NNSquad - Network Neutrality Squad
[ NNSquad ] Re: How do I detect connection disruption by my IAP?
Yes, all that is true. But if all you want to do is see if your ISP is deploying a forging attack against your particular application you can use WireShark or some other packet capture device to see if you are getting a RST after your SYN. The cable modem should be considered the PE, not CE, even though a lot of customers own their own cable modems. It's the provider's configuration that gets put on the cable modem, not whatever the user may desire. With this in mind, the only thing you should have to monitor is the Ethernet link between the PE cable modem and whatever you use for your customer equipment. Fred Reimer, CISSP, CCNP, CQS-VPN, CQS-ISS Senior Network Engineer Coleman Technologies, Inc. 954-298-1697 -----Original Message----- From: nnsquad-bounces+freimer=ctiusa.com@nnsquad.org [mailto:nnsquad-bounces+freimer=ctiusa.com@nnsquad.org] On Behalf Of Richard Bennett Sent: Thursday, November 08, 2007 4:21 PM To: nnsquad@nnsquad.org Subject: [ NNSquad ] Re: How do I detect connection disruption by my IAP? People who want to monitor cable modem networks with Wireshark or similar Ethernet capture tools should be aware of the limitations. On cable modem networks, upstream and downstream use different RF channels, and the cable modem itself is not capable of receiving upstream data. Hence, the only data you will see on the Ethernet side of a cable modem is downstream traffic and the immediate client's attempted upstream traffic (which may or may not be transmitted on the cable modem network.) Hence, it's impossible to say with certainty how busy the upstream side is at any given time. This means, for example, that any claims about the load on the Comcast network's upstream side during periods of upstream traffic shaping are total speculation. Of course, you can guess about the upstream traffic based on the number of ACKs you see on the downstream side, but dropped packets are hard to detect. There are ways to monitor the upstream side of a cable modem on the RF side, of course, but they require specialized equipment. RB Fred Reimer wrote: > You can download WireShark at www.wireshare.org for a packet > capture and analysis program. You'd need to know a bit about > TCP/IP in order to make good use of it, but you can search for > TCP packets with the RST bit set. That would be a "forced" > close. You CAN get them from some valid destinations, but they > should be rare, and should only happen at the end of a connection > anyway. A normal closure would be the use of the FIN flags. > > Fred Reimer, CISSP, CCNP, CQS-VPN, CQS-ISS > Senior Network Engineer > Coleman Technologies, Inc. > 954-298-1697 > > > > > -----Original Message----- > From: nnsquad-bounces+freimer=ctiusa.com@nnsquad.org > [mailto:nnsquad-bounces+freimer=ctiusa.com@nnsquad.org] On Behalf > Of B.J. Herbison (Mailing lists) > Sent: Thursday, November 08, 2007 10:08 AM > To: nnsquad@nnsquad.org > Subject: [ NNSquad ] How do I detect connection disruption by my > IAP? > > I have Comcast as my Internet access provider. I've been sending > large messages regularly via Gmail (almost daily for a couple of > years). I sent a message without problem Monday through > Wednesday. > > This morning I tried to send a message and it failed five times. > The attachment is large, but a little smaller than yesterday. > The error was: > > Oops... a server error occurred and your email was not sent. > (#001) > (Similar error if I try to "save" the message.) > > The five send failures and save failure were with Firefox, my > standard browser. Then I tried from IE and the message was sent. > Then it failed again from Firefox. (Chance? Coincidence? > Time-outs somewhere? I'd love to construct a formal experiment > with multiple computers, different browsers and add-ons, and > stop-watch controlled timing intervals. Unfortunately, I have a > life.) > > How can I tell whether there is a problem with Google today, some > issue "out on the Internet", a Firefox problem, or whether > Comcast is messing with my connections? > > Are there any Windows XP tools to monitor my connections (either > inside or out of Firefox) to see if there was a forced close? > > > Thanks, > B.J. > > ----------------------------------------------------------------- ------- > > _______________________________________________ > NNSquad mailing list information: > http://lists.nnsquad.org/mailman/listinfo/nnsquad -- Richard Bennett <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type"> </head> <body bgcolor="#ffffff" text="#000000"> People who want to monitor cable modem networks with Wireshark or similar Ethernet capture tools should be aware of the limitations. On cable modem networks, upstream and downstream use different RF channels, and the cable modem itself is not capable of receiving upstream data. Hence, the only data you will see on the Ethernet side of a cable modem is downstream traffic and the immediate client's attempted upstream traffic (which may or may not be transmitted on the cable modem network.) Hence, it's impossible to say with certainty how busy the upstream side is at any given time. This means, for example, that any claims about the load on the Comcast network's upstream side during periods of upstream traffic shaping are total speculation. Of course, you can guess about the upstream traffic based on the number of ACKs you see on the downstream side, but dropped packets are hard to detect.