Re: [93attendees] Network experiment during the meeting

[Rolf Winter <[e-mail]>]

Hi,

we were sloppy in our description, apologies. Multicast _is_ being 
collected. Basically everything the NIC receives which is not unicast. 
But ARP is actually not all that interesting. Most interesting are 
actually applications using broadcast/multicast messages. Here is a 
protocol distribution of a previous experiment omitting everything below 
7% of the overall broadcast/multicast traffic volume.

mDNS (16%), SSDP (15%), LLMNR (13%), NetBIOS (7%) and Dropbox LAN-sync (7%).

This clearly depends on the population of your LAN (mostly depending on 
OS distribution and installed apps). In this particular case, 
broadcast/multicast traffic peaked at around 1 GB a day, averaging at 
about 200 MB a day.

I hope this answers some of your no-legal questions.

Best,

Rolf



Am 7/15/15 um 6:07 AM schrieb Toerless Eckert:
> Rolfs web page explain almost nothing more than his email. I wouldn't
> know any actual broacast packet of interest except for ARP. I am
> pretty sure he means L2/L3 multicast. Having him say just "rfc919 / broadcast"
> makes me a bit nervuous about how well the other bits are thought out.
>
> As soon as IETF gives access for Rolf to any reasonable protected packets,
> i would assume IETF is at least partially indemnifying Rolfs org from
> legal responsibilities and takes on legal responsibilities itself.
>
> It would be good to understand what the IETF is really responsible for.
> I would fear that to be on the safe side, IETF should indemnify itself
> against the attendees by having them sign "something". I am sure
> that "something" needs to be better than "rfc919 / broadcast" unless he
> really only wants to analyze ARP patterns.
>
> Didn't IETF have security folks running around for decades telling us
> to not be insecure because they will be tap'ing our unprotected WiFi
> traffic and post our passwords ? Whatever happened of those experiments
> (sorry, can't remember) ?
>
> Logically its hilarious discussing legalese when Rolf would only tap
> what amounts to publically accessible packets, eg: on no- or obvious-password
> encrypted WiFI accessible in public areas like Hotel lobbies. Of course i
> am sure with digital laws being what they are, there is going to be difference
> in him publishing a paper about those packets vs. posting a paper
> about him observing/counting IETF participants in the public hotel
> lobby and oh, their observable legal drug consumption patterns.
>
> I am actually interested in what the heck the technical details are.
> Depending on what protocols are of interest, the different ways of how
> multicast traffic is constrained (IGMP snooping) or L2 unicast converted
> (vendor specific) makes a lot of difference to what can be observed where.
>
> If he can show some really useful stats he would create, i am all for giving
> him all the access needed as long as we can make sure the IETF indemnifies
> itself well enough so that it does not have to spend money later on some stupid
> lawsuit with some disgruntled ITEF participant. But then again, i am using
> a VPN tunnel for all my traffic anyhow.
>
> Cheers
>      Toerless
>
> On Tue, Jul 14, 2015 at 07:29:28PM +0300, Jari Arkko wrote:
>>> Rolf contacted me a while ago and I had him contact Jari for approval of
>>> this "experiment". Jari has approved it.
>> Right. I think it is a useful experiment and I find the privacy safeguards adequate.
>> And indeed, the main purpose of passing this kind of experiments via the
>> IETF chair is that I try to catch issues; in this case I reviewed the suggested
>> safeguards and suggested some changes, and felt that the result was adequate.
>>
>> It is possible that there are legal or other standards that would specify in
>> detail what we can and can not do. I am obviously not a lawyer either.
>> I don?t mind passing this to someone who understands laws about
>> human subject research or privacy, of course.
>>
>> Jari
>>
>
>
>> _______________________________________________
>> 93attendees mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/93attendees
>