[101019] in North American Network Operators' Group
Re: Giga fiber Tap
daemon@ATHENA.MIT.EDU (David Newman)
Sat Dec 1 16:38:01 2007
Date: Sat, 01 Dec 2007 13:37:03 -0800
From: David Newman <dnewman@networktest.com>
To: Sean Donelan <sean@donelan.com>
CC: nanog@merit.edu
In-Reply-To: <Pine.GSO.4.64.0712011405220.24410@clifden.donelan.com>
Errors-To: owner-nanog@merit.edu
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 12/1/07 11:17 AM, Sean Donelan wrote:
> On Fri, 30 Nov 2007, David Newman wrote:
>> I'd heard about a kiddie porn case getting tossed because the defense
>> successfully argued law enforcement's tap may have dropped frames. I
>> didn't believe it until I measured this myself with a packet blaster.
>
> I would like to see a citation for this case.
Dr. Endicott-Popovsky told me about the case in a phone call earlier
this year. My recollection is that she told me only the details about
the tap's use in the case, and not the name of the case.
You might check directly with her. I believe she's at the University of
Washington.
>> Endicott-Popovsky, B.E., Chee, B. and Frincke, D. Role of Calibration as
>> Part of Establishing Foundation for Expert Testimony, in Proceedings 3rd
>> Annual IFIP WG 11.9 Conference January 29-31, 2007, Orlando, FL.
>
> Thanks for the citation. Using an aggregation tap for a criminal
> investigation is not a good idea, but I guess it wouldn't surprise me if
> someone did. Investigators should understand the limitations of their
> equipment and as suggested check its calibration with known data.
Right. The only point with ops relevance is to be aware that some
gigabit fiber taps capture just that -- exactly one gigabit per second,
but not more.
dn
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (Darwin)
iD8DBQFHUdP+yPxGVjntI4IRApqFAJoD0KgBAgCASzB9YO9MtAjjpFo+eQCfc9RY
JhYCDJHJh4VpVc36RiPi4M4=
=ToWv
-----END PGP SIGNATURE-----
