Shaping or Chocking?

[slowgo]

I am trying to find out what protocol users what port. Say for instance you are doing an http session what port would this be using. Doing a VOIP what port would it use and P2P what port this would uses. The reason for this is it would seem that latterly doing P2P on an ADSL 512 has dropped down from around 52kbs to 3kbs. Now I know this is shaped but by shaping you are just giving preference to another port for that period. So you packet might be delayed a few seconds. What however seem to be happening is that the P2P port is actually being chocked? So what I am thinking is that the available bandwidth that might have been allocated for this has been dropped down to nearly nothing and shaping has not really got anything to do with it.

Not too sure if my theory is correct? Is there anyway to prove this?

 

[gkm]

You can use the netstat command in a dos window to see ports are used by programs. Use "netstat /?" to get all the options.

To look up port numbers, head for:
http://www.iana.org/assignments/port-numbers

I do not know about your theory. Simple port shaping is probably already enough to choke off non-http traffic when there is enough http traffic to use up nearly all the bandwidth.

 

[slowgo]

What I do not understand is that over night P2P went from around 49kbs to 2Kbs. would mere shaping have made such a change in so short a time. It would seem that you can actually restrict this even further. If you look at it port 80 is used for Http (or am I wrong in saying this). Now the higher ports are used for bitcoment and limewire, I think around 24142 or so. Is it not possible to allocate lower bandwidth to these ports making P2P unusable?

 

[gkm]

I would suspect it is more likely that the ADSL subscriber base increased and the 30Gb accounts is also an artificial increase, but that not enough extra bandwidth is provided by Telkom to cover this.

To take an example, let us say there is a pipe throught which can pass a 100 ball a minute. We have red ball and blue balls. If there are any red balls waiting, they get first priority.

- Now, if 50 balls arrive in a minute, the will all pass through fine.
- If 100 balls arrive, they will still pass through fine, with the red balls maybe getting through a bit faster.
- But is now all of a sudden 90 red balls and 90 blue balls arrive per minute, the 90 red balls will get through, but only 10 blue balls. The other 80 blue balls have to be discarded to avoid the pipe from getting congested.

In the ADSL shaped case, the red balls are the http traffic and the blue balls are the rest, so the rest suffers pretty badly at the moment.

And yes, port 80 is the default for http.

 

[slowgo]

Yes it does look like this is the problem no bandwidth. Also can they restrict the amount of bandwidth allocated to the P2P pipe and leave port 80 as it was?

 

[daysleeper]

Power of the ISPs

I think telkom also uses one these transparent proxy setups so they also cache lots of data to keep the bandwidth on the pipe down.

I also think that p2p causes big routing issue, because the downloads are not single sources but multiple like up to a 100, all of these use a local and a foreign port these packets also have to be routed, thus this can cause problems. Each seed is a like a session.

Thing have changed in the past couple of months. If you compare DSL to like ISDN ect, it still seems that DSL is only for http and mail. For example, I have seen on a diginet 64k that p2ps run at 8kB/s all the time. This just means the routing takes precendent over other traffic as explained earlier.

So in a nutshell. Telkom don't really provide you with true internet. They give you a form of internet that is the least burdensome on them and there pipe.

I mean http is quick, load page, read page, load another page. most pages are small like 20-40 kb and its over the request is satisfied.

with p2p it like constant requesting.

like it or lump it. This is the way it is.

I was in the states last year and saw this cable internet set, it uses a set top box and is fead with a co-ax cable to the exchange. All ports had exactly the same priority, be it 6346 or 80 same same same!

I think telkom shape, choke and squeeze!

 

[Clipse]

Yes it does look like this is the problem no bandwidth. Also can they restrict the amount of bandwidth allocated to the P2P pipe and leave port 80 as it was?

Stop the problems by signing up with FreeProxy, im confident you wont have any of these problems

 

[ScrnScrm]

Now I know this is shaped but by shaping you are just giving preference to another port for that period.

Hi. What you are referring to is port prioritisation. Shaping is when you examine the packet at layer 7 of the TCP/IP stack, and assign it bandwidth and priority based on the packet type and not the port.
Cheers~

 

[slowgo]

Using an unshaped account I am getting around 52Kbs on Limewire. Telkom states if you want to do P2P you must have an unshaped account, funny how this was never the case when I first got my ADSL512. As far as I can see an unshaped account should be used when doing real time applications like gamming and so on, not for data transfer

 

[Betonro]

Stop the problems by signing up with FreeProxy, im confident you wont have any of these problems

It will solve your problems.
Two of my friends use it, Moonboot and Alkine, they say it is excellent.

Already signed up, can't wait!

Thanks Clipse

 

[Daaru]

I'm using it too. Thanks Clipse!

 

[slimothy]

To take an example, let us say there is a pipe throught which can pass a 100 ball a minute. We have red ball and blue balls. If there are any red balls waiting, they get first priority.

