Finding how plus.net are prioritising your traffic

plus.net have now published official advice, please use that instead!

Thanks to some hints from customer support, I think I can see how to tell how your traffic is being classified. This is a bit techy, so apologies - and if I've got it wrong I'm sure someone will be around to correct me before too long :-)

First thing: you need to install wireshark (previously known as ethereal) from here: http://www.wireshark.org/download.html

Capturing the traffic

Now, start wireshark.

Select the 'capture' menu option (I think on windows you might have to select 'interfaces' first, then there's a "cap" button there).

You need to figure out which interface to use - if you're using a router, it'll be some kind of ethernet port. Watch for the one that the packet count is changing for as you browse the web etc.

At this point, it is best to shutdown any other applications that might be causing network traffic, otherwise it's difficult to interpret the captures.

Start the capture, then cause some traffic that you want to know the prioritisation of (eg. start your vpn software and connect).

Now stop the capture.

Analysing the traffic

You now need to select a packet that is for the vpn software (this might take some guess work, but if you know what port it uses, type 'tcp.port=53' or similar into the filter input box.

The packet needs to be one where the destination address is your IP address (ie. it is a packet sent by the remote computer arriving at your computer).

In the middle portion of the wireshark window is a section labelled 'Internet Protocol' - click on it to expand it.

In there is a line like 'Differentiated Services Field: 0x80' - the 0x80 is the traffic priority. It's a hex number, and bigger numbers are better.

The priorities

The values I've figured out and the traffic I checked with are here:
namevaluetypical traffic (premier account)
titanium0xa0dns
gold0x80ssh/web
'golver'0x60web download - eg. rapidshare
??0x40razor, whois
silver0x20premier p2p when below monthly limit
Note that from my experiments, the latency for silver traffic is fairly shocking - 3 seconds delay per packet.

Alternative method

You can also use tcpdump to determine the levels (thanks to Ian Stirling for this tip):

 tcpdump -x -n dst port 6881 -s 16
 The last two numbers in each line - for example 
 22:25:15.025276 IP [|ip]
        0x0000:  4520
                   ^^ 0x20 - so this is silver traffic

The End

Hope that helps someone. If you have any problems please try asking on the newsgroups or forums before emailing me. Thanks!


Joseph Heenan