<br> <br> There are ways to monitor the upstream side of a cable modem on the RF side, of course, but they require specialized equipment.<br> <br> RB<br> <br> Fred Reimer wrote: <blockquote cite="mid98B7739FB65BF04F9B3233AB842EEC950143E72E@EXCHANGE.ctiusa .com" type="cite"> <pre wrap="">You can download WireShark at <a class="moz-txt-link-abbreviated" href="http://www.wireshare.org">www.wireshare.org</a> for a packet capture and analysis program. You'd need to know a bit about TCP/IP in order to make good use of it, but you can search for TCP packets with the RST bit set. That would be a "forced" close. You CAN get them from some valid destinations, but they should be rare, and should only happen at the end of a connection anyway. A normal closure would be the use of the FIN flags. Fred Reimer, CISSP, CCNP, CQS-VPN, CQS-ISS Senior Network Engineer Coleman Technologies, Inc. 954-298-1697 -----Original Message----- From: <a class="moz-txt-link-abbreviated" href="mailto:nnsquad-bounces+freimer=ctiusa.com@nnsquad.org">nnsq uad-bounces+freimer=ctiusa.com@nnsquad.org</a> [<a class="moz-txt-link-freetext" href="mailto:nnsquad-bounces+freimer=ctiusa.com@nnsquad.org">mail to:nnsquad-bounces+freimer=ctiusa.com@nnsquad.org</a>] On Behalf Of B.J. Herbison (Mailing lists) Sent: Thursday, November 08, 2007 10:08 AM To: <a class="moz-txt-link-abbreviated" href="mailto:nnsquad@nnsquad.org">nnsquad@nnsquad.org</a> Subject: [ NNSquad ] How do I detect connection disruption by my IAP? I have Comcast as my Internet access provider. I've been sending large messages regularly via Gmail (almost daily for a couple of years). I sent a message without problem Monday through Wednesday. This morning I tried to send a message and it failed five times. The attachment is large, but a little smaller than yesterday. The error was: Oops... a server error occurred and your email was not sent. (#001) (Similar error if I try to "save" the message.) The five send failures and save failure were with Firefox, my standard browser. Then I tried from IE and the message was sent. Then it failed again from Firefox. (Chance? Coincidence? Time-outs somewhere? I'd love to construct a formal experiment with multiple computers, different browsers and add-ons, and stop-watch controlled timing intervals. Unfortunately, I have a life.) How can I tell whether there is a problem with Google today, some issue "out on the Internet", a Firefox problem, or whether Comcast is messing with my connections? Are there any Windows XP tools to monitor my connections (either