View low bandwidth version

Posts Tagged ‘bandwidth’

Network monitoring planning

Thursday, February 10th, 2011

People have been trying to monitor their networks with pmGraph, without understanding how they might need to change the network topology in order for that to work.

I think it is essential to understand this before attempting to install pmGraph, to avoid wasted time and frustration. But it seems that the relevant documentation was relegated to an easily-missed link off the installation instructions. It was also difficult to read and understand.

I’ve just completely rewritten the installation planning instructions. They are relevant to any kind of network traffic monitoring, not just using pmGraph or pmacct. Comments are most welcome.

Simulating low bandwidth: Publishers for Development

Tuesday, June 8th, 2010

We think that academic publishing is an area that’s both critically important to development, and simultaneously becoming more and more inaccessible to the people who need it most.

The average size of web pages has been growing much faster than the average speed of connections in developing countries, and journal websites are no exception, as you can see in Alan’s blog post:

Average page size has grown much faster than available bandwidth

Average Page Size vs Bandwidth

As Alan points out, the average journal’s home page in his sample would take over 90 seconds to load on average, for researchers at universities in developing countries. Usability research has shown that people expect a computer to respond within 30 seconds. Making them wait longer interrupts their concentration, causes dissatisfaction and annoyance, and they often abandon the process. The biggest factor in user satisfaction is speed of response.

While this research probably did not include users who are accustomed to slow and unreliable computers, I think it’s safe to say that most people would find it annoying and difficult to use the Internet on a dial-up modem. And even a modem would have been preferable to some of the Internet connections that I’ve experienced (and paid for) in some countries in the last few years.

Academics have little ability to persuade their universities to upgrade their internet connections, at a cost of several peoples’ salaries (several thousand dollars a month). The only people who can change this are the publishers of the journals, by optimising their journals’ websites for users with slower connections.

But how to persuade the publishers that this is important? We built a low bandwidth simulator ourselves, and took it to Oxford, to INASP and the ACU‘s Publishers for Development conference.

What We Did

We set up spare machine as a bandwidth management box, and used it as a network filter for the participants. They could come and plug their laptops into the box, and browse the Internet and their own websites at a simulated slow speed.

Table with server, router and laptops with exercise cards stuck on top

Exercise Table

We configured the box for transparent bridging. This allowed us to insert and remove it from the network easily, just by switching over a network cable, to demonstrate the difference between fast and slow loading of pages.

We gave the participants at the meeting tasks to perform on various publishers’ websites, for example finding and downloading an academic paper by topic or researcher.

Participants watching and using the throttled laptops

Playing the Game

I think they found the activities enlightening, because we had some very good comments from some of the participants:

  • We’re so pleased that Alan was able to work his magic at the recent PfD session – his delivery is innovative, dynamic and fact-packed so it really sparks enthusiasm from the audience… [which] is demonstrably channelled into action once people return to their places of work.
    Publishers for Development Team
  • It was really useful to try the low bandwidth! [Our site] is already considered fast but it made us think even more around this issue, what else can we do etc.
    Anonymous Participant
  • Alan Jackson’s information about bandwidth was kind of shocking even if I knew it before, but to really experience it was very valuable. We are going to redesign DOAJ’s home page and this must be the starting point.
    Sonja Brage, DOAJ
  • Site speed is a major consideration for us, and I really enjoyed Alan/Aptivate’s session, experiencing the exasperation of trying (and failing) to connect via low-bandwidth… I have a feeling that there is ‘excess baggage’ on a number of the pages…
    James Kitchen, OECD

How We Did It

We used FreeBSD as the operating system for the software bridge, because its dummynet traffic shaper is relatively easy to use, and very good at simulating slow connections.

We wanted to use a laptop instead of a desktop machine, so that we could carry it to the conference easily, but we had hardware compatibility issues with FreeBSD on all the laptops we had available to us (mostly IBM Thinkpads). We ended up using a compact Fujitsu desktop box.

