4 ms·

Every feature I've implemented has been security/stability related. Inspection/filtering/shaping/limiting are absolutely critical on ISP networks. Taps/mirrors

Every feature I've implemented has been security/stability related. Inspection/filtering/shaping/limiting are absolutely critical on ISP networks. Taps/mirrors are critical to troubleshooting. If ISPs didn't deploy all kinds of filtering, the Internet would be mostly unusable.

sp332 14y ago
I work at an ISP, and this is absolutely true. Sometimes our mail servers get hammered, and we need to modify our blacklist to include servers, netblocks, and/or entire countries(!) at a time. In order to know what to block, we need to be able to know who is emailing whom. Sometimes, it's one of our customers, and we can call them up and tell them their box is owned. This kind of intrusive access is only used for maintenance, and without it we literally couldn't keep the mail servers online.
- ceph_ 14y ago
  If the traffic is terminating on your own servers you in no way need deep packet inspection to determine the source of traffic and its nature. Even if the traffic wasn't terminating on your machines, you don't need DPI to determine src and dst ip:port tuples. Which is all you need to do what your suggesting.
  - sp332 14y ago
    My comment isn't about DPI specifically, but a whole range of intrusive monitoring policies at ISPs. In order to determine the originator of an email, you have to read (at least) the email headers. The IP address of the last hop is not that useful in routing email.
ceph_ 14y ago
If you need DPI to determine what traffic to drop, you are running your pipes way too hot. It's the users traffic, why do you think you're in the best position to decide to drop one website's traffic over another?
- mfukar 14y ago
  It's their network.
  - ceph_ 14y ago
    User traffic is user traffic, if they're paying for it it should be all treated the same. I'm not saying you don't need to prioritize some traffic with QoS. I'm saying you don't need DPI to run a network. Sincerely, A network engineer
    - mfukar 14y ago
      If you treat your network's users them all the same, more power to you. Running the network and deciding what goes through it is still out of their control. I don't get why you're against those that do use DPI to run their network more easily, though.
    - lttlrck 14y ago
      User traffic is user traffic is whole lot of different kinds of traffic. So there should be QoS, but how? You cannot depend on the IP Differentiated Services Field, so perhaps heuristics to deduce what the traffic is? Thats prone to misidentifying Netflix vs. CDN download thus ruining UX. No DPI is needed.
- bstpierre 14y ago
  Note that I said in my original comment that my experience has primarily been implementation of shallow inspection. Subscriber-connected edge gear is often oversubscribed. Lots of little pipes coming in from households; one or two medium-sized pipes headed to the core. > It's the users traffic, why do you think you're in the best position to decide to drop one website's traffic over another? All too often it's not actually the subscribers' traffic that causes problems; it may be malware.

sp332 14y ago

I work at an ISP, and this is absolutely true. Sometimes our mail servers get hammered, and we need to modify our blacklist to include servers, netblocks, and/or entire countries(!) at a time. In order to know what to block, we need to be able to know who is emailing whom. Sometimes, it's one of our customers, and we can call them up and tell them their box is owned. This kind of intrusive access is only used for maintenance, and without it we literally couldn't keep the mail servers online.

ceph_ 14y ago
If the traffic is terminating on your own servers you in no way need deep packet inspection to determine the source of traffic and its nature. Even if the traffic wasn't terminating on your machines, you don't need DPI to determine src and dst ip:port tuples. Which is all you need to do what your suggesting.
- sp332 14y ago
  My comment isn't about DPI specifically, but a whole range of intrusive monitoring policies at ISPs. In order to determine the originator of an email, you have to read (at least) the email headers. The IP address of the last hop is not that useful in routing email.

ceph_ 14y ago

If you need DPI to determine what traffic to drop, you are running your pipes way too hot. It's the users traffic, why do you think you're in the best position to decide to drop one website's traffic over another?

mfukar 14y ago
It's their network.
- ceph_ 14y ago
  User traffic is user traffic, if they're paying for it it should be all treated the same. I'm not saying you don't need to prioritize some traffic with QoS. I'm saying you don't need DPI to run a network. Sincerely, A network engineer
  - mfukar 14y ago
    If you treat your network's users them all the same, more power to you. Running the network and deciding what goes through it is still out of their control. I don't get why you're against those that do use DPI to run their network more easily, though.
  - lttlrck 14y ago
    User traffic is user traffic is whole lot of different kinds of traffic. So there should be QoS, but how? You cannot depend on the IP Differentiated Services Field, so perhaps heuristics to deduce what the traffic is? Thats prone to misidentifying Netflix vs. CDN download thus ruining UX. No DPI is needed.
bstpierre 14y ago
Note that I said in my original comment that my experience has primarily been implementation of shallow inspection. Subscriber-connected edge gear is often oversubscribed. Lots of little pipes coming in from households; one or two medium-sized pipes headed to the core. > It's the users traffic, why do you think you're in the best position to decide to drop one website's traffic over another? All too often it's not actually the subscribers' traffic that causes problems; it may be malware.