Has it occured to anyone that this may all be a ruse?

As has been pointed out, there is only a limited utility in using the stock traceroute and ping utilities to gather information. Ping will let you know whether something's 'up' and traceroute will show you the route through the void from the origin to the target. Unless loose source routing is enabled along the way, this technique couldn't tell me how the target gets to someone else, or how someone else gets to the target. Worse, traceroute may not be showing the same route the target would get if they traced to me.

A quick stop at traceroute.org will give you a list of hundreds of traceroute gateways on the net. You could use them to map various alternate routes into an address. Something that's far more usefull than tracing thousands of outbounds from a single location if you're interested in network topology.

Getting "geographical information" is trivial in most cases, since you can usually get that from the upstream provider. How many ISP's and GSP's name their routers "dedicated.sf.ca.GSP.net" or some such? That alone localizes it, and pretty much anything hanging off of it.

To get to the "nefarious plot" part, has anyone considered this is all a stunt to gain some publicity before the IPO with a non-existent, or at least "l4Ym3" product? "We've mapped the whole Internet! Buy our stock!" "Wow, Vern, they mapped the whole net! Let's buy their stock!"

Face it. Anyone could write a 10 minute perl script to mimic what these guys are doing. In fact, you could probably write an automated script to find the "core" routers for entire subnets (the thousands of DSL customers hanging off a big metro core router for example) and use the traceroute gateways to actually map the topology.

As for the CIA plot bit, it's cute. But a disgruntled Network Engineer at one of the big NAP's can do more damage with a pait of wirecutters than these guys can with all their data. "Funny. That OC192 looked just like target.com's OC3!"

"ph33r the clueless, for they shall inhibit the Net..."

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/56/2538#2538