🚀 go-pugleaf

Satch wrote:
> 
> Alledgedly erobins@ibm.net (earle robinson)  said on 18 Sep 1999 in
> <37E37C4F.7696A5F9@compuserve.com> the following:
> 
> >The cable company
> >can't see what you might have behind that router anyway, and unless your
> >traffic was such to draw attention, they won't blink.
> >
> 
> I beg to differ.  The primary characteristic of a server in this day and
> age is that you have inbound traffic without any corresponding outbound
> traffic.  A stateful firewall can detect and report this easily, even as it
> lets the packet traffic through.  This is not an absolute thing, but close
> enough that a cable operator can pretty well know who does and does not
> have a server connected.
> 
> For example, if you have a Web server you will have many TCP SYN packets
> heading from the head-end system to the cable modem CPE.  If you don't have
> a Web server then the number of inbound TCP SYN packets to port 80 is
> exactly...zero.  To tell the difference between a script kiddie probing and
> someone actually connecting, you can instead look for TCP ACK packets for
> port 80 coming from the customer.
> 
> Detecting other servers range from dead easy in the HTTP case to virtually
> impossible.  Sometimes the cable operator has to resort to traffic analysis
> to determine who is running a server versus who is running high-bandwidth
> user applications such as videoconferencing.
> 
> Of course, sometimes detecting other servers isn't worth the effort.  A DNS
> server isn't worth the concern, now is it?
> 
> --
>    _____
> __/satch\____________________________________________________________
>  Satchell Evaluations, testing modems since 1984, 'Netting since 1971
>  "The only good mouse-trap is a hungry cat"

I would hope that @home has better things to do than try to analyze my traffic
to see if I am running a server (I'm not, but the firewall might make them
think so).  Unless a user impacts the node, it is unlikely that any action
would take place.  They have more than enough active abusers to chase, and
don't seem to get around to THEM very quickly...  Sigh.

-- 
Ron Hunter     rphunter@home.com