-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 12/1/07 11:17 AM, Sean Donelan wrote:
On Fri, 30 Nov 2007, David Newman wrote:
I'd heard about a kiddie porn case getting tossed because the defense successfully argued law enforcement's tap may have dropped frames. I didn't believe it until I measured this myself with a packet blaster.
I would like to see a citation for this case.
Dr. Endicott-Popovsky told me about the case in a phone call earlier this year. My recollection is that she told me only the details about the tap's use in the case, and not the name of the case. You might check directly with her. I believe she's at the University of Washington.
Endicott-Popovsky, B.E., Chee, B. and Frincke, D. Role of Calibration as Part of Establishing Foundation for Expert Testimony, in Proceedings 3rd Annual IFIP WG 11.9 Conference January 29-31, 2007, Orlando, FL.
Thanks for the citation. Using an aggregation tap for a criminal investigation is not a good idea, but I guess it wouldn't surprise me if someone did. Investigators should understand the limitations of their equipment and as suggested check its calibration with known data.
Right. The only point with ops relevance is to be aware that some gigabit fiber taps capture just that -- exactly one gigabit per second, but not more. dn -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.3 (Darwin) iD8DBQFHUdP+yPxGVjntI4IRApqFAJoD0KgBAgCASzB9YO9MtAjjpFo+eQCfc9RY JhYCDJHJh4VpVc36RiPi4M4= =ToWv -----END PGP SIGNATURE-----