Received: from boskop.local (Ia507.i.pppool.de [85.73.165.7]) by agitator.ibr.cs.tu-bs.de (8.12.3/8.12.3/Debian-7.1) with ESMTP id j3THYG9D014798 for ; Fri, 29 Apr 2005 19:34:16 +0200 Received: by boskop.local (Postfix, from userid 501) id B05972B698E; Fri, 29 Apr 2005 19:34:15 +0200 (CEST) Date: Fri, 29 Apr 2005 19:34:15 +0200 From: Juergen Schoenwaelder To: Wes Hardaker Subject: Re: [nmrg] Re: nmrgsnmp traffic trace anonymization Message-ID: <20050429173415.GA1196@boskop.local> Mail-Followup-To: Wes Hardaker , nmrg@ibr.cs.tu-bs.de, Matus Harvan References: <20050429115216.GA24986@boskop.local> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.8i X-IBRFilter-SpamReport: -1.524 () BAYES_01 X-Scanned-By: MIMEDefang 2.24 (www . roaringpenguin . com / mimedefang) Cc: nmrg@ibr.cs.tu-bs.de, Matus Harvan X-BeenThere: nmrg@ibr.cs.tu-bs.de X-Mailman-Version: 2.1.4 Precedence: list Reply-To: j.schoenwaelder@iu-bremen.de List-Id: Network Management Research Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Apr 2005 17:34:17 -0000 On Fri, Apr 29, 2005 at 10:04:23AM -0700, Wes Hardaker wrote: > >>>>> On Fri, 29 Apr 2005 13:52:16 +0200, Juergen Schoenwaelder said: > > Juergen> We have looked into the problem at IUB. Matus Harvan, one of > Juergen> my students, has done a project where he developed a > Juergen> prefix-preserving and lexicographic-order-preserving > Juergen> anonymization scheme for IP addresses. > > Probably one of the best things you could do would be to take the data > and strip out everything you don't have a direct understanding of. At > least that would provide some level of assurance because a human was > responsible for saying "I know what this data should contain, and it > should be safe to show to other humans". This is called the "filter-in" principle and mentioned in the report somewhere. See also the references, i.e. the paper by Pang/Paxson. (This is where this term originates from.) We looked at IP addresses because they are most challenging. In general, you want to preserve lexicographic order (so that you can analyze message sequences) while randomizing data. For routing tables, preserving the prefix order is also highly desirable. MAC addresses or similar flat number spaces are simpler to deal with since you only have to keep the lexicographic order but otherwise you can hash them as you want (only bounded by the size of the number space, which for MAC addresses is not an issue). Note that our conclusion of this work is not necessarily that this approach is practically useful. In fact, for IPv4 addresses, it is rather weak since the number of bits that you can randomize is small. For IPv6, it can potentially work (depends on the privacy requirements you have). But then IPv6 is not that widely deployed... /js -- Juergen Schoenwaelder International University Bremen P.O. Box 750 561, 28725 Bremen, Germany Received: from wes.hardakers.net (adsl-64-165-72-150.dsl.scrm01.pacbell.net [64.165.72.150]) by agitator.ibr.cs.tu-bs.de (8.12.3/8.12.3/Debian-7.1) with ESMTP id j3TH4R9D000894 for ; Fri, 29 Apr 2005 19:04:27 +0200 Received: by wes.hardakers.net (Postfix, from userid 274) id 2A03211D944; Fri, 29 Apr 2005 10:04:24 -0700 (PDT) From: Wes Hardaker To: nmrg@ibr.cs.tu-bs.de Organization: Sparta References: <20050429115216.GA24986@boskop.local> Date: Fri, 29 Apr 2005 10:04:23 -0700 In-Reply-To: <20050429115216.GA24986@boskop.local> (Juergen Schoenwaelder's message of "Fri, 29 Apr 2005 13:52:16 +0200") Message-ID: User-Agent: Gnus/5.110003 (No Gnus v0.3) XEmacs/21.4 (Jumbo Shrimp, linux) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-IBRFilter-SpamReport: 0 () X-Scanned-By: MIMEDefang 2.24 (www . roaringpenguin . com / mimedefang) Cc: Matus Harvan Subject: [nmrg] Re: nmrgsnmp traffic trace anonymization X-BeenThere: nmrg@ibr.cs.tu-bs.de X-Mailman-Version: 2.1.4 Precedence: list List-Id: Network Management Research Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Apr 2005 17:04:28 -0000 >>>>> On Fri, 29 Apr 2005 13:52:16 +0200, Juergen Schoenwaelder said: Juergen> We have looked into the problem at IUB. Matus Harvan, one of Juergen> my students, has done a project where he developed a Juergen> prefix-preserving and lexicographic-order-preserving Juergen> anonymization scheme for IP addresses. If it was just IP addresses, it would be a bit simpler. The problem is that devices contain many sources of information beyond just addresses. Serial numbers. Phone numbers. MAC addresses. Proprietary forms... You have to ask people what level they'd feel comfortable divulging. Take the example of the configuration available via SNMP for network port filtering at an edge. I don't care if the data has the addresses messed with, as the port information contained within the data is highly useful to me as an attacker. Even IP addrs come in many forms. Embedded in OIDs. 4 byte strings. 6 byte strings which include the port number (TAddress). dotted-representation. It's even embedded into many snmpEngineIDs. It's not that it can't be done. It's just that I, personally speaking, probably wouldn't trust something to do it. In the same way that a generic MIB is useless without a smart manager that understands the data within it, or a human to understand it and manipulate it by hand, you can't figure out how to make all the data anonymous without understanding of it as well. Probably one of the best things you could do would be to take the data and strip out everything you don't have a direct understanding of. At least that would provide some level of assurance because a human was responsible for saying "I know what this data should contain, and it should be safe to show to other humans". -- Wes Hardaker Sparta, Inc. Received: from boskop.local (Ia749.i.pppool.de [85.73.167.73]) by agitator.ibr.cs.tu-bs.de (8.12.3/8.12.3/Debian-7.1) with ESMTP id j3TF3F9D008272 for ; Fri, 29 Apr 2005 17:03:15 +0200 Received: by boskop.local (Postfix, from userid 501) id 9DEB72B3B36; Fri, 29 Apr 2005 13:52:16 +0200 (CEST) Date: Fri, 29 Apr 2005 13:52:16 +0200 From: Juergen Schoenwaelder To: nmrg@ibr.cs.tu-bs.de Message-ID: <20050429115216.GA24986@boskop.local> Mail-Followup-To: nmrg@ibr.cs.tu-bs.de, Matus Harvan Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.5.8i X-IBRFilter-SpamReport: -4.9 () BAYES_00 X-Scanned-By: MIMEDefang 2.24 (www . roaringpenguin . com / mimedefang) Cc: Matus Harvan Subject: [nmrg] snmp traffic trace anonymization X-BeenThere: nmrg@ibr.cs.tu-bs.de X-Mailman-Version: 2.1.4 Precedence: list Reply-To: j.schoenwaelder@iu-bremen.de List-Id: Network Management Research Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Apr 2005 15:03:16 -0000 Hi. During our last meeting, we discussed how we can collect and analyze network management traffic traces and more specifically SNMP traces. I showed a tool which converts pcap traces into an XML format which makes it easy to write analyzer scripts in Perl, Python, ... One issue that came up during the meeting was whether it is possible to anynomize traces so that they do not reveal directly where the trace is coming from but we did not know the details how this could work. We have looked into the problem at IUB. Matus Harvan, one of my students, has done a project where he developed a prefix-preserving and lexicographic-order-preserving anonymization scheme for IP addresses. People interested into this work are invited to take a look at Matus' report and implementation which you can find on the following server: . We are generally interested to receive feedback. Note that there is also an implementation of the algorithm in case you want to try it out. /js -- Juergen Schoenwaelder International University Bremen P.O. Box 750 561, 28725 Bremen, Germany Received: from isis.wu-wien.ac.at (isis.wu-wien.ac.at [137.208.3.42]) by agitator.ibr.cs.tu-bs.de (8.12.3/8.12.3/Debian-7.1) with ESMTP id j3TA7R8p028903 for ; Fri, 29 Apr 2005 12:07:27 +0200 Received: from REM (isis.wu-wien.ac.at [137.208.3.42]) by isis.wu-wien.ac.at (8.12.11/8.12.9) with ESMTP id j3TA7Owh027224 for ; Fri, 29 Apr 2005 12:07:24 +0200 (envelope-from malexand@wu-wien.ac.at) Message-Id: <200504291007.j3TA7Owh027224@isis.wu-wien.ac.at> From: "Michael Alexander" To: Date: Fri, 29 Apr 2005 12:07:24 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" X-Mailer: Microsoft Office Outlook, Build 11.0.6353 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180 Thread-Index: AcUzfQBdHjnJpRIzQOCRb7Aso814lwZJfP8A In-Reply-To: <200503281000.j2SA02rX008117@agitator.ibr.cs.tu-bs.de> X-WU-wumi-status: clean v4.4.00/v4479 charon wu 938561cb458cd64d32d4b84a7e5233cb X-IBRFilter-SpamReport: -0.001 () BAYES_44 X-Scanned-By: MIMEDefang 2.24 (www . roaringpenguin . com / mimedefang) Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by agitator.ibr.cs.tu-bs.de id j3TA7R8p028903 X-Mailman-Approved-At: Wed, 04 May 2005 09:48:18 +0200 Subject: [nmrg] AW: Nmrg Digest, Vol 8, Issue 10 X-BeenThere: nmrg@ibr.cs.tu-bs.de X-Mailman-Version: 2.1.4 Precedence: list List-Id: Network Management Research Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Apr 2005 10:07:44 -0000 I am planning to attend also - will there be topic specific sessions in the workshop. Best Regards, Dr. Michael Alexander WU Wien Dept. of Information Systems malexand@wu-wien.ac.at / +43.1.31336.4467 -----Ursprüngliche Nachricht----- Von: nmrg-bounces@ibr.cs.tu-bs.de [mailto:nmrg-bounces@ibr.cs.tu-bs.de] Im Auftrag von nmrg-request@ibr.cs.tu-bs.de Gesendet: Montag, 28. März 2005 12:00 An: nmrg@ibr.cs.tu-bs.de Betreff: Nmrg Digest, Vol 8, Issue 10 Send Nmrg mailing list submissions to nmrg@ibr.cs.tu-bs.de To subscribe or unsubscribe via the World Wide Web, visit https://www.ibr.cs.tu-bs.de/mailman/listinfo/nmrg or, via email, send a message with subject or body 'help' to nmrg-request@ibr.cs.tu-bs.de You can reach the person managing the list at nmrg-owner@ibr.cs.tu-bs.de When replying, please edit your Subject line so it is more specific than "Re: Contents of Nmrg digest..." Today's Topics: 1. Re: voip management meeting (Juergen Schoenwaelder) ---------------------------------------------------------------------- Message: 1 Date: Sun, 27 Mar 2005 21:23:40 +0200 From: Juergen Schoenwaelder Subject: Re: [nmrg] voip management meeting To: "Romascanu, Dan (Dan)" Cc: nmrg@ibr.cs.tu-bs.de Message-ID: <20050327192340.GA25611@boskop.local> Content-Type: text/plain; charset=us-ascii On Sun, Mar 27, 2005 at 11:30:23AM +0200, Romascanu, Dan (Dan) wrote: > I plan to attend. Will there be hotel arrangements, or at least > recommendations for Nancy? Also, some directions about how to get > there (what train lines, connections form the two principal > airports in Paris, etc.) would be welcome. I am sure Olivier will provide this information after the easter break and I will assemble this on the meeting web page. /js -- Juergen Schoenwaelder International University Bremen P.O. Box 750 561, 28725 Bremen, Germany ------------------------------ -- !! This message is brought to you via the `nmrg' mailing list. !! Please do not reply to this message to unsubscribe. To unsubscribe or adjust !! your settings, send a mail message to !! or look at https://www.ibr.cs.tu-bs.de/mailman/listinfo/nmrg. End of Nmrg Digest, Vol 8, Issue 10 *********************************** Received: from smtp0.netlab.nec.de (smtp0.netlab.nec.de [195.37.70.40]) by agitator.ibr.cs.tu-bs.de (8.12.3/8.12.3/Debian-7.1) with ESMTP id j3R7I7aZ012248 for ; Wed, 27 Apr 2005 09:18:07 +0200 Received: from europa.office (europa.office [10.1.1.2]) by smtp0.netlab.nec.de (Postfix) with ESMTP id 0D1F1D9E8; Wed, 27 Apr 2005 09:21:27 +0200 (CEST) X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Subject: RE: [nmrg] Re: FWD: Invitation to the ITU-T Workshop on NGN inCollaboration with the IETF Date: Wed, 27 Apr 2005 09:18:03 +0200 Message-ID: <88F766D04E6AF3409B39E60D7D933EB23040@europa.office> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: [nmrg] Re: FWD: Invitation to the ITU-T Workshop on NGN inCollaboration with the IETF Thread-Index: AcVKhz1p2URv5b7MQWiOfek5ddiaZQAcfgxw From: "Marcus Brunner" To: , X-IBRFilter-SpamReport: -0.904 () BAYES_30 X-Scanned-By: MIMEDefang 2.24 (www . roaringpenguin . com / mimedefang) Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by agitator.ibr.cs.tu-bs.de id j3R7I7aZ012248 X-Mailman-Approved-At: Fri, 29 Apr 2005 08:24:56 +0200 Cc: X-BeenThere: nmrg@ibr.cs.tu-bs.de X-Mailman-Version: 2.1.4 Precedence: list List-Id: Network Management Research Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Apr 2005 07:18:13 -0000 I also managed to free up the time to got there. Marcus --------------------------------------------------- Dr. Marcus Brunner Network Laboratories NEC Europe Ltd. > -----Original Message----- > From: nmrg-bounces@ibr.cs.tu-bs.de > [mailto:nmrg-bounces@ibr.cs.tu-bs.de] On Behalf Of Juergen > Schoenwaelder > Sent: Tuesday, April 26, 2005 1:07 PM > To: nmrg@ibr.cs.tu-bs.de > Subject: [nmrg] Re: FWD: Invitation to the ITU-T Workshop on > NGN inCollaboration with the IETF > > On Thu, Apr 07, 2005 at 11:01:43PM +0200, Juergen Schoenwaelder wrote: > > [...] > > > I was planning to join this meeting. Unfortunately, the > scheduling on > > May 1-2 makes it extremely difficult for me to be in > Geneva. So I am > > wondering whether someonelse familiar with the NMRG is able > to attend > > this meeting. > > Just for your information: I have managed to solve the > scheduling problems and I will attend the ITU/IETF meeting in > Geneva next weekend. If you have any specific questions you > are intersted in, feel free to send me email and I will see > whether I can get any answers in Geneva. I am also looking > forward to see some of you there. > > /js > > -- > Juergen Schoenwaelder International University Bremen > P.O. Box 750 561, > 28725 Bremen, Germany > -- > !! This message is brought to you via the `nmrg' mailing list. > !! Please do not reply to this message to unsubscribe. To > unsubscribe or adjust !! your settings, send a mail message > to !! or look at > https://www.ibr.cs.tu-bs.de/mailman/listinfo/nmrg. > Received: from boskop.local (Ib291.i.pppool.de [85.73.178.145]) by agitator.ibr.cs.tu-bs.de (8.12.3/8.12.3/Debian-7.1) with ESMTP id j3QHd9aZ001477 for ; Tue, 26 Apr 2005 19:39:10 +0200 Received: by boskop.local (Postfix, from userid 501) id 001032A7666; Tue, 26 Apr 2005 13:06:31 +0200 (CEST) Date: Tue, 26 Apr 2005 13:06:31 +0200 From: Juergen Schoenwaelder To: nmrg@ibr.cs.tu-bs.de Message-ID: <20050426110631.GA3900@boskop.local> Mail-Followup-To: nmrg@ibr.cs.tu-bs.de References: <20050407210143.GA17328@boskop.local> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20050407210143.GA17328@boskop.local> User-Agent: Mutt/1.5.8i X-IBRFilter-SpamReport: -1.524 () BAYES_01 X-Scanned-By: MIMEDefang 2.24 (www . roaringpenguin . com / mimedefang) Subject: [nmrg] Re: FWD: Invitation to the ITU-T Workshop on NGN in Collaboration with the IETF X-BeenThere: nmrg@ibr.cs.tu-bs.de X-Mailman-Version: 2.1.4 Precedence: list Reply-To: j.schoenwaelder@iu-bremen.de List-Id: Network Management Research Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Apr 2005 17:39:16 -0000 On Thu, Apr 07, 2005 at 11:01:43PM +0200, Juergen Schoenwaelder wrote: [...] > I was planning to join this meeting. Unfortunately, the scheduling > on May 1-2 makes it extremely difficult for me to be in Geneva. So > I am wondering whether someonelse familiar with the NMRG is able to > attend this meeting. Just for your information: I have managed to solve the scheduling problems and I will attend the ITU/IETF meeting in Geneva next weekend. If you have any specific questions you are intersted in, feel free to send me email and I will see whether I can get any answers in Geneva. I am also looking forward to see some of you there. /js -- Juergen Schoenwaelder International University Bremen P.O. Box 750 561, 28725 Bremen, Germany Received: from boskop.local (I86aa.i.pppool.de [85.73.134.170]) by agitator.ibr.cs.tu-bs.de (8.12.3/8.12.3/Debian-7.1) with ESMTP id j37L1iBt029278 for ; Thu, 7 Apr 2005 23:01:44 +0200 Received: by boskop.local (Postfix, from userid 501) id 034B02573D9; Thu, 7 Apr 2005 23:01:43 +0200 (CEST) Date: Thu, 7 Apr 2005 23:01:43 +0200 From: Juergen Schoenwaelder To: nmrg@ibr.cs.tu-bs.de Message-ID: <20050407210143.GA17328@boskop.local> Mail-Followup-To: nmrg@ibr.cs.tu-bs.de Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.5.8i X-IBRFilter-SpamReport: -0.908 () BAYES_10 X-Scanned-By: MIMEDefang 2.24 (www . roaringpenguin . com / mimedefang) Subject: [nmrg] FWD: Invitation to the ITU-T Workshop on NGN in Collaboration with the IETF X-BeenThere: nmrg@ibr.cs.tu-bs.de X-Mailman-Version: 2.1.4 Precedence: list Reply-To: j.schoenwaelder@iu-bremen.de List-Id: Network Management Research Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 07 Apr 2005 21:01:45 -0000 I am not sure whether everybody on this list has seen the following announcement. I believe that this meeting is a very interesting event and it touches quite some management aspects as well, especially in the context of VoIP. I was planning to join this meeting. Unfortunately, the scheduling on May 1-2 makes it extremely difficult for me to be in Geneva. So I am wondering whether someonelse familiar with the NMRG is able to attend this meeting. I know that Aiko has some personal ties to the mountains in Switzerland or that Olivier is living relatively close to Geneva (as seen from the world-wide perspective). Please anyone intending to go there, please drop me a note so that we can ensure a good information flow into and out of this meeting. Note that the registration deadline is April 15th. /js ----- Forwarded message from Allison Mankin ----- To: IETF Announcement list From: Allison Mankin Date: Tue, 22 Mar 2005 15:10:19 -0500 Subject: Invitation to the ITU-T Workshop on NGN in Collaboration with the IETF Precedence: list Errors-To: ietf-announce-bounces@ietf.org The ITU-T will hold a workshop on NGN (Next Generation Network) together with the IETF 1-2 May, 2005, Geneva, Switzerland. Attendance is open to all IETF participants and is free of charge. The deadline for registration is 15 April 2005. Registration and other information is available at: http://www.itu.int/ITU-T/worksem/ngn/200505/index.html (Be sure to look at the convening letter for more links). The workshop will also serve as an important meeting point for ITU-T and IETF management. The overall objectives of the workshop are to explore specific NGN issues that impact both the ITU-T and the IETF to better understand the work underway in the two organizations and to identify areas where actions could be taken between the ITU-T and IETF to further coordinate their work. Six sessions will each be co-chaired by an ITU representative and an IETF representative. Topics will include (not final) requirements and functional architecture; nomadicity and mobility; QoS, control and signalling capabilities; network management; security capabilities, and evolution. Objectives: o To explore specific NGN issues that impact both the ITU-T and the IETF to better understand the work underway in the two organizations; and o To identify those areas where actions could be taken between the ITU-T and the IETF to further should coordinate their NGN-related work, and to seek to reach agreement on any actions to be taken to coordinate the work of the two organizations and perhaps establish joint activities. If a personal invitation letter is needed, please contact Allison Mankin (mankin@psg.com) immediately, who will arrange for an invitation from the ITU Secretariat. IETF organizing committee: Loa Andersson, IAB Scott Bradner, IETF Liaison to ITU-T Scott Brim, IETF Liaison to ITU-T NGN Activity Brian Carpenter, IETF Chair Russ Housley, IESG Security Area Director Leslie Daigle, IAB Chair Allison Mankin, Transport Area Director (organizing committee chair) Dave Meyer, IAB Jon Peterson, IESG Transport Area Director _______________________________________________ IETF-Announce mailing list IETF-Announce@ietf.org https://www1.ietf.org/mailman/listinfo/ietf-announce ----- End forwarded message -----