{"id":29814,"date":"2019-10-31T21:32:09","date_gmt":"2019-10-31T18:32:09","guid":{"rendered":"https:\/\/prohoster.info\/blog\/razvyornutyj-otvet-na-kommentarij-a-takzhe-nemnogo-o-zhizni-provajderov-v-rf\/"},"modified":"2019-10-31T21:32:09","modified_gmt":"2019-10-31T18:32:09","slug":"razvyornutyj-otvet-na-kommentarij-a-takzhe-nemnogo-o-zhizni-provajderov-v-rf","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/razvyornutyj-otvet-na-kommentarij-a-takzhe-nemnogo-o-zhizni-provajderov-v-rf","title":{"rendered":"Nj\u00eb p\u00ebrgjigje e zgjeruar ndaj komentit, si dhe pak p\u00ebr jet\u00ebn e ofruesve n\u00eb RF","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>M\u00eb inspiroi t\u00eb shkruaj k\u00ebt\u00eb postim <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/443898\/#comment_19891124\">ky koment k\u00ebtu<\/a><\/noindex>.<\/p>\n<p>Po e sjell k\u00ebtu:<\/p>\n<blockquote><p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/users\/kaleman\/\" class=\"user_link\">kaleman<\/a><\/noindex> sot n\u00eb 18:53<\/p>\n<p>Sot m\u00eb g\u00ebzoi ofruesi. Bashk\u00eb me p\u00ebrdit\u00ebsimin e sistemit p\u00ebr bllokimin e faqeve, u bllokua edhe posta mail.ru. Q\u00eb nga m\u00ebngjesi po e t\u00ebrheq mb\u00ebshtetje teknike, nuk mund t\u00eb b\u00ebjn\u00eb asgj\u00eb. Ofruesi \u00ebsht\u00eb i vog\u00ebl, dhe duket se bllokohen nga ofruesit m\u00eb t\u00eb lart\u00eb. V\u00ebrejta gjithashtu ngadal\u00ebsimin e hapjes s\u00eb t\u00eb gjitha faqeve, ndoshta kan\u00eb vendosur ndonj\u00eb DLP t\u00eb keqe? M\u00eb par\u00eb nuk kishte probleme me aksesin. Shkat\u00ebrrimi i Runet po ndodh p\u00ebrpara syve t\u00eb mi\u2026<\/p><\/blockquote>\n<p> \u00c7\u00ebshtja \u00ebsht\u00eb se, duket, ne jemi ai ofruesi \ud83d\ude41<\/p>\n<p>Dhe n\u00eb t\u00eb v\u00ebrtet\u00eb, <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/users\/kaleman\/\" class=\"user_link\">kaleman<\/a><\/noindex> pothuajse e zgjedha sakt\u00eb arsyen e problemeve me mail.ru (me gjith\u00eb se ne e refuzuam p\u00ebr nj\u00eb koh\u00eb t\u00eb gjat\u00eb nj\u00eb gj\u00eb t\u00eb till\u00eb).<\/p>\n<p>T\u00eb ardhmen do ta ndaj n\u00eb dy pjes\u00eb:<\/p>\n<ol>\n<li>arsyet e problemeve tona t\u00eb sotme me mail.ru dhe nj\u00eb aventur\u00eb emocionuese p\u00ebr t'i gjetur ato<\/li>\n<li>ekzistenca e ISP-ve n\u00eb realitetet e sotme, stabiliteti i Runetit sovran.<\/li>\n<\/ol>\n<p><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h3>Problemet me aksesin n\u00eb mail.ru<\/h3>\n<p>\nOh, kjo \u00ebsht\u00eb nj\u00eb histori e gjat\u00eb. <\/p>\n<p>\u00c7\u00ebshtja \u00ebsht\u00eb se p\u00ebr t\u00eb realizuar k\u00ebrkesat e shtetit (m\u00eb shum\u00eb n\u00eb pjes\u00ebn e dyt\u00eb) ne kemi bler\u00eb, konfiguruar dhe instaluar disa pajisje \u2014 si p\u00ebr filtrimin e burimeve t\u00eb ndaluara, ashtu edhe p\u00ebr realizimin e <noindex><a rel=\"nofollow\" href=\"https:\/\/ru.wikipedia.org\/wiki\/NAT\">NAT-translacioneve<\/a><\/noindex> t\u00eb abonent\u00ebve.<\/p>\n<p>Disa koh\u00eb m\u00eb par\u00eb, ne p\u00ebrfundojm\u00eb nd\u00ebrtimin e qendr\u00ebs s\u00eb rrjetit n\u00eb nj\u00eb m\u00ebnyr\u00eb q\u00eb t\u00eb gjitha trafiku i abonent\u00ebve kalonte p\u00ebrmes k\u00ebsaj pajisje plot\u00ebsisht n\u00eb drejtimin e nevojsh\u00ebm.