3 ms·

Isn’t their whole thing supposed to be spying on foreigners? They seem to be quite successful. There aren’t that many exchanges [1]. Could probably manage with

by junofan 25d ago

Isn’t their whole thing supposed to be spying on foreigners? They seem to be quite successful. There aren’t that many exchanges [1]. Could probably manage with cash, guns, and some know-how. [1]: https://en.wikipedia.org/wiki/List_of_Internet_exchange_points_by_size https://en.wikipedia.org/wiki/List_of_Internet_exchange_poin...

strictnein 25d ago
If you just look at the largest 4 of those, you'd have 100Tbps of traffic to monitor, with an average throughput of roughly half of that. That's ~540PB ((50 Tbps / 8 bits) * 86400 seconds/day) of traffic a day with just those four. Add in the rest and you're likely talking ~Exabytes of data each day. And that has to all be processed on site. If someone wants to argue that the NSA is in these facilities I'd be 100% onboard. But inspecting it all would be nearly impossible, let alone capturing it all and sending it back to some datacenter somewhere, which is a physical impossibility.
- mitxela 25d ago
  That's nothing a rack full of fast switches can't handle. A rack full of fast switches already does handle it - where do you think the original copy came from? They will get a copy of the whole feed, but not store all of it - they will have heuristics for selecting interesting traffic.
  - strictnein 24d ago
    Switches handle data at far faster rate than any hardware can actually inspect it, store it, process it, etc. But yeah, just a rack of "fast switches" is all it takes to route hundreds of petabytes of data each day. You should let the data center operators know. They'd save billions.
    - mitxela 24d ago
      Switches do inspect it. They also have a feature designed for wiretapping, which copies a percentage of traffic to another port. They may have a feature to copy 100% of traffic matching a certain filter. Managed switch ASICs have this feature even though it's usually not exposed in the CLI.

by junofan 25d ago

strictnein 25d ago

If you just look at the largest 4 of those, you'd have 100Tbps of traffic to monitor, with an average throughput of roughly half of that. That's ~540PB ((50 Tbps / 8 bits) * 86400 seconds/day) of traffic a day with just those four. Add in the rest and you're likely talking ~Exabytes of data each day. And that has to all be processed on site. If someone wants to argue that the NSA is in these facilities I'd be 100% onboard. But inspecting it all would be nearly impossible, let alone capturing it all and sending it back to some datacenter somewhere, which is a physical impossibility.

mitxela 25d ago
That's nothing a rack full of fast switches can't handle. A rack full of fast switches already does handle it - where do you think the original copy came from? They will get a copy of the whole feed, but not store all of it - they will have heuristics for selecting interesting traffic.
- strictnein 24d ago
  Switches handle data at far faster rate than any hardware can actually inspect it, store it, process it, etc. But yeah, just a rack of "fast switches" is all it takes to route hundreds of petabytes of data each day. You should let the data center operators know. They'd save billions.
  - mitxela 24d ago
    Switches do inspect it. They also have a feature designed for wiretapping, which copies a percentage of traffic to another port. They may have a feature to copy 100% of traffic matching a certain filter. Managed switch ASICs have this feature even though it's usually not exposed in the CLI.