Re: Email tapping by ISPs, forwarder addresses, and crypto proxies
Yes, but I think it's fairly clear that if one needs to dissasemble the OC-Ns in the field, you simply need too much gear. It's going to be far easier to grab whole swathes of it and ship it back to Montana or wherever for it to be sifted through later. What they probably do, however, is grab specific DS1s/3s locall and switch those via CALEA back to optical access points, where all of this stuff is pulled together into OC-192s or (very soon) OC-768s. As Variola suggests, once you get it back then you can plow through it at your leisure. Got a disident you want to shut down? "Surely he's said SOMETHING over the last 2 years that you could incriminate him on....find it, dammit!" -TD
From: Morlock Elloi <morlockelloi@yahoo.com> To: cypherpunks@al-qaeda.net Subject: Re: Email tapping by ISPs, forwarder addresses, and crypto proxies Date: Wed, 21 Jul 2004 02:19:20 -0700 (PDT)
Let's back up. You've got an OC-48 or OC-192 fiber and you want to grab ALL of the data in this fiber. Now I'll grant that in real life there's
A. You don't want all data.
A nice illustration on ether speeds is obtained by using simple tools like putting the NIC in promiscuous mode, using simple reassembler and filter that discards everything but smtp/pop text parts. This can be trivially done with tcpdump+awk. The percentage of mail texts is usually less than 2-3% of all traffic. And it's not even because of porn - it's stupidity of html generators (humans & software).
B. Even 'All data' is far less than line speed. Average fiber utilisation is under 4% in US. Buffers!
===== end (of original message)
Y-a*h*o-o (yes, they scan for this) spam follows:
__________________________________ Do you Yahoo!? New and Improved Yahoo! Mail - Send 10MB messages! http://promotions.yahoo.com/new_mail
_________________________________________________________________ Dont just search. Find. Check out the new MSN Search! http://search.msn.click-url.com/go/onm00200636ave/direct/01/
On Wed, Jul 21, 2004 at 10:20:36AM -0400, Tyler Durden wrote:
Yes, but I think it's fairly clear that if one needs to dissasemble the OC-Ns in the field, you simply need too much gear. It's going to be far
It's clearly not viable to process much underwater. How much machine room square meters do you need at those cable landings, though? http://cryptome.quintessenz.at/mirror/cable-eyeball.htm
easier to grab whole swathes of it and ship it back to Montana or wherever for it to be sifted through later.
There is no "later", there's only "elsewhere". Traffic filtering is an embarrassingly parallel problem. It's the data mining that needs to integrate and correlate. Here is your centralized bottleneck. How many .gov in http://top500.org/list/2004/06/ ? Data mining is different from Linpack.
What they probably do, however, is grab specific DS1s/3s locall and switch those via CALEA back to optical access points, where all of this stuff is pulled together into OC-192s or (very soon) OC-768s. As Variola suggests, once you get it back then you can plow through it at your leisure. Got a disident you want to shut down? "Surely he's said SOMETHING over the last 2 years that you could incriminate him on....find it, dammit!"
-- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature]
participants (2)
-
Eugen Leitl -
Tyler Durden