Avoiding the Chasm

April 17, 2008

Broadband Network Usage Monitoring and Measurement Tools

Filed under: Technology — Tags: , , , , , , , , , , — vextasy @ 8:10 pm

If you have found that your ISP has been restricting your broadband bandwidth the obvious question you will ask your ISP is why? If you ask that question the answer you are likely to get is that you have been using the “broadband service inappropriately”. You might also be told that you have exceeded your usage allowance but if you, like me, are on an unlimited contract you are unlikely to be told what the upper usage limit is. The reason you won’t be told the actual value of the upper limit is that it is likely to be more complicated than a simple figure and the reason that this is the case is because the ISPs are principally interested in avoiding router congestion at peak times. At off-peak times, such as in the early hours of the morning and during the working day, it makes little difference to an ISP if the capacity of their network is 25%, 50% or 75% used, they still have the same equipment costs and other overheads. But once the network reaches capacity, and routers are forced to drop packets, then customers start to notice and the ISP begins to get a bad name. For this reason most ISPs have, quietly, begun to apply traffic shaping at peak times.

Traffic shaping involves restricting the bandwidth of `heavy usage’ customers in such a way as to prevent them from interfering with the network experience enjoyed by `lighter usage’ customers. Unfortunately it looks like we are in for a lot more of this as network demand grows. The popularity of the Internet as a medium for watching media has rocketed in recent months and looks to continue to grow as more and more people switch their viewing habits from the more traditional broadcast medium to Internet based technologies. In the UK, the BBC iPlayer alone has been responsible for tremendous changes in network usage.

I recently found myself in the position of having determined from my ISP that I was being traffic shaped. Unfortunately, my router provided me with little help in identifying the volumes of data that were passing through my broadband connection each month but my ISP furnished me with figures which seemed to be considerably higher than I would have expected. Finding myself in a very weak position I decided to rearrange my home network to allow me to gain a better understanding of my broadband usage.

My broadband is supplied by BT on an unlimited tariff and I use the BT supplied broadband router (2-Wire 1800) which hosts two wired Ethernet connections, one to a PC and one to a network attached storage device, and a number of wireless connections to PCs or laptops. There are nine devices in total but typically a maximum of 4 might be actively using the broadband line at any one time, and by active I usually mean browsing web pages. Living reasonably close to our exchange we can manage to achieve a download speed of about 6.3 Mb/sec and even with the bandwidth restriction we still reach this speed outside of peak times.



The problem with having a wired network is that the only device that can really determine how much traffic is flowing is the broadband router as everything else talks directly to it and it funnels data into and out of the ADSL line. I attempted to get my existing router to log traffic information to a PC so that I could take a close look at what was travelling up and down the external line.

There are many different logging analysers available but the one I chose to use was WallWatcher a free tool with support for a large number of routers.


Unfortunately I found that I couldn’t get WallWatcher to correctly recognise the format of the packet logs coming from my model of 2-Wire router. Linksys_WRT54GLIn my case the solution was to make use of a spare wireless router that I had which was not being usefully employed, a Linksys WRT54GL. This variant of the WRT54 family of router runs Linux and can be easily upgraded to run an alternative piece of firmware. I wanted to concentrate my network devices on the Linksys router and then run a single connection from the Linksys router to an Ethernet port on the back of the 2-Wire broadband router. I also wanted to make use of the fine bandwidth reporting available from the Tomato firmware which this router can be upgraded to run. The process of upgrading the router took about 10 minutes as it can be done from a menu option within the native Linksys firmware. Once Tomato was up and running on the Linksys it was easy to configure it to provide a good quality wireless network that replaced the old 2-Wire network and as an added benefit was also faster.

