Comcast Is Blocking More Than BitTorrent, Including Lotus Notes

Yesterday, we posted about some experiments showing that Comcast is forging packets in order to interfere with its customers' use of BitTorrent. There have been reports of strange things happening with other protocols, and we've been running some tests on two other file transfer protocols in particular -- HTTP (which is used by the World Wide Web) and Gnutella. Comcast also has been strenuous in telling us, "We don't target BitTorrent". Perhaps not. Perhaps what they're doing is even worse.

In the limited tests we ran, we didn't see any interference with HTTP traffic. Comcast's network seems to behave correctly when you run a private Web server and share a few of your photos or videos over it (we tested files up to about 25 Mbytes).

But when you try to run a Gnutella P2P node on your machine, things start getting strange. Gnutella operates in two stages: first of all, your node starts a conversation with other nodes on the network. Once that conversation is happening, nodes can say things to each other to organize searches for and downloads of files. We saw forged TCP reset packets that stop some of the nodes from being able to converse with each other in the first place.

Forged reset packets are normally the kind of thing that would only be present if a hacker was attacking your computer, but in this case, it's the ISP you pay money to each month that is sending them.

Strangely, the packet forgery only occurs when a non-Comcast node is trying to start a conversation with a Comcast customer's Gnutella node. If the Comcast customer starts the conversation, there is no Reset packet. This means that Comcast customers will not see Gnutella fail entirely -- the network just doesn't work properly.

It isn't just BitTorrent and Gnutella that are affected. Kevin Kanarski has reported that Lotus Notes (a suite of software that many businesses use for e-mail, calendaring, and file sharing) also is being interfered with. We haven't tested this ourselves yet, but Kanarski's packet traces look a lot like the ones we've collected with BitTorrent and Gnutella.

I finally have an end-to-end trace to share which shows that Comcast is filtering the port 1352 traffic. The images below show that Comcast is impersonating and using man-in-the-middle tactics to filter the traffic as stated in the CNet post. The images show a network packet trace from the client side and from the server side during the same session. This was a new memo composed within Notes with a 6-Mbyte attachment and then saved as a draft to the server database. The transfer did not succeed.

CBB is 100% correct. Comcast has been screwing around with Vonage for YEARS, and it has only gotten worse as they have expanded their offering in the VOIP arena. This should come as no surprise. THIS is what makes 'net neutrality' matter. It needs to be illegal. The concept that an ISP is somehow responsible for the traffic on its network is pure legal BS. The people engaging in child porn, or the people distributing copyrighted material illegally, are the ones that should be held accountable. ANY discussion centered on making the ISPs police the network will result in competitive censorship.

I had to get rid of my VoIP and use Comcast's because the QOS stinks, now this. I would dump Comcast in a heartbeat if I had somewhere else to go.

It is not just P2P and VoIP technologies. I use FTP to back up files periodically. Small files go up roughly as Comcast would advertise. Large files, after a predictable number of packets, get throttled.