauRoNZA said:
Glasswire will only pick up data per device running it.

You'll need an actual gateway with bandwidth monitoring if you want to really find the culprit.

I've had this fight with many customers in the satellite telecoms space (where data is supremo expensive) and it's ALWAYS been a client side issue.
Click to expand...

Which is why I installed GlassWire on every desktop and laptop. Other wifi devices can't pull 40Mbps.
 
00ef73693f2e337ffe27975b90b2e1a0.png
 
Sinbad said:
My iPad can do over 50...
Click to expand...

If a wifi device on my network turned out to be capable of such usage (which they aren't because I ran speed tests), it would be plain as day to see in the Ubiquiti interface.
 
Bryn said:
Which is why I installed GlassWire on every desktop and laptop. Other wifi devices can't pull 40Mbps.
Click to expand...

There already is the weakest link.
You have GlassWire only on a subset of your devices.
You have Wifi and that can be hacked!

Proper solution:
Code: 
                            DMZ Zone
                              |
Internal network  ------ Smoothwall ------ ADSL Modem ---- Internet.
                              |
                           Wifi
 
Last edited:
We do not monitor your internal network devices, it would be illegal to do so unless it was a service you had voluntarily subscribed to. We cannot look at what each device is doing and we cannot log what each device does. In terms of usage data, it is calculated by Telkom and relayed to ISPs. Telkom maintains the authoritative record of usage of customers and any reference to a hack of any system would be one of theirs and not ours, however we do not believe in this case that anything was hacked in any manner whatsoever. In terms of "cyber attacks" how does an ISP know what traffic you are legitimately downloading and what traffic you are not requesting, and how does an ISP know which if that is as a result of unrequested data transfers? The moment you are allocated a public IP in the modern world, the risk of "cyber attack" begins and there is no mechanism with which to know the data residing on every server in the world, nor to know the motive for every packet of data transfer that takes place. If any ISP were to employ "attack mitigation as a service" for every client not only would it be prohibitively expensive, but it would also slow legit traffic down as such systems are not without their own flaws. You end up with a situation where you are having to police every connection on behalf of customers and make decisions on their behalf about what is legit and not, which not only is a precedent that we don't necessary like, but is a process that is almost impossible to get right without knowing the intent of every packet transfer. The other problem is that without "controlling" your internal network and every connected device, even if you had all of the other data, would mean you cannot convert the information into something logical to make a call about on an automated basis.

So the risk of cyber attack by things like DDoS certainly exist over public networks like the internet. We have employed a new system where we are searching for traffic signatures that "detect" if you are a potential host of malicious software and we recently began suspending these services until customers rectified on their end, but even this doesn't stop most attacks. The solution to not being capped by such an event is an uncapped solution. The solution for rectifying on an automated basis to prevent degradation in quality of experience is not one the industry yet has, not from vendors and not from ISPs, at least not in a fool-proof manner. Machine-learning helps, but is not ready yet for commercial deployment and at this stage still wouldn't protect against end-user connections, only core and border equipment. Until then, what is needed is better enforcement against such attacks and more resources from enforcement agencies to allow them to investigate such attacks and hold perpetrators accountable.
 
patrick123 said:
There already is the weakest link.
You have GlassWire only on a subset of your devices.
You have Wifi and that can be hacked!

Proper solution:
Code: 
                            DMZ Zone
                              |
Internal network  ------ Smoothwall ------ ADSL Modem ---- Internet.
                              |
                           Wifi
Click to expand...

Ubiquiti can monitor all wifi devices, but this DMZ solution does sound more reliable. What does setting one up involve? I hope it can be with a small device and not a 24/7 PC.

Crystal Web Management said:
We do not monitor your internal network devices, it would be illegal to do so unless it was a service you had voluntarily subscribed to. We cannot look at what each device is doing and we cannot log what each device does. In terms of usage data, it is calculated by Telkom and relayed to ISPs. Telkom maintains the authoritative record of usage of customers and any reference to a hack of any system would be one of theirs and not ours, however we do not believe in this case that anything was hacked in any manner whatsoever. In terms of "cyber attacks" how does an ISP know what traffic you are legitimately downloading and what traffic you are not requesting, and how does an ISP know which if that is as a result of unrequested data transfers? The moment you are allocated a public IP in the modern world, the risk of "cyber attack" begins and there is no mechanism with which to know the data residing on every server in the world, nor to know the motive for every packet of data transfer that takes place. If any ISP were to employ "attack mitigation as a service" for every client not only would it be prohibitively expensive, but it would also slow legit traffic down as such systems are not without their own flaws. You end up with a situation where you are having to police every connection on behalf of customers and make decisions on their behalf about what is legit and not, which not only is a precedent that we don't necessary like, but is a process that is almost impossible to get right without knowing the intent of every packet transfer. The other problem is that without "controlling" your internal network and every connected device, even if you had all of the other data, would mean you cannot convert the information into something logical to make a call about on an automated basis.

So the risk of cyber attack by things like DDoS certainly exist over public networks like the internet. We have employed a new system where we are searching for traffic signatures that "detect" if you are a potential host of malicious software and we recently began suspending these services until customers rectified on their end, but even this doesn't stop most attacks. The solution to not being capped by such an event is an uncapped solution. The solution for rectifying on an automated basis to prevent degradation in quality of experience is not one the industry yet has, not from vendors and not from ISPs, at least not in a fool-proof manner. Machine-learning helps, but is not ready yet for commercial deployment and at this stage still wouldn't protect against end-user connections, only core and border equipment. Until then, what is needed is better enforcement against such attacks and more resources from enforcement agencies to allow them to investigate such attacks and hold perpetrators accountable.
Click to expand...

