TaoSecurity Blog

I was looking for resources on campus network design and found these slides  (pdf) from a 2011 Network Startup Resource Center presentation. These two caught my attention: This bothered me, so I Tweeted about it. This started some discussion, and prompted me to see what NSRC suggests for architecture these days. You can find the latest, from April 2018, here . Here is the bottom line for their suggested architecture: What do you think of this architecture? My Tweet has attracted some attention from the high speed network researcher community, some of whom assume I must be a junior security apprentice who equates "firewall" with "security." Long-time blog readers will laugh at that, like I did. So what was my problem with the original recommendation, and what problems do I have (if any) with the 2018 version? First, let's be clear that I have always differentiated between  visibility and control . A firewall is a poor visibility too...

If you're a protocol junkie like me, you probably enjoy investigating a variety of network traffic types. I don't encounter multicast traffic too often, so the following caught my eye. I'm using Iperf for some simple testing, and I notice it has a multicast option. Here's how I used it. In the following scenario, I have two hosts (cel433 and cel600) on the same segment. This is important because the router(s) in this test network are not configured to support multicast. I set up cel433 as a Iperf server listening on multicast address 224.0.55.55. cel433:/root# iperf -s -u -B 224.0.55.55 -i 1 ------------------------------------------------------------ Server listening on UDP port 5001 Binding to local address 224.0.55.55 Joining multicast group 224.0.55.55 Receiving 1470 byte datagrams UDP buffer size: 41.1 KByte (default) Now I generate multicast traffic from cel600. cel600:/root# iperf -c 224.0.55.55 -u -T 32 -t 3 -i 1 -------------------------------------------...

I just wrote about Web Browsing with Tor . You might wonder if there's an easy way to switch to using Tor while running Firefox. I looked at the Torbutton extension, but then I found SwitchProxy . I like SwitchProxy because can you configure multiple proxies and decide when to use them. If you click on the thumb image above you'll see me accessing a Hidden Service using Tor while I have Privoxy and Tor working together. Notice the URL -- http://6sxoyfb3h2nvok2d.onion/ I can just as easily switch to my production proxy, or even import a list of anonymous proxies and have SwitchProxy cycle through them every X seconds.

A task I'm going to blog shortly recommends that I install Privoxy . I encounted some troubles using FreeBSD so I thought I would document them. First I installed the package. orr:/root# pkg_add -vr privoxy ...edited... Running pre-install for privoxy-3.0.3_4.. extract: Package name is privoxy-3.0.3_4 extract: CWD to /usr/local extract: /usr/local/man/man1/privoxy.1.gz extract: /usr/local/sbin/privoxy extract: /usr/local/etc/privoxy/config extract: /usr/local/etc/privoxy/default.action extract: /usr/local/etc/privoxy/default.filter extract: /usr/local/etc/privoxy/trust ...edited... *********************************************************** ** Before running privoxy you must modify the file ** ** /usr/local/etc/privoxy/config ** ** ** ** Start privoxy with: ** ** /usr/local/sbin/privoxy /usr/local/etc/privoxy/config ** ** ...

In my Installing Privoxy post I said I needed to install Privoxy for a certain task. I decided to use Privoxy with Tor to facilitate anonymous Web browsing. First I installed Tor via package. orr:/root# pkg_add -vr tor ...edited... Package 'tor-0.1.1.23' depends on 'tsocks-1.8.b5_3' with 'net/tsocks' origin. ...edited... extract: Package name is tsocks-1.8.b5_3 extract: CWD to /usr/local extract: /usr/local/man/man1/tsocks.1.gz extract: /usr/local/man/man5/tsocks.conf.5.gz extract: /usr/local/man/man8/tsocks.8.gz extract: /usr/local/bin/tsocks extract: /usr/local/etc/tsocks.conf.sample extract: /usr/local/lib/libtsocks.so.1 extract: /usr/local/lib/libtsocks.so extract: /usr/local/share/examples/tsocks/tsocks.conf.complex.example extract: /usr/local/share/examples/tsocks/tsocks.conf.simple.example extract: /usr/local/share/examples/tsocks/README ...edited... Package 'tor-0.1.1.23' depends on 'libevent-1.2' with 'devel/libevent' origin. ...

The ISS acquisition has me thinking again about the security space. I noticed Richard Stiennon wrote the following: Consolidation? Not even close. There are over 867 vendors in the IT-Harvest knowledge base this morning. When that number falls month to month we can start talking about consolidation. I'm not sure that's the right way to look at the issue. How many of those companies are 1 year old or less? 2 years? 3 years? I'm guessing that many companies that were firewall development startups have either been bought or gone out of business. The same can be said for other product types. The vendor count may never decrease because new companies are always joining the market to address new problems (or so they claim). I think that process is consolidation. The main reason I posted this entry, however, is the title above. I am not the only person to discuss collapsing all network security functions into switches, and I have probably said something similar already...