about dettecting different TTL value

about dettecting different TTL value

[isp]

Hello,

I am new here. I am working in an ISP. I like to know that how can I
prevent user to use multiple computer with single internet connection? I
have searched on the web and found nothing.

I think it is only possible by detecting different TTL value that comes
from same IP address. And I didn't get any thing from the web. I like to
know that is it possible to do with IPTABLES? And how can I detect
defferent TTL Value with IPTABLES?

Please someone help me on this matter.

Thanks.

Hasan Syed Jowhor.

Re: about dettecting different TTL value

[Thomas Kuiper]

Hi Hasan,

I think you want to filter with ebtables (like some cable ISP's do) based on 
the mac address. ttl is not good for that.

BR,
Thomas

isp@cgscomm.net wrote:
> Hello,
> 
> I am new here. I am working in an ISP. I like to know that how can I
> prevent user to use multiple computer with single internet connection? I
> have searched on the web and found nothing.
> 
> I think it is only possible by detecting different TTL value that comes
> from same IP address. And I didn't get any thing from the web. I like to
> know that is it possible to do with IPTABLES? And how can I detect
> defferent TTL Value with IPTABLES?
> 
> Please someone help me on this matter.
> 
> Thanks.
> 
> Hasan Syed Jowhor.
> 
> 
> 
> 
> 
> 
> 

Re: about dettecting different TTL value

[Cedric Blancher]

Le mercredi 03 mai 2006 à 13:18 +0800, Thomas Kuiper a écrit :
> I think you want to filter with ebtables (like some cable ISP's do) based on 
> the mac address. ttl is not good for that.

1. You can spoof MAC address, there's no big deal about it, even on
Windows. Most soho routers have a "MAC cloning" functionnality  that
exactly does this.

2. ISP only sees router's MAC address, may be 1 or 20 hosts behind it.


-- 
http://sid.rstack.org/
PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE
>> Hi! I'm your friendly neighbourhood signature virus.
>> Copy me to your signature file and help me spread!

Re: about dettecting different TTL value

[Thomas Kuiper]

Hello Cedric,

Cedric Blancher wrote:
> Le mercredi 03 mai 2006 à 13:18 +0800, Thomas Kuiper a écrit :
> 
>>I think you want to filter with ebtables (like some cable ISP's do) based on 
>>the mac address. ttl is not good for that.
> 
> 
> 1. You can spoof MAC address, there's no big deal about it, even on
> Windows. Most soho routers have a "MAC cloning" functionnality  that
> exactly does this.

You can spoof anything. :-) I just wanted to point out that mac filtering is 
definetly better than being based on ttl.

> 2. ISP only sees router's MAC address, may be 1 or 20 hosts behind it.

ISP's that filter are bad and ethernet isn't really designed to be secure 
for that. But thats wasn't question here. Whats your solution?

Thomas

Re: about dettecting different TTL value

[Cedric Blancher]

Le mercredi 03 mai 2006 à 13:53 +0800, Thomas Kuiper a écrit :
> ISP's that filter are bad

Agree. And thoses who are trying to prevent people from sharing their
connection as well. But nevermind, such dinosaurs will extinguish by
themselves. In France for instance, thoses who have been trying to
enforce that have seen there clients leave for other ISP, so they had to
stop and most actually droped the "sharing not allowed" clause from
their contracts. Most of them even encourage that now :)

> and ethernet isn't really designed to be secure for that.

Link layer is not designed to be secure in any mean.

> But thats wasn't question here. Whats your solution?

Imho, ISP should not bother with how many hosts are behind a link.
People won't subscribe 2 lines because they got 2 laptops at home :)
Now, there's still something obscur to me behind OP question. What are
we talking about ? People using a soho router so they can share their
connection (I think it is the point, as TTL is discussed) ? People
trying to get multiple IPs for multiple hosts from the same modem (case
where we'll see different MAC addresses) ?

First situation, no solution. But is there a point in trying to prevent
this ? Connection sharing is imho something so well accepted nowadays...
Traffic emitted is in complete user control so they can tweak any header
field or parameter they want to fool ISP tracking. In particular, stuff
like OpenBSD pf scrub[1] optionaly associated with modulate[2] (I don't
see someone trying to figure out ISN generator class to spot multiple
hosts though). A bit sad we do not have such things in Netfilter. BTW...

Second situation, there are solutions. One deployed is PPPoE links, even
for cable modems. If users have to set a PPP links, then you can
restrict a given login to one tunnel at the same time, you can restrict
one modem to establish one tunnel at the same time, you can attach BPF
filter to you PPP link (to enforce source IP as an example), etc.


[1] http://www.openbsd.org/faq/pf/scrub.html
[2] http://www.openbsd.org/faq/pf/filter.html#state

-- 
http://sid.rstack.org/
PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE
>> Hi! I'm your friendly neighbourhood signature virus.
>> Copy me to your signature file and help me spread!

Re: about dettecting different TTL value

[Thomas Kuiper]

Cedric Blancher wrote:
> Second situation, there are solutions. One deployed is PPPoE links, even
> for cable modems. If users have to set a PPP links, then you can
> restrict a given login to one tunnel at the same time, you can restrict
> one modem to establish one tunnel at the same time, you can attach BPF
> filter to you PPP link (to enforce source IP as an example), etc.

But they can still use NAT behind a second router right? :-) I think the 
whole connection sharing issues for ISP's is that they want to sell a second 
account to someone else in that house. Its bogus cause one pays (normally) 
for an agreed link speed (no matter how many computers are behind the router 
and it will still be the same up/downlink speed to the ISP). Traffic amount 
doesn't concern either as the user should have the right to use the line as 
much as the contract allows.

