Subject: Re: [RPSEC] Accessing topology-related information behind firewalls

From: "Ayyasamy, Senthilkumar (UMKC-Student)" <[email-masked]>
Date: Sat, 1 Feb 2003 04:23:11 -0600

> > > Actually I'm trying to develop some algorithm and consecutively some open 
> > > source tool to detect the topology of large multi-subnet netwroks, and 
> > > consecutively the Internet in layer-2 (Data link layer), so that the tools 
> > > will be able to detect non-cooperative nodes like hubs besides routers and 
> > > other cooperative nodes. I'm not worried much about IP level. Instead, I'm 
> > > working in the MAC address level.
> > > So far, I was able to develop some algorithms to detect layer-2 topology for 
> > > networks which are not behind a firewall, 

Can you give some more information on the algorithm off-list? 

> > > but I need to get some method to get 
> > > information about nodes protected by firewall so that I may able to use this 
> > > information to detect such network's layer-2 topology.

But, where is the problem space? who needs to know l2 topology ( other
that the network administrators- who already have a good documentation of 
their l2 topology.)   

Their is enough interest in topology inference at IP path/router level, since it 
gives us lot of useful information. The whole bunch of Content providers like 
akamai depends on such inference methods to place their servers.

As for Russ reply:

> > I don't really think it depends on a firewall in the middle, really. For
> > instance, if you nat'ing, then you lose all sense of what the network
> > inside the nat looks like (moreso if you are pat'ing, rather than nat'ing).
> > If you are not nat'ing, and you are summarizing your advertisements, then
> > you still lose most of the useful routing information, since you've no idea
> > what subnets are actually reachable, what most of the prefix lengths are,
> > etc.
>
> > ie--if you have 10.1.0.0/24, 10.1.1.0/24, 10.1.2.0/24, and 10.1.3.0/24
> > summarizaed into 10.1.0.0/22, then you've lost knowledge of what the
> > broadcast addresses are within the network, and a sense of what servers are
> > ocated on what segments from just the ip addresses.
> >
> > If, however, you are actually advertising destination subnets in your net,
> > you're probably giving away information you should give away.
> > 
> > Hiding information is generally good, I think....

Yes. I accept that *more the aggregation, the lesser the topology details.*

If you go for a tracert based inference, Caida's skitter is the default option. 
The whole research community depends on them. 

Given the aggregation, how much of the backbone topology be inferred?
http://www.cs.washington.edu/research/networking/rocketfuel/interactive/

Their are recent works to walk around the aggregation problem too. 
MIT researchers have worked on inferring topology by observing the frequency 
of BGP updates.
http://www.nms.lcs.mit.edu/papers/clustering-imw2002.html
Their clustering technique was same as the one previously applied by 
ATT researchers to indentify web clusters.

But, still getting the total topology information is difficult. The 
technologies which has a flavour of connection-orientness (mpls etc.) 
become a big stumble block for taking accurate topology measurements. 

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: Russ White <[email-masked]>
Date: Sat, 1 Feb 2003 07:20:31 -0500 (EST)

Hmm.... That sounds quite interesting. Are you gleaning the l2 information
from the subnets shown in the routing protocol? Or?

:-)

Russ

On Fri, 31 Jan 2003, Hasan Gobjuka wrote:

>
> Thank you Russ,
> Actually I'm trying to develop some algorithm and consecutively some open source tool to detect the topology of large multi-subnet netwroks, and consecutively the Internet in layer-2 (Data link layer), so that the tools will be able to detect non-cooperative nodes like hubs besides routers and other cooperative nodes. I'm not worried much about IP level. Instead, I'm working in the MAC address level.
> So far, I was able to develop some algorithms to detect layer-2 topology for networks which are not behind a firewall, but I need to get some method to get information about nodes protected by firewall so that I may able to use this information to detect such network's layer-2 topology.
>
> Russ White <[email-masked]> wrote:
> My 2c....
>
> located on what segments from just the ip addresses.
>
> :-)
> Russ
> On Fri, 31 Jan 2003, Hasan Gobjuka wrote:
>
> >
> > Hello all,
> >
> >
> >
> > Is there any way to get *useful* topology-related information from a firewall-protected network?
> >
> >
> >
> > Thanks,
> >
> >
> >
> > ---------------------------------
> > Do you Yahoo!?
> > Yahoo! Mail Plus - Powerful. Affordable. Sign up now
>
> __________________________________
> [email-masked] CCIE <>< Grace Alone
>
> ---------------------------------
> Do you Yahoo!?
> Yahoo! Mail Plus - Powerful. Affordable. Sign up now

__________________________________
[email-masked] CCIE <>< Grace Alone