Want to know what applications are really running on your network? A new appliance promises to provide all the details, even for links running at 1 Gbps and faster.

by Alex Goldman ISP-Planet Managing Editor [July 16, 2004]

Cambridge, UK-based CacheLogic, a company that bills itself as a provider of "advanced solutions for P2P networks," unveiled a network monitoring tool that will tell the network manager what applications are being used on the network.

In order to monitor actual applications, you need to match up inbound and outbound traffic from each unique session. Andrew Parker, CacheLogic founder and CTO, says the evice, the Streamsight 510, does so without identifying individual users. The product therefore requires no integration with an ISP's RADIUS server or billing system.

Instead, it simply sits, in line or out of line, at the core of the network or at a busy POP, and uses deep packet inspection to determine exactly what's going on. With GigE input and output, and one or two 2 GHz Intel Xeon processors, this is no lightweight box. It's designed for the high speed core of the Internet, which is exactly where the company built its demonstration system.

The demonstration system was running throughout June 2004 and showed exactly what Parker had suspected it would: that despite claims to the contrary by the RIAA, P2P use remains very high (for more detailed data, see related article).

Parker says ISPs have to accept that they cannot prevent P2P use on their network. "There are legitimate uses for P2P," he notes, citing the latest release of Fedora (formerly Red Hat Linux) over Bit Torrent as an example.

"ISPs don't know what's going on in the network," he claims. "If they assume all traffic on port 80 is HTTP, they're wrong." Another port used by P2P programs is 1323, which is used for VPNs.

"The approach has been to throttle or shape P2P traffic, but now that it goes over port 80 or port 1323, you cannot."

As P2P programs become more sophisticated, the tools that track them must evolve too. In fact, the pace of change is so rapid that Parker says he was forced to use commodity hardware. "The development time required for a custom ASIC is too long," he notes. "With commodity Intel hardware, you can upgrade, taking advantage of Moore's Law."

Unfortunately, given the legal assault on all forms of file transfer undertaken by the RIAA, the legality of any solution that gathers data on or assists the operation of P2P file sharing may be subject to the whim of Congress and other lawmakers.

Pricing and availability
Initial demo models are available now, with volume production scheduled for Q4, 2004. Each appliance is priced at £15,000, or about $27,500.

—End