August 2005 - Test - lists.nanog.org

FCC Issues Rule Allowing FBI to Dictate Wiretap-Friendly Design for In ternet Services
by Fergie (Paul Ferguson) 08 Aug '05

08 Aug '05

Via the EFF website. [snip] Today the Federal Communications Commission (FCC) issued a release announcing its new rule expanding the reach of the Communications Assistance to Law Enforcement Act (CALEA). The ruling is a reinterpretation of the scope of CALEA and will force Internet broadband providers and certain voice-over-IP (VoIP) providers to build backdoors into their networks that make it easier for law enforcement to wiretap them. The Electronic Frontier Foundation (EFF) has argued against this expansion of CALEA in several rounds of comments to the FCC on its proposed rule. CALEA, a law passed in the early 1990s, mandated that all telephone providers build tappability into their networks, but expressly ruled out information services like broadband. Under the new ruling from the FCC, this tappability now extends to Internet broadband providers as well. Practically, what this means is that the government will be asking broadband providers - as well as companies that manufacture devices used for broadband communications to build insecure backdoors into their networks, imperiling the privacy and security of citizens on the Internet. It also hobbles technical innovation by forcing companies involved in broadband to redesign their products to meet government requirements. "Expanding CALEA to the Internet is contrary to the statute and is a fundamentally flawed public policy," said Kurt Opsahl, EFF staff attorney. "This misguided tech mandate endangers the privacy of innocent people, stifles innovation and risks the functionality of the Internet as a forum for free and open expression." [snip] http://www.eff.org/news/archives/2005_08.php#003876 - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

10 15

Re: Fiber cut in SJ
by George William Herbert 08 Aug '05

08 Aug '05

>> So... is mail not getting in/out from Nanog right now, >> or is the fairly major fiber cut in San Jose not newsworthy >> on the operational list anymore....? > >I'm gonna guess that people were too distracted with "Oh crap, where'd >the internet go?" I couldn't get to outside email from inside for a while. >So since there's the question, for those not in the know, the word is >that there was a cut through half of a 1000 strand cable owned by >Level3, affecting 502 fibers. > >It's my understanding that they've been splicing since 23:45 GMT and >that they're moving through the mass of fibers at an impressive rate. I have it on good authority (fiber provider, around 5:30 pm pst) that the outage happened in two phases. First, an electrical contractor backhoed a large fiber link in downtown San Jose (address deleted due to security concerns) this morning, causing moderate damage. Initial repair efforts apparently went nowhere; there wasn't enough cable and trench space to work with. Around 2pm PST the repair lead onsite had the remaining cable sliced at manhole access points a couple of hundred meters each direction from the original cut, to give them clean surfaces and workspace for the splice. Which of course took out the other hundreds of pairs which had survived the initial backhoe. We certainly didn't get any warning that was going to happen, and neither did anyone else we were able to talk to over the course of the afternoon. I also understand from a couple of fiber providers that an unusually large amount of other fiber had been groomed onto that one cable over the last few years of consolidations. Eight or nine people I had talked to thought they had geographically distinct ring loops that turned out to be on that one cable when the second cut took it down hard. -george william herbert gherbert(a)retro.com

5 6

Re: /8 end user assignment?
by Sabri Berisha 08 Aug '05

08 Aug '05

On Fri, Aug 05, 2005 at 02:04:21PM -0700, Peter Boothe wrote: > On Fri, 5 Aug 2005, Sabri Berisha wrote: Hi Peter, > Everything can break. We want to know what will break less. > > http://soy.dyndns.org/~peter/projects/research/anycast/nanog/ > So, since Daniel Karrenberg showed that there was at least a 1% difference > between anycast and unicast reliability, and we showed that the median AS > switches root clusters every 3 hours, anycast is still a net win for the > median AS, even with TCP queries, and is probably a net win for everyone > except the people who have severe extant route flapping issues. So what I understand from your slides is basically that you acknowledge the fact that it is theoretically possible for the setup to cause temporary loss of connectivity (very minor packetloss) which may result in DNS queries to timeout, but that the impact of such an event has no real-life damage. I thought that it would be virtually impossible to get this actually working outside of a lab-environment due to continuous route-changes on the net. I stand corrected. -- Sabri Berisha, Juniper Certified - JNCIA #747 | Cisco Certified - CCNA email: sabri(a)cluecentral.net | cell: +31 6 19890416 http://www.cluecentral.net/ | http://www.virt-ix.net/

1 0

RE: FCC Issues Rule Allowing FBI to Dictate Wiretap-Friendly Design for In ternet Services
by Hannigan, Martin 07 Aug '05

07 Aug '05

> > That is IF you even get an order. The brunt of the work is > > at the tier1's. This is like DDOS. LEC's have to do it, but > > they frequently misinterpret the requirements and scale and > > end up spending money they never had to. Misinterpretation is > > a big problem for CALEA, technically speaking. > > First time anyone has every accused tier 1's of spending > money they didn't > need too. Let me lower the reading comprehension level for you. I said that tier1's bear the brunt of the orders, and insinuated that tier2's get less orders. They do. Many midwest/rural CLEC's get NO orders. They must still be compliant. > > Folks may find it useful to review [ SNIP ] The place to get the authoritative word is direct from the AskCALEA folks here: http://www.askcalea.net/ - and of course you can discuss with your telecom lawyers. You may be confusing terminology though, which is understandable. I can't find a government official calling defining the applicability of the law a "wish list" so I'll leave that to the gentle readers to determine. -M<

3 2

Re: Cisco mulls buying Nokia?
by Fergie (Paul Ferguson) 07 Aug '05

07 Aug '05

Voice over WiFi? - ferg -- Rachael Treu Gomes <rara(a)navigo.com> wrote: Strange... Explicit reference to how this would enable Cisco to gain purchase into the wireless space, but no mention of the impact on the popularity of Nokia platforms with a competing firewall vendor, Check Point. Any thoughts on VoIP? ymmv, --ra -- rachael treu gomes rara(a)navigo.com ..quis custodiet ipsos custodes?.. (this email has been brought to you by the letters 'v' and 'i'.)

