Subject: [RPSEC] Accessing topology-related information behind firewalls

From: Hasan Gobjuka <[email-masked]>
Date: Fri, 31 Jan 2003 13:58:21 -0800 (PST)

Hello all,

Is there any way to get *useful* topology-related information from a firewall-protected network?

Thanks,

---------------------------------
Do you Yahoo!?
Yahoo! Mail Plus - Powerful. Affordable. Sign up now

---

From: Russ White <[email-masked]>
Date: Fri, 31 Jan 2003 21:59:27 -0500 (EST)

My 2c....

I don't really think it depends on a firewall in the middle, really. For
instance, if you nat'ing, then you lose all sense of what the network
inside the nat looks like (moreso if you are pat'ing, rather than nat'ing).
If you are not nat'ing, and you are summarizing your advertisements, then
you still lose most of the useful routing information, since you've no idea
what subnets are actually reachable, what most of the prefix lengths are,
etc.

ie--if you have 10.1.0.0/24, 10.1.1.0/24, 10.1.2.0/24, and 10.1.3.0/24
summarizaed into 10.1.0.0/22, then you've lost knowledge of what the
broadcast addresses are within the network, and a sense of what servers are
located on what segments from just the ip addresses.

If, however, you are actually advertising destination subnets in your net,
you're probably giving away information you should give away.

Hiding information is generally good, I think....

:-)

Russ

> Is there any way to get *useful* topology-related information from a firewall-protected network?

__________________________________
[email-masked] CCIE <>< Grace Alone

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: Hasan Gobjuka <[email-masked]>
Date: Fri, 31 Jan 2003 19:14:57 -0800 (PST)

Thank you Russ,
Actually I'm trying to develop some algorithm and consecutively some open source tool to detect the topology of large multi-subnet netwroks, and consecutively the Internet in layer-2 (Data link layer), so that the tools will be able to detect non-cooperative nodes like hubs besides routers and other cooperative nodes. I'm not worried much about IP level. Instead, I'm working in the MAC address level.
So far, I was able to develop some algorithms to detect layer-2 topology for networks which are not behind a firewall, but I need to get some method to get information about nodes protected by firewall so that I may able to use this information to detect such network's layer-2 topology.
 
Russ White <[email-masked]> wrote:
My 2c....

:-)

Russ