Subject: Re: wiretaping , streams and topology

From: "Rosen, Brian" <[email-masked]>
Date: Mon, 5 Feb 2001 09:22:19 -0500

>      If   t1  and  t2  are terminations conected bothways ,
> and i want to
> do wiretap the stream recived by t2 ,
>      then according to your suggestion i will add an
> ephemeral termination
> t3 that will be described in a topology
>      descriptor as:  t2,t3,oneway .
Doesn't have to be an ephemeral.  Depends on what you want done with the
tapped
stream.  If you want it send by, say, RTP, to a remote location (LEA), you
might use an ephemeral.  If the physical MG has a physical tap access port,
it might be a physical termination.

>      And the questions are :
>
>        a. Does termination t2 have to have to streams ?!?!?!?
>   or only one
> ? after adding t3 ?
I don't understand all the question marks.  Is this a voice-only (one
stream)
MG?  If so you add t3, and then make T1 - T3 one way AND T2 - T3 one way if
you
want to tap both sides of the call.

>
>        b. A question to  brian: You said it can be doen by adding a
> termination that is oneway without topology .
>            How it is possible according to the present spec , in a
> termination as i understand the only way to control
>            stream direction is by it's mode , but the mode
> refers to the
> direction of the stream regarding element
>            outside the gateway ???
Yes, you use mode.  The "direction outside the gateway" is just to give you
the information about which way does "recieveonly" mean - receive from the
point of view of the termination out to the external world, or receive from
the point of view of the external world into the termination.  The spec
says,
from the termination out.  Therefore, you want "sendonly".

Brian

---

From: "Rosen, Brian" <[email-masked]>
Date: Mon, 5 Feb 2001 11:34:16 -0500

I think that is still right.  I express it as no observable difference in
the
message sequence.

Brian

> -----Original Message-----
> From: Matt Holdrege [mailto:[email-masked]]
> Sent: Monday, February 05, 2001 11:11 AM
> To: [email-masked]
> Subject: Re: wiretaping , streams and topology
>
>
> Is there not a basic wiretapping requirement that the field
> technicians
> cannot know about the wiretap? If so, then you cannot tell
> the MG about the
> wiretap since the field tech's will easily be able to
> discover it. Am I wrong?
>
>
> At 03:29 AM 2/4/2001, Shlomo Kabaz  ECItelecom wrote:
> >Hi , all !
> >
> >I  asked  a question on wiretapping and  a conversation
> started on that
> >subject , but sorry to be left still
> >with the simple trechnical  questions unanswered  :
> >
> >        a. Does termination t2 have to have to streams
> ?!?!?!?   or only one
> >? after adding t3 ?
> >
> >     regards  , Shlomo .

---

From: Matt Holdrege <[email-masked]>
Date: Mon, 5 Feb 2001 08:37:16 -0800

That's one thing, but more interesting to a field tech is a new destination
IP address for RTP. But maybe I'm worrying too much.

---

From: "Rosen, Brian" <[email-masked]>
Date: Tue, 6 Feb 2001 10:11:21 -0500

While Christian and I are agreeing to disagree on how to do LI,
one point he makes is valid, which is that LI isn't going to
be done in IETF.  The efforts at the International Softswitch
Consortium, PacketCable, 3GPP and other groups are likely to
determine how LI is done in future networks.

I do agree with Matt, there is not likely to be an LEA-acceptable
way to use any Megaco construct (packet sniffers are a typical
field tech tool, so hidden terminations or any other such
tricks won't be acceptable, IMO).  Even a message length difference
would be trivial to detect, and that would be visible even if the
control channel was encrypted.  It will be interesting to see
how "do it in the gateway" proponents fair with the LEAs.
I can see how to do it, but not with Megaco.

Brian

> Sent: Tuesday, February 06, 2001 4:09 AM
> I hope we don't have to approach it in such a narrow way, but legal
> authorities define the rules and we have to somehow play in
> their world.
> It's still up in the air how exactly we will do LI in a VoIP
> network, but
> some of the basics of LI will apply in any case. One of the
> basic tenets is
> that only a very small group of authorized people know about
> the wiretap.
> That requirement isn't going to go away, IMHO so we have to
> find an agreed
> upon way to implement LI in that manner.
>
> At 10:20 PM 2/5/2001, Christian Groves wrote:
> >I don't think you should approach wiretap in such a narrow
> way. Having
> >something go across the Megaco interface is one thing but your boxes
> >have to be designed in such a way that if a field technician wants to
> >find out something about the wiretap the system makes it
> very hard. ie.
> >that termination doesn't show up in normal O&M routines,
> secure links,
> >general mechanisms etc. You also have to be concerned about
> the type of
> >hardware implemented in the MG to effect a 3 way connection
> - it can't
> >have noticable effects on the user plane. A conference
> bridge typically
> >is detectable. Special connections are required for LI where
> nothing can
> >be detected. Thats why on topology its says it shall be
> implemented in
> >such a way that the other terminations can't detect the
> presense of an
> >additional termination.
> >
> >I don't think we're going to solve the exact implementation
> of LI in a
> >system that has Megaco. Different applications will have different
> >requirements and using Megaco is one small part. If people
> want to focus
> >on that LI should not be done in the MG then good luck
> selling products
> >in the real world.
> >
> >Christian
> >
> >"Rosen, Brian" wrote:
> > >
> > > That's an observable difference!  I think you are correct.
> > > That is why I don't think you can implement wiretap in an MG.
> > > I also think you can't have a "tap box" that just sits on the net.
> > >
> > > I think you have to tap on the IP flow, without changing any
> > > addresses or other observable message sequence and I
> think the most
> > > sensible place to do that is on the access router (or switch).
> > >
> > > Brian
> > >
> > > > From: Matt Holdrege [mailto:[email-masked]]
> > > > Sent: Monday, February 05, 2001 11:37 AM
> > > > To: Rosen, Brian; [email-masked]
> > > > Subject: RE: wiretaping , streams and topology
> > > >
> > > >