1

Recently, UC Irvine's Residential Network department changed their security policies to include the following requirement:

Reconfiguration of Home Routers

Home routers will need to have DHCP functionality and network address translation (NAT) disabled.

Now, I've only dabbled in network protocols, but I thought that it's impossible to tell if a device on your network is a router using NAT or a client that's just making a lot of connections, and that DHCP is completely OS agnostic.

So I'm wondering: social issues aside*, would it be technically feasible to enforce this policy**? (on a university residential network's budget, of course)

I don't know how they could do it, especially in a network that has to deal with more sophisticated users who might be doing things like changing their MAC address or modifying their browser's user-agent string (and isn't that particularly expensive to sniff?).

On the other hand, like I said before, I've only ever dabbled in network protocols, so maybe there's something obvious I'm missing.

* Presumably, after this policy change, they can now say "well, you weren't following policy, it's your job to find the computer that was infected and fix it".

** As far as I can tell, they aren't actually. It theoretically went into effect last week.

5 Answers 5

0

It can be difficult, but not impossible. For example, if you see a Macintosh and a Windows browser client from the same IP, that's probably NAT. Or, if you routinely see near-simultaneous requests for completely different web pages (say, serverfault and TMZ), that could also be a sign. Or, ICMP requests that can be "fingerprinted" differently - e.g. some implentations null-filling certain packets and some that don't. Remember, even if they do find people doing these sorts of things, it's still against policy, so if they catch you doing it, they can still say 'it was against the rules'. You can almost never fully enforce a policy decision via technical means, but this allows them to say 'See, it is against the rules.

3
  • A few things: How hardware intensive is it to do user-agent sniffing on a campus-wide network? (I'm assuming that's what you mean by a Mac and Windows browser client from the same IP). Wouldn't browser prefetching occasionally make it look like there's multiple requests for a site coming from a single browser? Do you have any sources for ICMP fingerprinting, I hadn't heard of that and it sounds interesting. Beyond that, this is probably the most complete answer.
    – Tacroy
    Sep 21, 2011 at 4:49
  • I guess it was TCP/IP fingerprinting I was thinking of: en.wikipedia.org/wiki/TCP/IP_stack_fingerprinting . Yes, browser prefetching would make it look like multiple people were doing the same things, which is why this isn't an exact science. As far as hardware intensive goes.... it all depends how much money someone is willing to spend.
    – Aaron
    Sep 21, 2011 at 12:09
  • Well, you gave the best answer to the technical question, so here you go.
    – Tacroy
    Sep 22, 2011 at 3:27
4

The intent is probably more along the lines of reducing the chances of folks plugging in their equipment incorrectly and then rendering the reset of the network(s) less than usable with DHCP servers (from the NAT routers) serving incorrect IP addresses.

As stated by TomTom, it is difficult to detect a "normal" client from a NAT servicing multiple clients, but in addition to higher simultaneous port/application connection usage - a NAT configuration will also tend to exhibit a larger network utilization footprint as well. The combination of more active network port connections and more bandwidth utilization can trigger more attention if active network analysis is performed.

5
  • +1, great minds... ;-)
    – Handyman5
    Sep 20, 2011 at 7:25
  • THat would be stupid setup, though - like plugging the router in in reverse. Normal home routers dont serve DHCP requests on the uplink side. Only downstream.
    – TomTom
    Sep 20, 2011 at 7:34
  • "plugging in their equipment incorrectly" - no mention of WAN-side here...
    – user48838
    Sep 20, 2011 at 12:28
  • This doesn't really answer the question, though - I'm aware of the social reasons for creating this policy (UCI ResNet specifically says it's so they don't have to diagnose misbehaving computers), and the method you mentioned only works if there's a large network on the other side of the NAT. I don't really think that most families are going to have more than a few computers behind a wireless router, and how are you going to tell the difference between that and one person with a really short attention span?
    – Tacroy
    Sep 21, 2011 at 4:46
  • Actually, it was answered by the manual examples and logic. There are also Layer 7 security devices which can also detect NAT devices with good reliability as well.
    – user48838
    Sep 23, 2011 at 9:06
3

They are also concerned about non-network-savvy students getting routers and plugging them into the campus network via one of the LAN ports instead of the WAN port. When that happens, it's possible for other students' computers to get DHCP addresses from the rogue router instead of the official one, and of course the rogue router isn't going to provide any connectivity to the Internet (as its WAN port isn't plugged in to anything). This problem can be very confusing for people who think they're doing everything right, and it causes a lot of support hassle for the network department.

1

The decrease of TTL in packets can be a sign of NAT device(s).

Google for more: nat ttl.

0

Yes, it is - it alwo is a ridiculous stupid policy to start with.

While NAT is transparent on the surface, there are certain things that can hint - tons of TCP connection from one address, there are certain behavrios of certain NAT implemtentations that provide hints of the NAT implementation used.

But this is a VERY hard game to play - not reliable.

That said, it is a very vague game, and I would: * Send them back a legal document where they declare FULL LEGAL AND FINANCIAL RESPONSIBILITY FOR MY DATA as they force me to abandon a standard layer of security (i.e. my network is not scanable from the outside). I would also ask for a 5 million USD insurance cover or bond to be deployed. * Get another provider and possibly reduce rent etc. for breach of contract, depending on contract.

It is a good example why one should have a separate internet connection always ;) Sadly in the US you are a little more primitive than in parts of europe - here they just roll out LTE phones, which are made as mobile replacements for DSL etc. - I would jusst get a LTE router in some months and be done with them ;)

5
  • 1
    You should probably re-read the question and delete your last couple paragraphs - he's talking about students setting up their own mini-networks inside the University's residence network. This is exactly analogous to a company having policies that staff have to follow - no rogue WiFi AP's, etc. They have every right to set whatever rules they want. They might be stupid rules and difficult to enforce in this case, but the idea of a student sending a demand to be allowed to use NAT is laughable. Sep 20, 2011 at 6:00
  • No, sorry. If I rent a place from a university, I dont expect them to treat me different than any other ISP. This is not about a university lapb, it is about a univerity acting as ISP for their dorms.
    – TomTom
    Sep 20, 2011 at 6:46
  • Based on that rational, the dorm resident should also be able to drink too if they are of legal age, but that's not always the case...
    – user48838
    Sep 20, 2011 at 7:34
  • In many states, universities cannot legally restrict alcohol in their dorms. By State law, if you rent space to someone, they have the right to use it how they please provided they don't disturb others. Sep 20, 2011 at 7:50
  • Doesn't mean they don't do it and students don't waive their "rights" with their agreement to the terms. Same thing with firearms in states with firearms provisions. Most folks incorrectly assume the Federal laws apply when they only specifically cover K through 12.
    – user48838
    Sep 20, 2011 at 12:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .