Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have had experience with an ISP that slows down all encrypted connections (down to an average 20-35 KBps) I was wondering if a) this is legal b)how can they do it and c) is there a way to bypass it. I have also noticed that the use of a VPN is still prone to such limitations.

Furthermore, what are the implications of slowing down encrypted connections. For example, how does it help them apart from stopping their users from doing something under the "cloak" (as much as that can happen).

I would appreciate any answers.

share|improve this question

closed as off-topic by Xander, AJ Henderson, Iszi, Eric G, Noordung Apr 4 at 17:05

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Xander, AJ Henderson, Eric G, Noordung
If this question can be reworded to fit the rules in the help center, please edit the question.

I suspect they throttle based on port number alone, so you may be able to bypass it using a common port (e.g. 80 or 443). –  paj28 Apr 5 at 14:24
@paj28 That is what I thought to because otherwise Windows updates will be very slow as well but that is not the case. The windows update are on a secure server, correct? However, other HTTPS site are also slow, including GMAIL. –  user29568 Apr 6 at 10:29
If you can adjust the port your VPN uses you could experiment with a few ports to see if any are not throttled; I would try port 80 first. If it turns out that port 80 is throttled when encrypted, but not throttled otherwise, then they are using deep packet inspection and that will be hard to bypass. At that point I would probably switch ISP. –  paj28 Apr 6 at 11:50

1 Answer 1

I'll leave legality to someone else. In terms of how they do it, here's a rough overview:

  1. Any connection, encrypted or not, is visible to your ISPs routers as a TCP session (generalization, I know there are other protocols).
  2. The routers know, regardless of whether or not encryption is present, how long each session has been connected for, and how much traffic has been processed.
  3. Session length and traffic per session are key metrics used for bandwidth management - there is normally a limit to the total number of sessions/connections, and also data rate per session. There may also be an "allowance" of unthrottled data per TCP session, so that web pages (even HTTPS ones) continue to load quickly.
  4. In addition to the rough throttling methods below, various companies are able to distinguish between web traffic, VoIP, torrents using clever heuristic methods, thus allowing for particular applications to be selectively throttled.

There are a number of ways to reduce throughput, but many just use TCPs inbuilt congestion control mechanisms. The bandwith management appliances will start dropping packets and/or increasing latency on those TCP connections that need to be slowed down. These will be interpreted by the TCP protocol as congestion, and result in a speed reduction. Again, this is very greatly simplified!

You can bypass most application detection using a VPN, but it will still be subject to the basic controls described in #3.

Most good bandwidth management solutions is not impede HTTPS websites, yet still detect and throttle file sharing connections.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.