Subject: Re: wiretaping , streams and topology

From: "Rosen, Brian" <[email-masked]>
Date: Mon, 5 Feb 2001 11:42:04 -0500

That's an observable difference!  I think you are correct.
That is why I don't think you can implement wiretap in an MG.
I also think you can't have a "tap box" that just sits on the net.

I think you have to tap on the IP flow, without changing any
addresses or other observable message sequence and I think the most
sensible place to do that is on the access router (or switch).

Brian

> -----Original Message-----
> From: Matt Holdrege [mailto:[email-masked]]
> Sent: Monday, February 05, 2001 11:37 AM
> To: Rosen, Brian; [email-masked]
> Subject: RE: wiretaping , streams and topology
>
>
> That's one thing, but more interesting to a field tech is a
> new destination
> IP address for RTP. But maybe I'm worrying too much.
>
> At 08:34 AM 2/5/2001, Rosen, Brian wrote:
> >I think that is still right.  I express it as no observable
> difference in
> >the
> >message sequence.
> >
> >Brian
> >
> > > -----Original Message-----
> > > From: Matt Holdrege [mailto:[email-masked]]
> > > Sent: Monday, February 05, 2001 11:11 AM
> > > To: [email-masked]
> > > Subject: Re: wiretaping , streams and topology
> > >
> > >
> > > Is there not a basic wiretapping requirement that the field
> > > technicians
> > > cannot know about the wiretap? If so, then you cannot tell
> > > the MG about the
> > > wiretap since the field tech's will easily be able to
> > > discover it. Am I wrong?
> > >
> > >
> > > At 03:29 AM 2/4/2001, Shlomo Kabaz  ECItelecom wrote:
> > > >Hi , all !
> > > >
> > > >I  asked  a question on wiretapping and  a conversation
> > > started on that
> > > >subject , but sorry to be left still
> > > >with the simple trechnical  questions unanswered  :
> > > >
> > > >      If   t1  and  t2  are terminations conected bothways ,
> > > and i want to
> > > >do wiretap the stream recived by t2 ,
> > > >      then according to your suggestion i will add an
> > > ephemeral termination
> > > >t3 that will be described in a topology
> > > >      descriptor as:  t2,t3,oneway .
> > > >      And the questions are :
> > > >
> > > >        a. Does termination t2 have to have to streams
> > > ?!?!?!?   or only one
> > > >? after adding t3 ?
> > > >
> > > >        b. A question to  brian: You said it can be doen
> by adding a
> > > >termination that is oneway without topology .
> > > >            How it is possible according to the present
> spec , in a
> > > >termination as i understand the only way to control
> > > >            stream direction is by it's mode , but the mode
> > > refers to the
> > > >direction of the stream regarding element
> > > >            outside the gateway ???
> > > >
> > > >     regards  , Shlomo .
> > >
>

---

From: Christian Groves <[email-masked]>
Date: Tue, 6 Feb 2001 17:20:18 +1100

I don't think you should approach wiretap in such a narrow way. Having
something go across the Megaco interface is one thing but your boxes
have to be designed in such a way that if a field technician wants to
find out something about the wiretap the system makes it very hard. ie.
that termination doesn't show up in normal O&M routines, secure links,
general mechanisms etc. You also have to be concerned about the type of
hardware implemented in the MG to effect a 3 way connection - it can't
have noticable effects on the user plane. A conference bridge typically
is detectable. Special connections are required for LI where nothing can
be detected. Thats why on topology its says it shall be implemented in
such a way that the other terminations can't detect the presense of an
additional termination.

I don't think we're going to solve the exact implementation of LI in a
system that has Megaco. Different applications will have different
requirements and using Megaco is one small part. If people want to focus
on that LI should not be done in the MG then good luck selling products
in the real world.

Christian

---

From: Matt Holdrege <[email-masked]>
Date: Tue, 6 Feb 2001 01:09:06 -0800

I hope we don't have to approach it in such a narrow way, but legal
authorities define the rules and we have to somehow play in their world.
It's still up in the air how exactly we will do LI in a VoIP network, but
some of the basics of LI will apply in any case. One of the basic tenets is
that only a very small group of authorized people know about the wiretap.
That requirement isn't going to go away, IMHO so we have to find an agreed
upon way to implement LI in that manner.