We installed FreeBSD 8 on it, and configured it to transparently bridge between two interfaces. Our internet access at the conference would be wireless, but we had issues with bridging wired and wireless interfaces together. So instead we used a Linksys WRT-54GL router with the Tomato firmware, which enables wireless client mode, to connect to the network:

WRT-54GL connected to FreeBSD throttler connected to network switch connected to client laptops

Throttler Network Diagram

And this is what it looked like in the room. Notice the essential coffee and cupcake, without which the system mysteriously failed to work:

FreeBSD server, wireless router and a laptop

Network Close Up

We configured the FreeBSD box to bring up the bridge automatically at boot time, and to load a set of ipfw firewall rules to enable dummynet, the traffic shaper. On this box, the ethernet interfaces are called em0 and rl0, so we added the following lines to /etc/rc.conf:

ifconfig_em0="up"
ifconfig_rl0="up"
cloned_interfaces="bridge0"
ifconfig_bridge0="addm em0 addm rl0 up dhcp"

firewall_enable="YES"
firewall_type="/etc/ipfw.rules"
dummynet_enable="YES"

Then we created /etc/ipfw.rules with the following contents:

# with bridge mode, two nics. em0 is wan
add pipe 1 all from any to any out recv em0
add pipe 2 all from any to any out xmit em0
add allow all from any to any
pipe 1 config delay 700ms bw 40Kbit/s mask dst-ip 0x000000ff
pipe 2 config delay 700ms bw 40Kbit/s mask src-ip 0x000000ff

This configuration creates two dummynet pipes. Pipe 1 is for traffic received on the external interface (downloads), and pipe 2 is for traffic being sent out of the external interface (uploads). We have to follow this by a rule which allows all other traffic, otherwise local traffic (on the box itself) is denied by default when the firewall is enabled, which breaks local DNS and inbound SSH and makes the box pretty unusable on the console.

Then we configure both pipes to allocate 40 Kbps (kilobits per second) for each individual IP address in the private subnet (allocated by the DHCP server on the Tomato router) and a 700 ms delay in each direction, which gives a 1400 ms round trip time. This is somewhat higher than the expected 600 ms round trip for a connection by geostationary satellite.

The end result is that each user connects a laptop to the switch behind the box, gets an IP address from the DHCP server on the router, is NATted by the router onto the public network, and is able to browse the Internet with a connection of 40 kbps upload and download. If you remove the FreeBSD box, by connecting the switch directly to the router, you can access the public network at full speed.

One issue was that the public network used a captive portal, which we had to log into. We didn’t want each client on our network to have to log in separately, so we enabled NAT on the router, and in wireless client mode, all the NATted clients get the MAC address of the router, so the public network thinks that they’re all the same PC and doesn’t ask them to log in again.

Why We Did it

We think that members of universities and research institutions need to be able to join and participate in the global research community as equals, in order to play their part in assisting development in their home countries.

Programmes such as PERii, HINARI and AGORA negotiate free or discounted online access to these journals for universities in developing countries. But the users still need to get online and access the content.

Online publishing for Western markets is usually designed for users with fast Internet connections, which Western universities have. But in other regions, universities often can’t afford fast connections, and this makes it very difficult for them to access these journals online.

Publishers for Development is bringing international publishers together who are interested in finding out how they might contribute to discourse and action around developing country access, encourage publication from developing country researchers and understand the diversity within research cultures/communities and the challenges these present.

The Censorship Arms Race

Wednesday, April 7th, 2010

Preface: This post discusses censorship. I want to be clear that I represent only my own personal views here, and I don’t personally support censorship in most cases. I think that freedom of access to information has a benefit and a cost, and the tradeoff depends on circumstances.

I think that censorship is useful when it serves a higher purpose, for example to save lives, or to save vital money for underfunded universities in countries where bandwidth is expensive and there are alternative ways for students to access the uncensored Internet for private browsing purposes. I’m opposed to censorship that requires leaving the country or changing your ISP to get around it.

