Virgin Media Phorm Webwise Adverts [Updated: See Post No. 1, 77, 102 & 797]

[rryles]

Originally Posted by Dephormation

For any tech head like me who was thinking trace route apps use ICMP echo packets over IP, see here

tcptraceroute is a traceroute implementation using TCP packets.

The more traditional traceroute(8) sends out either UDP or ICMP ECHO packets with a TTL of one, and increments the TTL until the destination has been reached. By printing the gateways that generate ICMP time exceeded messages along the way, it is able to determine the path packets are taking to reach the destination.
<snip>
By sending out TCP SYN packets instead of UDP or ICMP ECHO packets, tcptraceroute is able to bypass the most common firewall filters.

You learn something new every day. Interesting. That could come in very handy.

Yes. I posted that same link a few pages back! The same functionality is now integrated into recent versions of traceroute though. You just need to use the -T option and set the destination port with -p

---------- Post added at 12:21 ---------- Previous post was at 12:04 ----------

I've edited my previous post here: http://www.cableforum.co.uk/board/34...post12610.html

There is evidence that squirrelmail is used on over 117,000 sites! That's an awful lot of webmail sites phorm is still to exclude.

[madslug]

Originally Posted by rryles

Yes. I posted that same link a few pages back! The same functionality is now integrated into recent versions of traceroute though. You just need to use the -T option and set the destination port with -p

I must have an old version

Usage: traceroute [-dFInrSvx] [-g gateway] [-i iface] [-f first_ttl]
[-m max_ttl] [-p port] [-P proto] [-q nqueries] [-s src_addr]
[-t tos] [-w waittime] [-z pausemsecs] host [packetlen]

[rryles]

Originally Posted by madslug

I must have an old version

Must be. This is mine:

$ traceroute -V
Modern traceroute for Linux, version 2.0.9 Sep 28 2007

[isf]

Originally Posted by madslug

I must have an old version

There's also a dedicated tcptraceroute, most linux/BSD distros should have it in their repos.

Originally Posted by rryles

There is evidence that squirrelmail is used on over 117,000 sites!

It's hardly as if squirrelmail has the monopoly on webmail. I've used mhonarc in the past to briefly provide external web access to private mail archives. And while Phorm say they won't profile sites using HTTP auth, almost nobody uses it. I've been disabling the Apache module for years in favour of cookie based authentication.

[rryles]

Originally Posted by isf

There's also a dedicated tcptraceroute, most linux/BSD distros should have it in their repos.

Yup. Ubuntu 7.04 doesn't have the capability built into traceroute, but 7.10 does. Both have tcptraceroute in their repos though.

For Macs, you need to compile tcptraceroute from source. Not that hard see http://www.qsyssoft.com/machaxor/?p=4

For windows there is http://tracetcp.sourceforge.net/

Originally Posted by isf

It's hardly as if squirrelmail has the monopoly on webmail. I've used mhonarc in the past to briefly provide external web access to private mail archives. And while Phorm say they won't profile sites using HTTP auth, almost nobody uses it. I've been disabling the Apache module for years in favour of cookie based authentication.

Yeah. The 117,000 will only be a fraction of the global webmail sites. Many of them will be private (i.e. not open to the general public). SquirrelMail was just an easy example to get some figures for and it doesn't use "basic authentication".

1,000 excluded webmail sites is only scratching the surface. The Earl of Northesk said it better than I could - "There's a fundament issue there as soon as you start talking in those terms. If you've got to indulge in exceptions and abstracts to make the system workable then the system almost by definition has to be wrong."

A general request for the tech-experts (texperts?)

Can one of you post a laymans explanation of the use of traceroutes and how it relates to this issue? It may help some of the non-techys amongst us to understand the significance of all of these posts.

[Wildie]

Originally Posted by Peter N

A general request for the tech-experts (texperts?)

Can one of you post a laymans explanation of the use of traceroutes and how it relates to this issue? It may help some of the non-techys amongst us to understand the significance of all of these posts.

waypoints on route from A to B one could say. no me not texpert

[BetBlowWhistler]

Originally Posted by Peter N

A general request for the tech-experts (texperts?)