And how many ISP's are there who promise a certain speed but never deliver it...

Still, to remain netfilter related in this topic, its a security question if 
its possible to force without third party software that only one computer 
uses a link, and the question remains if its possible to do it with 
netfilter (I doubt).

BR,
Thomas

Re: about dettecting different TTL value

[Cedric Blancher]

Le mercredi 03 mai 2006 à 15:50 +0800, Thomas Kuiper a écrit :
> But they can still use NAT behind a second router right? :-) I think the 
> whole connection sharing issues for ISP's is that they want to sell a second 
> account to someone else in that house. Its bogus cause one pays (normally) 
> for an agreed link speed (no matter how many computers are behind the router 
> and it will still be the same up/downlink speed to the ISP). Traffic amount 
> doesn't concern either as the user should have the right to use the line as 
> much as the contract allows.

Agreed.
As for the technical stuff, see situation 1... ISP do not have a single
little technical solution to achieve that properly outside finding an
effective RFC 3751 implementation.

Soho manufacturers already ship MAC spoofing because ISPs are
restricting their access to one MAC address and there's no easy way to
change it afterward. If ISPs fall into analysing traffic to spot
multiple hosts, they will ship traffic normalization as well, basicly
TTL mangling for instance, or more (see previously mentionnned
technics).

> And how many ISP's are there who promise a certain speed but never deliver it...

:) Quality of service...

> Still, to remain netfilter related in this topic, its a security question if 
> its possible to force without third party software that only one computer 
> uses a link, and the question remains if its possible to do it with 
> netfilter (I doubt).

The only trick I see is filtering out non default TTL values, basicly
values that differs from mostly 32, 64 or 128 (but not restricted to).


-- 
http://sid.rstack.org/
PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE
>> Hi! I'm your friendly neighbourhood signature virus.
>> Copy me to your signature file and help me spread!

Re: about dettecting different TTL value

[Cedric Blancher]

Le mercredi 03 mai 2006 à 10:41 +0600, isp@cgscomm.net a écrit :
> I am new here. I am working in an ISP. I like to know that how can I
> prevent user to use multiple computer with single internet connection? I
> have searched on the web and found nothing.

Before preventing, you need to detect. And there's _plenty_ of papers
online about that. Imho, the best ways are TTL matching and IPID classes
observations.

> I think it is only possible by detecting different TTL value that comes
> from same IP address. And I didn't get any thing from the web. I like to
> know that is it possible to do with IPTABLES? And how can I detect
> defferent TTL Value with IPTABLES?

	iptables -m ttl --help

But, what do you think people will do if ISPs are begining to enforce
something like this ? Traffic normalization, which is very easy. For
instance, you can rewrite TTL field on the fly with Netfilter :

	iptables -j TTL --help

And all your traffic now exhibits the same TTL value, whatever host can
send it...


<rant>
BTW, I don't understand why there's still ISP in this world still losing
their time on detecting and preventing connection sharing. For what I
could see for some that acutally do this, they really should consider
spending their time on improving quality of service...
</rant>

-- 
http://sid.rstack.org/
PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE
>> Hi! I'm your friendly neighbourhood signature virus.
>> Copy me to your signature file and help me spread!

about dettecting different TTL value

[isp]

Hello,

I am new here. I am working in an ISP. I like to know that how can I
prevent user to use multiple computer with single internet connection? I
have searched on the web and found nothing.

I think it is only possible by detecting different TTL value that comes
from same IP address. And I didn't get any thing from the web. I like to
know that is it possible to do with IPTABLES?

Please someone help me on this matter.

Thanks.

Hasan Syed Jowhor.

Re: about dettecting different TTL value

[Bob Sully]

This isn't an answer to your question...it's another question.  Sorry if
it's off-topic.

WHY would you want to do this???

If I had a choice between your ISP and another, I certainly would NOT
choose yours, given the fact that you are trying to limit use in this way.

Someone should enlighten your employer.

Just my $0.02 USD worth (= 1.4 Taka)

Bob

isp@cgscomm.net wrote:
> Hello,
>
> I am new here. I am working in an ISP. I like to know that how can I
> prevent user to use multiple computer with single internet connection? I
> have searched on the web and found nothing.
>
> I think it is only possible by detecting different TTL value that comes
> from same IP address. And I didn't get any thing from the web. I like to
> know that is it possible to do with IPTABLES?
>
> Please someone help me on this matter.
>
> Thanks.
>
> Hasan Syed Jowhor.
>
>


-- 
________________________________________
Bob Sully - Simi Valley, California, USA
http://www.malibyte.net
http://www.malibyte.com

Re: about dettecting different TTL value

[Curby]

On 4/23/06, isp@cgscomm.net <isp@cgscomm.net> wrote:
> Hello,
>
> I am new here. I am working in an ISP. I like to know that how can I
> prevent user to use multiple computer with single internet connection? I
> have searched on the web and found nothing.
>
> I think it is only possible by detecting different TTL value that comes
> from same IP address. And I didn't get any thing from the web. I like to
> know that is it possible to do with IPTABLES?

It is possible but a flawed solution for several reasons:

1) You can use an iptables patch to mangle/reset the TTL of all
outgoing packets (even those of NATed machines), rendering such a
check useless.

2) Your subscribers could spoof packets with varying TTL values to get
other subscribers in trouble.

3) There are cases where a single computer would send outgoing packets
with varying TTL values: traceroutes, sensitive/custom protocols, etc.

Regarding the "problem" itself, remember that increasingly, more and
more households will have wireless laptops in addition to desktop
computers, separate computers for children, networked gaming consoles,
etc.  IMHO it would be preferable to adjust your pricing so you are
profitable instead of cutting off an ever-growing demographic of
multi-machine households.

--Curby