If it's encrypted it's obviously harder to detect but that is what the hardware was designed for I thought. If they haven't got their kit configured to detect NNTP regardless they are either being very cynical or very naive. I suspect it just isn't operating all the time so they can do some real world evaluation of its impact on network loading.

In reply to a post by Roph:

Remember that they're essentially on 2 different networks. Virgin's 10/20 meg offerings run over DOCSIS 2, whereas 30/50/100 are on their DOCSIS 3 network. Maybe that has something to do with it?

I've found that with torrents, during the day it does seem harder to get higher speeds, but if there are enough seeds (or some fast seeds), I can still max out this 30 meg line and get roughly 3.6 MB/s. 10am, 2pm, 5pm, 8pm etc.

10mbit typically on docsis1 up and down
20mbit will either be on docsis 1 up and down or docsis3 down, maybe on docsis2 up if uplifted area.
30, 50mbit will all be on docsis3 down and either docsis1 or docsis 2 up depending if uplifted area.
100mbit should always be on docsis3 down and docsis2 up as its a uplifted area only service.

also as far as I know 443 does evade the traffic shaping for encrypted traffic.

In reply to a post by Chrysalis:

also as far as I know 443 does evade the traffic shaping for encrypted traffic.

That's interesting. I wonder what they are playing at.

I know, I did wonder that myself once news got out that traffic shaping was purely by port and not using DPI, seems odd.

In reply to a post by kwikbreaks:

In reply to a post by Chrysalis:

also as far as I know 443 does evade the traffic shaping for encrypted traffic.

That's interesting. I wonder what they are playing at.

Same here. My dad's connection gets throttled on the 10meg. Why would they not do it on the other packages regardless wether they are docsis 1,2 or 3.

Hmmm....

I don't know much at all about the DPI kit or how VM organise their data centre so the only guess I can make is that the DOCSIS1/2 and DOCSIS3 parts of the network are handled separately and only the DOSCIS1/2 portion actually has the DPI kit which I guess is very expensive and they are using something simpler/cheaper for the DOCSIS3 portion? That would deter downsizing by heavy downloaders because all products get similar speeds on p2p and nntp.

Whatever the reason I can't se it staying that way as the news will spread fast amongst those it impacts (it isn't only files that get shared) and the shaping will quickly become totally ineffective. It will only get worse (from the VM viewpoint) as more and more move to DOCSIS3.

In reply to a post by kwikbreaks:

Hmmm....

I don't know much at all about the DPI kit or how VM organise their data centre so the only guess I can make is that the DOCSIS1/2 and DOCSIS3 parts of the network are handled separately and only the DOSCIS1/2 portion actually has the DPI kit which I guess is very expensive and they are using something simpler/cheaper for the DOCSIS3 portion? That would deter downsizing by heavy downloaders because all products get similar speeds on p2p and nntp.

Whatever the reason I can't se it staying that way as the news will spread fast amongst those it impacts (it isn't only files that get shared) and the shaping will quickly become totally ineffective. It will only get worse (from the VM viewpoint) as more and more move to DOCSIS3.

the traffic shaping is same for everyone, regardless of docsis version, however it will vary I think depending on loal congestion levels so I think people in congested areas will possibly see lower shaped speeds.

It is STM that differs per package. There is tons of confusion as people often think STM and shaping are one and the same thing.

It boils down to one thing really. Hard core serial torrent users will always find ways to evade shaping, but the casual torrent users wont bother messing with ports, VPNs proxies etc. There is tons of casual torrent use out there. So this will be having an affect I suspect but I dont think the effect is significant overall as now days p2p is only a small % of download traffic, its only still a majority on upload traffic. So VM have been shaping the wrong direction Especially when considering 90% or so of congestion on VM is on upstream capacity not downstream.

Edited by Chrysalis (Thu 24-Feb-11 11:49:22)

I thought I read that the STM was a built in feature of the CMTS so was reasonably local. Being just volume driven it can't differentiate between congested and non-congested areas.

The shaping kit is used by ADSL ISPs too so must be designed as high capacity for use at the ISP data centre and I would have thought by then it would all be aggregated so there would still be no different action depending on local congestion although I suppose it could be done based on IP or something. What I was wondering was whether or not the DOCSIS1/2 and DOCSIS3 networks were handled differently back at the data center or if they just get combined at a local level anyway.

Given the low STM thresholds on the old products maybe is i just that kicking in and not shaping which makes the 10Mbps poster above think using 443 doesn't help him.

Traffic is marked centrally and shaping policy enforced locally.

In reply to a post by kwikbreaks:

If it's encrypted it's obviously harder to detect but that is what the hardware was designed for I thought. If they haven't got their kit configured to detect NNTP regardless they are either being very cynical or very naive. I suspect it just isn't operating all the time so they can do some real world evaluation of its impact on network loading.

Zero point in doing that, the hardware can sit in monitor mode to assess traffic distribution.

It detects NNTP fine but cannot detect NNTP encapsulated in TLS, that's the point of TLS.

I imagine there's a performance reason why other ways to detect, such as by source IP, aren't being used.