inside or out of Firefox) to see if there was a forced close? Thanks, B.J. </pre> <pre wrap=""> <hr size="4" width="90%"> _______________________________________________ NNSquad mailing list information: <a class="moz-txt-link-freetext" href="http://lists.nnsquad.org/mailman/listinfo/nnsquad">http://l ists.nnsquad.org/mailman/listinfo/nnsquad</a> </pre> </blockquote> <br> <pre class="moz-signature" cols="72">-- Richard Bennett </pre> </body> </html> --===============1726109127== Content-Type: text/plain; charset="iso-8859-1" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Disposition: inline _______________________________________________ NNSquad mailing list information: http://lists.nnsquad.org/mailman/listinfo/nnsquad --===============1726109127==-- MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIPVDCCBDIw ggMaoAMCAQICAQEwDQYJKoZIhvcNAQEFBQAwezELMAkGA1UEBhMCR0IxGzAZBgNVBAgMEkdyZWF0 ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBwwHU2FsZm9yZDEaMBgGA1UECgwRQ29tb2RvIENBIExpbWl0 ZWQxITAfBgNVBAMMGEFBQSBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczAeFw0wNDAxMDEwMDAwMDBaFw0y ODEyMzEyMzU5NTlaMHsxCzAJBgNVBAYTAkdCMRswGQYDVQQIDBJHcmVhdGVyIE1hbmNoZXN0ZXIx EDAOBgNVBAcMB1NhbGZvcmQxGjAYBgNVBAoMEUNvbW9kbyBDQSBMaW1pdGVkMSEwHwYDVQQDDBhB QUEgQ2VydGlmaWNhdGUgU2VydmljZXMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC+ QJ30buHqdoccTUVEjr5GyIMGncEq/hgfjuQC+vOrXVCKFjELmgbQxXAizUktVGPMtm5oRgtT6stM JMC8ck7q8RWu9FSaEgrDerIzYOLaiVXzIljz3tzP74OGooyUT59o8piQRoQnx3a/48w1LIteB2Rl gsBIsKiR+WGfdiBQqJHHZrXreGIDVvCKGhPqMaMeoJn9OPb2JzJYbwf1a7j7FCuvt6rM1mNfc4za BZmoOKjLF3g2UazpnvR4Oo3PD9lC4pgMqy+fDgHe75+ZSfEt36x0TRuYtUfF5SnR+ZAYx2KcvoPH Jns+iiXHwN2d5jVoECCdj9je0sOEnA1e6C/JAgMBAAGjgcAwgb0wHQYDVR0OBBYEFKARCiM+lvEH 7OKvKe+CpX/QMKS0MA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MHsGA1UdHwR0MHIw OKA2oDSGMmh0dHA6Ly9jcmwuY29tb2RvY2EuY29tL0FBQUNlcnRpZmljYXRlU2VydmljZXMuY3Js MDagNKAyhjBodHRwOi8vY3JsLmNvbW9kby5uZXQvQUFBQ2VydGlmaWNhdGVTZXJ2aWNlcy5jcmww DQYJKoZIhvcNAQEFBQADggEBAAhW/ALwm+j/pPrWe8ZEgM5PxMX2AFjMpra8FEloBHbo5u5d7AIP YNaNUBhPJk4B4+awpe6/vHRUQb/9/BK4x09a9IlgBX9gtwVK8/bxwr/EuXSGti19a8zS80bdL8bg asPDNAMsfZbdWsIOpwqZwQWLqwwv81w6z2w3VQmH3lNAbFjv/LarZW4E9hvcPOBaFcae2fFZSDAh ZQNs7Okhc+ybA6HgN62gFRiP+roCzqcsqRATLNTlCCarIpdg+JBedNSimlO98qlo4KJuwtdssaMP nr/raOdW8q7y4ys4OgmBtWuF174t7T8at7Jj4vViLILUagBBUPE5g5+V6TaWmG4wggTdMIIDxaAD AgECAhBxkvvmGV+sTRKFdHE0ohinMA0GCSqGSIb3DQEBBQUAMHsxCzAJBgNVBAYTAkdCMRswGQYD VQQIDBJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAOBgNVBAcMB1NhbGZvcmQxGjAYBgNVBAoMEUNvbW9k byBDQSBMaW1pdGVkMSEwHwYDVQQDDBhBQUEgQ2VydGlmaWNhdGUgU2VydmljZXMwHhcNMDQwMTAx MDAwMDAwWhcNMjgxMjMxMjM1OTU5WjCBrjELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAlVUMRcwFQYD VQQHEw5TYWx0IExha2UgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMSEwHwYD VQQLExhodHRwOi8vd3d3LnVzZXJ0cnVzdC5jb20xNjA0BgNVBAMTLVVUTi1VU0VSRmlyc3QtQ2xp ZW50IEF1dGhlbnRpY2F0aW9uIGFuZCBFbWFpbDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC ggEBALI5haTyfatBO2JGN67NwWB1vDll+UoaR6K5zEjMapjVTTUZuaRC5c5J4oovHnzSMQfHTrSD ZJ0uKdWiZMSFvYVRNXmkTmiQexx6pJKoF/KYFfKTzMmkMpW7DE8wvZigC4vlbhuiRvp4vKJvq1le pS/Pytptqi/rrKGzaqq3Lmc1i3nhHmmI4uZGzaCl6r4LznY6eg6b6vzaJ1s9cx8i5khhxkzzabGo Lhu21DEgLLyCio6kDqXXiUP8FlqvHXHXEVnauocNr/rz4cLwpMVnjNbWVDreCqS6A3ezZcj9HtN0 YqoYymiTHqGFfvVHZcv4TVcodNI0/zC27vZiMBSMLOsCAwEAAaOCAScwggEjMB8GA1UdIwQYMBaA FKARCiM+lvEH7OKvKe+CpX/QMKS0MB0GA1UdDgQWBBSJgmd9xJ0mcABLtFBIfN49rgRufTAOBgNV HQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUH AwQwEQYDVR0gBAowCDAGBgRVHSAAMHsGA1UdHwR0MHIwOKA2oDSGMmh0dHA6Ly9jcmwuY29tb2Rv Y2EuY29tL0FBQUNlcnRpZmljYXRlU2VydmljZXMuY3JsMDagNKAyhjBodHRwOi8vY3JsLmNvbW9k by5uZXQvQUFBQ2VydGlmaWNhdGVTZXJ2aWNlcy5jcmwwEQYJYIZIAYb4QgEBBAQDAgEGMA0GCSqG SIb3DQEBBQUAA4IBAQCdlcs8uH6lCcQevwvCx3aOOTyUxhCqTwzJ4KuEXYlU4GU7820cfDcsJVRf liH8N4SRnRXcFE+Bz1Qda2xFYMct+ZdRTPlmyjyggoymyPDi6dRK+ew/VsnddozDggFPbADzHhph dARHA6nGQFeRvGUixSdnT1fbZFrZjR+6hi/0Bq6cae3p9M8pF9jgSp8aIC+XTFG7RgfEijdOIOMJ MWjHnsSLneh+EbwyaBCWEZhE2CpRYE2I63Q630MGMsg5Vow6EVLTQaRDA/Tt7zMn2zngFE4mydj1 OeKJuJNdtykmQeqzm66D/Hd1yujKtf7iZUpjPkTE0MNeh3OpmByvfxV/MIIGOTCCBSGgAwIBAgIQ JK13cA/UUzQEYeFeqdvxxTANBgkqhkiG9w0BAQUFADCBrjELMAkGA1UEBhMCVVMxCzAJBgNVBAgT AlVUMRcwFQYDVQQHEw5TYWx0IExha2UgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3 b3JrMSEwHwYDVQQLExhodHRwOi8vd3d3LnVzZXJ0cnVzdC5jb20xNjA0BgNVBAMTLVVUTi1VU0VS Rmlyc3QtQ2xpZW50IEF1dGhlbnRpY2F0aW9uIGFuZCBFbWFpbDAeFw0wNzA4MjYwMDAwMDBaFw0w ODA4MjUyMzU5NTlaMIHZMTUwMwYDVQQLEyxDb21vZG8gVHJ1c3QgTmV0d29yayAtIFBFUlNPTkEg Tk9UIFZBTElEQVRFRDFGMEQGA1UECxM9VGVybXMgYW5kIENvbmRpdGlvbnMgb2YgdXNlOiBodHRw Oi8vd3d3LmNvbW9kby5uZXQvcmVwb3NpdG9yeTEfMB0GA1UECxMWKGMpMjAwMyBDb21vZG8gTGlt aXRlZDEUMBIGA1UEAxMLRnJlZCBSZWltZXIxITAfBgkqhkiG9w0BCQEWEmZyZWltZXJAY3RpdXNh LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMhpiqY4HuAUG1QIugun5ZDHOcEs 18ucmOHrz529RsGlcL5HCJ5d/Q9S/0nx5rkJlqdvMR89jbOkLkPdx9Zv/2XVM1hxZcZyhpFJAIBd pFcU1hvhQh2V9vz3J+tQzmmbJFVNIaD3UoTogryhzHf2LmDgSThG4hp+qXceAjkHJiKPfDz2SMpj VRWEZ+avfShUK7bs+FYWBXLQDROtApMhWrTGaqEzS14HSca+ZQ6nJSa+9sCx0TH5mX/63bnsj+h8 12hC39hU2pqrA40fCt6X4L/vnZxERNlGuRvA0WeOIJgdBsdPamBTVTZXcUQAxdAC6nhsyPrGx3/3 qZopcmCQr3MCAwEAAaOCAiQwggIgMB8GA1UdIwQYMBaAFImCZ33EnSZwAEu0UEh83j2uBG59MB0G A1UdDgQWBBRnyt1NrJZSxS9tJrgBj8v/lSBqJTAOBgNVHQ8BAf8EBAMCBaAwDAYDVR0TAQH/BAIw ADAgBgNVHSUEGTAXBggrBgEFBQcDBAYLKwYBBAGyMQEDBQIwEQYJYIZIAYb4QgEBBAQDAgUgMEYG