What's Banned On Your Campus?

Going through the Slashdot submission bin, one story has been popping up over and over again over the past few months. Every few days, someone writes in to tell us about yet another university that has banned Napster, the popular mp3 distribution tool. From Indiana University to Seton Hall, there are over a hundred colleges and universities that have banned its use. It's not just Napster, either. DeCSS and internet telephony are being targeted, as well. Some people say it's censorship, others say it's just a matter of reclaiming the university's bandwidth.

We wanted to give the Slashdot readership a chance to talk about this issue. The 'Students Against University Censorship' have set up a site chronicling the day-to-day Napster battle, listing every school they know of that has banned the program. What's going on at your school? What are their policies regarding Internet usage? Have you had a run-in with the collegiate authorities over something you were trying to do? Let us know!

As a student AND administrator...

I'm a student and systems administrator at a state university. I'm not absolutely certain whether we block Napster (I think we may have just started doing so) but if we haven't I sure wish we would. We don't block DeCSS or anything else really, though some types of connections (streaming media in particular) are rate-limited. Let me tell you first that is anything but censorship. As has been pointed out by the network admin, many uses for streaming media are more than legitimate, but we just simply don't have the bandwidth. There are three T1s to the world at our site, to serve something like 12000 students and hundreds of faculty and staff.

Censorship is restricting certain types of content only within a medium for some sort of political or moral goal. I don't believe that the university has any objection to students receiving any certain type of content (the AUP simply specifies that usage should be for educational purposes - I'll get to what this means in a bit). But regardless of the content, as the head admin says, "network bandwidth is a very limited resource." And I wholeheartedly agree to any measures he takes to help relieve the congestion, especially if it impacts only services, like Napster, that cannot possibly be considered to have legitimate educational purposes.

Yes, that's right, educational purposes. That's what university networks are supposed to be for. And I believe in a broad definition of "educational" that includes things like hosting Free Software projects, receiving and playing (non-stolen) music files, and even reading Slashdot. Most organizations, especially for-profit ones, do not even allow these activities because they do not contribute to that organization's mission. You should be thankful that most universities liberally interpret the boundaries of their missions and do not require you to pay for your own bandwidth to use these and other services.

Another issue to consider is that, in a badly oversubscribed environment like ours (100% usage from 8am to 6pm), every byte you get is a byte someone else won't. In a lot of cases, that someone else is trying to do real research, or as in my case, get security fixes and other data crucial to my job as a systems administrator. The conscientious individual recognizes this and self-imposes limits to his network use during congested times. After-hours, in fact, most limits are removed and students and faculty are allowed even freer use of the network. As I've been saying, these restrictions and limits are placed so that everyone has a fair shot at using the network. It would be nice if people would further limit their usage to truly educational material during the day; if they did then restrictions would not even be necessary. Until that happens (ha!) we'll continue to restrict and/or rate-limit certain services.

Unfortunately, decisions must be made as to exactly which services must be limited or cut off, and in general I feel that Napster is an example of a service with no real educational value and high bandwidth usage. Thus it is a good candidate for restriction. Perhaps you disagree, but then it would be your responsibility to decide what else must be limited or cut. Obviously items like DeCSS are not cut for these reasons, and I vehemently disagree with that practice. Ditto for cutting internet long-distance just to prevent competition. There are lots of bad reasons to restrict network usage, but I've yet to see anyone around here bringing them up and I suspect that in most places, decisions are being made for valid reasons, not censorship or to stifle competition. Here we are talking about bandwidth usage, and something has to go. I'm glad it's Napster and not FTP or HTTP. Certainly these protocols can be abused as well, but they are also frequently used for purposes directly related to the stated goals of the university. Think about it. If not Napster, then what?

--TM

Within their rights

When I was at Uni, I got into some moderate trouble for mailing on a copy of the 1000 question Purity Test to a few friends. I didn't object: those computers, that network infrastructure, they were paid for so that we (the students) could use them for education -- not so we could exchange lighthearted smut.

When MP3s flying around the network start to affect people's ability to get real work done -- both by students and researchers -- I think it's entirely within the rights of the admins to restrict the use of things like Napster. Buy your own T1.
--

I'm a campus network admin ...

My job is system and network administration on the campus of a local university. I would be the one to recommend to my boss about these types of policies (and ultimately I think the final say would be mine).

Personally, I feel that this _is_ a matter of censorship. Furthermore, banning sites and blocking ports is a futile attempt. Students are resourceful. They will find some way around it (proxies, say), or someone else who knows. Once one student knows a way around it, the whole campus knows.

Recently our uplink set a packet filter blocking all packats to napster.com. I lobbied against this, and stressed that this wasn't a solution to the problem. Blocking content _is_ censorship. While I am sympathetic to the problem, censoring people is simply wrong. The filter was dropped a few days later; I hope my arguments had a hand in persuading them. :)

I currently impose bandwidth throttling on the interface that connects to our campus residence. This seems to work reasonably well and I would recommend this to any network admin over packet filtering.