<\/p>\n<p>Disa dit\u00eb m\u00eb par\u00eb e aktivizuam filtrimin e ndaluar (duke l\u00ebn\u00eb t\u00eb funksionoj\u00eb edhe sistemin e vjet\u00ebr) \u2014 \u00e7do gj\u00eb dukej se kaloi mir\u00eb.<\/p>\n<p>M\u00eb pas \u2014 gradualisht filluam t\u00eb aktivizojm\u00eb NAT p\u00ebr pjes\u00eb t\u00eb ndryshme t\u00eb abonent\u00ebve n\u00eb k\u00ebt\u00eb pajisje. P\u00ebr dukjen \u2014 gjithashtu, duket se gjith\u00e7ka shkoi mir\u00eb.<\/p>\n<p>Por sot, duke aktivizuar NAT-n\u00eb p\u00ebr nj\u00eb pjes\u00eb tjet\u00ebr t\u00eb abonent\u00ebve \u2014 q\u00eb nga m\u00ebngjesi u p\u00ebrball\u00ebm me nj\u00eb num\u00ebr t\u00eb konsideruesh\u00ebm ankesash p\u00ebr mosaksesimin ose aksesin e pjessh\u00ebm <noindex><a rel=\"nofollow\" href=\"https:\/\/mail.ru\">mail.ru<\/a><\/noindex> dhe burimeve t\u00eb tjera t\u00eb Mail Ru Group.<\/p>\n<p>Filluam t\u00eb kontrollojm\u00eb: di\u00e7ka diku <i>ndonj\u00ebher\u00eb<\/i>, <i>rrall\u00eb<\/i> d\u00ebrgon <noindex><a rel=\"nofollow\" href=\"https:\/\/ru.wikipedia.org\/wiki\/%D0%90%D1%82%D0%B0%D0%BA%D0%B0_TCP_Reset\">TCP RST<\/a><\/noindex> si p\u00ebrgjigje ndaj k\u00ebrkesave p\u00ebr rrjetet mail.ru. M\u00eb shum\u00eb se kaq \u2014 d\u00ebrgon nj\u00eb TCP RST t\u00eb gjeneruar gabimisht (pa ACK), qartazi artificial. Diku k\u00ebshtu dukej:<\/p>\n<p><img decoding=\"async\" alt=\"Nj\u00eb p\u00ebrgjigje e zgjeruar ndaj komentit, si dhe pak p\u00ebr jet\u00ebn e ofruesve n\u00eb RF\" src=\"\/wp-content\/uploads\/2019\/03\/2ce762c44e86b97125806a27d91da1f0.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"Nj\u00eb p\u00ebrgjigje e zgjeruar ndaj komentit, si dhe pak p\u00ebr jet\u00ebn e ofruesve n\u00eb RF\" src=\"\/wp-content\/uploads\/2019\/03\/c7041cf0ae273666fe9bb36ff236710f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"Nj\u00eb p\u00ebrgjigje e zgjeruar ndaj komentit, si dhe pak p\u00ebr jet\u00ebn e ofruesve n\u00eb RF\" src=\"\/wp-content\/uploads\/2019\/03\/c594ee9e5f1c7127ac849c6b7afcd5d8.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNatyrisht, mendimet e para ishin p\u00ebr pajisjet e reja: DPI i friksh\u00ebm, nuk kishte besim ndaj tij, kush e di se \u00e7far\u00eb mund t\u00eb ndodhte \u2014 sepse TCP RST \u00ebsht\u00eb nj\u00eb gj\u00eb mjaft e zakonshme midis mjeteve t\u00eb bllokimit.<\/p>\n<p>Supozimi <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/users\/kaleman\/\" class=\"user_link\">kaleman<\/a><\/noindex> se dikush 'lart' po filtrohet, ne gjithashtu e kemi hedhur at\u00eb \u2014 por menj\u00ebher\u00eb e hedh\u00ebm posht\u00eb.<\/p>\n<p>S\u00eb pari, kemi lidhje t\u00eb mjaftueshme p\u00ebr t\u00eb mos vuajtur nga kjo \ud83d\ude42<\/p>\n<p>S\u00eb dyti, jemi t\u00eb lidhur me disa <noindex><a rel=\"nofollow\" href=\"https:\/\/ru.wikipedia.org\/wiki\/%D0%A2%D0%BE%D1%87%D0%BA%D0%B0_%D0%BE%D0%B1%D0%BC%D0%B5%D0%BD%D0%B0_%D0%B8%D0%BD%D1%82%D0%B5%D1%80%D0%BD%D0%B5%D1%82-%D1%82%D1%80%D0%B0%D1%84%D0%B8%D0%BA%D0%BE%D0%BC\">IX<\/a><\/noindex> n\u00eb Mosk\u00eb, dhe trafikimi deri te mail.ru kalon pik\u00ebrisht p\u00ebrmes tyre \u2014 dhe ata nuk kan\u00eb as obligime, as ndonj\u00eb motiv tjet\u00ebr p\u00ebr t\u00eb filtruar trafik.