Re: IP sniffing (was:Re: Whaaa...?)

From: Dan Clemmensen (dgc@cox.rr.com)
Date: Mon Apr 29 2002 - 22:01:16 MDT


Mike Lorrey wrote:

> 3@cox.rr.com>
> Content-Type: text/plain; charset=us-ascii
> Content-Transfer-Encoding: 7bit
>
> Dan Clemmensen wrote:
>
>>R. Coyote wrote:
>>
>>
>>>I wonder how I can put my DSL modem into promiscuous mode
>>>
>>>
>>You can't. The modem is decoding a single point-to-point
>>connection between itself and the DSLAM at the far end.
>>The only traffic on that connection is destined for
>>you or originated by you.
>>
>
> Since DSLs are attached to switches rather than just modem banks kluged
> together on hubs (how ISP's used to do it), they get only the IP packets
> that they are supposed to get, *as a full power signal*. This is not to
> say that you couldn't look for ghost packets due to Tempest-type
> radiation on the line, but you'd essentially have to just tape the whole
> line signal, filter out your own packet traffic, then capture any
> digital signals that remain above line noise, boost that amplitude, then
> scan that for packet information. So you'd need something more than your
> desktop PC and DSL modem alone to do this...
>
> If you look at the internet as a universe of radiation, all of the
> packets that switches prevent from passing anywhere on the net
> generates noise. These result in a sort of Cosmic Internet Background
> Radiation level. The local switch, though, acts like a membrane, letting
> properly coded spacecraft through. However, if you ding the membrane and
> don't get through, you will create an echo which will be stronger than
> the echos generated at successively more distant switches.
>
>

Where to start?
   1) As soon as you get into capturing of any signal other than the
primary digital signal, you need very sophisticated
equipment, far beyond what most of us can cobble together in the
basement. It's almost always cheaper to use a different sort of attack
such as breaking into the target's house, unless the target is really
serious about defending the data.
   2) DSL is RF imposed on the phone pair. It radiates all over the
place, especially into other copper pairs in the same cable.
   3) The trunk side of a DSLAM is almost always a fiber-optic (OC-3 or
better.) You will get essentially no cross-talk from the DSL onto the
fiber. Upstream from that you have still more fiber. Every time an
optical signal (O) must be reshaped, it is converted into an electrical
signal (E) and back to O via a process known as O-E-O regeneration.
Each O-E-O is an essentially perfect filter, rejecting all crosstalk,
and the fibers don't radiate.
   4) There are some very odd forms of "cross-talk" in the purely digital
domain, but they are so subtle as to be of no practical use except to
deliberately send data seriptisciously. Example: a sender may craft a
data stream that imposes an intermittent load pattern on a router. This
will affect the delay seen by other data streams. You can analyze the
delays statistically and use this phenomenon to send data. Again,
it's much cheaper and simpler to use steanography or other techniques
in almost all cases.



This archive was generated by hypermail 2.1.5 : Sat Nov 02 2002 - 09:13:43 MST