I appreciate the detailed reply. The emboldened bits were particularly interesting. I know that CW can't account for detailed usage per customer (and that it would be unacceptable if you could), but I was hoping for something more conclusive regarding my case.

The fact that no one in my home (with loads of gamers, downloaders and streamers) noticed any degraded service during the first 3 days of this month while over 425GB was used is more telling to me than any of the other bits of info. But what can I do when everyone is saying there's no evidence of nefarious activity and that DDOS attacks can't be detected most of the time anyway. As I said, this saga will just have to move along and hopefully not reoccur.
 
Bryn said:
Ubiquiti can monitor all wifi devices, but this DMZ solution does sound more reliable. What does setting one up involve? I hope it can be with a small device and not a 24/7 PC.

/snip/
Click to expand...

Smoothwall (down at the moment) & IPCop do require a 24/7 PC, they have the advantage that they can log the bandwidth of every single device that communicates through them. Basically a simple 486 would be sufficient for their requirements.

A possibly simpler solution is flashing an appropriate device (I'm using a Linksys unit) with dd-wrt to give you that extra bit of protection.

Feel free to shout, I'm certain that there are a bunch of knowledgable people here who can assist you with coming up with an optimal, cost effective solution.
 
Bryn said:
Ubiquiti can monitor all wifi devices, but this DMZ solution does sound more reliable. What does setting one up involve? I hope it can be with a small device and not a 24/7 PC.



I appreciate the detailed reply. The emboldened bits were particularly interesting. I know that CW can't account for detailed usage per customer (and that it would be unacceptable if you could), but I was hoping for something more conclusive regarding my case.

The fact that no one in my home (with loads of gamers, downloaders and streamers) noticed any degraded service during the first 3 days of this month while over 425GB was used is more telling to me than any of the other bits of info. But what can I do when everyone is saying there's no evidence of nefarious activity and that DDOS attacks can't be detected most of the time anyway. As I said, this saga will just have to move along and hopefully not reoccur.
Click to expand...

Well done Bryn. Good to see this not turning into some mud slinging nonsense we've seen on other ISPs threads.
 
Minutes after my Afrihost account died, my CW one did too. Anyone else experience downtime? Switched back to Afrihost and their problem was sorted out by then.

patrick123 said:
Smoothwall (down at the moment) & IPCop do require a 24/7 PC, they have the advantage that they can log the bandwidth of every single device that communicates through them. Basically a simple 486 would be sufficient for their requirements.

A possibly simpler solution is flashing an appropriate device (I'm using a Linksys unit) with dd-wrt to give you that extra bit of protection.

Feel free to shout, I'm certain that there are a bunch of knowledgable people here who can assist you with coming up with an optimal, cost effective solution.
Click to expand...

Thanks. I'll do some more research and give it some consideration. Another option is to simply buy a Ubiquiti UniFi gateway - R4.8k for something like this is probably not much more expensive than buildling a Linux terminal. You unlock loads of monitoring capabilities when pairing a UniFi AP setup with a UniFi gateway.

Spizz said:
Well done Bryn. Good to see this not turning into some mud slinging nonsense we've seen on other ISPs threads.
Click to expand...

Throwing toys seldom helps anyone. And CW has not behaved unreasonably.

patrick123 said:
I agree, a problem has been identified. Now let's get it resolved.
Click to expand...

I don't see this one getting resolved. It's just going to remain mystery theft.
 
DISCLAIMER!!: If my following observations and comments offend somebody - I am very sorry, but to get the information I want I might step onto somebodies toes (so suck it up).

How would one go about, when you encounter a problem like Bryn is experiencing, to get the required information to secure your internet access equipment without buying a lot of expensive hardware or pay a Cyber Security Expert?

I am sure contacting the ISP and run tests is the first step, but where do you go from there if you do not get relevant information back from the ISP to secure your connection other than changing to another ISP (changing the IP address)?



I am not battering CW, but what I understand from Bryn's comments is that after all the tests was run he did not get a clear answer as to what the problem is and how he should go about fixing it.

If he got that info, good. If not well :wtf::erm:

How and what can I do to secure my connection that the same thing does not happen to me. Should I go every week and buy new top of the range, the most expensive and latest network equipment and hope and pray it will happen to me?

P.S. Like the top says: I am not looking for a p1ssing contest and I don't want to step on anybodies toes, but surely the ISP can provide information of procedures to get a issue like this sorted.
 
You as the end user cannot stop or prevent yourself from being affected by a DDoS. Not on any ISP, and we are not the only ones hit when it happens. All ISPs are hit and we are seeing cycles in how this plays out, over which ISPs. By the time you try to do something on your network it has already traversed the network operator transit, so realistically you cannot do anything. Computerphile have a good video I've linked to below about this.

https://www.youtube.com/watch?v=BcDZS7iYNsA
 
International borked again.

3 Days with the service - 3 days with problems.

Whomever is doing this to CW - GO **** YOURSELF
 
Status
Not open for further replies.
Back
Top
Sign up to the MyBroadband newsletter
X