<\/p>\n<p>Pjesa tjet\u00ebr e dit\u00ebs u shpenzua n\u00eb at\u00eb q\u00eb zakonisht quhet shamaniz\u00ebm \u2014 s\u00eb bashku me furnizuesin e pajisjeve, p\u00ebr t\u00eb cilin ju fal\u00ebnderojm\u00eb, nuk e lan\u00eb \ud83d\ude42<\/p>\n<ul>\n<li>filtrimi u \u00e7aktivizua plot\u00ebsisht<\/li>\n<li>NAT u \u00e7aktivizua me nj\u00eb skem\u00eb t\u00eb re<\/li>\n<li>PC-ja testuese u t\u00ebrhoq n\u00eb nj\u00eb grup t\u00eb izoluar<\/li>\n<li>u ndryshua adresimi IP<\/li>\n<\/ul>\n<p>\nN\u00eb pjes\u00ebn e dyt\u00eb t\u00eb dit\u00ebs u caktua nj\u00eb virtualke, e cila dal\u00eb n\u00eb rrjet me skem\u00ebn e p\u00ebrdoruesit standard, dhe edhe asaj dhe pajisjes iu dha akses p\u00ebrfaq\u00ebsues\u00ebve t\u00eb furnizuesit. Shamanizmi vazhdoi \ud83d\ude42<\/p>\n<p>N\u00eb fund t\u00eb fundit, p\u00ebrfaq\u00ebsuesi i furnizuesit deklaroi me siguri se pajisja nuk ka asnj\u00eb lidhje: rst't\u00eb po vijn\u00eb nga ndonj\u00eb vend m\u00eb sip\u00ebr.<\/p>\n<p><b class=\"spoiler_title\">Sh\u00ebnim<\/b><i>N\u00eb k\u00ebt\u00eb pik\u00eb, dikush mund t\u00eb deklaroj\u00eb: por ishte m\u00eb e leht\u00eb t\u00eb merrje dumpin jo nga PC-ja testuese, por nga magistralja m\u00eb lart se DPI?<\/p>\n<p>Jo, p\u00ebr fat t\u00eb keq, t\u00eb marr\u00ebsh dump (dhe madje thjesht ta mirrorosh) mbi 40+ gbps \u2014 nuk \u00ebsht\u00eb ndonj\u00eb gj\u00eb e thjesht\u00eb.<\/i><\/p>\n<p>Pas k\u00ebsaj, tashm\u00eb mbr\u00ebmjen \u2014 nuk kishte asnj\u00eb opsion tjet\u00ebr p\u00ebrve\u00e7se t\u00eb kthehesh n\u00eb supozimin e filtrimit t\u00eb \u00e7uditsh\u00ebm diku lart.<\/p>\n<p>Shikova p\u00ebrmes cilit IX tani kalon trafiku deri n\u00eb rrjetet e MRG dhe thjesht fikja seancat bgp p\u00ebr t\u00eb. Dhe \u2014 oh mrekulli! \u2014 gjith\u00e7ka u normalizua menj\u00ebher\u00eb \ud83d\ude41<\/p>\n<p>Nga nj\u00ebra an\u00eb \u2014 \u00ebsht\u00eb shum\u00eb p\u00ebr t\u00eb ardhur keq q\u00eb u shpenzua nj\u00eb dit\u00eb p\u00ebr t\u00eb gjetur problemin, megjithat\u00eb, zgjidhja e tij zgjati vet\u00ebm pes\u00eb minuta.<\/p>\n<p>Nga ana tjet\u00ebr:<\/p>\n<p> \u2014 n\u00eb memorien time, ky \u00ebsht\u00eb nj\u00eb rast paprecedent. Si\u00e7 thash\u00eb m\u00eb lart \u2014 IX'ave <i>v\u00ebrtet\u00eb<\/i> nuk ka asnj\u00eb kuptim p\u00ebr t\u00eb filtruar trafikun transit. Ata zakonisht kan\u00eb qindra gigabit \/ terabite n\u00eb sekond\u00eb. Un\u00eb thjesht deri n\u00eb fund nuk mund ta imagjinoja di\u00e7ka t\u00eb till\u00eb seriozisht.<\/p>\n<p> \u2014 nj\u00eb rast jasht\u00ebzakonisht i suksessh\u00ebm: nj\u00eb pajisje e re komplekse, t\u00eb cil\u00ebs nuk i besohej shum\u00eb dhe nga e cila nuk dihet \u00e7far\u00eb mund t\u00eb pritet \u2014 e cila \u00ebsht\u00eb e dizajnuar sakt\u00ebsisht p\u00ebr bllokimin e burimeve, duke p\u00ebrfshir\u00eb TCP RST-t\u00eb.<\/p>\n<p>Aktualisht, NOC i k\u00ebtij internet exchange \u00ebsht\u00eb duke k\u00ebrkuar p\u00ebr problemin. Sipas tyre (dhe un\u00eb i besoj), nuk ka ndonj\u00eb sistem filtrimi t\u00eb ve\u00e7ant\u00eb t\u00eb instaluar. Por, fal\u00eb Zotit, aventura e ardhshme \u2014 tani nuk \u00ebsht\u00eb m\u00eb problemi yn\u00eb \ud83d\ude42<\/p>\n<p>Ishte nj\u00eb p\u00ebrpjekje e vog\u00ebl p\u00ebr t'u justifikuar, lutem kuptoni dhe falni \ud83d\ude42<\/p>\n<p>P.S.: q\u00ebllimisht nuk po e p\u00ebrmend as prodhuesin e DPI\/NAT, as IX (n\u00eb t\u00eb v\u00ebrtet\u00eb, nuk kam ndonj\u00eb ankes\u00eb t\u00eb ve\u00e7ant\u00eb p\u00ebr ta, e r\u00ebnd\u00ebsishme \u00ebsht\u00eb t\u00eb kuptojm\u00eb se \u00e7far\u00eb ndodhi)<\/p>\n<h3>Realiteti i sot\u00ebm (si dhe ai i djesh\u00ebm dhe i ante-djesh\u00ebm) nga perspektiva e ofruesit t\u00eb internetit<\/h3>\n<p>\nJava e fundit e kalova duke transformuar ndjesh\u00ebm kernelin e rrjetit, duke kryer shum\u00eb manipulime \"n\u00eb jet\" me rrezik t\u00eb r\u00ebnd\u00ebsish\u00ebm p\u00ebr trafik t\u00eb gjall\u00eb t\u00eb p\u00ebrdoruesve. Duke marr\u00eb parasysh q\u00ebllimet, rezultatet dhe pasojat e t\u00eb gjithave k\u00ebtyre \u2014 emocionalisht, gjith\u00e7ka \u00ebsht\u00eb mjaft e v\u00ebshtir\u00eb. Sidomos \u2014 duke d\u00ebgjuar p\u00ebrs\u00ebri fjalime t\u00eb bukura rreth mbrojtjes s\u00eb stabilitetit t\u00eb runet, sovranitetit, etj.<\/p>\n<p>N\u00eb k\u00ebt\u00eb seksion do t\u00eb p\u00ebrpiqem t\u00eb flas p\u00ebr \"evolucionin\" e kernelit t\u00eb rrjetit t\u00eb nj\u00eb ofruesi tipik t\u00eb internetit p\u00ebr nj\u00eb dekad\u00eb t\u00eb fundit.<\/p>\n<p><b>Dhe nj\u00eb dekad\u00eb m\u00eb par\u00eb.<\/b><\/p>\n<p>N\u00eb ato koh\u00eb t\u00eb bekuara, kernel i rrjetit t\u00eb ofruesit mund t\u00eb ishte i thjesht\u00eb dhe i besuesh\u00ebm, si nj\u00eb kork.<\/p>\n<p><img decoding=\"async\" alt=\"Nj\u00eb p\u00ebrgjigje e zgjeruar ndaj komentit, si dhe pak p\u00ebr jet\u00ebn e ofruesve n\u00eb RF\" src=\"\/wp-content\/uploads\/2019\/03\/06c455b9debf27799451d9f29a12a4a9.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nN\u00eb k\u00ebt\u00eb imazh shum\u00eb t\u00eb thjeshtuar mungojn\u00eb magjistrale, unaza, routing ip\/mpls.<\/p>\n<p>Thelbi i saj \u00ebsht\u00eb se trafiku i p\u00ebrdoruesve n\u00eb fund arrinte n\u00eb kthimin e nivelit t\u00eb kernelit \u2014 prej nga shonte n\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/Broadband_remote_access_server\">BNG<\/a><\/noindex>, \u043e\u0442\u043a\u0443\u0434\u0430, \u043a\u0430\u043a \u043f\u0440\u0430\u0432\u0438\u043b\u043e \u2014 \u043e\u0431\u0440\u0430\u0442\u043d\u043e \u0432 \u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0446\u0438\u044e \u044f\u0434\u0440\u0430, \u0438 \u0434\u0430\u043b\u0435\u0435 \u00ab\u043d\u0430 \u0432\u044b\u0445\u043e\u0434\u00bb \u2014 \u0447\u0435\u0440\u0435\u0437 \u043e\u0434\u0438\u043d \u0438\u043b\u0438 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e border gateway&#8217;s \u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442.<\/p>\n<p>Nj\u00eb skem\u00eb e till\u00eb \u00ebsht\u00eb shum\u00eb-e leht\u00eb p\u00ebr t'u rezervuar si n\u00eb L3 (nga routing dinamik), ashtu edhe n\u00eb L2 (MPLS).<\/p>\n<p>Mund t\u00eb vendosni N+1 \u00e7far\u00ebdo: servera aksesit, switch, border \u2014 dhe q\u00eb si do t\u00eb ishte, t'i rezervoni ato p\u00ebr failover automatike.<\/p>\n<p><b>Pas disa vjet\u00ebsh<\/b> t\u00eb gjith\u00ebve n\u00eb Rusi iu b\u00eb e qart\u00eb se nuk mund t\u00eb jetoj\u00eb m\u00eb k\u00ebshtu: ishte e nevojshme t\u00eb shp\u00ebtoheshin urgent f\u00ebmij\u00ebt nga ndikimi i d\u00ebmsh\u00ebm i rrjetit.<\/p>\n<p>Kishte nevoj\u00eb urgjente p\u00ebr t\u00eb k\u00ebrkuar m\u00ebnyra p\u00ebr t\u00eb filtruar trafikun e p\u00ebrdoruesve.<\/p>\n<p>K\u00ebtu ka qasje t\u00eb ndryshme.