Walubengo wrote on the BMO Training mailing list:

Am just from the student labs and came across this sneaky little [software]:

http://www.ninjacloak.com/

It basically allows my students to get behind the good old
dansguardian/squid proxy_firewall; essentially allowing them to visit
and download all and sundry (read porn, warez, torrents et al)

[H]ave been wondering why the clamour to “open-up” the internet “for
research” had gone down (now I know).

Any quick counters? (beyond just blocking ninjacloak.com, since they are likely to get an equivalent sooner rather than later)

I have never used ninjacloak and I don’t intend to, but I’m sure that if you post some logs of its use from your proxy server, we can figure out how to block it.

However, no security is perfect. There will always be ways around any security measure that we implement. However, no workaround is perfect either. Once we understand how it works, e.g. what the requests that it makes look like, we can block it.

This quickly turns into an arms race between the user and the administrator. The winner is usually the one with the most time, patience and determination. This may be a fight that you don’t want to take on.

In my view, if users really really want to access some blocked content, they will find a way. However, a good security system will make it possible to at least trace that they did so, if not exactly what they accessed. So my approach would be two-fold:

  1. Tackle the biggest problems first, and when they make sense. If someone uses ninjacloak to view a porn site once, it is hardly going to bring down your network, so you don’t need to care. If all your students are using TOR, AND it is bringing down your network, THEN it’s time to do something about it. If you don’t know what the biggest problem is, find out.
  2. Don’t forget that social measures are far more effective than technical ones. If students know that they are being watched, they are much less likely to try things like this. Make REALLY sure that everyone knows and understands your policy. When you find students bypassing your security, go and talk to them. If necessary, consider the use of formal sanctions, which are likely to have a stronger deterrent effect.

If users think they are being treated unfairly or harshly, it can increase their determination to fight the system. If you have a good reason for censoring, because you can show them how much damage their actions are causing to legitimate or intended uses (such as academic research), they are much more likely to understand and comply with your requests, hopefully avoiding the need for sanctions.

nb: but again, someone may ask, why not just open up the internet any way?

Because (and only when) it wastes your precious bandwidth that’s better used for your core purpose (e.g. academic research), which is why you pay for the connection in the first place.

Network Management Basics

Wednesday, April 7th, 2010

I’ve been asked for some advice on how schools and universities can take advantage of the increased bandwidth available with the arrival of the TEAMS and EASSY submarine cables in East Africa.

Management of Internet connections is a big subject. Whole books have been written about it, including the freely downloadable How To Accelerate Your Internet (BMO Book). However, for anyone who doesn’t have time to read it, I will briefly summarise the most important points that I can think of:

  • have a clear, simple and strict Internet access policy, and enforce
    it.
  • have enough bandwidth, AT LEAST 3 kbps per computer, uncontended. So if you have 1000 computers, you should have 3 MBits dedicated bandwidth, or 60 MBps if it’s shared or contended with a 20:1 contention ratio (typical ISPs).
  • have competent network administrators. If you don’t have them, then hire or train them.
  • implement good network management practices, e.g. by following the advice of the BMO Book.
  • start by solving the problems that users complain most about, to give them the best possible service.
  • monitor your network to understand how Internet bandwidth is being used.
  • block misuses of Internet access that are causing problems for legitimate use of the Internet connection.
  • ensure that client PCs have good, fast antivirus, perform well, are
    regularly reformatted and reimaged, and have strong local security to prevent unauthorized software installation.

Far more information on all of these topics can be found in the BMO book. I suggest starting with the Introduction if you’re interested.

Google Broadband

Tuesday, September 9th, 2008

According to FT and other sources, Google has announced their support for a new initiative called O3B to “bring internet access to 3bn people in Africa and other emerging markets by launching at least 16 satellites to bring its services to the unconnected” in 2010.

