Systems behind routers tracable?

Steve Bellovin, one of the founding fathers of Usenet and now working for the Internet Engineering Task Force, claims to have written an algorithm able to make the distinction between packets coming from different computers behind a NAT-router.

What he did is study the IPid, a 16-bit IP header number (RFC 0760) added to the packets by the TCP/IP protocol. Succeeding packets are numbered with succeeding IPid's. What Bellovin's algorithm does, is search for succeeding sequences, where different sequences belong to different computers.

A helping hand for ISP's that don't like customers to connect more than one computer on one line?

There's something that doesn't make the algo 100% effective though. Within a LAN, packets are also numbered. This makes that from outside the router, the visable IPid values appear to belong to different sequences, making it look like there is more than one computer behind the router.

Another thing is that BSD for example generates random IPid's, making the algorithm useless...

Here's the research paper.

Hmm, I wonder if Darwin and MacOS X maintain BSD's random IPid's...., I'd like to think that I have that kind of "protection". This technology not only could be used by ISP's to identify user transgressions, but I imagine that if those overly zealous laws being proposed across the US would benefit from this kind of technology, making interesting problems with search and seizure, wire-tapping, etc. What would qualfy as a legal use of this technology to track down "illegal NAT"? Would there have to be a warrant, or would ISP's be obliged to turn in criminals? I imagine that the legislation and enforcement would take the same course as the Kazaa/Napster P2P mess.
My question, you can identify the IP of the router/NAT/gateway and from that you can identify the network that the computer is on. Is it really that tenuous a position to assume that if you can identify the network that the person is being naughty on, then you can find the computer? After all, if it is a major corporation, they probably have logs out the wazzoo for finding just such data and protecting their butts, and if you are a home user, then 1-5 computers is that hard to find, heck, 1-30 is just time consuming...

Rediculous. I guess than I now will keep BSD on my server...

Interesting article Neg, thanks.
Dhej

I thought this was found a long time ago already... There are vulnerability scanner services that check these things already... There are pretty some programms that makes you able to change this, like you said BSD already does it in most cases... I don't know if you knew that already, or I'm really wrong... But this isn't really new isn't it ?

ps
If I'm not mistaking many routers already have software on board that doesn't need those numbers anymore to send the right packets to the right pc, so they replace it with something random.

Interesting. I agree and also like Dhej's question. I use a Linksys NAT CABLE router and have 2 XP boxes and 2 MANDRAKE boxes behind it.

[QUOTE]There's something that doesn't make the algo 100% effective though. Within a LAN, packets are also numbered. This makes that from outside the router, the visable IPid values appear to belong to different sequences, making it look like there is more than one computer behind the router.

but isnt this whole Idea behind the NAT??? So why would you even need the Algo???

Welp... what the algorithm tries to take into account, is that some packets stay on the LAN.
Packets that stay on the LAN are also numbered. So - if I get this correctly - if you send some packets outside your LAN, then send some packets that stay within your LAN, then again send some packets outside your LAN, there are some missing IPid's (the ones that didn't reach the internet), making it look like you have two computers in your LAN.
And that is basically what the algorithm is capable of: handling those gaps...

Ahh...gotcha. I wasnt totally sure if the Packets were identical. wonder how it handles different forms of encryption. Like when the entire packet is encrypted but not the key that is inside.

well one would assume there has to be some way to distinguish it, otherwise how would the NAT router know which computer it's forwarding the returning packets to?

AT&T is also working on this. As someone already pointed out, this isn't new but just now is being noticed a little more.

There are scanners that check this field in packets right now but I haven't seen a good one yet. How about anyone else?

I havent seen any yet either. Maybe if ya put another NAT router behind the first one it will confuse them. hahaha...sometimes the erroneous works..lol

I think this sort of algo can be made inefficient if you configure well your router. Or maybe would it be interesting to create false "computers" connected playing with the parameters of the algorithm and creating false internal trafic in order to make some honeypots more attractive for crackers.

KC

Quote:

---

I think this sort of algo can be made inefficient if you configure well your router. Or maybe would it be interesting to create false "computers" connected playing with the parameters of the algorithm and creating false internal trafic in order to make some honeypots more attractive for crackers.

---

This is an interesting reply...Any idea on how to achieve this? Configuring your Router and/or creating the look of false internal traffic.

very curious...

<quote>I think this sort of algo can be made inefficient if you configure well your router. Or maybe would it be interesting to create false "computers" connected playing with the parameters of the algorithm and creating false internal trafic in order to make some honeypots more attractive for crackers. </quote>

Are you still plugged into the matrix?

Neutron.....who is the question directed at and can you elaborate?

Sorry......Just sounds like jargon and not reality.......

Thats what I am trying to uncover..heh!
:D

I have not studied the algorithm. But I think that if we understand it correctly, we should be able to find how it analyses the "gap" in sequences in order to determine the number of machines. So if we create false traffic (maybe with new network interfaces on servers and with specific scripts, the only target is to make variations in IPid's), we must be able to "create" false computers: computers that don't exist but which are detected by the algorithm.
If crackers scan your network with this method, they will view more computers. The major problem of honeypots is often to make the vunerable computer attractive and realistic without buying a lot of money. It could become a way to do so easily if this algorithm becomes popular and if somebody with a better knowledge than me create one or two scripts to create this false traffic. The secret is only in the datas given to the algorithm after all: change the datas, you will change the result.

KC

KC...that sounds Great in Theory...but I havent found much of anything to support any such progress toward such a project (via Google).

Quote:

---

ps
If I'm not mistaking many routers already have software on board that doesn't need those numbers anymore to send the right packets to the right pc, so they replace it with something random. by neel

---

I would very much like some more info. on this quote by neel. If it is indeed true and which NAT routers may have this software.

Any help??

Quote:

---

that sounds Great in Theory

---

And, as you have noticed, it will remain only a theory until that someone made it. If it is really recent and if old algorithms of the same types were inefficients, it is normal that nobody searched such a thing. But if this algorithm becomes popular, don't worry, it will be done.

KC

well, where this algorithm comes into play really is when these new DMCA like laws get passed, and it's illegal to use a NAT device to share a connection, the ISP's and government agencies will use tools like this to determine who they need to harrass.

But I believe that a gateway, perhaps openbsd, doing nat adding randomness to the packet identifiers would cause problems, either flagging you instantly, or letting you slide through the cracks.. you would need to proxy everything inorder to go escape it, but even that would be detectible..

but with these laws in on the books, and people not liking it will cause kernel developers to come up with slick ways to stop the scans... just my thoughts

Ahh very true about DMVA laws. I guess my question would be that if a person is gonna get a NAT router for a SOHO w/<5 users they should get it NOW, are ther any with configuarable software that are in expensive??