RE: DSL

["Bob McDowell" <bmcdowell () coxhealthplans com>]

My own experience with DSL has shown gobs and gobs of folks rummaging
through my computers.  As a result, my 'test-bed' for Linux firewall has
recently become my house.  I took my Iptables logs and made a pretty
effective presentation by simply showing what hackers were after.

My set-up differs a bit in the fact that my DSL device is some sort of
Ethernet-to-DSL bridge with a router upstream.  I would guess that in my
implementation sniffing would be basically fruitless.

I do, however get a ton of local spoofers and I'd guess they're trying to
pry their way in...

-----Original Message-----
From: snort-users-admin () lists sourceforge net
[mailto:snort-users-admin () lists sourceforge net]On Behalf Of Rich
Adamson
Sent: Tuesday, January 07, 2003 6:31 AM
To: NoLiMiT1961 () aol com; snort-users () lists sourceforge net
Subject: Re: [Snort-users] DSL



> Is it a fact that you can only sniff the traffic on
> DSL that's directed only to you and you caint sniff
> any other traffic at all?

That depends 100% on how your telephone company and ISP configured
their dsl offering. In most US cases, the telephone company provides
the basic dsl pipe, and most of the layer 2 and/or 3 components are
implemented by the ISP. There has been three popular implementations.

1. small telephone companies frequently use a relatively inexpensive
 dslam-like device that act similar to a hub. The equipment allows
 one dsl subscriber to see and interact with some of the other dsl
 subscriber's systems. (Most of these devices appear almost like
 ethernet extenders with no layer 2 or 3 functionality to speak of.)

2. some ISPs implement their head-end equipment in bridging mode as
 it's the easiest configuration to use when you don't understand all
 the technical dsl details. Later they generally wish they would have
 used a true layer-3 approach, but it becomes too costly for them to
 revisit their dsl customers to switch to another implementation.
 The bridging approach will allow broadcasts and some other traffic
 to appear at a customer's location that has no business for going
 there (wastes bandwidth). Given the chatty nature of Microsoft
 systems, you will see some traffic from other dsl customer machines.

3. some ISPs implement true layer-3 at the head-end, reducing the
 amount of other dsl customer traffic seen at your location. That
 implementation generally requires a fair amount of understanding
 and planning prior to activating a dsl offering.

4. regardless of how the telephone company and ISP configure their
 equipment, the majority use dsl modems at the customer location
 that implements Network Address Translation (NAT). The NAT function
 provides a very basic firewall-like function that further reduces
 (and in many cases eliminates) any traffic from neighboring dsl
 users. Pure guess is that something greater then 90% of all dsl
 modems in use implement NAT in one form or another.

Since most people don't have access to the equipment necessary to
sniff (or snort) the actual physical dsl circuit, whether adjacent
dsl customer traffic appears on the wire is mostly irrelevant (except
for the small amount of bandwidth consumed by this unproductive
neighbor broadcast traffic, etc).

If you sniff/snort the ethernet side of the dsl modem (as opposed to
the physical dsl circuit) and see broadcasts, the implementation is
probably either #1 or #2, above.

The telphone companies generally consider the dsl modem as "customer
owned" equipment. Therefore, a fairly large percentage of dsl providers
leave the dsl modem open to console, telnet, web and/or snmp access
in one direction or the other. In some implementations, the modem is
password protected, but the password is given to the customer since the
box is considered customer owned. If a hacker-type subscribes to dsl
services, he can reconfigure the dsl modem in some cases to allow him
to sniff/snort more of his neighboring dsl customer traffic then what
would normally be seen. If the telephone company uses #1, above, the
hacker would see most/all neighboring dsl traffic.

If security is a concern for a dsl customer (regardless of the above),
then the customer should consider an on-site firewall-like device
to reduce the possibility of neighbors rummaging through their mostly
open PC systems, etc.



-------------------------------------------------------
This SF.NET email is sponsored by:
SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See!
http://www.vasoftware.com
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users