<\/p>\n<p>N\u00eb nj\u00eb rast jo shum\u00eb t\u00eb mir\u00eb \u2014 di\u00e7ka vendoset \"n\u00eb thyerje\": midis trafikut t\u00eb p\u00ebrdoruesve dhe internetit. Trafiku q\u00eb kalon p\u00ebrmes k\u00ebtij \"di\u00e7kaje\" i n\u00ebnshtrohet analiz\u00ebs dhe, p\u00ebr shembull, d\u00ebrgohet nj\u00eb paket\u00eb e rreme me redirekt n\u00eb drejtim t\u00eb abonentit.<\/p>\n<p>N\u00eb nj\u00eb rast pak m\u00eb t\u00eb mir\u00eb \u2014 n\u00ebse volumi i trafikut lejon \u2014 mund t\u00eb b\u00ebjm\u00eb nj\u00eb truk t\u00eb vog\u00ebl: d\u00ebrgo vet\u00ebm trafikun e d\u00ebrguar nga p\u00ebrdoruesit p\u00ebr filtrim vet\u00ebm drejt atyre adresave q\u00eb duhen filtruar (p\u00ebr k\u00ebt\u00eb, mund t\u00eb marrim adresat IP t\u00eb dh\u00ebna nga regjistri, ose t\u00eb rezolvojm\u00eb domene ekzistuese n\u00eb regjist\u00ebr).<\/p>\n<p>N\u00eb koh\u00ebn e saj, p\u00ebr k\u00ebto q\u00ebllime un\u00eb kam shkruar nj\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/ircop\/nfq_filter\">mini-dpi<\/a><\/noindex> \u2014 megjith\u00ebse asnj\u00ebher\u00eb nuk do ta quaja ashtu. Ai \u00ebsht\u00eb shum\u00eb i thjesht\u00eb dhe jo shum\u00eb efikas \u2014 megjithat\u00eb, edhe ne, edhe dhjet\u00ebra (n\u00ebse jo qindra) ofrues t\u00eb tjer\u00eb na lan\u00eb pa investuar menj\u00ebher\u00eb milionat n\u00eb sisteme industriale DPI, dhe na dhan\u00eb disa vite shtes\u00eb.<\/p>\n<p><b class=\"spoiler_title\">Dhe p\u00ebr t'i p\u00ebrmendur, p\u00ebr DPI-t\u00eb e asaj kohe dhe t\u00eb tanishme<\/b>Duhet th\u00ebn\u00eb se shum\u00eb nga ata q\u00eb blen\u00eb sistemet DPI q\u00eb ishin n\u00eb treg n\u00eb at\u00eb koh\u00eb \u2014 tashm\u00eb i kan\u00eb hequr ato. Ato nuk jan\u00eb t\u00eb dizajnuara p\u00ebr di\u00e7ka t\u00eb till\u00eb: qindra mij\u00ebra adresa, dhjet\u00ebra mij\u00ebra URL.<\/p>\n<p>N\u00eb t\u00eb nj\u00ebjt\u00ebn koh\u00eb, prodhuesit vendas u rrit\u00ebn shum\u00eb p\u00ebr k\u00ebt\u00eb treg. Nuk po flas p\u00ebr p\u00ebrb\u00ebrjen harduerike \u2014 k\u00ebtu gjith\u00e7ka \u00ebsht\u00eb e qart\u00eb, por softi \u2014 gj\u00ebja kryesore q\u00eb ka DPI \u2014 ndoshta sot \u00ebsht\u00eb, n\u00ebse jo m\u00eb e avancuar n\u00eb bot\u00eb, patjet\u00ebr a) po zhvillohet me hapa t\u00eb m\u00ebdhenj dhe b) me \u00e7mimin e kutis\u00eb \u2014 thjesht pa krahasim me konkurrent\u00ebt e huaj.<\/p>\n<p>D\u00ebshiroja t\u00eb krenohesha, por ndiej pak trishtim =)<\/p>\n<p>Tani gjith\u00e7ka dukej k\u00ebshtu:<\/p>\n<p><img decoding=\"async\" alt=\"Nj\u00eb p\u00ebrgjigje e zgjeruar ndaj komentit, si dhe pak p\u00ebr jet\u00ebn e ofruesve n\u00eb RF\" src=\"\/wp-content\/uploads\/2019\/03\/d4b36c9f02fbbe7d36e9dc81fb1fe9ed.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>Edhe pas disa vjet\u00ebsh<\/b> t\u00eb gjith\u00eb kishin revizor\u00eb; resurset n\u00eb regjist\u00ebr po rriteshin gjithnj\u00eb e m\u00eb shum\u00eb. P\u00ebr disa pajisje t\u00eb vjetra (p.sh., cisco 7600) skema me \"filtrimin nga ana\" b\u00ebhej thjesht e pap\u00ebrshtatshme: numri i rrug\u00ebve n\u00eb platformat 76 \u00ebsht\u00eb i kufizuar n\u00eb rreth n\u00ebnt\u00ebqind mij\u00eb, nd\u00ebrkoh\u00eb q\u00eb numri i vet\u00ebm IPv4-rug\u00ebve sot \u00ebsht\u00eb af\u00ebr 800 mij\u00eb. Dhe n\u00ebse flasim edhe p\u00ebr ipv6\u2026 E sa jan\u00eb ajo? 900000 adresa t\u00eb ve\u00e7anta n\u00eb bllokimin e rkn? =)<\/p>\n<p>Disa kaluan n\u00eb skem\u00ebn e pasqyrimit t\u00eb gjith\u00eb trafikut t\u00eb autostrad\u00ebs n\u00eb nj\u00eb server filtrues, i cili duhet t\u00eb analizoj\u00eb t\u00eb gjith\u00eb fluksin dhe, n\u00eb rast se gjen di\u00e7ka t\u00eb keqe, t\u00eb d\u00ebrgoj\u00eb n\u00eb t\u00eb dyja an\u00ebt (d\u00ebrguesit dhe marr\u00ebsit) RST.<\/p>\n<p>Megjithat\u00eb, sa m\u00eb shum\u00eb trafik, aq m\u00eb pak e p\u00ebrshtatshme b\u00ebhet nj\u00eb skem\u00eb e till\u00eb. N\u00ebse ka vonesa t\u00eb vogla n\u00eb p\u00ebrpunim \u2014 trafiku i pasqyruar ndoshta do t'i shp\u00ebtoj\u00eb pa u v\u00ebn\u00eb re, dhe ofruesi do t\u00eb marr\u00eb nj\u00eb protokoll p\u00ebr nj\u00eb gjob\u00eb.<\/p>\n<p>Nj\u00eb num\u00ebr gjithnj\u00eb e m\u00eb i madh i ofruesve t\u00eb sh\u00ebrbimeve \u00ebsht\u00eb i detyruar t\u00eb vendos\u00eb sisteme DPI me nivele t\u00eb ndryshme besueshm\u00ebrie n\u00eb boshtet e komunikimit.<\/p>\n<p><b>Nj\u00eb ose dy vjet m\u00eb par\u00eb<\/b> sipas thashethemeve, praktikisht t\u00eb gjith\u00eb FSB-n\u00eb filluan t\u00eb k\u00ebrkojn\u00eb instalimin real t\u00eb pajisjeve <noindex><a rel=\"nofollow\" href=\"https:\/\/vasexperts.ru\/blog\/osobennosti-i-otlichiya-sorm\/\">SORM<\/a><\/noindex> (m\u00eb par\u00eb shumica e ofruesve t\u00eb sh\u00ebrbimeve shkonte me miratimin e organeve <i>plani SORM<\/i> \u2014 nj\u00eb plan veprimi n\u00eb rast nevoj\u00ebs p\u00ebr t\u00eb gjetur di\u00e7ka diku)<\/p>\n<p>P\u00ebrve\u00e7 parave (jo se jan\u00eb krejt\u00ebsisht astronomike, por megjithat\u00eb \u2013 miliona), SORM-i k\u00ebrkoi nga shum\u00eb njer\u00ebz edhe disa manipulime n\u00eb rrjet.<\/p>\n<ul>\n<li>SORM-i duhet t\u00eb shoh\u00eb adresat \"gri\" t\u00eb p\u00ebrdoruesve, para NAT-imit<\/li>\n<li>SORM-i ka nj\u00eb num\u00ebr t\u00eb kufizuar t\u00eb nd\u00ebrfaqeve t\u00eb rrjetit<\/li>\n<\/ul>\n<p>\nPrandaj, n\u00eb ve\u00e7anti, na duhej t\u00eb ristrukturojm\u00eb nj\u00eb pjes\u00eb t\u00eb thelbit \u2013 thjesht p\u00ebr t\u00eb mbledhur diku n\u00eb nj\u00eb vend trafik p\u00ebr p\u00ebrdoruesit n\u00eb serverat e aksesit. N\u00eb m\u00ebnyr\u00eb q\u00eb ta pasqyronim at\u00eb me disa lidhje n\u00eb SORM.<\/p>\n<p>K\u00ebshtu q\u00eb, shum\u00eb thjesht, ishte (majtas) vs \u00ebsht\u00eb b\u00ebr\u00eb (djathtas):<\/p>\n<p><img decoding=\"async\" alt=\"Nj\u00eb p\u00ebrgjigje e zgjeruar ndaj komentit, si dhe pak p\u00ebr jet\u00ebn e ofruesve n\u00eb RF\" src=\"\/wp-content\/uploads\/2019\/03\/0c6af5715ba59eda722309292c6f6735.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>Tani<\/b> te shumica e ofruesve t\u00eb sh\u00ebrbimeve k\u00ebrkohet gjithashtu implementimi i SORM-3 \u2013 i cili p\u00ebrfshin, p\u00ebrfshir\u00eb, regjistrimin e NAT-imit.<\/p>\n<p>P\u00ebr k\u00ebto q\u00ebllime, n\u00eb skem\u00ebn e m\u00ebsip\u00ebrme na duhej t\u00eb shtonim gjithashtu pajisje t\u00eb ve\u00e7anta p\u00ebr NAT-in (aq sa \u00ebsht\u00eb \u00e7\u00ebshtja q\u00eb diskutohet n\u00eb pjes\u00ebn e par\u00eb). Gjithashtu, p\u00ebr t\u00eb shtuar n\u00eb nj\u00eb rend t\u00eb caktuar: sepse SORM-i duhet t\u00eb \"shoh\u00eb\" trafikun para adres\u00ebs s\u00eb translacionit \u2013 trafiku duhet t\u00eb kaloj\u00eb n\u00eb m\u00ebnyr\u00eb strikte si\u00e7 pason: p\u00ebrdoruesit -&gt; komutimi, thelbi -&gt; serverat e aksesit -&gt; SORM -&gt; NAT -&gt; komutimi, thelbi -&gt; interneti. P\u00ebr k\u00ebt\u00eb, na duhej, n\u00eb t\u00eb v\u00ebrtet\u00eb, t\u00eb \"kthejm\u00eb\" rrjedhat e trafikut n\u00eb an\u00ebn tjet\u00ebr n\u00eb koh\u00eb reale, q\u00eb gjithashtu ishte mjaft e v\u00ebshtir\u00eb.