Jason,
[e-mail]

Net demographics 1994-2000

Something I looked into last year, as an admin at my school, was computer usage, and where it was likely to go. There were some concerns such as planning for a bigger pipe, which IS freaking expensive (go buy your own) and often has to include hours of research and talking to idiot salespeople at ISPs. Our other concern was the shear number of students bringing computers to campus.

In 1994, it was rare for students to take computers to campus. For most schools, this was the dawning of the connected era, when they were thinking about the procurement process for full scale fiber ethernet networks. Some schools wrote grant applications, begged alums, asked the state govt, raised tuition to pay for their "pipe dreams".

So, for a few years, in most cases, the bandwidth that was planned in the mid 90's has held out. But in the past two years, hardware prices have fallen through the floor, and evry kid wants to bring his or her computer to school.

At my school last spring, when I sat down to look, less than 5% of seniors had computers on the campus network (all computers have to be listed as students' usernames for easy ID). More than 70% of freshmen did. The explosive growth of end-user computing sent the computer from the realm of luxury item to the realm of more-important-than-a-tv.

So the procurement process has to start again, admin staff trying to get money to upgrade the network, keep faculty in working machines, provide multimedia teaching facilities in classrooms, provide public use computers for students who don't bring computers, spend money selling the school through its website, and making sure CS students have access to labs that will allow them to actually learn something. Add to that the personnel cost of manning the network, admining accounts, going to meetings to get more money, and researching new tech for upgrades, and you've got a pretty hefty bill, even in cases where a lot of the grunt work is done by students. Not to mention that hefty chunks of 1999's budget probably went to Y2K upgrades.

In short, bandwidth is a very expensive commodity for departments with short budgets, and students abusing it before the school can get what it needs deserve to be shut down. The angst-ridden middle class kid syndrome will whine to no end, though, thinking they were really paying what the resources are worth. Yeah, right.

Of course, the faculty were more concerned with "what do you do with students who spend all their time on the net and no time working? They already recentered the SAT for them. Now what?" But that's for another day...

--mandi

Re:QoS has been suggested

I did this comment the last time the ugly beast showed its head a few weeks ago. I'll repeat it again:

You can use QoS.

Even if you cannot use it selectively (with Napster this requires sniffing the proto and configuring QoS filters realtime) use per net/per IP limits (aka per dorm). Or even better schedule the dorms to use ONLY leftovers from the rest of the campus. Over. Done. Whoever says it is impossible eat a gun. Been there. Done that

Problem is elsewhere:

• Most University admins knowledge goes as far as banning and not any further
• Most Universities CS Depts are highly disinterested in developing/deploying new bandwidth control technologies. Reason is that they are not so "cool" and do not require so much money like WWW2. They actually save money. And their salaries are percent of the budget. Dropping the budjet. Dropping the spending... Forget it...

Re:Whats wrong with banning Napster?

Well, I know this is about as bad as censorship, but students need to be worn down. They need an oppressive network dictator lording over their every packet and destroying their fun. Otherwise how will they feel when they get into a job at a large company? They might be devistated. But that's how I would do it. Sure, take the easy way out. See if I care. ;)


Bad Mojo

Re:But we Pay

Just because you pay a fee for your connection does not mean they waive the right to determine how it may be used. If you don't like the fee, the conditions, or whatever else, you can always find an alternate method of connecting.

Personally, I don't see what people are bitching about. $80/semester is a fantastic deal for high-speed acccess. My cablemodem costs me $240 per semester.

cjs

Re:As a former university sysadmin

I agree with you on the Napster issue as well as just about every other point you make. I also don't believe that it's censorship more than it's trying to control bandwidth and legal exposure.

One place that I do have a problem is when public schools make sweetheart deals with long-distance carriers in return for kickbacks. They force their students to use one carrier from their dorm rooms under the auspices of cheaper rates, when in fact they are taking some of the savings themselves. Now, don't get me wrong -- I think that public schools should try to save money (or generate it) wherever possible to save both the taxpayers and the students money.

However, banning IP long distance phone calls is an active conflict of interest. It puts the school into a position of protecting their preferred long distance carrier's market by controlling their network.

What I suggest is not that schools should give up controlling their networks, but that they should be more careful in choosing who they make exclusive agreements with, or if they should at all. These agreements with LD carriers put them in an exposed position and tie their hands when they want to later control network bandwidth, and they are just plain no good.

In the last few years, it's almost been a free-for-all with schools making exclusive agreements with everyone from Microsoft to all the long distance carriers to Subway and even credit card companies. But these agreements come at a price that administrators don't yet realize: the integrity of their school's goal to provide education, not business relationships.

Re:As a former university sysadmin

If schools resources are to be used only for "learning", then why are student activity fees collected at most universities, often for recreational services most students never use?

And remember that universities are not usually strictly private profit-seeking entities. They are payed for by tuition and student fees, by charitable endowments, and by govenment money collected with taxes (even private schools receive federal funds for student programs and research).

