4 ms·

Perhaps software and virtual routers are the way to go, especially if any are open source. It would be great if someone with knowledge in this domain could comm

by SeanDav 12y ago

Perhaps software and virtual routers are the way to go, especially if any are open source. It would be great if someone with knowledge in this domain could comment on this.

peterwwillis 12y ago
Well part of the problem is nobody makes open source devices or software that do Enterprise-class work. On top of that you need a sales and support team to manage accounts for customers. Once you have a company designed to create this stuff in an open-source way, virtualized software alone wouldn't change hardware interdiction. If somebody can modify your gear, they can modify the software that runs on your gear. If the hardware was designed to only work with certain signed code, that's another thing... but that would need to be a per-device, per-customer solution, which could get pricey. For a more practical solution you could use today, I would buy hardware locally, then hide it amongst scrap metal and declare $0 value, and have a trusted courier ship it direct along with a secret receipt. If somebody interdicts, i'd have the courier deliver an erroneous receipt so I know something bad happened.
- Phlarp 12y ago
  Until the courier gets served with a NSL
jforman 12y ago
Switches have reasonably sophisticated hardware to prevent packet collisions which would probably be hard to do away with.
- VLM 12y ago
  Digilent NetFPGA board, basically plug a bunch of gig-e connectors into a FPGA, upload some ethernet software and away you go. Upload a softcore and run spanning tree on the softcore. You won't like the price of the board I mentioned. On the other hand, nobody said a dev board with a bazillion extra features you don't want, made in extremely low quantity, is the cheapest possible way to stick a bunch of ethernet PHY to a FPGA (and you could optimize the size of that FPGA if you wanted...) The point of that provided example multi-ethernet FPGA development board isn't that its the best you could do financially or technologically, but that if you tried to do your own thing and screwed up, its probably difficult to do worse. As a practical matter having fooled with much smaller and simpler things the price should end up competitive in the end. The biggest problem is synth takes a long time, god only knows what the CIA and KGB ops embedded in the source, and the IP licenses probably make distribution of the source rather difficult. Its mostly a business/government problem, not a technological problem.
- dfox 12y ago
  Switches have sophisticated hardware on both low and high ends, but many widely used entry level L3 switches are essentially nothing more than large amount of ethernet NICs connected to single CPU (sometimes with hardware acceleration which usually means specialized DMA engine). This is even more true for routers (some Cisco platforms even have various acceleration hardware that their software simply does not use).
wmf 12y ago
The NSA can probably compromise software easier than hardware. Even for open source, enterprise and telco customers will be using official builds (by which I mean officially NSA-compromised).
scottlinux 12y ago
You can use Linux as a router. Any Linux distro would work (Debian, Ubuntu, RHEL, SuSE, etc). I do this at home and work with a Debian router. There is also pfsense as well.

by SeanDav 12y ago

Perhaps software and virtual routers are the way to go, especially if any are open source. It would be great if someone with knowledge in this domain could comment on this.

peterwwillis 12y ago

Well part of the problem is nobody makes open source devices or software that do Enterprise-class work. On top of that you need a sales and support team to manage accounts for customers. Once you have a company designed to create this stuff in an open-source way, virtualized software alone wouldn't change hardware interdiction. If somebody can modify your gear, they can modify the software that runs on your gear. If the hardware was designed to only work with certain signed code, that's another thing... but that would need to be a per-device, per-customer solution, which could get pricey. For a more practical solution you could use today, I would buy hardware locally, then hide it amongst scrap metal and declare $0 value, and have a trusted courier ship it direct along with a secret receipt. If somebody interdicts, i'd have the courier deliver an erroneous receipt so I know something bad happened.

Phlarp 12y ago
Until the courier gets served with a NSL

jforman 12y ago

Switches have reasonably sophisticated hardware to prevent packet collisions which would probably be hard to do away with.

VLM 12y ago
Digilent NetFPGA board, basically plug a bunch of gig-e connectors into a FPGA, upload some ethernet software and away you go. Upload a softcore and run spanning tree on the softcore. You won't like the price of the board I mentioned. On the other hand, nobody said a dev board with a bazillion extra features you don't want, made in extremely low quantity, is the cheapest possible way to stick a bunch of ethernet PHY to a FPGA (and you could optimize the size of that FPGA if you wanted...) The point of that provided example multi-ethernet FPGA development board isn't that its the best you could do financially or technologically, but that if you tried to do your own thing and screwed up, its probably difficult to do worse. As a practical matter having fooled with much smaller and simpler things the price should end up competitive in the end. The biggest problem is synth takes a long time, god only knows what the CIA and KGB ops embedded in the source, and the IP licenses probably make distribution of the source rather difficult. Its mostly a business/government problem, not a technological problem.
dfox 12y ago
Switches have sophisticated hardware on both low and high ends, but many widely used entry level L3 switches are essentially nothing more than large amount of ethernet NICs connected to single CPU (sometimes with hardware acceleration which usually means specialized DMA engine). This is even more true for routers (some Cisco platforms even have various acceleration hardware that their software simply does not use).

wmf 12y ago

The NSA can probably compromise software easier than hardware. Even for open source, enterprise and telco customers will be using official builds (by which I mean officially NSA-compromised).

scottlinux 12y ago

You can use Linux as a router. Any Linux distro would work (Debian, Ubuntu, RHEL, SuSE, etc). I do this at home and work with a Debian router. There is also pfsense as well.