Slashdot Mirror
More On Detecting NAT Gateways
tcom91 writes "The Slashdot article Remotely Counting Machines Behind A NAT Box described a technique for counting NAT hosts. A recently published paper Detecting NAT Devices using sFlow describes an efficient way of detecting NAT gateways using sFlow, a traffic monitoring technology built into many switches and routers. This technology could be used to enforce single host access policies and eliminate unauthorized wireless access points."
people are still using the same amount of bandwidth payed for, no matter how many machines are using it. when will these companies realize that many people have multiple computers in their home?
Go calculate something
Nice, besides an ad for Sflow, just shows some more holes we need to patch, and more standards to break.
OS fingerprinting was nice, but now some boxes are replying as a tandy coco, its a very amusing battle. Now TTL is being used to determine multiple Nat'ed IPs. I'm sure someone will write a nice nat module for linux/etc to bypass this also. Seems like the endless cycle of control freaks loosing control.
BTW, not sure which ISPs care about NAT, but there are very very large NAT friendly ISP's out there. (Speakeasy for one)
I just wanted to extend a big thanks to sFlow for posting this paper (and the AT&T people for posting theirs). Despite the fact that DARPA screwed Theo & Co, they are probably already adding a "modulate TTL" setting to pf as we speak.
And of course if you're ultra-paranoid, then just use something like socks or squid to proxy most or all of your TCP connections, and it's 100% indistinguishable from your firewall making the connections out. Because your firewall is making the connections out.
When will they learn?
Kinda irritates me that stuff like this may make my nice all-in-a-box Netgear NAT useless some day, but it's nice to know that people like OpenBSD are there to back us up.
And like someone else said, what exactly does the cable company expect me to do? Expose all of my internal network to the internet? Cha right! They wouldn't even give me more than 3 IPs anyway!
Cryptic Allusion - New Mac and Dreamcast Games!
but what do i know, i'm just a model.
As someone on slashdot wrote before me, what about 1 singular PC connected to the internet running a couple of sessions of vmware?
Perhaps it would appear to the outside world that there are more than 1 pc connected, but to prove it, they'd have to have physical access to your home.
Pretty sure they won't get past me...
Praying for the end of your wide-awake nightmare.
I work for a small ISP in northern California. We don't have any policies against our users using NAT. We provide NAT routers to our ADSL customers and recommentd cable/dsl routers to our DSL customers on our older system. We also help our users setup ICS if they're running windows. We have sold systems running linux to our wireless customers.
It's not that we care how many computers someone has behind these NAT devices. It's how much of the bandwidth they bought that they are using and how often they're using it.
Our basic ADSL and wireless offerings are 384k/128k. If we had every user maxing out their connection all the time, then we'd have to charge more. Because we're in a remote area, we pay more for our T1 service. We have a T1 that runs about $1k per month and another about $1300 per month (special build for geographic diversity). If 4 of our ADSL or wireless users held their connection maxed out all the time, that would pretty much eat a whole T1. We have just over 300 broadband customers and about 600 dialup on two T1 lines with a third on the way.
Our 384k/128k service is regulated and costs $49.95 per month. If every broadband user insisted on maxing out their connection 24/7, we'd have to charge broadband customers $250 per month just to break even on the T1 costs. That doesn't even count the overhead associated with staff and equipment.
I'm sure there are ISP's out there that are all about the money. We try to be more about service and making sure our customers are happy. But we have to make a living too. I don't think the issue should be if you're using a NAT device or how many computers you have hooked up to it. As I said, we encourage it. I think the issue should be about usage. Sell 3 gig per month. Charge for data over that. (3 gig is a number I pulled out of my head)
My point is, if the ISP is worried about usage, they should charge for that and not for how many computers are behind a NAT box.
Since the method relies on knowing the default TTL, (128 for windows), just set the default TTL to something higher...
\ Servic es\Tcpip\Parameters\DefaultTTL (DWORD)
In W2K:
HKEY_LOCAL_MACHINE\System\CurrentControlSet
Just set to 129 if you have a NAT between your PC and the modem.
This way all the packets seem to come directly from a Windows box, and you don't have the (potential) sideeffects of getting the NAT to change the TTL.
main(i){putchar(177663314>>6*(i-1)&63|!!(i<5)<<6)&&main(++i);}
You're assuming here that every customer is maxing out his/her bandwith all the time, as if every customer had a P2P client running all the time and enough active downloads that more data is available than he/she can suck down.
I think the point is that there is a maximum amount that you can utilize in a day. My cable modem is capped at 1.5 mbps (I hope). That given, I can download a max of 129600 mbits, or 16 GB in a day. I'm never going to see maximum bandwidth usage, we'll say it maxes out at around 800 mbps, which means I'd be able to d/l 8 GB.
Now, it's definitely possible that I'd do something like that, but I don't need more than one machine to do it. Get it? I have one machine continuously connected, continuously using the maximum amount of bandwidth that I can use, and it's going to be 8-16 GB / day. If I had 2 machines, I'd still be maxing out at 8-16 GB / day.
Having more machines connected to my gateway does not increase the amount of bandwidth available to my cable bridge. It does affect the amount of bandwidth that each of my machines get individually, in that it goes down with the number of machines. If it went up, then we'd have some interesting physics working in this world.
I really don't care if Comcast disconnects me for having more than one machine connected to my modem. Sure, it's against my TOS, but I could just as easily sign a contract with a more agreeable company if Comcast boots me. It'd be a small loss of service on my part, a big loss of profit on their part.
If I were them, I'd let the users do whatever they want, as long as they don't fuck with the cable bridge. That's all comcast really has to be accountable for. If they can show that any machine on the other end of the network cable that is plugged into the cable bridge is getting a signal, then they are following the terms of their contract. If the machine is not getting a signal, then they are liable. The end user should be liable for anything that occurs within the household that is a third party to the cable network.
You need to restart your computer. Hold down the Power button for several seconds or press the Restart button.