1 edit | reply to tschmidt
Re: ISP "Data Retention" - what exactly are they retaining? quote:
Of course the ISP knows source/destination IP addresses otherwise it would not be able to route packets. You are correct that typically ISPs do not log and maintain this information. The requirement to do so is rather onerous because of the huge volume.
Exactly...for those that want to understand this better, Google 'Cisco Netflow'...it essentially enables a provider to audit and log ALL user traffic *at an IP and TCP ***HEADER**** level* (e.g. srcIP, srcPort, dstIP, dstPort, IP protocol, tcp flags, bytescount, packetcount..and a few more tidbits).
In uncompressed form the above information consists of 47 bytes per "flow" Note: a single flow event record can actually be used to summarize thousands of packets related to a single connection over many minutes...thus there is a fair amount of aggregation going on.
Nevertheless, netflow results in MASSIVE amounts of data...for example a single GigaBit Ethernet connection (which is barely utilized) is currently generating 5-10GB of flow data per DAY. For a provider like Comcast to store just one day of flow data from their entire network would probably take terabytes....which is why it's not generally done.
Trying to archive full payload (which I believe would be considered an illegal wiretap anyway) would probably require 1000 to 10000 the amount of disk space as just doing Netflow...plus you'd need double the network capacity, as you'd have to use half of it for logging purposes.
--
Lawrence Baldwin
myNetWatchman
The Internet Neighborhood Watch |
 AuthorityObama Biden '12
join:2000-03-29
Woodland Hills, CA | said by NetWatchMan: Nevertheless, netflow results in MASSIVE amounts of data...for example a single GigaBit Ethernet connection (which is barely utilized) is currently generating 5-10GB of flow data per DAY. For a provider like Comcast to store just one day of flow data from their entire network would probably take terabytes....which is why it's not generally done.= Thanks for jumping in LB. My question is what exactly do the proposed laws require providers to retain, and what would that tell them? I don't believe they're asking for as much as in your example... I think it's just email and maybe DNS requests, in which case they get nothing off anyone use a different mail and DNS provider. Am I wrong? |
