Below is a recent editorial featured on Processor.com…
Equalizing Technology
NetEqualizer Offers A New Approach To Application Shaping
by Julie Sartain
Current application shaping products examine the content of Internet packets as they pass through the packet shaper. Using pattern-matching techniques, the packet shaper determines, in real time, the application type of each packet and then proceeds to restrict or allow the data based on a set of rules established by the system administrators.
Administrators can use these programs and define rules to restrict or allow any application that exists, but it takes an incredible amount of effort to keep pace. There is one product, however, that’s trying a new approach called equalizing technology. This product is NetEqualizer (800/918-2763; www.netequalizer.com) from a Colorado-based company called APconnections.
The Problems
According to Art Reisman, CEO at APconnections, pattern-matching techniques work on most classified packets, but what if the rules are set to restrict all packets containing ASCII characters or words such as Rhapsody, Napster, or bit torrent? One of these packets might contain a company-wide memo explaining the corporate policies regarding the usage of these programs on company computers. Pattern-matching rules would restrict this memo attachment.
In addition, many companies intentionally refuse to classify their communications, so their packets slip past the application-shaping products. Seems like a small issue, unless hundreds of these junk mail packets are slipping through onto thousands of desktops in your company nationwide on a daily basis. Then it becomes a huge problem, as the bandwidth is usurped to process this unwanted garbage.
Even if an application-shaping product can identify 90% of the spectrum of apps (and that’s a lot), notes Reisman, 10% is still unclassified. Your options are to either monitor and manually classify that 10%, which is very time-consuming and costly, or allow those packets to pass without restrictions.
Solutions
“Our products can, generally, extend the capacity of your Internet from 25 to 50%,” says Reisman. “This means you can have that many more people using the Internet without adding more bandwidth.”
There is always the potential for a few users to overwhelm the Internet connection, he notes. But when applied to many verticals such as ISPs, libraries, schools, colleges, and businesses with 50 or more employees, the NetEqualizer prevents this from happening.
“NetEqualizer appliances automatically shape traffic based on built-in fairness rules,” notes Reisman. “This method allows network administrators/operators to quickly and easily bring network traffic into balance without having to build and manage extensive policy libraries and all without changes to their existing network infrastructure.”
How It Works
Reisman explains that APconnections looked at how systems keep one process from locking up the whole computer. For example, Microsoft Windows (www.microsoft.com) does not handle this well; however, Linux and Unix, as well as some of the other server equipment that’s available, do. The premise of these products is that no single computer program is allowed to dominate the CPU, so everything that’s running gets a turn. “We then applied this tried-and-true methodology to an Internet link,” says Reisman. “The result is NetEqualizer.”
NetEqualizer uses behavior-based shaping, adds Reisman. It looks at the behavior of abuse on an Internet link and then takes action based on that. When the network is congested, the fairness algorithm favors business-class applications, such as VoIP, Web browsing, chat, and email, at the expense of large file downloads.
The other available products (that is, the competition) try to classify specific varieties of traffic by type. Intuitively, the classification by type is easy for customers to understand, but implementing that process is very time-consuming, and the cost of trying to identify every type of traffic on the Internet is overwhelming and nearly impossible. NetEqualizer, on the other hand, always gets the bad guys because bad behavior is not a function of application type. And, as an added bonus, customers do not have to relicense the technology every month; it just works.
In addition, says Reisman, all the settings can be changed in real time, with no effect on network service quality. And, NetEqualizer allows priority to traffic for hosts that are not supposed to be shaped. Also (for organizations that require 100% network uptime), the NetEqualizer architecture allows customers to build a redundant system by configuring two NetEqualizer products running in parallel.
R&D History
“We started with no backing money, so we built a simple open-source version of the concept and begged people to try it,” says Reisman. The product excelled and then rose to one of the top 100 open-source projects in the world. (That’s considered extremely high when most top open-source projects are targeted to the general consumer.) Then, the company commercialized and enhanced it and contracted with a hardware manufacturer to produce it. There are now more than 1 million end users on six continents behind the NetEqualizer equipment.
“We had many setbacks in the early going,” says Reisman. “Mostly just trying to get the product stable and keep it running on a reasonably priced piece of hardware.”
Most of APconnections’ market is customers who desperately need something but don’t want to pay $50,000 to optimize their $500-a-month Internet trunk. Getting the product stable in heavy use required the company to purchase sophisticated simulation equipment to troubleshoot the last few hard-to-find bugs. (That was more than three years ago.) Since then, APconnections has had reports of its servers in continuous, heavy use for years at a time without rebooting. “We are very proud of that,” says Reisman.
What’s New?
According to Reisman, the company has recently adopted this technology into an AP (access point) and, quite by accident, have solved a common problem called the hidden node issue, which has plagued 802.11 operators for years. There are other options for this problem, but these choices lock customers into proprietary solutions. APconnections’ solution is completely compatible with existing 802.11 wireless technologies, so customers can mix and match its AP without replacing everything.
NetEqualizer News Blog 
When is Deep Packet Inspection a Good Thing?
March 26, 2009 — netequalizerCommentary
Update September 2011
Seems some shareholders of a company who over promised layer 7 technology are not happy.
By Eli Riles
As many of our customers are aware, we publicly stated back in October 2008 that we officially had switched all of our bandwidth control solutions over to behavior-based shaping. Consequently, we also completely disavowed Deep Packet Inspection in a move that has Ars Technica described as “vendor throws deep packet inspection under the bus.”
In the last few weeks, there has been a barrage of attacks on Deep Packet Inspection, and then a volley of PR supporting it from those implementing the practice.
I had been sitting on an action item to write something in defense of DPI, and then this morning I came across a pro-DPI blog post in the New York Times. The following excerpt is in reference to using DPI to give priority to certain types of traffic such as gaming:
The key to this excerpt is the phrase, “IF YOU ASK THE CONSUMER WHAT THEY WANT.” This implies permission. If you use DPI as an opt-in , above-board technology, then obviously there is nothing wrong with it. The threat to privacy is only an issue if you use DPI without consumer knowledge. It should not be up to the provider to decide appropriate use of DPI, regardless of good intent.
The quickest way to deflate the objections of the DPI opposition is to allow consumers to choose. If you subscribe to a provider that allows you to have higher priority for certain application, and it is in their literature, then by proxy you have granted permission to monitor your traffic. I can still see the Net Neutrality purist unhappy with any differential service, but realistically I think there is a middle ground.
I read an article the other day where a defender of DPI practices (sorry no reference) pointed out how spam filtering is widely accepted and must use DPI techniques to be effective. The part the defender again failed to highlight was that most spam filtering is done as an opt-in with permission. For example, the last time I checked my Gmail account, it gave the option to turn the spam filter off.
In sum, we are fully in support of DPI technology when the customer is made aware of its use and has a choice to opt out. However, any use of DPI done unknowingly and behind the scenes is bound to create controversy and may even be illegal. The exception would be a court order for a legal wiretap. Therefore, the Deep Packet Inspection debate isn’t necessarily a black and white case of two mutually exclusive extremes of right and wrong. If done candidly, DPI can be beneficial to both the Internet user and provider.
See also what is deep packet inspection.
Eli Riles, a consultant for APconnections (Netequalizer), is a retired insurance agent from New York. He is a self-taught expert in network infrastructure. He spends half the year traveling and visiting remote corners of the earth. The other half of the year you’ll find him in his computer labs testing and tinkering with the latest network technology.
For questions or comments, please contact him at eliriles@yahoo.com.
Share this: