6 ms·
Every router is technically capable of doing this. It's just firewall rules and pcap. Not sure this is front-page worthy.
by sgjohnson 4y ago
Every router is technically capable of doing this.
It's just firewall rules and pcap.
Not sure this is front-page worthy.
- kj4ips 4y agoIt depends, I've got some junipers that only pass the application processor the first N bytes of a packet, and even captures are limited to the first N bytes. Vendor docs say that if you need captures, you should do them on the switch, or use DPI and route everything through the application processor.
- bombcar 4y agoYou could probably develop a "NSA sniffer" to determine when captures are happening by noting network degradation, especially if it forces everything onto the application processor and off of fast-path.
- jhartwig 4y agolike putting a script on the switch that says the cpu utilization is x% higher? Do higher end switches report out utilization of the packet processing asic? I have a few high end switches in my homelab, I can of course tell the utilization of the management processor but I have never tried to delve into what the actual switch chip is doing.
- bombcar 4y agoI was thinking more remotely noticing that throughput dropped - my switches can route at line speed if they avoid the CPU, but if the CPU is involved it drops to about half line speed. If you're the one controlling the network router, you know when the sniffing is going on - this would be trying to detect that your ISP has turned the "NSA button" on.
- capableweb 4y agoSeems like a feature for mandatory "intercept and log network traffic" is interesting enough for hackers for the story to land on the frontpage. I didn't know about CALEA since before but I've dealt with lots of network infrastructure (never in the US though), so I found this interesting, and upvoted it.
- medo-bear 4y ago> Not sure this is front-page worthy why not ? i believe it is especially as i imagine most people are not aware that such things exist in freedom lands
- sgjohnson 4y agoTo be fair, this makes perfect sense. It allows compliance with wiretap warrants. Which are perfectly reasonable.
- salawat 4y agoThey are not. This is broadband. This goes far beyond pen-registers. This is bloody everything from a particular endpoint, and not in an application specific manner. There is very little but storage reqs and someone getting uppity keeping this from becoming a dragnet type of surveillance mechanism.
- kube-system 4y agoThe warrant is part that makes it not a dragnet.
- jaywalk 4y agoDepends on how specific and difficult the warrants are.
- distantsounds 4y agoif you're on HN there is a level of confidence that you understand basic networking, and that you are aware your traffic goes through a multitude of devices before you get the data you requested. it should come as no surprise that those devices can log the data passing through it.
- icedchai 4y agoJust wait... someone will complain this is a GDPR violation. ;)
- frankfrankfrank 4y agoI find that nephile mentality quite ignorant of the fact that the negative and bad things aren’t just ephemeral, regardless of whether you would like to move on to next-thing. But I guess to people with your mindset the slippery slope is no slope at all, but rather a flat plane as you are sliding down it. “Why are you so concerned with the old Constitution” you proclaim, “we have the patriot act instead. It even has the word patriot in its title and the iPatriot act is on the way to replace the old patriot act. I support next-thing.”
- deleted 4y ago[deleted]