...

I'm sorry, but this is simply an unsupportable statement. What is required of routers is that the provider be able to configure the device to make copies of certain packets to a monitoring port. Assuming that the monitoring port is duly managed, how does this qualify as "insecure"?

It qualifies as "insecure" because if that rather dubious assumption fails to be true, you have a big problem.

Then you'll have to conclude that a lot of managed switches are insecure since they include some form of packet mirroring capability. Steinar Haug, Nethelp consulting, sthaug@nethelp.no