Re: What's the best way to wiretap a network?

2004-01-23 Thread Roland Perry
In article [EMAIL PROTECTED], Kurt Erik Lindqvist [EMAIL PROTECTED] writes (Although I now what the NA...stands for I have to ask) Plenty of NANOs will have bits of network in the EU (or indeed within the remit of the Cybercrime Convention which the USA has signed but not ratified). So the EU

Re: What's the best way to wiretap a network?

2004-01-22 Thread Kurt Erik Lindqvist
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 (Although I now what the NA...stands for I have to ask) From the initial discussions in Sweden around the new electronic communications act, it seems as if the operators are obliged to provide tapping free of charge. If this turns out to be

Re: What's the best way to wiretap a network?

2004-01-21 Thread Kurt Erik Lindqvist
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 2004-01-20, at 22.19, Steven M. Bellovin wrote: In message [EMAIL PROTECTED], William Allen Simpson writes: Eriks Rugelis wrote: On the other hand, if your environment consists of a large number (100's) of potential tapping points,

Re: What's the best way to wiretap a network?

2004-01-21 Thread Daniel Karrenberg
On 21.01 09:24, Kurt Erik Lindqvist wrote: From the initial discussions in Sweden around the new electronic communications act, it seems as if the operators are obliged to provide tapping free of charge. If this turns out to be the case, I guess it is pretty much the same all over

Re: What's the best way to wiretap a network?

2004-01-21 Thread Paul Wouters
On Tue, 20 Jan 2004, William Allen Simpson wrote: This is a feature, not a bug. Law enforcement is required to pay -- up front -- all costs of tapping. No pay, no play. Oh, I wish, I wish In NL, law dictates any telecommunicatins device (as defined amongst things as anything with

Re: What's the best way to wiretap a network?

2004-01-21 Thread Roland Perry
In article [EMAIL PROTECTED], Kurt Erik Lindqvist [EMAIL PROTECTED] writes From the initial discussions in Sweden around the new electronic communications act, it seems as if the operators are obliged to provide tapping free of charge. If this turns out to be the case, I guess it is pretty much

Re: What's the best way to wiretap a network?

2004-01-20 Thread Eriks Rugelis
Sean Donelan wrote: Assuming lawful purposes, what is the best way to tap a network undetectable to the surveillance subject, not missing any relevant data, and not exposing the installer to undue risk? 'Best' rarely has a straight-forward answer. ;-) Lawful access is subject to many of the

Re: What's the best way to wiretap a network?

2004-01-20 Thread Scott McGrath
Scott C. McGrath On Tue, 20 Jan 2004, Eriks Rugelis wrote: Sean Donelan wrote: Assuming lawful purposes, what is the best way to tap a network undetectable to the surveillance subject, not missing any relevant data, and not exposing the installer to undue

Re: What's the best way to wiretap a network?

2004-01-20 Thread William Allen Simpson
Eriks Rugelis wrote: On the other hand, if your environment consists of a large number (100's) of potential tapping points, then you will quickly determine that in-line taps have very poor scaling properties. a) They are not rack-dense b) They require external power warts

Re: What's the best way to wiretap a network?

2004-01-20 Thread Steven M. Bellovin
In message [EMAIL PROTECTED], William Allen Simpson writes: Eriks Rugelis wrote: On the other hand, if your environment consists of a large number (100's) of potential tapping points, then you will quickly determine that in-line taps have very poor scaling properties. a) They are

Re: What's the best way to wiretap a network?

2004-01-18 Thread Chris Brenton
On Sat, 2004-01-17 at 21:08, Sean Donelan wrote: Assuming lawful purposes, what is the best way to tap a network undetectable The best way to go undetectable is easy, run the sniffer without an IP address. The best way to tap a network varies with your setup. If your repeated, just plug in

Re: What's the best way to wiretap a network?

2004-01-18 Thread Paul Vixie
Assuming lawful purposes, what is the best way to tap a network undetectable ... The best solution I've found is to use an Ethernet tap. It allows you to piggy back off of an existing connection and monitor all the traffic going to and from that system. Its pretty undetectable, does not

Re: What's the best way to wiretap a network?

2004-01-18 Thread Steven M. Bellovin
In message [EMAIL PROTECTED], Paul Vixie writes: i'm fairly sure that this is what law enforcement uses for wiretap warrants. I believe you're correct. In fact, I first learned of these devices from government documents during the Carnivore discussions a few years ago.

Re: What's the best way to wiretap a network?

2004-01-18 Thread Bohdan Tashchuk
You can plug a mini-hub in line and use that as a tap point to monitor the stream. Up side is its cheap and easy. Down side is you have to drop to half duplex. Not a problem in most situations but in some the drop in performance can be an issue. Don't throw out your old hubs. It's hard to find

Re: What's the best way to wiretap a network?

2004-01-18 Thread Sean Donelan
On Sun, 18 Jan 2004, Steven M. Bellovin wrote: In message [EMAIL PROTECTED], Paul Vixie writes: i'm fairly sure that this is what law enforcement uses for wiretap warrants. I believe you're correct. In fact, I first learned of these devices from government documents during the Carnivore

Re: What's the best way to wiretap a network?

2004-01-17 Thread Jared Mauch
I'd have to say this depends on the media involved. ethernet switches allow the monitoring of specific ports (or entire vlans) in most cases. This can be done without impact (assuming nobody goofs on the ethernet switch config) to other people and limit the scope of packets

Re: What's the best way to wiretap a network?

2004-01-17 Thread doug
We've been using Shomiti taps for several years with good effect. All they do is copy all the data going through a segment (100bT in our case) to two ports, one for inbound, another for outbound. Now Finisar, they sell both copper and fiber taps for a variety of media, including Ethernet from