You claim it's not censorship when someone else owns the wire, but what happens when everybody who owns the wires won't let you talk? What's your recourse, build your own Internet?

Give each user their own allocation - IProute2

I was partly responsible for QoS at a UK university, where things are worse because we have to pay 2 pence (4 cents??) per MB for all traffic received from the US (with a 56KBps video stream that adds up!) In the first year we left it open and made a HUGE loss. (We charged 30 pounds per year per student).

It's a tough problem (obviously). The best solution we came up with was to use DummyNet under BSD or iproute2 under Linux to give each user their own allocation of bandwidth. When they run out, they can still use our proxy servers (which don't incur charges) or can buy more bandwidth for their allocation.

IProute2 is actually excellent for this. It can do just as much as your average Cisco, much more easily: source-based routing, processing of packets based on arbitrary hexadecimal strings in them, and so-on. With a powerful enough CPU and two 3Com cards, we got a decent throughput too.

We came up with a whole complex system with perl, Oracle, DBI, SNMP, shaper.o (no iproute2 in those days) and lots of other things - then ran out of time and money just as it was starting to work (though shaper.o wasn't very suited to the task). There just isn't enough money, at least in UK universities, to do this sort of thing.

Instead each ethernet segment of 100+ users squeezes through a 20Kbps throttle. This is of course totally unfair, because 2% use more than the rest put together, but on the bright side traffic through our proxies is excluded from the throttling. It's a terrible solution but there isn't money for anything better. We don't have Cisco CPU capacity for selective QoS by protocol. Any suggestions welcome :-)

Re:Whats wrong with banning Napster?

I work for core networking for the Univ. of Missouri and am a student who uses Napster.

I understand the problem. I mean, several weeks ago one res-hall (250 students) was cranking out 35 MBit (all Napster/MP3). We have a 45MBit link to the Internet. We put a filter on the router just to count # of packets going to the Napster server - several hundred per second. That just to the server, NOT mp3 files going across the wire.

I can understand turning it off. Although we started with the biggest offenders at first - that doesn't work. It's the large number of people using it - not several major offenders.

So how to nail it? filter out anything to that class C - fine. That'll work temporarily. Proxy's are abundant. DNS it - they'll use external DNS servers. The only viable way I know of to really shut it down is possibly to shut off ICMP inbound. Although I'm going to try to write a filter that would nail the Napster protocol. Blocking ICMP would suck, but it would work. If anyone knows a better idea, please please let me know.


Brent Deterding
Univsity of Missouri - Columbia
Data Network Planning & Support - Core Group
Research Computing Group
Grader - CECS 253 (UNIX)

From savenapster.com .....

The most common practice by university admins to block student access to napster servers is by establishing a firewall (or modifying existing firewall to block napster). Unfortunately, this is also the most difficult method to bypass. Essentially this firewall looks for all information going to *napster.com and stops it. The only way to continue to access napster servers is to "bounce" off another site (that you can connect) to, to napster. This can be achieved using various 'proxy' software. 1) Someone who is offsite from your university needs to download and install a socks4/5 compatible proxy server, configure it correctly and then give you the information. 2) You will put this information in the section where napster asks if you go through a socks proxy/firewall. This will tell napster to first establish a connection with that server and then go to server.napster.com. Then you will be able to connect to napster's servers. Also, a good thing to remember - you're going to want to bounce off someone with a decent connection to the internet. Although almost all traffic is peerpeer - napster still talks to you for queries. The peerpeer connections will be established seperately. Another fairly common method to prevent students from accessing *napster.com is to remove the dns entry for napster.com. Every computer needs a dns server to resolve IPs (xxx.xxx.xxx.xxx) to hostnames (host.mask.com). Your school (or ISP) provides this DNS (domain name server) for you to use. The school could change their dns entry of server.napster.com, which is the host that the client looks for, to something else (a school warning page) -- or remove it entirely. Fortunately it's very easy to bypass this method. Unlike the firewall, we can do one of two simple things. 1) Simply insert a different DNS server into your configuration. This will then have your computer point to a different nameserver instead of pointing to your school's. Other nameservers won't have blocked napster because they have no reason to do so. 2) Edit your 'c:\windows\hosts' file. This file allows you to put an IP and what host it should resolve to, thus bypassing the need to have the dns server look it up for you. This is perhaps the best option of the two, incase your school has special dns entries that another server won't have. sample: (c:\windows\hosts) 208.184.216.223 server.napster.com #napster dns entry Note: You will have reboot for these settings to take effect. Also, if your school FIREWALLED napster, you will not be able to use this method. See Proxies section. (A good way to know you're firewalled, is to try to ping server.napster .com, then when it doesn't work ping 208.184.216.223. If the second way (ip) works - you're not firewalled. You just need a dns entry).

SSU - Salisbury State University, Salisbury, MD

This is an excerpt from the most recent Information Tec