On Thu, 31 Jan 2002, Jim Shankland wrote:

opener, etc. will all be IP-addressable. I'll be damned if I'll spend an extra $5/month for my refrigerator to surf the web, and I'll bet I'm not alone :-).

Without rehashing the Slashdot discussion, no, I really don't think you are, and with the large market for home networking and steps people are taking toward security with NAT routers and pesonal firewalls, I think it would be an uphill battle to enforce a policy such as this. I guess we will see how it shakes out. andy -- PGP Key Available at http://www.tigerteam.net/andy/pgp

At 12:15 PM 1/31/02, Daniel Golding wrote:

Hmm. I doubt Comcast is actually doing this - they are far too busy actually trying to build a network, out of the ashes of the @home debacle. However, even if they were, there isn't really anything wrong with it. We scratch our heads, collectively, when a large broadband provider goes chapter 11, but then oppose a pricing model that might be profitable. Now, if a provider was refusing to provide extra IPs, then I could see the problem. However, if a provider is willing to provide extra IPs for something reasonable like $5/month, more power to them. There are several good reasons why they might want to ban NAT:

1 - When you come to the stadium, you can't bring in your own hot-dogs. It's the same sort of thing - the hot dogs are subsidizing the ticket price. In this case, extra fees for things like IP addresses and extra email boxes, are the concession items.

2 - Support issues - supporting a largely clue-challenged user base, is hard enough without people slapping linksys routers in, then expecting the ISP to, defacto, provide support. Anyone remember when the only supported router for UUNet ISDN lines was the Pipeline 50? This was to (in theory) enable supportability

Especially considering the clue-challened support departments at Cable ISPs, this is a legitimate problem. Newer Linksys and similar routers can spoof the MAC address of the PC that's behind them as a way to avoid having to tell the cable company about the new "computer." Connected backwards, the Linksys routers appear to merrily spoof the default gateway off the segment (i.e. most likely the first MAC address the box hears) and create lots of support headaches.

3 - NAT is wonderful, but we aren't running out of IP addresses that quickly, and NAT will break some applications. Large scale NAT is probably not the solution to future IP address exhaustion problems. Providers who do this are not being bad guys, because extra IP addresses cost less than the costs of supporting NAT boxes. If folks don't like this, they can become involved with ARIN and propose some bizarre price-support scheme for IP addresses, to encourage NAT, I suppose.

Well, NAT saves the cable company from having to route subnets. ATT Broadband in Massachusetts is now offering "business" service. Reading the fine print, they provide a NAT router, and say you can have up to 253 users behind it. Of course any apps that wouldn't work with NAT will not work. As such, clearly they DO support and/or allow such use of routers. Actually, they've been doing this for a long time. They supply cable service to many schools in the area, and those are all supported using NAT boxes.

4 - This is, of course, an unenforceable policy (which is why I suspect it does not exist). However, it is very reasonable for a provider to refuse to support a customer with a NAT box, if the customer is buying a single user service.

Support is one thing. Trying to detect the presence is another entirely. Wasting time, effort and money trying to track down users who're using "cable routers" is looney. ----------------------------------------------------------------- Daniel Senie dts@senie.com Amaranth Networks Inc. http://www.amaranth.com

1/31/02 12:18:09 PM, Jon Mansey <jon@interpacket.net> wrote:

2) I heard recently of ppl openly sharing their broadband connection using 802.11 access points, Airports etc among friends, neighbors, coworkers. I can see where your DSL or cable company would be a little more concerned about losing revenue like this, over just 2 or 3 PCs sharing at one domestic location.

www.freenetworks.org The movement is quite large, and the implications of its continued growth are interesting. Perhaps this is the ultimate target? Community-owned networks are mildly free-riding for the time being. New DOCSIS specs give finer control on bandwidth usage which is more important than IP addresses. Comcast "hunting" NAT users - sounds like strong language, but I think the SlashDot reference has been pummeled enough. No residental SP should be burning support $$ for residential NAT, so a "public" policy of either charging for it or not supporting it sounds like good business to me. It's not very enforceable, so I'd be very surprised to see much money spent on this witch hunt. Marc (new to list)

On Thu, 31 Jan 2002, Dan Hollis wrote: |+On Thu, 31 Jan 2002, Marc Pierrat wrote: |+> It's not very enforceable, so I'd be very surprised to see much money |+> spent on this witch hunt. |+ |+At least one provider has a fully staffed full time "anti-nat" divison |+now. But will they burn more cash in the nat witch-hunt than they save? |+ |+I also wonder about false positives. Watch the lawsuits fly as they |+mistakenly cutoff non-nat customers.

From a technical standpoint how does one detect NAT users over the network?

Keith

On Thu, 31 Jan 2002, David Charlap wrote: |+ |+Keith Woodworth wrote: |+> |+> From a technical standpoint how does one detect NAT users over the |+> network? |+ |+You can't deterministically do so, but there are some telltale signs. |+NAT implementations (at least the ones I've seen) tend to choose very |+large port numbers (above 30,000) for the ports that they generate. That was my understanding. |+Anybody who tries to detect NAT through these kinds of heuristic methods |+will end up with a lot of false positives and false negatives. And if |+it becomes a problem, the NAT implementors will simply alter their code |+to make it impossible to distinguish from a single host's traffic. Thats sort of what I thought. Ive looked at some tcpdumps that are coming from a FreeBSD machine doing NAT a while ago to see what was in the packets exactly and I could not see how you could tell that box was doing NAT really. But I'm not completely proficient in deciphering packets so I may have missed something along the way. Keith

At 05:02 PM 1/31/02, Jared Mauch wrote:

how to identify non-host based devices:

1) check out mac-address ranges

Many of the small boxes will spoof the MAC address of the PC behind them. They do this so that cable modem companies who track mac addresses don't need to be called to tell them. Of course you then have Linksys which makes both a NAT-box and LAN cards. So the MAC ranges are likely intermixed. On Cisco's, you can easily program any MAC address you want. ----------------------------------------------------------------- Daniel Senie dts@senie.com Amaranth Networks Inc. http://www.amaranth.com

Keith Woodworth wrote:

On Thu, 31 Jan 2002, Dan Hollis wrote:

|+On Thu, 31 Jan 2002, Marc Pierrat wrote: |+> It's not very enforceable, so I'd be very surprised to see much money |+> spent on this witch hunt. |+ |+At least one provider has a fully staffed full time "anti-nat" divison |+now. But will they burn more cash in the nat witch-hunt than they save? |+ |+I also wonder about false positives. Watch the lawsuits fly as they |+mistakenly cutoff non-nat customers.

...

From a technical standpoint how does one detect NAT users over the network?

Informants wherever Linksys router are sold.

Keith

-- Paul A. Bradford pbradford@adelphia.net

Hmm, how can they prove it to _any_ court? They have not right to come in and look around. ----- Original Message ----- From: "Dan Hollis" <goemon@anime.net> To: "Marc Pierrat" <marc@sunchar.com> Cc: "Martin J. Levy" <mahtin@mahtin.com>; "Jon Mansey" <jon@interpacket.net>; <nanog@merit.edu> Sent: Thursday, January 31, 2002 1:27 PM Subject: Re: SlashDot: "Comcast Gunning for NAT Users"

On Thu, 31 Jan 2002, Marc Pierrat wrote:

...

It's not very enforceable, so I'd be very surprised to see much money spent on this witch hunt.

At least one provider has a fully staffed full time "anti-nat" divison now. But will they burn more cash in the nat witch-hunt than they save?

I also wonder about false positives. Watch the lawsuits fly as they mistakenly cutoff non-nat customers.

-Dan -- [-] Omae no subete no kichi wa ore no mono da. [-]

At 10:05 AM 1/31/02 -0800, Bill Woodcock wrote:

> Besides the technical difficulties of detecting a household that is > running a NAT...

Can you think of a way of doing it reliably? Anything that provides anything more than a guess?

How about sniffing the packets going into the Carnivore box? Maybe there's no Carnivore box and the ISPs are providing the Feds with the data from their own logs. Now put a price tag on the cost of doing that and wince. Now find a cost-recovery option for acquiring that data in the first place (like $5 per month per machine using NAT). Best Regards, Simon -- ###

On Thu, 31 Jan 2002, Eric A. Hall wrote:

More than ~4 simultaneous TCP connections open at once.

False positives galore... -Dan -- [-] Omae no subete no kichi wa ore no mono da. [-]

Date: Thu, 31 Jan 2002 16:34:21 -0600 From: Eric A. Hall <ehall@ehsco.com>

Then use six or eight or 20000 or whatever number is above the 90% false positive threshold

Which requires accurate correlation between number of sessions and shared connections. Still false positives, or false negatives galore... If one assumes a 10% duty cycle for someone casually browsing the Web using HTTP/1.1, many of those users could share a single physical connection with only a few open TCP connections. Eddy Brotsman & Dreger, Inc. - EverQuick Internet Division Phone: +1 (316) 794-8922 Wichita/(Inter)national Phone: +1 (785) 865-5885 Lawrence -- Date: Mon, 21 May 2001 11:23:58 +0000 (GMT) From: A Trap <blacklist@brics.com> To: blacklist@brics.com Subject: Please ignore this portion of my mail signature. These last few lines are a trap for address-harvesting spambots. Do NOT send mail to <blacklist@brics.com>, or you are likely to be blocked.

Joel Jaeggli wrote:

the unix box I'm sitting on, which isn't natted, and isn't serving anything, lists 133 open tcp connections.

One would hope that a single metric would not be the basis for a termination. -- Eric A. Hall http://www.ehsco.com/ Internet Core Protocols http://www.oreilly.com/catalog/coreprot/

One can hope all one wants, but I have had the misfortune to sit on my town's cable advisory board and I can assure you that these guys are abysmally ignorant on nearly everything (no experience with ComCast, just Time-Warner, Cox, and MediaOne). And they are arrogant to boot. David Leonard ShaysNet On Thu, 31 Jan 2002, Eric A. Hall wrote:

Joel Jaeggli wrote:

...

the unix box I'm sitting on, which isn't natted, and isn't serving anything, lists 133 open tcp connections.

One would hope that a single metric would not be the basis for a termination.

-- Eric A. Hall http://www.ehsco.com/ Internet Core Protocols http://www.oreilly.com/catalog/coreprot/

On Thu, 31 Jan 2002, Steven J. Sobol wrote:

2 x ssh = 2 tcp connections. 1 x ftp = 2 tcp connections, 1 command and 1 data. 1 x browser = potentially several connections, depending on how much content there is on the page I'm viewing.

The question I have is, by the letter of the terms, is running ssh a 'VPN'? Or if I use a VPN client to connect to my datacenters from home? Or is it you 'hosting' a VPN?

I'm not sure how I got put into the position of defending their possible practices. I've already said that looking for NATs as a practice isn't a good idea. I suggest that people read the following (they seem to be cut-n-pasted from the @Home agreements, BTW): http://www.comcast.net/TermsofService/aup.asp Bandwidth, Data Storage and Other Limitations Users must ensure that their activity does not improperly restrict, inhibit, or degrade any other user's use of the Services, nor represent (in the sole judgment of Comcast High-Speed Internet Service) an unusually large burden on the network itself. [What's an "unusually large burden" (in Comcast's sole opinion)?] The Comcast High-Speed Internet Service residential service offering is a consumer product designed for your personal use of the Internet. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Violation of Acceptable Use Policy Comcast High-Speed Internet Service does not routinely monitor the activity of accounts for violation of this Policy. However, in our efforts to promote good citizenship within the Internet community, we will respond appropriately if we become aware of inappropriate use of our Services. http://www.comcast.net/TermsofService/subagree.asp 6. PROHIBITED USES OF THE SERVICE viii ... THE SERVICE IS TO BE USED SOLELY IN A PRIVATE RESIDENCE; LIVING QUARTERS IN A HOTEL, HOSPITAL, DORM, SORORITY OR FRATERNITY HOUSE, OR BOARDING HOUSE; OR THE RESIDENTIAL PORTION OF A PREMISES WHICH IS USED FOR BOTH BUSINESS AND RESIDENTIAL PURPOSES. [I'm in violation on that, since I have it feeding into my lab] THE SERVICE IS FOR PERSONAL AND NON-COMMERCIAL USE ONLY AND CUSTOMER AGREES NOT TO USE THE SERVICE FOR [...] ANY BUSINESS ENTERPRISE, OR AS AN END-POINT ON A NON-COMCAST LOCAL AREA NETWORK OR WIDE AREA NETWORK, OR IN CONJUNCTION WITH A VPN (VIRTUAL PRIVATE NETWORK) OR A VPN TUNNELING PROTOCOL; | "Steven J. Sobol" wrote: | > 2 x ssh = 2 tcp connections. So Steven would be in violation of that, unless he were using SSH to access a MUD. :p The point is that they do not want people using it for anything other than consumer-oriented Internet access. There are ways to cast a net and catch such fish. Yes, every system can be fooled, and every fool has a system. If you show up on their radar, chances are that they can still yank you for something else even if the first filter proves false. It's also interesting that NATs are not explicitly mentioned in either of the above specifications, and I saw no reference anywhere else on their web site (not that it matters; violation is within their discretion). http://www.comcastonline.com/FAQsList.asp?.=.&FAQCategoryID=2#15 Can I use the service on more than one computer? Yes, customers with home networks may order additional network addresses in order to connect several computers to the service through one cable modem. You must first subscribe to the basic Comcast High-Speed Internet Service. Once you become a subscriber, you can sign up for a second and third address. You will need to have access to network expertise because Comcast High-Speed Internet Service neither installs nor supports networks. The cost is $6.95 per month for each additional outlet. Customers can have two additional addresses, for a total of three. Comcast will install the network card and software on a second and third computer for a change of $49 for each computer. http://www.comcastonline.com/howmuch.asp?.=. additional IP addresses "$6.95 - 9.95/each" As far as I can tell, using a NAT is permitted. Running a server, staying connected to corporate mail systems 24x7, and doing other non-consumer stuff is still the only thing forbidden. -- Eric A. Hall http://www.ehsco.com/ Internet Core Protocols http://www.oreilly.com/catalog/coreprot/

On Fri, 01 Feb 2002 10:38:24 EST, David Charlap <David.Charlap@marconi.com> said:

Here's their out against NATs. They are prohibiting use "as an end-point of a non-compast local area network".

Ahh... but the box doing the NAT isn't an end-point, it's a router. ;) And if they want to argue "but it's also an endpoint for a LAN", they'll have to figure out how that's any different than a USB or FireWire setup (after all, those *are* networks too, if you think about it....) RFC2734 IPv4 over IEEE 1394. P. Johansson. December 1999. (Format: TXT=69314 bytes) (Status: PROPOSED STANDARD) Slippery slope there..... -- Valdis Kletnieks Computer Systems Senior Engineer Virginia Tech

On Fri, Feb 01, 2002 at 11:17:56AM -0500, Valdis.Kletnieks@vt.edu wrote:

RFC2734 IPv4 over IEEE 1394. P. Johansson. December 1999. (Format: TXT=69314 bytes) (Status: PROPOSED STANDARD)

Slippery slope there.....

Of course, there's also the cable modems that connect to the PC via USB, does that make USB keyboards, mouses, speakers, printers and scanners, etc. part of a non-comcast local area network?

-- Valdis Kletnieks Computer Systems Senior Engineer Virginia Tech

-- Matthew S. Hallacy CACU, PWGCS, and BOFH Certified http://techmonkeys.org/~poptix GPG public key 0x01938203

While most ISPs really don't care if folks use a VPN, there is a reason for this inclusion in the T&C's. When a service provider is trying to sell 500 accounts to an enterprise, for VPN connectivity, they want to be able to charge more. There are also support issues, which include the nightmarish scenerio of a user calling Tech Support, wanting assistance setting up or using their corporate VPN client. To say that this is beyond the skills of the average Tech Support staffer, is an understatement. And, of course, it's not his job to help a user do this. The other interesting part of this is that the Comcast T&C's DON'T mention NAT, and it looks like they don't have a "NAT POLICE" group, scouting for violators on their network. I'm sure this is a crushing blow to the tinfoil-hat wearing set on NANOG, but it shouldn't be a surprise, except to those who spend their free time reading slashdot, and cursing the "forces of corporate evil" who are looking to confiscate their linksys NAT boxes. :) - Daniel Golding

Eric Hall Said...

I'm not sure how I got put into the position of defending their possible practices. I've already said that looking for NATs as a practice isn't a good idea.

I suggest that people read the following (they seem to be cut-n-pasted from the @Home agreements, BTW):

http://www.comcast.net/TermsofService/aup.asp

Bandwidth, Data Storage and Other Limitations

Users must ensure that their activity does not improperly restrict, inhibit, or degrade any other user's use of the Services, nor represent (in the sole judgment of Comcast High-Speed Internet Service) an unusually large burden on the network itself.

[What's an "unusually large burden" (in Comcast's sole opinion)?]

The Comcast High-Speed Internet Service residential service offering is a consumer product designed for your personal use of the Internet. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Violation of Acceptable Use Policy

Comcast High-Speed Internet Service does not routinely monitor the activity of accounts for violation of this Policy. However, in our efforts to promote good citizenship within the Internet community, we will respond appropriately if we become aware of inappropriate use of our Services.

http://www.comcast.net/TermsofService/subagree.asp

6. PROHIBITED USES OF THE SERVICE

viii ...

THE SERVICE IS TO BE USED SOLELY IN A PRIVATE RESIDENCE; LIVING QUARTERS IN A HOTEL, HOSPITAL, DORM, SORORITY OR FRATERNITY HOUSE, OR BOARDING HOUSE; OR THE RESIDENTIAL PORTION OF A PREMISES WHICH IS USED FOR BOTH BUSINESS AND RESIDENTIAL PURPOSES.

[I'm in violation on that, since I have it feeding into my lab]

THE SERVICE IS FOR PERSONAL AND NON-COMMERCIAL USE ONLY AND CUSTOMER AGREES NOT TO USE THE SERVICE FOR [...] ANY BUSINESS ENTERPRISE, OR AS AN END-POINT ON A NON-COMCAST LOCAL AREA NETWORK OR WIDE AREA NETWORK, OR IN CONJUNCTION WITH A VPN (VIRTUAL PRIVATE NETWORK) OR A VPN TUNNELING PROTOCOL;

| "Steven J. Sobol" wrote:

| > 2 x ssh = 2 tcp connections.

So Steven would be in violation of that, unless he were using SSH to access a MUD. :p

The point is that they do not want people using it for anything other than consumer-oriented Internet access. There are ways to cast a net and catch such fish. Yes, every system can be fooled, and every fool has a system. If you show up on their radar, chances are that they can still yank you for something else even if the first filter proves false.

It's also interesting that NATs are not explicitly mentioned in either of the above specifications, and I saw no reference anywhere else on their web site (not that it matters; violation is within their discretion).

http://www.comcastonline.com/FAQsList.asp?.=.&FAQCategoryID=2#15

Can I use the service on more than one computer?

Yes, customers with home networks may order additional network addresses in order to connect several computers to the service through one cable modem.

You must first subscribe to the basic Comcast High-Speed Internet Service.

Once you become a subscriber, you can sign up for a second and third address.

You will need to have access to network expertise because Comcast High-Speed Internet Service neither installs nor supports networks.

The cost is $6.95 per month for each additional outlet. Customers can have two additional addresses, for a total of three.

Comcast will install the network card and software on a second and third computer for a change of $49 for each computer.

http://www.comcastonline.com/howmuch.asp?.=.

additional IP addresses "$6.95 - 9.95/each"

As far as I can tell, using a NAT is permitted. Running a server, staying connected to corporate mail systems 24x7, and doing other non-consumer stuff is still the only thing forbidden.

-- Eric A. Hall http://www.ehsco.com/ Internet Core Protocols http://www.oreilly.com/catalog/coreprot/

"Eric A. Hall" wrote:

If you use too much bandwidth, they will [] drop your service.

ps--the original message sounds like they have gone beyond hunting down the people running warez servers and the like, and have gone into an agressive mode of pursuing anybody with a NAT regardless of their utilization. I have no idea if that is true. I don't think it would be a smart move on their part but that probably doesn't enter the equation. -- Eric A. Hall http://www.ehsco.com/ Internet Core Protocols http://www.oreilly.com/catalog/coreprot/

Indeed, I DO have a a linksys for just that reason, in fact its a 1 wan/1 lan version...'Course, its plugged into a switch, that has an airport attached as well but... I have been, and am constantly probed for just about everything under the, er, sun. Considering the amount of people out there who have less than a full allotment of clue for these types of things, the larger issue is the OS vendors should probably make an effort to not turn on every less-than-secure service out of the box on a default install. But thats probably off topic... Having some sort of firewall is a good start, though not a complete solution. The comcasts of the world are only going to hurt themselves more if they continue to make a huge stink out of this. (Yes, I know a fw!=NAT, but do you think the vendor will make that distinction?) toddler (ps yes, at times I think using a computer on the internet should require a license) On Thu, 31 Jan 2002, M. David Leonard wrote:

You know, if I had a cable modem I would have some sort of firewall router just to preserve my peace of mind. I might even run NAT on the LAN side. So the question is this: can a customer use a firewall for *one* computer? If so, how can the cableco determine whether there is a single computer or two computers or more behind a firewall? I really don't think they can except in cases of egregious abuse.

David Leonard ShaysNet

On Thu, 31 Jan 2002, Eric A. Hall wrote:

...

"Eric A. Hall" wrote:

...

If you use too much bandwidth, they will [] drop your service.

ps--the original message sounds like they have gone beyond hunting down the people running warez servers and the like, and have gone into an agressive mode of pursuing anybody with a NAT regardless of their utilization. I have no idea if that is true. I don't think it would be a smart move on their part but that probably doesn't enter the equation.

-- Eric A. Hall http://www.ehsco.com/ Internet Core Protocols http://www.oreilly.com/catalog/coreprot/

On Thu, Jan 31, 2002 at 10:40:10PM +0000, E.B. Dreger wrote:

...

This is hard because they are selling bandwidth ("watch video") so they can't really cap the downloads, and they are selling always-on so they can't measure by time conveniently either. So they try to get the "bandwidth hogs" through contractual means. Comcast prohibits VPNs, and prohibits ~"attaching to another network", as examples. If you use too much bandwidth, they will use these to drop your service.

There it is... how many bits is the customer actually moving?

As for the person who mentioned modifying Linux IP code to alter the port range... it's a simple set of sysctl tunables in BSD (at least FreeBSD).

And it just came to my mind, a solaris machine uses by default high port numbers to open tcp connections: root@backup:~[15] > ndd /dev/tcp tcp_smallest_anon_port 32768 That settings determines which port number it uses to open outbound connection from what I know. -- Regards, Ulf. --------------------------------------------------------------------- Ulf Zimmermann, 1525 Pacific Ave., Alameda, CA-94501, #: 510-865-0204 You can find my resume at: http://seven.Alameda.net/~ulf/resume.html

OK. I am running VMWare and run virtual machine on my PC; is it 2 computers or 1 computer? There is not ANY sharp boundary between 1 computer and many computers -:). It can be less that 1 computer, 1.0 computer, 1.02 computer and so on -:)... ----- Original Message ----- From: "Eric A. Hall" <ehall@ehsco.com> To: "Bill Woodcock" <woody@zocalo.net>; "Martin J. Levy" <mahtin@mahtin.com> Cc: <nanog@merit.edu> Sent: Thursday, January 31, 2002 2:09 PM Subject: Re: Fwd: SlashDot: "Comcast Gunning for NAT Users"

"Bill Woodcock" <woody@zocalo.net> wrote:

...

> Besides the technical difficulties of detecting a household that is > running a NAT...

Can you think of a way of doing it reliably? Anything that provides anything more than a guess?

Several ways:

Comcast has a mail server, they could poke at the HELO banners and other identifiers.

HTTP proxies indicating that multiple browsers are in use, especially if multiple platforms (Win95, WinXP, as simple test)

More than ~4 simultaneous TCP connections open at once.

None of those would be bothered by firewalls or other legitimate devices, and would probably all be within a legally-defensible purview of ~analysis.

As to whether or not Comcast does any of this, I do not know. My brother has a friend who was a 2nd level tech with @Home, and he says they did it, so I would not be surprised that Comcast would also.

The thing is that Comcast is trying to make money by selling ~consumer Internet access, and they have a perception problem with shared access (PacBell used to run great "bandwidth hog!" ads). They don't want people using more pipe than ~consumer access would normally imply.