- Now, if 50 balls arrive in a minute, the will all pass through fine.
- If 100 balls arrive, they will still pass through fine, with the red balls maybe getting through a bit faster.
- But is now all of a sudden 90 red balls and 90 blue balls arrive per minute, the 90 red balls will get through, but only 10 blue balls. The other 80 blue balls have to be discarded to avoid the pipe from getting congested.

In the ADSL shaped case, the red balls are the http traffic and the blue balls are the rest, so the rest suffers pretty badly at the moment.

woh woh woh, no, thats not how it works, you have 2 main types of shaping, packet shaping where each and every packet is checked and then either shaped or not and port shaping where the source (and sometimes destination) ports are checked and then either shaped or not depending on the rules set.

If a connection is shaped, with either packet or port shaping, the method used by ISPs is the bucket method, this is to reward patience and punish abusers. All that happens is a set buffer size is made (this is the bucket that holds the data) to whatever the isp shapes at, lets say 64kbit. Then what happens is all data you request goes to the isp and fills this 'bucket' up then the bucket will only empty (send data to you) at set intervals, like say once per second. Each time the bucket fills the data that doesnt make it into the bucket isnt disgarded at all because with TCP it would break the connection, rather it is stored in a queue untill you are able to recieve it. The same can be said with normal unshaped traffic except rather than going from source -> ISP -> bucket -> you it goes from source -> ISP -> you.

as for the question the author of this thread posed, no the theory isnt entirely correct, p2p doesnt use a single port, there are many different p2p protocols and a great many of them are dynamic, that is to say they don't rely on certain ports and the hub and peers can ussually send and recieve data from any port.

If you are trying to get port numbers for protocols yo get around shaping you need to remember that alot of ISPs that shape will packet and port shape, this means even if you use a good port such as HTTP (80) for a p2p protocol the traffic will be inspected and shaped. In those cases you need to change the way the traffic looks in order to bypass shaping by using tunnels or encrypting traffic (or both).

Im not sure if you're port or packet shaped but one way to test is to use "bad traffic" on good ports, so try test with the following ports which might be good

21, 22 (SSH isnt often a priority port but try it anyway) 25, 53 (DNS is often a great port to tunnel UDP traffic with), 80, 110, 443 (HTTPS isnt always priority), 8080 (alt HTTP isnt always priority).

Best way to test is by using tunnels through ports mentioned above but if you're really good you would use GRE tunneling.. you'd be suprised how many big ISPs forget to shape that.

 

[slimothy]

Using an unshaped account I am getting around 52Kbs on Limewire.

problem with some p2p protocols is they dont like proxies, as far as i recall limewire was one of them, whilst a socks proxy will sort out a good 80% of shaping/bottle neck problems it will not help with protocols that dont like proxies and there for give you lower priority as a peer because you're on a proxy. Tunneling should almost certainly do the trick.

 

[slowgo]

In short, how do we prove that over night Telkom did something to drop 512 P2P from around 50Kbs to 2 Kbs? In short, how do we prove that over night Telkom did something to drop 512 P2P from around 50Kbs to 2 Kbs? Now they are saying you need to get an unshaped account for P2P, in my mind unshaped should only be necessary if you want to do real time applications like gamming. Not to solve the fact that I had a service with 512 and now I don’t!

Has any one else noticed the dramatic drop in speed on 512?

 

[slimothy]

you cant prove it merely because p2p protocols aren't proper networks and speeds will never be guaranteed, but chances are the dramatic drop in speed you saw was down to packet shaping being implemented over port shaping.

Unfortunately your p2p traffic is seen to clog up the normal day to day internet (on networks without shaping etc p2p ussually chews up 70% of traffic) so they are sort of right when they request you get an unshaped account because p2p traffic has been known to make other peoples experience on the same network worse.

Having said that I don't think you should get an unshaped account personally, you just need to change your habbits, use clipses free proxy service and perhaps even the paid ones and start using proxies/tunnels for p2p

 

[slowgo]

How does proxies/tunnels work? The free proxy services seem to work out quite pricy. Looking at the policies set-up by Telkom you don’t really have much say in how they change the services. See below taken from http://www.telkom.co.za/minisites/dsl/terms.html

ADSL Access terms and conditions
The provision of Telkom's Asymmetric Digital Subscriber Line (ADSL) access service is subject to Telkom's standard terms and conditions for the provision of Public Switched Telecommunication Services available on this website, and at Telkom's Customer Service Branches as well as the ADSL Access Service Acceptable Use Policy avaialble on here.

The terms and conditions contained herein shall be in addition to the above terms and conditions and policies. Where any of the above terms and conditions or policies and these terms and conditions conflict, then these terms and conditions sall take precedence.

Telkom cannot and does not guarentee the bandwidth throughput achieved on the Internet utilizing the ADSL access service.

ADSL access service is a best effort service and no guarantees are provided on throughput. The ADSL access service is an access medium to the Internet or to a customer's preferred ISP. As such, the ADSL access service will not overcome any bandwidth related constraints within the World Wide Web.

To provide all ADSL customers with a reasonable service monthly usage limits are imposed on all customers to ensure that certain bandwidth-intensive users do not abuse the international bandwidth and to equally distribute the limited bandwidth amongst all ADSL access users.

Once a customer exceeds the usage limit applicable to his/her Internet account their international traffic will be transported over a slower international link, without affecting local access. In this event the customer may experience substantially slower access speeds on the alternate international link. SAIX is working on new products that will allow users to purchase more bandwidth.

Telkom reserves the right to implement technical mechanisms, which prevents usage patterns in violation of the Acceptable Use Policy for the ADSL access service. Telkom also reserves the right to take such action as may be necessary to protect the integrity of the system, including, but not limited to, system monitoring, as well as protocol management and shutting down of ports affected by viruses, worms or other malicious code.

International traffic may also be subject to technical limitations imposed by Telkom in its sole discretion to ensure that bandwidth-intensive applications such as peer-to-peer, including Kazaa, Fasttrack, Napster, etc do not adversely affect other applications.

Nothing contained in these terms and conditions shall be construed to limit Telkom's rights or remedies in any way with respect to any of the foregoing activities, and Telkom reserves the right to take any actions that it may deem appropriate with respect to such activities, including without limitation, investigating suspected violations of these terms and conditions, taking action to recover the costs and expenses of identifying offenders and terminating their access to and use of the ADSL access service, and levying cancellation charges to cover Telkom's costs in the event of termination of access to the ADSL access service. In addition, Telkom reserves all available rights and remedies with respect to such activities at law or in equity.

These terms and conditions may be amended from time to time in Telkom's sole discretion and any such amendments shall become effective as soon as they are posted on the Telkom website.

 

[Roman4604]

slowgo, also depends on what p2p protocols you were using.

Since SAIX/Telkom is a Cisco shop, they're probably using Cisco's NBAR functionality to do traffic indentification and classification. With each new release of their software, Cisco add more packet identification signitures into their code, and it's seem Telkom has been doing a lot of upgrading recently (i.e. ADSL net instability)

While ver. 12.3 could identify the KaZaA2, fasttrack (KaZaA, older Morpheus) and Gnutella (LimeWire, BearShare & newer Morpheus) protocols irrespective of port number being used, recent 12.4 versions can identify Bittorrent also.

The good news is that NBAR doesnt seem to be able to identify the above packets within a socks proxied packet as used by OpenWeb & NukeCap .... yet.

 

[slimothy]

How does proxies/tunnels work? The free proxy services seem to work out quite pricy.

lol dude.. ITS FREE.

The local proxy services will do the trick but they're pricier than international ones simply because they're local and bandwidth costs them more. You do get lots of free proxies all over the world but the problem using those is that they ussually get crowded, put on spam lists or dissapear.

Tunneling works by using one protocol like say HTTP to send/receive another protocols traffic like say a p2p protocol, the only problem is you need somewhere to tunnel to, so if you have a web account somewhere or a SSH account you can probably sort yourself out but if not.. use proxies.

I think the openweb.co.za proxy gives 5GB for free and then theres clipses nukecap.co.za free proxy so with those 2 you can probably get some of your p2p stuff depending on how heavy you download and after you've depleted those you can use open proxies.

Basically to use a proxy for your p2p app all you gotta do is locate the proxy settings in the application, ussually where the connection options are. If the app has no proxy settings you go get an application called SocksCap and that lets you redirect that applications traffic through a proxy which is pretty usefull for less sophisticated p2p protocols.

 

[thrakath]

Ports?

I am trying to find out what protocol users what port. Say for instance you are doing an http session what port would this be using. Doing a VOIP what port would it use and P2P what port this would uses. The reason for this is it would seem that latterly doing P2P on an ADSL 512 has dropped down from around 52kbs to 3kbs. Now I know this is shaped but by shaping you are just giving preference to another port for that period. So you packet might be delayed a few seconds. What however seem to be happening is that the P2P port is actually being chocked? So what I am thinking is that the available bandwidth that might have been allocated for this has been dropped down to nearly nothing and shaping has not really got anything to do with it.

Not too sure if my theory is correct? Is there anyway to prove this?

80-http
110-pop3
25-smtp
23-telnet
21-ftp
143-imhap
443-secure

These are the ports prioritised by telkom

 

[Roman4604]

A month or 2 ago ppl were getting 30-50K on p2p (torrent, limewire etc.) and this month 3-5K ... this is not prioritisation, this is purposeful throttling.