A1UdIAQ/MD0wOwYMKwYBBAGyMQECAQEBMCswKQYIKwYBBQUHAgEWHWh0dHBzOi8vc2VjdXJlLmNv bW9kby5uZXQvQ1BTMIGlBgNVHR8EgZ0wgZowTKBKoEiGRmh0dHA6Ly9jcmwuY29tb2RvY2EuY29t L1VUTi1VU0VSRmlyc3QtQ2xpZW50QXV0aGVudGljYXRpb25hbmRFbWFpbC5jcmwwSqBIoEaGRGh0 dHA6Ly9jcmwuY29tb2RvLm5ldC9VVE4tVVNFUkZpcnN0LUNsaWVudEF1dGhlbnRpY2F0aW9uYW5k RW1haWwuY3JsMHwGCCsGAQUFBwEBBHAwbjA2BggrBgEFBQcwAoYqaHR0cDovL2NydC5jb21vZG9j YS5jb20vVVROQUFBQ2xpZW50Q0EuY3J0MDQGCCsGAQUFBzAChihodHRwOi8vY3J0LmNvbW9kby5u ZXQvVVROQUFBQ2xpZW50Q0EuY3J0MB0GA1UdEQQWMBSBEmZyZWltZXJAY3RpdXNhLmNvbTANBgkq hkiG9w0BAQUFAAOCAQEATSZfG68rGikpXBVv8YZi2CFRwCbkidao7VWEpq3OZB58XGiacdYuIFe1 medsZvENnORXHcgjcZbNFOHmPeN8kdWu4mzFEVPfJGZuf7qY2UddJpdoZz7qz7n5+cSMupsUl/jM ez2tn75A3Hr6YIaudgjbDRX/7W1Mxcyxv5PGV13gCTAqFXI/WbpZYSOe1e8pX1zvResxVHVazYy7 oO0G5x3AZQqW965bt+iVcAUh25s88eTsNCvLrCx889VD2PBAVnFTiPsezUwU+ZMMfFroQU2XFl3/ jn90tXwrDRDUxhmlt2vmWSHO9cmh8PODIwqJPIaNUeVk9Wo4qTsLSxYHojGCBLIwggSuAgEBMIHD MIGuMQswCQYDVQQGEwJVUzELMAkGA1UECBMCVVQxFzAVBgNVBAcTDlNhbHQgTGFrZSBDaXR5MR4w HAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxITAfBgNVBAsTGGh0dHA6Ly93d3cudXNlcnRy dXN0LmNvbTE2MDQGA1UEAxMtVVROLVVTRVJGaXJzdC1DbGllbnQgQXV0aGVudGljYXRpb24gYW5k IEVtYWlsAhAkrXdwD9RTNARh4V6p2/HFMAkGBSsOAwIaBQCgggLDMBgGCSqGSIb3DQEJAzELBgkq hkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTA3MTEwODIzNDUyNlowIwYJKoZIhvcNAQkEMRYEFJRg tBjiO2zvzQw8lUJ2k5B/+z2FMEsGCyqGSIb3DQEJEAIBMTwwOgQdAAAAABAAAACswfYb7h1nSZLG RZbYHiuIAQAAAACAAQAwFjAUgRJmcmVpbWVyQGN0aXVzYS5jb20wZwYJKoZIhvcNAQkPMVowWDAK BggqhkiG9w0DBzAOBggqhkiG9w0DAgICAIAwDQYIKoZIhvcNAwICAUAwBwYFKw4DAgcwDQYIKoZI hvcNAwICASgwBwYFKw4DAhowCgYIKoZIhvcNAgUwgdQGCSsGAQQBgjcQBDGBxjCBwzCBrjELMAkG A1UEBhMCVVMxCzAJBgNVBAgTAlVUMRcwFQYDVQQHEw5TYWx0IExha2UgQ2l0eTEeMBwGA1UEChMV VGhlIFVTRVJUUlVTVCBOZXR3b3JrMSEwHwYDVQQLExhodHRwOi8vd3d3LnVzZXJ0cnVzdC5jb20x NjA0BgNVBAMTLVVUTi1VU0VSRmlyc3QtQ2xpZW50IEF1dGhlbnRpY2F0aW9uIGFuZCBFbWFpbAIQ JK13cA/UUzQEYeFeqdvxxTCB1gYLKoZIhvcNAQkQAgsxgcaggcMwga4xCzAJBgNVBAYTAlVTMQsw CQYDVQQIEwJVVDEXMBUGA1UEBxMOU2FsdCBMYWtlIENpdHkxHjAcBgNVBAoTFVRoZSBVU0VSVFJV U1QgTmV0d29yazEhMB8GA1UECxMYaHR0cDovL3d3dy51c2VydHJ1c3QuY29tMTYwNAYDVQQDEy1V VE4tVVNFUkZpcnN0LUNsaWVudCBBdXRoZW50aWNhdGlvbiBhbmQgRW1haWwCECStd3AP1FM0BGHh Xqnb8cUwDQYJKoZIhvcNAQEBBQAEggEAIk9/0kOPyICLcWEe7aDkvP8a/XyUpZehMPWO76U3Om3j sS3fM+IlT4DHp4ZMPMby5RcsHQgLv+Czl5ztTEoin5mMnAI7QC85LUp8kN1iXQy0LhsDYCZ9NNBe k0lOeIdb4hrnkkJxP2JHmyUb9V6TdfNPV2gWvwQGR9T0EIhLL4bZESZy1H298/mKErRbaCDiQ508 1ij2ozl0iu6GB0kmKVcbWX6avPzbaxZ1wibXVyUwLZb0Yz6fkEcAPEPH23hYbMqn0GIWxqVqCXt2 GxSmMXjSnapca0ffHcGlD81RmpFCrlf0idcVEepFNCUA2NGAJrxxKYX6H+dHKi1qm49NgQAAAAAA AA==
_______________________________________________ NNSquad mailing list information: http://lists.nnsquad.org/mailman/listinfo/nnsquad.org