<\/p>\n<p>Pra, n\u00eb p\u00ebrmbledhje: p\u00ebr nj\u00eb dekad\u00eb, skema e thelbit t\u00eb nj\u00eb ofruesi mesatar t\u00eb sh\u00ebrbimeve \u00ebsht\u00eb komplikuar shum\u00eb, dhe pikat e tjera t\u00eb d\u00ebshtimit (si p\u00ebrmes pajisjeve, ashtu edhe p\u00ebrmes linjave t\u00eb komutimit t\u00eb vetme) jan\u00eb rritur ndjesh\u00ebm. Me t\u00eb v\u00ebrtet\u00eb, k\u00ebrkesa p\u00ebr t\u00eb \"par\u00eb gjith\u00e7ka\" n\u00ebnkupton q\u00eb ky \"gjith\u00e7ka\" t\u00eb p\u00ebrqendrohet n\u00eb nj\u00eb pik\u00eb.<\/p>\n<p>Mendoj se kjo mund t\u00eb ekstrapolohet n\u00eb iniciativat aktuale p\u00ebr sovranizimin e Runet-it, mbrojtjen e tij, stabilizimin dhe p\u00ebrmir\u00ebsimin \ud83d\ude42<\/p>\n<p>Dhe p\u00ebrpara \u00ebsht\u00eb akoma Yarovaya.<\/p>\n<p>Burimi: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/444274\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0421\u043f\u043e\u0434\u0432\u0438\u0433 \u043c\u0435\u043d\u044f \u043d\u0430 \u044d\u0442\u043e\u0442 \u043f\u043e\u0441\u0442 \u0432\u043e\u0442 \u044d\u0442\u043e\u0442 \u0432\u043e\u0442 \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439. \u041f\u0440\u0438\u0432\u043e\u0436\u0443 \u0435\u0433\u043e \u0437\u0434\u0435\u0441\u044c: kaleman \u0441\u0435\u0433\u043e\u0434\u043d\u044f \u0432 18:53 \u041c\u0435\u043d\u044f \u0441\u0435\u0433\u043e\u0434\u043d\u044f \u043f\u043e\u0440\u0430\u0434\u043e\u0432\u0430\u043b \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440. \u0412\u043c\u0435\u0441\u0442\u0435 \u0441 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u0430\u0439\u0442\u043e\u0432, \u0443 \u043d\u0435\u0433\u043e \u043f\u043e\u0434 \u0431\u0430\u043d \u043f\u043e\u043f\u0430\u043b \u043f\u043e\u0447\u0442\u043e\u0432\u0438\u043a mail.ru \u0421 \u0443\u0442\u0440\u0430 \u0434\u0435\u0440\u0433\u0430\u044e \u0442\u0435\u0445\u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0443, \u043d\u0438\u0447\u0435\u0433\u043e \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u043d\u0435 \u043c\u043e\u0433\u0443\u0442. \u041f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440 \u043c\u0430\u043b\u0435\u043d\u044c\u043a\u0438\u0439, \u0438 \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u044e\u0442 \u0432\u0438\u0434\u0438\u043c\u043e \u0432\u044b\u0448\u0435\u0441\u0442\u043e\u044f\u0449\u0438\u0435 \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u044b. \u0415\u0449\u0435 \u0437\u0430\u043c\u0435\u0442\u0438\u043b \u0437\u0430\u043c\u0435\u0434\u043b\u0435\u043d\u0438\u0435 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0435 \u0432\u0441\u0435\u0445 \u0441\u0430\u0439\u0442\u043e\u0432, \u043c\u043e\u0436\u0435\u0442 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-29814","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0421\u043f\u043e\u0434\u0432\u0438\u0433 \u043c\u0435\u043d\u044f \u043d\u0430 \u044d\u0442\u043e\u0442 \u043f\u043e\u0441\u0442 \u0432\u043e\u0442 \u044d\u0442\u043e\u0442 \u0432\u043e\u0442 \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439. \u041f\u0440\u0438\u0432\u043e\u0436\u0443 \u0435\u0433\u043e \u0437\u0434\u0435\u0441\u044c:\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sq\/blog\/razvyornutyj-otvet-na-kommentarij-a-takzhe-nemnogo-o-zhizni-provajderov-v-rf\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"sq_AL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0430\u0437\u0432\u0451\u0440\u043d\u0443\u0442\u044b\u0439 \u043e\u0442\u0432\u0435\u0442 \u043d\u0430 \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043d\u0435\u043c\u043d\u043e\u0433\u043e \u043e \u0436\u0438\u0437\u043d\u0438 \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u0432 \u0432 \u0420\u0424 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0421\u043f\u043e\u0434\u0432\u0438\u0433 \u043c\u0435\u043d\u044f \u043d\u0430 \u044d\u0442\u043e\u0442 \u043f\u043e\u0441\u0442 \u0432\u043e\u0442 \u044d\u0442\u043e\u0442 \u0432\u043e\u0442 \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439. \u041f\u0440\u0438\u0432\u043e\u0436\u0443 \u0435\u0433\u043e \u0437\u0434\u0435\u0441\u044c:\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sq\/blog\/razvyornutyj-otvet-na-kommentarij-a-takzhe-nemnogo-o-zhizni-provajderov-v-rf\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:32:09+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:32:09+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47P\u00ebrgjigje e detajuar ndaj komentit, si dhe pak mbi jet\u00ebn e ofruesve n\u00eb RF | ProHoster","description":"M\u00eb motivoi p\u00ebr k\u00ebt\u00eb postimi ky koment. Po e citoj k\u00ebtu:","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/razvyornutyj-otvet-na-kommentarij-a-takzhe-nemnogo-o-zhizni-provajderov-v-rf","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0430\u0437\u0432\u0451\u0440\u043d\u0443\u0442\u044b\u0439 \u043e\u0442\u0432\u0435\u0442 \u043d\u0430 \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043d\u0435\u043c\u043d\u043e\u0433\u043e \u043e \u0436\u0438\u0437\u043d\u0438 \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u0432 \u0432 \u0420\u0424 | ProHoster","og:description":"\u0421\u043f\u043e\u0434\u0432\u0438\u0433 \u043c\u0435\u043d\u044f \u043d\u0430 \u044d\u0442\u043e\u0442 \u043f\u043e\u0441\u0442 \u0432\u043e\u0442 \u044d\u0442\u043e\u0442 \u0432\u043e\u0442 \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439. \u041f\u0440\u0438\u0432\u043e\u0436\u0443 \u0435\u0433\u043e \u0437\u0434\u0435\u0441\u044c:","og:url":"https:\/\/prohoster.info\/sq\/blog\/razvyornutyj-otvet-na-kommentarij-a-takzhe-nemnogo-o-zhizni-provajderov-v-rf","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:32:09+00:00","article:modified_time":"2019-10-31T18:32:09+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"29814","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-20 22:35:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:48:50","updated":"2026-01-20 22:35:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/29814","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=29814"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/29814\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=29814"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=29814"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=29814"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}