Can one of you post a laymans explanation of the use of traceroutes and how it relates to this issue? It may help some of the non-techys amongst us to understand the significance of all of these posts.

Every packet you send out on the network has an associated TTL (Time to Live). This is typically set to 30 so that in the event of a routing loop that packets will eventually die off.

Every layer 3 (IP)device in the chain will decrement this TTL by one. If the packet should die, it is usual for the layer 3 device to send an error message to the orininating device.

In the case of traceroute, these tcp packets are sent with each packet incrementing it's ttl by 1.

So, first packet TTL=1
Second packet TTL=2
etc.

Traceroute can then compile a list of layer 3 hops by using the returning error message (which comes from an IP address). If there is a reverse-dns lookup available for that IP address it will also list it's name (not always configured).

If you get * * * as a response from a hop then it means that the device is prevented from sending error responses back to you. That also explains why traceroute can carry on because after it times-out 3 packets in succession it moves on to sending the next packet out with an extra +1 to the TTL (so the packet dies at the next hop).

Does that help?

EDIToh! just re-read your request for a laymans explanation...it's all done by magic (and pixies)

How does knowing the route relate to Phorm or DPI?

Is it a matter of looking for a certain IP address (or number of them) or is it simply a matter of the number of hops that is affected?

[Dephormation]

Originally Posted by Peter N

How does knowing the route relate to Phorm or DPI?

Is it a matter of looking for a certain IP address (or number of them) or is it simply a matter of the number of hops that is affected?

Adding a new device (hop) into the network path, or a strange path taken by packets, might indicate something interesting was going on.

Particularly if the path goes out to a third party and back for example.

Its a way of assessing how efficiently your packets are travelling to the destination, and who is handling them.

Thanks Pete.

How can you tell if these hops relate to Phorm (or any other form of intervention/diversion by ISPs)?

Is it just a matter of constantly looking for a problem or do you only need to check when there are specific signs of a problem such as slow connections?

How usual or unusual are the results being posted here lately?

[BetBlowWhistler]

Originally Posted by Peter N

Thanks Pete.

How can you tell if these hops relate to Phorm (or any other form of intervention/diversion by ISPs)?

Is it just a matter of constantly looking for a problem or do you only need to check when there are specific signs of a problem such as slow connections?

How usual or unusual are the results being posted here lately?

If you see a lot of hops in within the same subnet range that could indicate that some re-direction was going on (proxies basically).

Having said that, traceroute is a diagnostic tool. In of itself it just gives you something to work with regarding where the packets are actually going, how many hops. It really needs to be used in conjunction with a detailed network diagram to say for sure what was going on.

---------- Post added at 14:08 ---------- Previous post was at 14:06 ----------

I'm not personally going to analyse the traceroutes provided so far as I was recently in a contract with BT that effectively means I can't use proprietary knowledge and it could be argued that I am using priveledged information (even though I didn't work in this area of BT).

[Dephormation]

Originally Posted by BetBlowWhistler

If you see a lot of hops in within the same subnet range that could indicate that some re-direction was going on (proxies basically).

Having said that, traceroute is a diagnostic tool. In of itself it just gives you something to work with regarding where the packets are actually going, how many hops. It really needs to be used in conjunction with a detailed network diagram to say for sure what was going on.

Important to note there are two levels of 'redirection' that might relate to Phorming.

There's redirection at the application (http web) layer - which is what Phorm described to Richard Clayton. You'd see this in your web browsers as an unexpected page load from webwise.net (used to set phorged cookies).

Then there's redirection of packets at the transport/network (TCP/IP packet) layer - which is what is being discussed with respect to trace routes.

As an end user you have no control over packet routes, the route your packet takes is determined by routers. However if you see packets taking a strange route, such as bouncing around a set of IPs in a subnet, or in/out/in/out of a given subnet... you might infer that route wasn't 'optimal' (for want of a very different word).

[rryles]

Here is my attempt at a layman's guide to traceroute. It omits many details, to the point of being technically incorrect, but hopefully not in a way that matters.

The Internet

The internet consists of hundreds of millions of computers all connected together so they can talk to each other. That's a lot of computers! Therefore it should be obvious that it's not practical to connect every computer directly to every other computer. Instead, the internet is designed a bit more like a phone system. Your computer is connected to an exchange. That exchange is connected to some other exchanges. Some of those exchanges are connected to cables that run under the sea to exchanges in other countries. To phone someone in another country your call will have to pass through a number of exchanges. Some clever stuff is used to determine how to get your call to the destination you desire. This is known as routing the call (finding a route). The internet is very similar. Calls are replaced by "packets", phone numbers are replaced by IP addresses and exchanges are replaced by "routers" which route your packet to its destination.

However, the internet is not exactly like a phone system. In some ways it's more like a postal system. Remember I said calls are replaced by packets? Well you can think of them like a postal packet or a letter. You decide you want to send a message to someone. You write what you want to say, in a language that your intended recipient will understand. Then you put your letter inside an envelope and write the address on it that you want to send it to. If you're worried it might not get delivered you might also write a return address on the back. When you're done you pop it in a post box and forget about it for a while. All being well you get a reply delivered a few days later. You might have a lengthy exchange consisting of several letters both ways.

Every time you send a letter or packet you dispatch it and hope/assume it reaches it's destination. You have no idea how it reaches it's destination but it usually does. Sometimes, however, it doesn't. There are two possibilities: it simply gets lost never to be seen again; or it gets returned to you with some explanation as to what went wrong. I'll cover a particular way in which things can go, which is required to understand traceroute.

The internet was designed to be robust and fault tolerant. One fault that can occur is when the routing stops working and sends packets round in a loop. this would cause the packet to continue hoping around, never reaching its destination but forever using resources such as bandwidth. This would not be good. So a feature was included to prevent this. Every packet has a number associated with it called its "Time To Live" or TTL. The TTL starts at say 100. Every time a packet passes through a router the TTL for that packet is decreased by 1. When it reaches zero the router gives up trying to get it to its destination. It then sends a special packet back to the return address that says "Your packet's TTL reached zero so I stopped trying to send it." This prevents your packet from going round in an endless loop.

Trace Route

I said earlier that you don't care how a packet gets delivered. Well sometimes it can be useful to track a packet on its way to it's destination. This might be to locate where a fault or bottleneck in the system is. It might also be to investigate potentially illegal practices of your ISP. This is quite a common requirement for some techy people so there are software tools to help. Normally they are called something like traceroute. Here is how traceroute works. It sends a series of packets to your chosen destination. However it does something a little unusual with them. The first packet it sends doesn't have a TTL of 100 to start. It has a TTL of 1! This means it will only go as far as the first router it encounters before being returned with an error. Sounds pretty pointless, but you can get two bits of information from that returned packet: which router it got to and how long it took for the packet to get there and back. The second packet that traceroute sends out has a TTL of 2, so it gets as far as the second router before being returned. The next has a TTL of 3 and so on. Eventually your packet reaches its intended destination and you get a normal every day response from it. At this point traceroute stops sending packets. It then prints a list of all of the routers that it found between you and your chosen destination, along with the trip times measured for each.

Problems With TraceRoute

1. Some packets might take a different route to the same destination. It's not possible to track a single packet from start to end using the traceroute method so this can cause errors in the results.

2. The packets that get sent by traceroute can't be blank. They must contain something. Usually they are what are known as ping packets. This are like writing "Are you there?" on a piece of paper and posting it. Normal you get the response "Yes, I'm here", unless the recipient is too rude to reply (quite common these days). For our purposes, we don't want to send a ping packet because it may be identified as such and routed past the phorm stuff without touching it. We want to send what looks like the start of a web page request. To do this we need to send a TCP packet to port 80. This can be done with new versions of traceroute, or a separate program called tcptraceroute.

Hope that helps

P.S. It might be interesting to compare a standard traceroute using ping packets with a tcptraceroute on port 80.

[Wildie]

great means slower web access more bandwidth used and all for what freaking adverts we all avoid.
we do not want your service of added value it is not from any ISP