🚀 go-pugleaf

[POSTED TO comp.dcom.modems.cable; PLEASE REPLY THERE]

In <3A776B57.C495242C@mynetwatchman.com>, Lawrence Baldwin
<baldwinlSPAMMENOT@mynetwatchman.com> wrote:

>John Navas wrote:

>> Am I missing something, or are you just referring to encryption between
>> the cable modem and the CMTS? 
>
>Absolutely.
>
>> If the latter, then traffic beyond the
>> CMTS is unencrypted, and just as exposed as DSL traffic.  Both are
>> secure on the local link; 
>
>ADSL sure isn't secure on the local link, for reasons above.

The local DSL link isn't shared.  Someone would have to tap into the
phone line with sophisticated and expensive equipment in order to
intercept your communications.  Given the easier attack points, I see no
real concern unless you've attracted some serious attention (e.g., NSA,
DEA).  <g>

>If typical cable modem isn't encrypted, than agree it's equally
>insecure.

I believe that the local link is usually encrypted.

>What irks me is when ADSL providers say: "ADSL is more secure than
>because your connection
>isn't shared between your home and central office".

While technology is marching on, there are older forms of cable where
sharing does mean a security problem.  In other words, cable providers
only have themselves to blame.

>I think it's
>ridiculous to associate *shared* with *insecure* without obviously
>taking the time to understand the issues.  Even worse, they're inferring
>that the *unshared* = *secure* (from all threats), which is dangerously
>mis-leading.

I personally don't see much of that -- the usual attack on shared is
speed (e.g., PacBell "web hog" ads).

>I doubt packet sniffing the local link is a big concern anyway, so this
>is really pretty moot.

Agreed.

>I guess my only big concern would be with cable modem...I've heard that
>the modems get be put into an promiscous
>debug mode and and start forwarding *all* traffic out the Ethernet
>port.  This would be a real threat as it means
>anyone with a shareware analyzer could Sniff.  If this isn't possible,
>then you'd need a broadband analyzer, which would be out of most people
>reach.

FWIW, I haven't seen any reliable reports of that.

>>both are exposed on shared links beyond the CMTS/DSLAM.
>
>Agreed.  But presumably access to network infrasture is physically
>secured at these layers.  Anybody can walk up to a pedestal and cross
>box and jack in without much trouble.

Not really.  Doesn't take much to disrupt the DSL signal.  I'd guess
that it's difficult to intercept transparently without pretty
sophisticated and expensive gear.

>> I agree that most broadband ads are colorful nonsense.  Nevertheless,
>> there is a real and important difference -- when the uplink saturates on
>> the typical consumer asymmetrical TCP/IP connection, downlink speed
>> takes a big hit down to about the uplink speed (e.g., your 128/1500
>> service suddenly becomes 128/128).  
>
>OK, but what percentage of users are impacted by this.

I've seen enough reports to consider it a pretty significant problem.
Note how sensitive most cable MSO's are on the issue of uplink traffic.

>> On DSL, that affects *only* the
>> subscriber's own downlink; on cable, that affects *all* subscribers on
>> the shared segment.  It's the big dark secret that cable MSO's don't
>> want to talk about, and the probable reason that servers are typically
>> prohibited on cable, even with an uplink cap, but not on DSL.
>
>HUMMMM. VERY interesting point.  Basically one porn server in the
>"neighborhood"
>and the whole darn thing is down even though there's tons of downstream
>bandwidth
>available. ....hmmmm.... DSL is looking better and better every day.

<sigh>  It's not just "one porn server" -- that's disingenuous spin by
cable MSO's.  Data is data -- the problem is the same whether
subscribers are running a webcam, uploading big PowerPoint
presentations, mailing family photo albums, and/or mailing home videos.

Regardless, typically no one cable user can use a disproportionate share
of capacity in any event -- the issue is the total usage of the uplink
and the lack of graceful degradation at the point of saturation.  If the
uplink saturates, BAM!  Downlink goes to hell.

>I have no hands-on experience with cable infrastructure internals, but
>a lot of what you content would seem to depend on how cable is
>throttled.
>
>I know that DOCSIS has the *capability* of defining transmission slots
>such
>that the cable is no longer a CSMA/CD shared Ethernet...however, I'm
>pretty
>sure that almost no one implements this.  Anyone know for sure??

Most cable systems are not like shared Ethernet -- just take a look at
Motorola documentation for example.  Everything is controlled by the
CMTS.  It's thus a simple matter to cap individual modems either by
configuring the modem or by limiting the transmission slots.

Regardless, none of this matters if the uplink saturates!  When such
saturation is imminent the only way the CMTS could avoid the downlink
problem is to immediately cap all modems to a speed low enough to avoid
saturation.

Read "TCP Performance Implications of Network Asymmetry"
<http://www.ietf.org/internet-drafts/draft-ietf-pilc-asym-02.txt> --
this is a very big deal indeed.

-- 
Best regards,
John Navas     <http://navasgrp.home.att.net/>
     CABLE MODEM/DSL GUIDE:  <http://Cable-DSL.home.att.net/>