I configured the Linksys to store its bandwidth logs on a network Windows share and to forward its packet logs to WallWatcher as before and the results bandwidth-24hrswere immediately interesting. Tomato hosts a number of web pages that show bandwidth over varying periods of time. I could see straight away that the download bandwidth on the WAN port was considerably higher than I would have expected and at quite a sustained value (see the image on the right). The graph shows consistently high volume of download overnight and then a period of very low activity in the morning when all of the PCs were switched off followed by high usage again from about 2pm when they were restarted. Tomato also hosts a real time bandwidth display. Using these displays combined with WallWatcher it was easy to identify the PC responsible for the heavy usage and by examining the addresses of the remote end-points shown by WallWatcher it was also easy to determine the offending program.

TV Tonictvtonic_realtime

In my case, the program generating the traffic was the TV Tonic RSS service, a program responsible for downloading video podcasts from the Internet. I hadn’t realised that the program was still active as I had not made use of the client for a number of weeks. Incidentally, the TV Tonic client runs as an add-on to Windows Media Center (under Vista) and is quite a nice addition. Had I looked a little more closely at its configuration I would have noticed that not only did it have an option to limit the download bandwidth but also it had a download scheduler to control the time of day that it be allowed to download at all (both of these options would be nice to see adopted by the BBC iPlayer). I’m not quite sure why TV Tonic was downloading such large amounts of data but, not wishing to experience another month of bandwidth restriction, I immediately disabled the TV Tonic service and the Tomato real time monitor showed the corresponding reduction in bandwidth usage.

BBC iPlayerwallreviewer-out

Even after disabling the TV Tonic RSS service there still seemed to be a lot of network activity from my PC although I wasn’t running any obvious client program. A closer look at the WallWatcher log display showed a large number of incoming and outgoing UDP packets wallwatcher-iplayerbeing sent to external machines. WallWatcher comes with a charting tool called WallReviewer which gives a useful interactive graphical picture of incoming and outgoing traffic information over a given period of time. The WallReviewer chart of “Outbound Leaks by Remote Names” showed a large number of packets being sent to the machines iplaykdms82.telhc.bbc.co.uk and iplaykdms6.telhc.bbc.co.uk. The names of these remote sites suggested the BBC iPlayer might be responsible but the application wasn’t running and the option “allow programmes to be shared when you exit download manager” was not ticked in the iPlayer configuration dialogue so I had assumed that there ought to be no networking activity from the iPlayer Kontiki-based software. I found that if I disabled the Windows service named “KService” (which runs the BBC iPlayer program “C:\Program Files\Kontiki\KService.exe”) then all of this network activity stopped immediately. From the WallWatcher display it was clear to see that these packets were being sent about every 2 to 4 seconds but WallWatcher is not able to give any indication of the size of the packets.


To get a better indication of packet sizes a protocol analyzer is required. The “old faithful” in this area used to be called Ethereal but development on Ethereal has now been moved to Wireshark. Wireshark is simple to install and can be used on many platforms. It is also free and licensed under the GNU General Public License. There is a lot more to Wireshark that the casual user is ever likely to need and a basic knowledge of networking protocols and terminology helps but there is plenty of documentation.wireshark-iplayer

Running Wireshark on my PC confirmed that data packets were being sent to the BBC domain every two to four seconds but also showed that the packet sizes were small, 16 bytes of payload which by the time they have been wrapped in the UDP and IP packets amount to a 58 byte Ethernet frame. I find that having disabled the KService service I am unable to start up the BBC iPlayer but as soon as I re-enable the service the iPlayer functions as normal.


Having made these networking changes I am now in a much better position to know exactly how much traffic is being downloaded (or uploaded) over my broadband line and also able to detect this traffic early on to avoid triggering any ISP penalties. The tools required to monitor bandwidth are not expensive (in fact they are free) and are easily configured. I think that my ISP should have been able to give me the information that I needed to monitor and control my bandwidth – it feels a little like having been sold a car which has no fuel gauge.

One lesson that can be learnt from all of this is that it is becoming more and more important for anyone with a reasonable grasp of networking to take matters into their own hands to monitor their own network usage. I don’t see the ISPs relaxing their grip on our usage patterns in the short term, at least not until their own issues of congestion have been addressed. So by tightening up on wasted bandwidth we should be left with more to do the things that we really want to use it for.


