🚀 go-pugleaf

I wasn't clear enough.  It wasn't servers, web or ftp, that might be
setup by the customer, and which are detectable as stephen satchell
says, but small scale networking, the kind used in a home where the
children might be online in one room and the parents in other roooms. 
The latter, as long as usage doesn't become monumental isn't such to
disturb the flowthrough of traffic on the system, be it cable or adsl.

Further, a server set up for private use, say accessing from one's
office or while travelling isn't something that should disturb the
operators either.  

 -er

"Ronald P. Hunter" wrote:
> 
> Satch wrote:
> >
> > Alledgedly erobins@ibm.net (earle robinson)  said on 18 Sep 1999 in
> > <37E37C4F.7696A5F9@compuserve.com> the following:
> >
> > >The cable company
> > >can't see what you might have behind that router anyway, and unless your
> > >traffic was such to draw attention, they won't blink.
> > >
> >
> > I beg to differ.  The primary characteristic of a server in this day and
> > age is that you have inbound traffic without any corresponding outbound
> > traffic.  A stateful firewall can detect and report this easily, even as it
> > lets the packet traffic through.  This is not an absolute thing, but close
> > enough that a cable operator can pretty well know who does and does not
> > have a server connected.
> >
> > For example, if you have a Web server you will have many TCP SYN packets
> > heading from the head-end system to the cable modem CPE.  If you don't have
> > a Web server then the number of inbound TCP SYN packets to port 80 is
> > exactly...zero.  To tell the difference between a script kiddie probing and
> > someone actually connecting, you can instead look for TCP ACK packets for
> > port 80 coming from the customer.
> >
> > Detecting other servers range from dead easy in the HTTP case to virtually
> > impossible.  Sometimes the cable operator has to resort to traffic analysis
> > to determine who is running a server versus who is running high-bandwidth
> > user applications such as videoconferencing.
> >
> > Of course, sometimes detecting other servers isn't worth the effort.  A DNS
> > server isn't worth the concern, now is it?
> >
> > --
> >    _____
> > __/satch\____________________________________________________________
> >  Satchell Evaluations, testing modems since 1984, 'Netting since 1971
> >  "The only good mouse-trap is a hungry cat"
> 
> I would hope that @home has better things to do than try to analyze my traffic
> to see if I am running a server (I'm not, but the firewall might make them
> think so).  Unless a user impacts the node, it is unlikely that any action
> would take place.  They have more than enough active abusers to chase, and
> don't seem to get around to THEM very quickly...  Sigh.
> 
> --
> Ron Hunter     rphunter@home.com

-- 

  -er