Re: Network sniffer

From: S Moonesamy <sm+mu_at_elandsys.com>
Date: Thu, 07 Jul 2022 10:58:44 -0700


Hi Ish,
At 10:19 AM 07-07-2022, Ish Sookun wrote:
>After you mentioned about looking into the
>"trailer" part, I read RFC 791 and RFC 1661. I
>update the blog post and added an erratum at the
>bottom to explain the correction made. Is that part that I mentioned correct?

Section 1.3 of RFC 791 was written from the
ARPANET case, i.e. the precursor of what is
nowadays known as the Internet. I'll have to do
some reading before commenting more about that section.

The specifications for PPPoe are RFC 1661 and RFC 2516.

>No. I wanted to say exactly that. If the sniffer
>performs DPI on encrypted data, it might know
>the nature of the data by comparing signatures
>against a database but not read the actual data. Did I convey this wrong?

The "sniffer" would have to compare the actual
data against the list of "signatures" and it has
to read the data to be able to do that.

>I didn't focus on how would a third-party get
>access to the ISP's network infrastructure. I
>meant anyone having access to that
>infrastructure can get access to the network
>traffic. I should probably add the word ISP in the question & answer.

There were some ISP networks which were designed
like that. I would expect the network design to
be better nowadays as it is not good practice for
a commercial entity to use that design.

Regards,
S. Moonesamy
Received on Thu Jul 07 2022 - 18:01:06 PST

This archive was generated by hypermail 2.4.0 : Fri Jul 08 2022 - 05:00:01 PST