[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: NAT detection



A buddy of mine who works for a local branch of a cable co. described how they monitor in his particular situation. With this company, it's not at the local level, but at the regional NOC.

While most of the identification techniques listed so far are nifty, it would be pretty pointless to use these techniques en masse. Most people on this list are sysadmins of some sort, so given the task by management, how would you peg the people who are 'abusing' service? I would do some statistical analysis of the traffic, and look for massive abusers. People who are sharing 802.11b APs to an apartment complex or something will light up like a red flag in sheer bandwidth use. People who are using VPNs or other problem protocols will have alot of port specific traffic. How are you going to distinguish between someone who has set up a regular web server for hosting and someone who is hacking up a highschool project with frontpage? Simple, the people who get bunches o' port 80 traffic to their web server are hosting.

This is the most effective way to do it. Look for the bad boys with traffic analysis, then use the more in-depth techniques to verify that they're abusing TOS. IF the cable companies try doing this stuff en masse, it will only hurt them in the long run. So be it if they do.

-Mike



Visit your host, monkey.org