1 0

Cisco mulls buying Nokia?
by Fergie (Paul Ferguson) 07 Aug '05

07 Aug '05

I had to check the date to make sure it wasn't really April 1st.... A Reuters newswire article, via Yahoo! News, reports that: [snip] Cisco Systems Inc. is considering buying the world's top mobile handset maker Nokia in a bid to gain its wireless infrastructure technology, the Business newspaper reported on Sunday. The paper, which did not reveal the source of its information, said U.S.-based Cisco had traditionally concentrated on acquisitions of niche technology players, but its Chief Executive John Chambers is believed to be interested in merging with a wireless infrastructure company. "Nokia has been identified as the most likely target," the paper said. Cisco, the largest maker of Internet equipment, is worth around $123 billion, while Nokia's market value is around $71 billion. The paper said Cisco's mainstay networking market was fast changing with the convergence of fixed-line and wireless networks, and Cisco needed a merger to acquire the technology to create intelligent wireless applications, which Finnish-based Nokia could provide. Cisco was not immediately available for comment. A Nokia spokeswoman in Helsinki declined to comment. [snip] http://news.yahoo.com/s/nm/20050807/bs_nm/telecoms_cisco_nokia_dc - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1

RE: DACS Equipment
by Hannigan, Martin 07 Aug '05

07 Aug '05

> > > I have a number of mux DS-3s coming in - right now they drop straight > into aggregation routers. What I like to do is drop them into > a local DACS > and comb them out to DS-1s and then re-mux them back on to > internal DS-3s. > This will let me move circuits around digitally inside our equipment. You're looking for digital cross connect, for the most part. You should take a look at the Cisco line i.e. 15454 et. al. You can bring in ds3, groom on the backplane, and send out ds3. I've used the 15454 et. al. in production and for your stated purpose it's more economical than buying some big iron. You may also want to consider your physical layer architecture if you do this i.e. interconnecting vs. cross connecting so that you have test access where you need it. IIRC, the 15454 et. al. will do passive monitoring at a line level and will SNMP alert on outages down to the smallest mux' unit. Very nice for the IP NOC. -M<

1 0

RE: FCC Issues Rule Allowing FBI to Dictate Wiretap-Friendly Design for In ternet Services
by Hannigan, Martin 07 Aug '05

07 Aug '05

> I think the EFF is missing the important part of the wish > list items. The punch list is law. If you are talking about the applicability of CALEA, that's different. > The > wish list items aren't for wiretaps, but defining as many things as > possible as "non-content." Its important for network > operators because > they will end up doing a lot more work digging through packets for > non-content information, and important for lawyers because it > lessens the > legal requirements for non-content information. What is the > "expectation > of privacy" of non-content information? ObNANOG: Archicture, operation, cost. CALEA doesn't dictate architecture. Political issues aside, and attempting to stick with operations as this is NANOG, the major issue for carriers regardless of size is that this that compliance is an expense. The cost of an implementation for a medium sized carrier is upwards of 1MM. Maintenance runs at ~200K per year for a similiar installation not coupling in legal and operations costs. That is IF you even get an order. The brunt of the work is at the tier1's. This is like DDOS. LEC's have to do it, but they frequently misinterpret the requirements and scale and end up spending money they never had to. Misinterpretation is a big problem for CALEA, technically speaking. -M<

2 1

RE: FCC Issues Rule Allowing FBI to Dictate Wiretap-Friendly Design for In ternet Services
by Hannigan, Martin 07 Aug '05

07 Aug '05

> > > > On Sat, 6 Aug 2005, Matt Ghali wrote: > > > > > On Sat, 6 Aug 2005, Joshua Brady wrote: > > > > the FBI can call the NSA anytime they want without a tap order and > > get them to trigger ECHELON when your voice is apparant on any > > line. > > > > > > Not me, I wrapped my cellphone in tin foil. > > shiny side out one hopes? Seriously though, I'm not a > telco/phone person, > but I was once told that the phone switch equipment does the tap > 'automagically' to special ds-1 facilities inn LEA-land... > which means the > cell phone can be wrapped in anything you'd like. If the calls get > completed a copy is silently made to the right folks (not the > nsa, they > aren't LEA). Sort of. It has to be provisioned like any other service, (that's most of the X.25 portion that people were talking about) but it's a protocol(J-STD) enabled between the carrier and the LEA. It can be DS1, or it could be VPN. The capture is near real time content and data. -M<

1 0

Re: FCC Issues Rule Allowing FBI to Dictate Wiretap-Friendly Design for In ternet Services
by sthaug＠nethelp.no 07 Aug '05

07 Aug '05

> > I'm sorry, but this is simply an unsupportable statement. What is > > required of routers is that the provider be able to configure the device > > to make copies of certain packets to a monitoring port. Assuming that > > the monitoring port is duly managed, how does this qualify as "insecure"? > > It qualifies as "insecure" because if that rather dubious assumption fails to > be true, you have a big problem. Then you'll have to conclude that a lot of managed switches are insecure since they include some form of packet mirroring capability. Steinar Haug, Nethelp consulting, sthaug(a)nethelp.no

2 1