April 13, 2008

Fair Use for BT Unlimited Broadband Traffic Shaping

Filed under: Media, Technology — Tags: , , , , — vextasy @ 8:27 am

gn_logoHave you ever noticed large variations in your broadband performance? If so, there are a number of factors you might want to check before putting it down to bad luck. It may be that you, like me, are having your download bandwidth silently restricted by your ISP.

My broadband is supplied by BT and known as BT Business Broadband Share, I’ve been a BT customer for a number of years now and I think the equivalent (and, I notice, somewhat cheaper) current package is known as BT Business Total Broadband – Option 3. Both packages are advertised with the term ‘unlimited usage’ and both refer you, in the small print, to BT’s fair use policy.

I wouldn’t describe myself as a heavy user of broadband. I think I may have purchased and downloaded a dozen music files from the Internet, in my life, and I have used the BBC iPlayer to download a similar number of TV programmes, although I was careful to tick the little box that prevented the iPlayer from re-sharing those files after I had finished watching them. I download, perhaps, 6 large DVD size images from Microsoft’s MSDN subscriber site a year as part of my developer network subscription. I connect to the office with a VPN connection to collect email and occasionally use remote desktop or VNC to connect to one of several remote servers to perform evening or weekend maintenance. Other than that, I browse the web and listen again to a repeat of a Radio 4 audio programme on average about once a month. None of these things are particularly expensive in terms of bandwidth.

We are only a short distance from our local exchange and so usually comfortably achieve download bandwidth figures of over 6M bits/sec, but recently I had noticed much longer delays in displaying web pages from all sources and interrupted video streaming. We have a number of other PCs in the house on our wireless LAN and they were all experiencing similar problems so I checked the router (a BT supplied 2-Wire 1800) and noted that its broadband monitor showed low download and upload demand. This made me suspicious that there was a problem with the wireless network itself and so I checked the various settings, rebooted PCs and restarted the router and all of this made no difference at all to the download performance. I even chose to accept the firmware upgrade that the router was offering me in the hope that it might fix the problem but, rather ironically, the only visible difference I could detect was that the router’s nice bandwidth monitoring page has now been removed which means that I no longer have any indication of the upload or download bandwidth in use at any given point in time.

Noting that the download bandwidth was low, and knowing that our line normally performs well, I assumed then that the problem might be congestion at the exchange. There are good congestion checking tools at nildram and plusnet and plenty of information about broadband exchanges at samknows.com. These resources all suggested that my local exchange had no congestion issue.

Puzzled, I thought I’d monitor the bandwidth and see if I could determine a pattern. I initially suspected some form of interference from, say, a poor electrical connection or a fluorescent light, both of which can have this effect on broadband speeds, or so I had read.

You can check you broadband bandwidth with the excellent speed checker at speedtest.net which allows you to maintain a nice record of the measurements you have taken over a period of time or the less impressive BT offering at speedtester.bt.com which I found had to be run with administrative privileges on my Vista system but which does additionally provide you with what BT call your IP profile. There is an excellent description of this IP Profile at kitz.co.uk and a wealth of background information about ADSL too.

According to speedtester.bt.com my IP profile was 6.5Mbits/sec which was what I had expected:

IP profile for your line is - 6500 kbps
DSL connection rate: 448 kbps(UP-STREAM)  7616 kbps(DOWN-STREAM)
Actual IP throughput achieved during the test was - 2569 kbps

But depending on the time of day that I ran the test the IP throughput would vary from the expected 6340 kbps to as low as 379 kbps in the evening, rising through 3788 kbps after 11pm back to full speed after midnight and during the daytime. I saw this pattern repeat itself over a number of days.

Armed with this information I began to become suspicious that my line was being traffic shaped in some way. I called BT Business Broadband support and the nice lady there confirmed that my number was being restricted but she seemed surprised that I had not received an email alerting me to this. Broadband support said they were unable to give me any more information other than to say that it was due to excessive usage and gave me a phone number to ring to investigate further. That number turned out to be for reporting security breaches but they, in turn, gave me the email address: liteusage@btbroadbandoffice.com to which issues regarding traffic shaping and bandwidth restriction can be addressed.

I understood from the phone conversation that it was BT’s policy to review these restrictions at the billing points and that the restrictions could be gradually reduced if not completely removed when the excessive usage ceased. This meant that I should expect restrictions to be in place for several more weeks until BT saw fit to restore my service.

I emailed a request asking if they could help me to:

  1. Understand why the restriction has been applied .
  2. Help me get it released as soon as possible as it is interfering
    with my business use of this line.
  3. Give me an idea of the volume (or nature) of downloads that must have
    been present to have this restriction applied so that I can ensure
    it doesn’t happen again.

and the reply I got back said:

From the description you have given it appears that you are being
traffic shaped under the terms of our Fair Usage Policy, this is
why your connection is slow between 5pm and midnight.

and then followed this up with the surprising statement:

I am sorry but we cannot lift this restriction for you as our suppliers implement these measures.

Neither of these was particularly helpful or acceptable so I thought I’d better have a closer look at the fair use policy to see what I had done wrong and that is where the confusion really begins. The fair use policy doesn’t explain what BT consider fair use to be. I’d be only to happy to make a considered judgement about whether my £50/month unlimited broadband package was worth that amount if I could see what I was allowed to use it for. The policy explains in its three major sections:

Why do we have a fair use policy?

BT explain that their “… Fair Use Policy manages inappropriate use and makes sure the service can be used fairly by everyone”. And they define inappropriate use:

“A very small number of our customers use their broadband service inappropriately, for example when sending or downloading very large files, or using ‘peer to peer’ and file sharing software (which may be sending and receiving video and other large files constantly)”

So their concern appears to be related to the transmission of very large files and “peer to peer” or file sharing software. There is no mention of an acceptable download (or upload) usage figure, especially for their unlimited services.

How does the fair use Policy work?

Quite simply:

“If you regularly use the service inappropriately during peak hours, and we believe this is unfairly affecting other customers’ use of the service, we’ll manage your bandwidth during peak times (which could result in reduced service speeds).”

The policy clearly states that BT will control bandwidth for what they deem inappropriate use (earlier rather feebly defined as something involving large files and, possibly “peer to peer” and file sharing software) if this is done regularly (again undefined). There is no indication of how long they will continue to manage bandwidth for or an advanced warning that it might be about to happen. They do say that:

“If you continue to use your service inappropriately we reserve the right to end your agreement with us and will give you notice before doing so.”

But, of course, if you weren’t aware that you were using the service in an inappropriate way to begin with how are you supposed to know that you have continued to use it inappropriately. This seems to me to be an opportunity for BT to silently manage bandwidth to whatever extent suits them whilst continuing to charge the full rate for the service.

How do I know if the Fair Use Policy affects me?

BT say: “Our Fair Use Policy applies to all our customers but it’ll only actually affect you if you’re one of the very few customers who make inappropriate use of our service”. So another recursive and incomplete piece of information.

But don’t worry because:

“If you don’t use peer to peer, file sharing or other inappropriate software and you’re not, for example, constantly downloading or uploading: videos or very large files, you’re unlikely to be affected by our Fair Use Policy.”

So quite simply, don’t trouble your pretty little heads over our fair usage policy as it is unlikely to affect you. But hang on a minute,

  • I use the BBC iPlayer and that is peer-to-peer file sharing software,
  • I pay several hundred pounds a year to Microsoft to allow me to download operating system DVD images or sometimes videos from their web site and those are large files.

So, on both those counts BT can legitimately claim that I have fallen foul of their fair use policy and without warning restrict my broadband connection to whatever extent they wish and for however long they wish and still continue to bill me the same amount of money even though they neither specify the acceptable usage limits or provide me with any mechanism by which I can determine my current usage?

That doesn’t seem like fair use to me.

Create a free website or blog at WordPress.com.