Educause Security Discussion mailing list archives

Re: copyright infringement notices volume


From: Dave Inman <dave.inman () VISTAONE COM>
Date: Fri, 17 Sep 2010 13:20:21 -0400

Our experience with Procera and other traffic shaping solutions generally
leads us to believe that the best practice for managing P2P traffic like
BitTorrent is to limit it to extremely low bandwidth, rather than to
filter/discard it completely.

When these applications are blocked, they kick into overdrive to obfuscate
themselves, which increases the likelihood that they will get around the
PacketLogic's signatures. Limiting the bandwidth consumption by shaping, on
the other hand, will make the applications think that they're working, but
make them so slow that they are effectively unusable.

Of course, with PacketLogic's ability to create objects and policies based
on such a variety of properties, you may be able to combine a filtering rule
based on application signature with a shaping rule based on flags.

Hope this helps...
________________________________________________

*Dave Inman*
VistaOne Corporation
10001 Patterson Avenue, Suite 101
Richmond, VA 23238
804.972.3622 (phone)
804.497.5889 (fax)
www.vistaone.com | *see/control/accelerate/secureā„¢*
________________________________________________
Keep yourself posted on our blog! http://blog.vistaone.com
Follow me on Twitter! @v1DInman <http://www.twitter.com/v1dinman>



On Fri, Sep 17, 2010 at 11:55 AM, Cal Frye <cjf () calfrye com> wrote:

On 9/17/10 7:15 AM, John Ladwig wrote:
I *had* meant to send my policy query only to Jeff but given the
sudden but inevitable betrayal by my MUA, I'm interested in BT
control policies, as some I've seen apply to bulk-transfer only, and
others apply to control and discovery traffic.  Do you do full-block
or radically-degraded service, etc?

For the purposes of avoiding DMCA notifications, I believe a full-block
is required. This would be a firewall rule on the Packetlogic, and the
PL is clever enough to handle those clients that would respond by
switching to well-known ports like 80 or 53...

It occurs to me that blocking BT via bulk-transfer policies without
also limiting tracker and other discovery traffic may net one the
worst of both worlds;users grumpy about not being able to transfer
fiels, *and* DMCA notices due to uncontrolled tracker traffic.

If you cannot block all BT communications but file-transfers are
effectively denied, you could still respond to DMCA notifications with a
form letter to that effect without having to perform an individual
takedown.

--
Best regards
-- Cal Frye, Network Administrator, Oberlin College
  Mudd Library, x.56930 -- CIT will NEVER ask you for your password!

  www.calfrye.com,  www.oberlin.edu/cit/

"The greatest gift is a portion of thyself." -- Ralph Waldo Emerson.


Current thread: