CALEA Compliance on the Cheap -- A Feasibility - Merit Network.pptVIP

CALEA Compliance – A Feasibility StudyOctober 25, 2006 Mary Eileen McLaughlin Director – Networking Merit Network, Inc. Overview Merit believes it will need to be “Gateway compliant” for CALEA Will need to have a device at the ingress/egress points of our network In other words, where traffic enters or leaves AS-237 About 9 sites including private peering points We wanted to see if we could develop an architecture that Met what we see today as the law’s requirements Was cost effective and practical We’re not talking the legal pros/cons, or the expectations of law, or challenges Goals of Experimental Framework Build a modest packet capture platform Based on simple hardware and open-source software Test ability to capture a single data stream In the presence of a moderate amount of background traffic Measure performance Packet loss Make decision on just how good performance has to be for Merit to say it is in conformance with the law cont. Goals of Experimental Frameworkcont. Where will this solution ‘break’ Or, until what level of aggregate bandwidth usage is this solution functional How well might this solution work with 10G cards compared to price/performance of commercial solutions Testing only traffic capture functionality, not Transfer to law enforcement device Re-aggregation of traffic Other Hardware/Software Dell Precision GX260 Workstation, 2 GIGE interfaces for management and sampling Pentium 4 3GHz 1GB RAM 7200 RPM disk Gentoo Linux OS Tcpdump/tethereal for packet capture -- both depend on pcap library Testing whether tcpdump can handle the data rates Iperf as the traffic generator Some custom wrapper software to make it easier to manage the data collection activity Experiment Architecture Experiment Methodology Background traffic for the duration of the test: ~ 190-225Mbps (Sunday evening load), repeat for higher traffic load ~400Mbps (Monday afternoon) Phase 1 test: Send data from source to sink using iperf Attempt to capture traff