Slashdot Mirror

← Back to Stories (view on slashdot.org)

Carnivore Update

Posted by Hemos on from the keep-up-the-fight dept.

A reader writes: "Yahoo has a news item about the continued use of DCS-1000 AKA Carnivore. Looks like it's being used more than ever, and some privacy groups are still fighting in court for more disclosure about its use."

4 of 201 comments (clear)

  1. Re:my packets by sphealey · · Score: 5, Informative
    Speaking of Carnivore: for 3 months, just after September 11th. I noticed that all of my traffic was being routed through Arlington VA. This stopped about two months ago. Now my packets travel normally, (no Arlington node in every traceorute). Was that Carnivore?
    Its possible, and something you might want to think about.

    OTOH, a large percentage of the East Coast's Internet infrastructure was located in and around WTC, and much was destroyed and/or shut down. Different routes were certainly used while this stuff was under repair.

    sPh

  2. You're right...it means nothing. by Surak · · Score: 5, Informative

    You may not be familiar with SMTP servers like sendmail, postfix, etc. Mails that are sent from clients go into a queue. In the case of larger ISPs with many many users, the mail servers handle quite a bit of mail, so messages may sit in queue for longer.

    The order that they are sent out of the queue in is determined by settings set by the administrator. Some SMTP servers are actually setup so that small-sized messages get priority over bigger messages. Since most e-mails are small, your larger messages with attachments may sit in the queue longer, waiting for a bunch of smaller messages to be sent.

    This queueing depends on the mostly on the *senders* mail server. The receivers mail server will generally put messages from the receive queue into the users mailboxes in the order they came in, but not always.

    Have your mail client display all headers...these show where the mail was along its route and typically have date/time stamps on them. This will help you determine where the hold up is (on the sender's mail server, on your mail server, etc.) Look for the length of time between timestamps. If one is unusually longer than the rest, that's where the hold up is. I'm not saying it's not Carnivore, but what you describe is a fairly common occurrence.

    --
    My journal has hot /. gossip.
  3. Re:Carnivore by UM_Maverick · · Score: 5, Informative

    Right, carnivore (in my understanding at least) does sniff all traffic, and stores it for a set period of time. However (and it's a big however), if the FBI wants to go in and read anything that's been sniffed, it needs to get a warrant. And the warrant doesn't say "we want to open the box"...it says "we want to open the box, and read only emails to person X from date y to date z"

    And if you think it's easy to just hop in and get a warrant, I suggest you go read 'Black Mass' - it will shed some light on your misconceptions.

    --
    Juiced? Or Not?
  4. Want to buy a Carnivore? by wirzcat · · Score: 5, Informative

    Here are the folks that make it:
    www.niksun.com

    Carnivore is called NetDetector for commercial sales.
    http://www.niksun.com/products/pdf_files/N etDetect or_Data_Sheet.pdf
    About $20k, runs on BSD.