They will… order 16 low-earth orbit satellites… as the first stage in a $750m project to connect mobile masts in a swath of countries within 45 degrees of the equator to fast broadband networks… the project could bring the cost of bandwidth in such markets down by 95 per cent.

This will probably be the largest single investment in developing country network infrastructure in history. The TEAMS submarine cable for East Africa (which is not yet active) will cost $82m to lay according to Wikipedia, while SAT-3 (West Africa) cost $280m. However, the comparable but larger Iridium satellite service, with 77 LEO satellites, was estimated to have cost US$6 billion and filed for bankruptcy in 1999.

According to the FT, “wireless spectrum required for the service had been secured through the ITU“, but this seems unlikely as the ITU works by consensus and not coercion, and it has no power to override local governments’ license demands.

In Kenya for example, a deregulated market, an international gateway operator must pay Ksh 15m ($210,000) for a 15-year license, plus up to $70,000 per year, and probably the same again for VSAT licenses. If this is scaled up from Kenya’s 37 million population to the whole of Africa’s 955 million, O3B might have to pay US$ 18m per year for licenses alone, adding $360m to the cost of the project over the 20-year lifespan of the satellites.

The technical model is interesting. By not dealing directly with end users, but being a bandwidth provider for communications providers, O3B enters a market with Intelsat, Iridium and other satellite operators, providing expensive bandwidth in places where none is available. Their service should have lower latency than the usual geostationary satellites, as their satellites orbit closer to the Earth in MEO (NYT claims only 120 milliseconds, compared to 500 for a geostationary satellite). However:

  • latency will still be worse than land-based connections (I don’t buy NYT’s claim that 120 ms is “close to fiber”)
  • bandwidth will still be limited by available frequency space
  • bandwidth will have to be shared (to some extent) between users of a single satellite
  • ground stations communicating with moving satellites have spectrum efficiency problems (due to the Doppler effect)
  • ground stations with moving (tracking) antennae must switch from one satellite to another every 10 minutes, causing a short dropout
  • satellite communications require more power than microwave links, and in this case are likely to be located in rural areas with no electricity grid
  • the hidden node problem makes satellite more suitable for leased line substitution than Internet access

Latency is likely to remain a problem for voice customers, both mobile networks and Internet access, for which bandwidth demand is largely being driven by VoIP (estimated at 70% of bandwidth use in some African countries). Satellite VoIP providers apparently use different codecs with lower bitrates than standard VoIP, so popular services like Skype may not work well over satellite.

Google and other partners have so far invested $65m of the total $750m sought, and venture capital is being raised for the rest. This proves just how much this bottom of the pyramid Internet market is worth to Google.

Satellite bandwidth is already highly commoditised, and O3B’s plan to reduce this from US$4,000 per megabit per month to $500 requires compelling evidence. In any case this is wholesale bandwidth, not for end users, who will still pay whatever the telco wishes to charge.

I also think that their US$ 750 million investment in satellites will be useless within 20 years of launch due to degradation (NYT claims a 10-15 year life for MEO satellites), whereas building more land capacity in Africa would have much longer-lasting benefits.

Om Malik says: “I’m intrigued by this startup because it does make sense to offer connectivity in remote areas. It also makes sense because Africa is one of the booming cellular markets and one where there is a need for cellular backhaul infrastructure. In remote areas, voice is going to be the killer app for a long, long time. The problem is that this company will always compete with fiber networks in terms of pricing, and that might put them on the back foot.

Google clearly wishes to use this project to enable broadband Internet access in developing regions, but many other things must be in place, including fixed power infrastructure, PCs or OLPCs, technical support and skills, and demand and useful content and services for areas with lower literacy, before that can happen.

Hopefully this will at least increase the spread of mobile and broadband networks by adding backhaul options (competition) and reducing the financial barriers that telcos have to overcome to deploy these networks, but this is far from certain, especially as the telcos would like to offer such services themselves, and may view O3B as a competitor more than a supplier.

See also: