Korea Blocking Service July 1st

Posts: 7 · New Forum Member Joined: Jun 28, 2006 Posts: 7

M_C_John wrote:

looks like we are still on borrowed time.

I don't think that's the case. If the Korean gov blocks SIP protocols and ports to prevent Vonage VOIP it will become a game of "whack-a-mole" similar to attempting to kill off P2P file sharing services.

I doubt Korea will be able to block all of the Voice IM's (GoogleTalk, Skype, iChat, AIM, MSN, etc). Crap, if things are really bad, you can always do SSH over port 80.

The only way to stop everything is to block all internet traffic. Even the Great Firewall of China is having a tough time stopping VOIP traffic.

The only reason I really enjoyed Vonage was not that it was cheap. The US Military negotiated a sweet long distance contract with KDDI (Japan). It was about 3 yen a minute (2 cents a min) to call to the states. The great thing about Vonage was that my relatives didn't have to key in a 15 digit long distance phone number to our house in Japan. Plus many of the cell phone companies (Verizon, Sprint) won't let you call international numbers unless you completely change phone plans.

When we got Vonage, it was a godsend because people could easly dial a simple US phone number that would ring our house in Japan.

Posts: 85 · Posted: Sun Jul 02, 2006 7:08 pm Post subject:

It has supposedly been delayed until the 15th of July now.

Posts: 1424 · Posted: Sun Jul 02, 2006 9:02 pm Post subject:

Sparky9292 wrote:

I don't think that's the case. If the Korean gov blocks SIP protocols and ports to prevent Vonage VOIP it will become a game of "whack-a-mole" similar to attempting to kill off P2P file sharing services.

I doubt Korea will be able to block all of the Voice IM's (GoogleTalk, Skype, iChat, AIM, MSN, etc). Crap, if things are really bad, you can always do SSH over port 80.

There are very successful ways to block VoIP traffic. One method uses semantic traffic analysis to identify connections with by directional real time protocol streams and cut them off. This would result in calls being established, but being disconnected very quickly. One product that is capable of doing this, and in use in countries that block VoIP, is from Narus.

Even if you encrypt the traffic or tunnel it inside another protocol the basic patterns still appear very much like VoIP traffic. You need to ensure that you put a lot of traffic in the tunnel so that an outside authority can't tell that one or more VoIP connections are active.

The government reaction to that will likely be to shut down all encrypted traffic.

The Great Firewall of China is a much more difficult problem because it is filtering based on content, not on structure. It would be analogous to attempting to block all VoIP discussions that talked about Vonage.

For information on VoIP blocking and leads to further reading, please see Narus Blocks.

Posts: 6 · New Forum Member Joined: Jul 03, 2006 Posts: 6

Someone mentioned using a VPN as a work around to the block - can you elaborate?

Posts: 1424 · Posted: Mon Jul 03, 2006 1:13 pm Post subject: Re: vpn block workaround

Horton wrote:

Someone mentioned using a VPN as a work around to the block - can you elaborate?

Current mechanisms for blocking traffic rely on Internet packet headers. Even if you change regular port numbers a simple examination of the headers will reveal that two simultaneous RTP streams connect two points, this is the signature of a VoIP call. If you get really fancy you could even see that most of the time, during the session, data is travelling from A->B or B->A but not simultaneously in both directions.

A VPN is a mechanism where you route your data to a trusted computer instead of directly to the Internet. The data is encrypted by you and then sent to the VPN host to be decrypted and sent over the Internet. If you add a VPN into the mix, then the packet headers are hidden from the scanning device. All that the scanning device knows is volume of data from point A to the VPN termination point. It doesn't actually know where the data goes (it can't see point B). However, if all the VPN does is carry one VoIP call then the scanning device can look at the signature of the stream (packet spacing, packet size, time between packets) and determine that a VoIP conversation is in place. The workaround for this is to put additional traffic on the VPN to confuse the scanning algorithm, you can even extend this to running your VoIP over an anonymizing network but this increases latency and might degrade call quality.

I have heard, in the past, that there is a problem running VoIP over VPNs. In order to maintain encryption the end points of the VPN regularly exchange keys. I have been told that during these key exchanges the VPN ceases to carry traffic for a short period.

It is likely that VoIP will be available for a period of time via VPN tunnels until the problem becomes big enough for the ISP to consider closing the hole.

I have not worked with Narus on a VoIP project. I was working for an ISP doing traffic measurement with Narus software. During this period I attended several presentations on the capability of their software. This information is from those presentations. As part of the presentation they would monitor a couple of computers and their system would spit out information about what was being done on those computers, I specifically remember them monitoring video streaming but I recall them discussing capturing records for IP based phone conversations, at the time they talked about monitoring them for billing purposes.

Posts: 1424 · Posted: Mon Jul 03, 2006 1:27 pm Post subject: Re: vpn block workaround

Horton wrote:

Someone mentioned using a VPN as a work around to the block - can you elaborate?

I'm thinking that perhaps you were asking more for a how-to than an elaboration of the VPN//VoIP blocking issue.

I can't recommend using a VPN to bypass laws regulating VoIP access. Not only it is illegal for you to do it, because it is illegal it is also a violation of Vonage's most recent terms of service.

There are situations however where ISPs may be blocking traffic in violation of laws or regulations. In those cases a VPN might be a valid temporary solution.

In order to use a VPN you have to have an end point that is outside of the network being blocked. This is where your traffic will be routed onto the Internet. This will be your VPN host. You can find some commercial VPN providers who will provide this service.

You will then need a VPN client compatible with your VPN host. These clients come in two forms. One is a hardware box that sits on your network and sends the designated traffic, encrypted, to your VPN host. The other is a software client that routes any or all traffic generated on your machine to the VPN host. A hybrid of these two mechanisms is to share the Internet connection of the VPN software client machine with other machines. Some software clients specifically prohibit this mode of operation.

Using either a hardware VPN client or a software client configured to share access, route the traffic from your VoIP adapter through the client, to the host then out on the Internet.

Routing VoIP through a VPN may increase latency, degrade sound quality and/or result in dropped calls. Additionally it increases your network complexity and that may increase downtime. Finally since this provider is paying to send your traffic to the Internet it may add significant cost.

Posts: 6 · New Forum Member Joined: Jul 03, 2006 Posts: 6

I was more interested in the "how" to do it. Specifically; there is a guy here in Seattle that let out a program that people in China can load up; that will bypass all the restrictions there. The computer in China talks to a computer in a "free" country and apparently it works well seamlessly as if the China user was here in USA.

Now I don't know anyone in China nor know anyone using it - but the technology to do it and the approach the programmer took was very interesting - as is these other "work-arounds" to use Vonage in restricted areas.

Posts: 1424 · Posted: Mon Jul 03, 2006 2:20 pm Post subject:

While the concepts are similar, it is a significantly easier problem to deal with web browsing rather than VoIP due to the nature of the communication.

The fundamentals remain the same, a requirement to have an unblocked friendly computer and the ability to route traffic through that computer.

The most common use of VPN are for mobile or home based employees. It allows access into the corporate network from unsecured places in a secure fashion. It is not hard to set up a VPN server, the issues are more business and political than technical.

Are you assisting someone in breaking a law?
Does the cost you will be paying for the Internet connection and the bandwidth for the server overcome cost advantages of using the blocked service in the first place?
Will the resulting quality be acceptable?
Will the ISP block VPNs or attempt to categorize VPNs that have VoIP traffic?

Posts: 6 · New Forum Member Joined: Jul 03, 2006 Posts: 6

Not I - not helping myself nor anyone - just was wondering at a high level of what the approach was. Like I said - the Seattle guy who figured out how to defeat China's block was extremely interesting despite me never doing it nor knowing anyone to do it. Those restrictions drive technology. How about the guys who figured out how to copy and DVD like using DVD Decrypter - that was some amazing technology then it drove the movie folks to be more sophisticated in their encryption - but also have the program out-lawed prob helped a lot too!

Posts: 7 · New Forum Member Joined: Jun 28, 2006 Posts: 7

Horton wrote:

Someone mentioned using a VPN as a work around to the block - can you elaborate?

The simpliest would be to purchase a VPN router at both peoples houses and establish a connection between the two through the router software. You can buy these for pretty dang cheap (<$100). Whammo, you now have an encrypted connection that Skype can use.

scerruti is predicting the most gloomy outlook, that all of the Korean ISP's will use some kinda of packet shaping technology to sniff out evil VOIP activity Rolling Eyes

. However, given that many universities have done this and STILL not stamped out P2P on their own campus networks.... I think VOIP in some form will continue to persist.

The RIAA killed the old Napster, then Kazaa appeared, Kazaa died, and then EDonkey appeared, then Bitorrent appeared. Heck, Freenet has always survived.

Until then....if Vonage stops working then, try these:

Skype, Yahoo IM, AIM, MessengerMSN, GoogleTalk, iChat (OSX), Xbox Live.....