Subject: [Raven] DNS query capture

From: "Carter Bullard" <[email-masked]>
Date: Tue, 8 Feb 2000 09:29:42 -0800

Gentle people,
   When Law Enforcement (LE) has permission to
use a Pen Register wiretap, the local phone
company is required to give LE what is called
participant information for every call made from
a specific handset, in near-realtime.

   When thinking about how Pen Register wiretaps
would work in packet-mode networks, it seems
reasonable to think that you would need to provide
the same type of information that is provided by
local carriers in the PSTN.

   One aspect of this can be satisfied by providing
RMON2 network matrix data that includes the target
IP address.  This will give LE the analogy of the
called party numbers.  But Pen Register wiretaps
can also provide the name of the subscriber of the called
telephone number.

   Providing the name associated with a specific
IP address in not as straight forward as it is in
the PSTN.  The simplest way would be to allow
Law Enforcement to capture the contents of DNS requests
and responses to and from the target of the wiretap.

   My question(s) are:

      Is the DNS protocol IP network control plane information?
	Is the DNS a public service?
	Does the requestor have any claim to ownership of the response?

Carter

---

From: "Ge' Weijers" <[email-masked]>
Date: Tue, 8 Feb 2000 17:18:31 -0700

>       Is the DNS protocol IP network control plane information?

I'd see DNS as an automated 411 service.  The network does not need
the DNS information to 'complete the call', an IP number will do
nicely. Even e-mail will work without. 

A simple router does not need more than the destination address to
forward a packet (it should update the hop count, and use the source
address for error messages). I'd say that anything in a packet that
can be encrypted without loss of functionality of the network is not
control plane information. This includes TCP port numbers.

> 	Is the DNS a public service?

Define 'public'. My employer's DNS server is privately owned, and I
assume that the ownership of the data lies with the employer too. The
service is accessible to the public, but so is a web server.

> 	Does the requestor have any claim to ownership of the response?

As much claim as he or she has to the contents of a web page being viewed. 

Ge'

-- 
-
Ge' Weijers                                Voice: (614)326 4600
Progressive Systems, Inc.                    FAX: (614)326 4601
2000 West Henderson Rd. Suite 400, Columbus OH 43220

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven