Sampled Traffic Analysis by Internet-Exchange-Level Adversaries

[coderman]

On 5/28/07, coderman <coderman at gmail.com> wrote:
>... is the assumption that inspection at
>OC/WDM layers is too cumbersome/expensive for all but the previously
>mentioned TLA/$gov adversaries?

one more comment that ties into your mention PCIe bus limitations.
previous research on monitoring high speeds links has shown FPGA
devices well suited for header and deep packet inspect at line rates
up to 10GigE for hundreds of snort style  filter rules. this approach
scales in a linear fashion.

i'll try to find some of the papers on this subject; i don't have them
on hand.  coincidentally, many of those involved in such projects seem
to get sucked into the proprietary/classified commercial and
government sectors. *grin*

it's turtles, all the way down...

----- End forwarded message -----
-- 
Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org
______________________________________________________________
ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org
8B29F6BE: 099D 78BA 2FD3 B014 B08A  7779 75B0 2443 8B29 F6BE