Hacker News Reader

Comment by Tossrock | Hacker News Reader

I don't think blocking a specific set of IP addresses constitutes deep packet inspection. If they were reading the payload contents for strings matching the CourseTable site, that would qualify.

Still, this is a stupid move by Yale.

View on HN

If they were only blocking based on IP address then students wouldn't be able to ping the server. So they're blocking on at least the TCP layer.

... not that that constitutes DPI either.

This looks like the block page you get from a Palo Alto firewall. The feature set includes traffic inspection, among many other things. We've got a couple where I work, they are pretty great firewalls actually.

The type of block they're describing could easily be implemented in simple stateless firewall, something like iptables. No deep packet inspection is needed to block based off of header info like src/dst ip, port, or protocol.

DPI specifically means examining the payload of the packet. This is not DPI.

You don't think they probably force their students through a HTTP Proxy (which will have a different address) than the one a ping ends up originating from?

I'm with the parent, I doubt they're doing DPI here.

If that's the case, and it looks like it may be, then they should simply switch to https and things will work again.

There's a million other reasons to use https as well.

HTTP Proxys can be transparent: http://en.wikipedia.org/wiki/Proxy_server#Transparent_proxy

The way to get around transparent proxies is to use HTTPS btw.

Reply on news.ycombinator.com