Untitled

access to the backbone. This is traditionally
something that the network fo lks aren't really
keen on. Right now, their main worry is off-site
hackers since they tend to have the local ma­
chines locked down. Off-site links are a lot easier
to deal with since you can drop a filter on a Tl
with no real speed hit. 10MB and above can
cause a serious loss of throughput, although
some newer flow-based algorithms can reduce
that a lot. With RESNET, they now have a bunch
of unknown kids with root access to their (own,
local) machine on a LAN who know all about
their security by obscurity. That is usually a
pretty big mental shift for them and they don't
want to consider (budget I) costly consequences
until someone holds a gun to their head. If the
RESNET hacker docsn '( become the squeaky
wheel then they can get away with a lot.
Unlike slow WAN situations, high-speed
LAN access can cause some problems for secu­
rity. Any firewall or other bottleneck is going to
stick out like a sore thumb when you have 500+
switched- I 0 connections trying to go through it.
If you get a high-performance firewall or a lot of
low-performance firewalls working in tandem,
you're going to add cost which the housing fo lks
aren 't going to like. The network fo lks will have
wanted to keep their options open, but they're
probably not going to have a filter in place when
people start hyping about all the cool things
they're doing for the students. Bandwidth, much
like disk space, tends to get filled to capacity
very quickly. If they don't put a firewall in place
quickly, people aren't going to want it for the
added expense or the bottleneck.
You may think these non-decisions are obvi­
ous, but paper-pushers are a different breed, es­
pecially when their money is involved. They
seem perfectly happy to bc reactive and fix a
problem alter they get hit. Up-front cost is every­
thing, and long-term savings don 't mean a whole
lot when you're living year-to-year on a budget.
The obvious analogy of standing on the train­
track and getting offbeforc or after the train goes
by is totally lost on them.
What tools do they have to track you down?
Potentially lots. It really depends on the hard­
ware they're using, their competence, and the
tools they have available to them. The easiest bit
of information they'll have is your IP address,
since anyone who noticed will log that these
days. If it is on the other side of a router, your
MAC will be unavailable. If you registered with
DHCP, they'll quickly track you down and turn
off your port. They may be able to blacklist your
NIC so you can't use it in any port. That would
be inconvenient.
Depending on their router setup, they'll typi­
cally know what network segment you're on
(host routes and source routes don't work too
well in the modern LAN, but you never know). In
your average RESNET, those tend to start out big
(a building) and narrow down as required. If you
haven 't left a permanent record (registered) or
they're not strict about what MACs are used on
any given port, they pretty much have to catch
you real-time by looking at ARP entries on the
nearest router and bridging tables on the switches
(to find out what port a MAC address is behind).
One of the security options some switches
have is the ability to lock a port to one MAC ad­
dress. If you're hacking with a fixed MAC on a
locked port, the hunt is going to be pretty short.
In your favor are convenience (public access ar­
eas, that they can't lock to one MAC) and lazi­
ness (if they have to unlock a port every time it
locks, some human is going to be bored out of
their mind). A few late night calls saying your
port got locked for no good reason might con­
vince an RA that it is more trouble than it is
worth.
Routers are a small problem since they are
passive learners and will hold onto ARP ad­
dresses long after they're out of use (10+ min­
utes). Switches are a little easier since they tend
to clear their MAC tables when the port loses
link. Do the dirty deed and drop the link. They're
going to have a hard time finding out what port
the MAC was behind.
Some SNMP-ready switches can send a
'TRAP" to an SNMP management station when
a port comes up and down. This is usually dis­
abled by default since it generates a lot of traffic
and notifications managers normally don't care
about. Some of the clever RESNET sites look
fo r the link-up TRAP and then start probing for
MAC addresses periodically on that port. This
is a pretty good proactive way of doing it. The
ways they might probe are pretty custom since
it usually requires someone fairly competent to
set it up, so a little inside knowledge will work
wonders. I f they only probe once at some inter­
val after the link comes up, you only have to
wait it out and then send your traffic. If they
Page 28 2600 Magazine Fall 1998