This is hard because they are selling bandwidth ("watch video") so they can't really cap the downloads, and they are selling always-on so they can't measure by time conveniently either. So they try to get the "bandwidth hogs" through contractual means. Comcast prohibits VPNs, and prohibits ~"attaching to another network", as examples. If you use too much bandwidth, they will use these to drop your service.

-- Eric A. Hall http://www.ehsco.com/ Internet Core Protocols http://www.oreilly.com/catalog/coreprot/

yeah, and what about a ibm z/800 with a few thousand linux images inside? ;)

I have ONE computer on my cable; it's an ARM processor. Now, there are some helper CPU's in the intelligent peripherals: a Duron in one, a T-bird in another, but hey...the ARM box has to farm out some tasks...right? -- A host is a host from coast to coast.................wb8foz@nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

On Thursday, January 31, 2002, at 10:35 , Alexei Roudnev wrote:

OK.

I am running VMWare and run virtual machine on my PC; is it 2 computers or 1 computer?

There is not ANY sharp boundary between 1 computer and many computers -:). It can be less that 1 computer, 1.0 computer, 1.02 computer and so on -:)...

On the flip side, even if they ignore all non-Microsoft systems both Windows Terminal server and Windows XP can have multiple, simultaneous users, so a single-user ban wouldn't work much better. Chris

On Thu, 31 Jan 2002 22:55:06 PST, Chris Adams <chris@improbable.org> said:

proxies and some browsers can easily spoof user-agents but there's no reason other than NAT or proxying to explain automatically downloading both the NT and XP patch lists.

Hmm.. Odd.. I've seen machines that dual-boot NT and XP and not using either NAT or proxying - I'd assume they'd at one point or another try to download the NT and XP patch lists. Hell. I've got a machine that has been known to be simultaneously downloading both the AIX and RedHat patch lists. And it wasn't doing NAT or proxying. ;) -- Valdis Kletnieks Computer Systems Senior Engineer Virginia Tech

David Charlap <David.Charlap@marconi.com> writes:

It's nothing short of hubris (on the part of both Microsoft and the ISPs) to assume that nobody ever uses a computer for more than web surfing.

When TCI cable was first rolling out high-speed Internet access in the Bay Area, they at one point without notice throttled download speeds to 128 Kb/s per customer in Fremont. Customers hit the ceiling, and the matter boiled over into a community meeting, where TCI explained with a straight face that this step was necessary because customers were "abusing" the network -- they were using it to do things like *work from home*! The collective response from attendees might be paraphrased as "well, duh!" TCI had to relent on this issue; but the episode is telling as to the mindset, I think. This also brings to mind John Perry Barlow's comment that "when these people think interactive video means putting a 'buy this' button on your remote control". Jim Shankland

<snip>

Even this would have problems - there'd probably be a class action if they required users not to use firewalls and I doubt they'd want to deal with the support headache in convincing users to give up their wireless access points.

OK... I think the stuff gone with the <snip> was adequately addressed by others. According to the excerpts from the TOS, VMWARE, Firewalls (other than an in-box firewall like BlackIce, etc.), WAPs and the like are already prohibited. All of those represent termination of the connection on a non-comcast LAN. VMWARE connects the vmware systems via a LAN implemented as a driver in the host operating system kernel (at least in Linux, I don't know about Windows). Even if there's no physical equipment outside the computer involved, it's still arguably a LAN. That having been said, the real bottom line is that their policy is a bad idea, and one which would prevent me from subscribing to comcast. If you are subscribing to comcast, you have the following choices available to you: 1. Accept the policy and continue on. 2. Ignore the policy and accept the consequences. 3. Tell comcast that you feel they should reconsider their policy, and cancel your service if they do not. They aren't the only ISP available.

The real lesson is that filtering on equipment is a bad way to control bandwidth usage. Of course, these are the same people who will complain about something listening on port 80 which transfers 5KB/month but won't say a thing if you spend 18 hours a day deathmatching and downloading crap.

Here, I agree 100%. Any attempt at an automated enforcement of the above TOS is likely to be a DOS attack on their customers who are not violating the TOS. Owen