Is it feasible/likely that my ISP is doing per-client throttling of bittorrent?

Seems very strange to me, but I've run a few tests, and would love some ideas of other tests. I have a linux box here running Deluge, where I most of my bittorrent activity happens, and a Windows box where I do less of it. I've performed these tests:

Downloading the same torrent, over the same forwarded ports on windows and linux.

Downloading the same torrent, over the different forwarded ports on windows and linux.

Downloading the same torrent, using the hardware from the windows box on linux (using a livecd).

Downloading the same torrent, Using the linux box, with a windows VM running in virtualbox. (I know, not a REAL test)

The results are always the same. Under windows, using uTorrent 3.1, I see the traffic spike and then slow to a trickle for the remainder of the download. Under linux, using deluge 1.3.3, the traffic maintains it's high speed throughout the download. I'm baffled by this behavior. Have I overlooked some obvious test that I should be doing? How would it even be possible for my ISP to profile windows-based bittorrent activity and not linux traffic?

matt

Posted 2011-12-02T02:06:55.797

Reputation: 150

1Are you sure it's "Windows-based" and not just "uTorrent-based"? – Ignacio Vazquez-Abrams – 2011-12-02T02:19:37.320

1It seems unlikely. It is must more likely to be a utorrent issue. The behaviour seems like utorrent is not contributing to the swarm so is getting penalised. Could Windows be blocking incoming connections? – Paul – 2011-12-02T02:22:51.900

@Paul I don't think it's based on the torrent itself, but I can look into that. Thanks! – matt – 2011-12-02T03:14:51.427

Also, I'll try another client. – matt – 2011-12-02T03:21:20.853

Test your ISP here...http://broadband.mpi-sws.org/transparency/bttest.php

– Moab – 2011-12-02T05:20:12.930

Answers

It's certainly feasible. Each bittorrent client sends a string identifying the software title and version (although not necessarily plaintext), and any monitoring software can decode it easily enough.

As for likely, well, unless they have an axe to grind, there are probably other reasons why you're seeing this. Check your encryption settings.

Ignacio Vazquez-Abrams

Posted 2011-12-02T02:06:55.797

Reputation: 100 516

Yeah, but that would mean deep packet inspection of every stream. That would require incredible resources, wouldn't it? – matt – 2011-12-02T03:14:07.417

1Yes. But some ISPs have them. – Ignacio Vazquez-Abrams – 2011-12-02T03:23:31.697

@Matt: There are some tricks that significantly lower the load imposed by the inspection though. You only need to do real work on the first few packets of each TCP stream for instance, which is the most effective heuristic that springs to mind but there are no doubt many others. The cost of the traffic management resource is worth it to many ISPs as it reduces their bandwidth needs without sacrificing performance in other area as more general throttling would. Encryption will not always help: some ISPs throttle any bulk traffic that looks encrypted, particularly at peak times. – David Spillett – 2011-12-02T12:21:09.270

Does deep packet inspection work the same way for vpn traffic? – steampowered – 2011-12-03T04:37:02.467

I'd say the half-open TCP/IP connections, but that's just a way to speed it up at the beginning, although still maybe worth looking into. Try a few other clients and see if that makes a difference.

Rob

Posted 2011-12-02T02:06:55.797

Reputation: 2 152

It's feasible and it's happening for example in Spain with the ISP "Telefonica", there should be news articles about it.

golimar

Posted 2011-12-02T02:06:55.797

Reputation: 846

Could you perhaps list a news article or two? – Simon Sheehan – 2011-12-02T21:03:58.607

http://www.nytimes.com/2011/11/14/technology/putting-the-brakes-on-web-surfing-speeds.html?_r=2&pagewanted=2&ref=cellulartelephones – golimar – 2011-12-03T17:40:46.680

In the UK, most ISP's do some form of P2P traffic throttling, especially at peak times. Because of the sheer volume they look for simple identifiers, rather than deep inspection of everybody's bittorrent, so it may be they just aren't looking for the signature of your linux torrent client.

Windows makes the vast majority of their traffic, so from the ISP perspective they maybe get the best bang for buck just watching for the windows clients.

Rory Alsop

Posted 2011-12-02T02:06:55.797

Reputation: 3 168

A lot of ISP these days are doing some kind of traffic shaping on traffic and usually this is on the P2P traffic for fairly obvious reasons. So yes it’s more than likely that your ISP is dosing some kind of shaping on the connections.

I would suggest performing a packet capture of the two machines so you can get a better idea of what’s actually going on, you might see things like excessive RST packets from your remote torrent peers. With the right hardware these can be forged by your ISP to trick the software into thinking the connection has been closed, effectively shaping the speed. Do a quick search for “sandvine rst tcp” if you want to read up a bit more on that.

There are certainly many other methods your ISP could be using, that’s just an example.

iTom

Posted 2011-12-02T02:06:55.797

Reputation: 545

I have found in general - not just with BitTorrent - that there is a large gap in connection speed between Linux and Windows (This due to I/O differences in the underlying OS, not actual connection speed differences. See comments). Linux tends to have a higher sustained connection speed.

3321thec

Posted 2011-12-02T02:06:55.797

Reputation: 111

Operating system should NOT make a difference – Simon Sheehan – 2011-12-03T00:44:49.463

You cannot say that with even a little bit of certainty. Operating system easily can make a difference. I have personally seen it many times, as I'm sure many others have too – 3321thec – 2011-12-03T04:14:15.703

1Until you can provide me numbers and evidence, I will continue to state it being false – Simon Sheehan – 2011-12-03T04:17:20.800

1You are correct that variance in the I/O throughput of the network adapters will not vary significantly between systems, but the software managing the OS's use of the Hard Disk does vary significantly. A slower disk I/O introduced by an Operating System will result in a lower apparent connection speed as reported by an application. I apologize for not being more precise in my wording. – 3321thec – 2011-12-03T04:33:11.250

That's reasonable enough. Perhaps you could edit your answer to add that in :) – Simon Sheehan – 2011-12-03T12:03:43.650

It sure does happen - My Internet provider is Rogers, and they throttle your entire connection when you torrent, and it continues for up to 15 minutes after you finish. I'm sure there's plenty of ISP's that do it, to varying degrees - mine has random times where it happens. There have been ways of avoiding it that have been brought up, like Encrypting your bittorrent traffic. Best to lookup your ISP's Wikipedia page, it would likely say it there, since it tends to be controversial. On the page for Bandwidth Throttling it even highlights some ISP's, particularly in Canada.

Simon Sheehan

Posted 2011-12-02T02:06:55.797

Reputation: 8 641