URL Filtering

[Shakeel Ahmad]

All,

As off now (may be from a bit earlier), HTTP request to several sites are getting rejected, some of which i could test are *.wordpress.com, PKPolitics.com and several others. Although you can use HTTPS or proxies to open this up but I guess someone either in TW or PTA/Govt. is again playing with the filters.

To our ISP related folks on the list, did anyone hear any notification about it or something ? I could only check it on TW backbone and was getting these errors but on PTCL these websites are working.

thanks,
Shakeel

[Tee Emm]

URL level filtering orders from PTA to ISPs is very common these days. Filters and firewalls are in abundance at almost every step - from individual ISPs to the major backbones of TW and PTCL. The URL level thing is playing with the fidelity of the Internet and the notion that Internet should just work. Not any more. 

The misconfiguration, however unintentional they might be and notwithstanding that they will be fixed the next morning, are making Internet very very unpredictable, way beyond what could be considered as acceptable.

-T

Tariq Mustafa MSN:t...@hotmail.com | Follow me: http://friendfeed.com/abunet
Phone Num:http://tinyurl.com/tmcell| Twitter: http://twitter.com/tariqmustafa
>>>>If you think email is dead, lets facebook: http://tinyurl.com/tmonfb <<<<<

--
Manage your subscription: http://groups.google.com/group/telecom-grid-pakistan
Browse and populate the community wiki at: http://wiki.telecompk.net

[Masud]

The concept of filtering traffic is not something new in the land of
the pure although I find the idea of censorship per se an impure one.

Egypt, Iran, China, Burma, Saudi Arabia, North Korea and a few other
countries are on Reporters Sans Frontiers' Internet Enemy list. In
these countries, there is virtual control over what the population can
see or do over the internet. For a complete list, see the Wikipedia
article at http://en.wikipedia.org/wiki/Internet_censorship

PTA already watches internet traffic under the guise of stopping
illegal voice traffic. The Narus system installed in PTA cost a cool
10 million dollars of your and my tax Rupees.

PTCL has Bluecoat proxies in place which can do deep packet inspection
and filtering of URLs (even https: based). TWA uses 'cheaper' way of
filtering URL which is to redirect traffic through squid proxies for
certain sites and then for the filtered URL displaying a message to
the user informing them that access to the URL is blocked.

The URLs to be blocked are 'pondered over' by a committee comprising
of MoIT officials, PTA officials and then some. The committee
frequently floats URLs which are to be blocked based upon different
factors i.e. political, social, religious etc.

If the URL filtering is blocked by PTCL, it doesn't usually degrade
the performance since their infrastructure is geared to handle this.
Even TWA filtering, though trivial, will get the job done without
degrading the internet. Misconfiguration is another thing. However, in
the last six months, I am not aware of any such misconfigurations
occurring at TWA or PTCL.

Regards

Masud

[Tee Emm]

As of now, wordpress.org is blocked at TW's proxies. I am sure the entire wordpress.org is not intended to be blocked and this is a clear case of misconfiguration. Apparently, there must be a blog that is required to be blocked at the URL level. 

-T

 

 Misconfiguration is another thing. However, in
the last six months, I am not aware of any such misconfigurations
occurring at TWA or PTCL.

Regards

Masud

On Dec 6, 7:26 pm, Shakeel Ahmad <shakeelah...@gmail.com> wrote:
> All,
>
> As off now (may be from a bit earlier), HTTP request to several sites are
> getting rejected, some of which i could test are *.wordpress.com,
> PKPolitics.com and several others. Although you can use HTTPS or proxies to
> open this up but I guess someone either in TW or PTA/Govt. is again playing
> with the filters.
>
> To our ISP related folks on the list, did anyone hear any notification about
> it or something ? I could only check it on TW backbone and was getting these
> errors but on PTCL these websites are working.
>
> thanks,
> Shakeel

[Shakeel Ahmad]

Totally Agreed with what Masud sb. said - even with squid proxies, if they play cool and use some BGP/EIGRP metrics, they can separate the traffic from core and only block XYZ and let all other data traffic go back to the backbone but who knows whats being used.

I must say blocking *.wordpress should definitely be considered as a misconfiguration. I doubt PTA would take any notice of it :)

thanks,
Shakeel

[Masud]

Well, an email to n...@tw1.com is in order i presume. This is
definitely some misconfiguration at TW1 end.

Regards

Masud

[Shakeel Ahmad]

A late night reply from TWNOC suggests that the issue is resolved but
no RFO yet.

Thanks

--
Sent from my mobile device