Hi There!..
We are using a Mikrotik based PPPoE concentrator to deliver internet to our subscribers on a per host subscription basis.
Now some subscriber could install a PPPoE capable router and masquarade any number of hosts behind that router.
Is there a way to control or to limit the number of masquaraded host behind a router
Simple answer - no, there is not as all the packets would come from one and the same IP address, and this is all you can check out on the router.
Long answer - well, there are some ways involving sniffing all the traffic and analyzing it on a separate machine. There is at least one document on the Internet describing possible techniques to do this. The two techniques I remember are:
-
There is the Identification (bits 32..47) field in IP header, which must be unique for each packet and generally is sequential (AFAIK, unless special actions are taken almost all OSs make it sequantial) with increase of 1. But this number is sequential for each host masqueraded in particular, and AFAIK, router does not change this field on NAT! That it… If you analyze the traffic, and make a table of all IP Identification field values, you will recognise one or more sequences. First guess would be - how many independent sequences, so many independent computers are sitting behind the router. Incorrect. First, there is only 16 bits for the field, so at some moment (after reaching value of 65535) they will reset to 0. Second, it is perfectly possible to loose some items in the sequence as not all the packets that are sent by end hosts are actually seen by your router (they might communicate within their local network)
-
Very similar story is about TCP and UDP ports. Source ports of all outgoing connections of hosts must be unique, and in most cases (unless a special randomizer available, for example, for Linux, is used) they also are sequential. Analyze and group - voila… The same two notes mentioned above apply to this point too. Also note that port numbering for outgouing connections is generally started from 1024. And one more thing: NATting router strives not to change the original src-port of the sender but in some cases (when there is a port conflict) it can change the source port (note that Linux and RouterOS in no case will change the “class” of the port; there are three classes of ports: 0..511, 512..1023, 1024..65535)
But… not everything is so shiny:
-
I do not know any implementations of such a techniques. But remember that it is very easy to make one.
-
Both mentioned techniques apply to 3-rd OSI level gateways (that is what routers are). They will not apply for higher level gateways. It means that the user in order to hide a network behind him, should not make masquerading, but make proxying (remember, many things can be proxied transparently, so his clients might not even notice this proxying; also remember that SOCKS may proxy any TCP protocols). Proxy server will establish a new connection using its own IP Identification and TCP port sequencing, and nothing will be detected on an analyzer
Thank you for this complete answer.
I think the other way would be to use HotSpot feature instead of PPPoE.
I guess it would more difficult for a router to enter a login and password. The host behind the router would have to do it and then we could easily control the number of hosts behind that router. Am I right ? How woul a proxy react to the hotspot login page ?
- HotSpot will be no help. When the first sub-client will be up to connect to the Internet, he will be presented with a HotSpot login form which he/she will be able to authenticate from. Next one will not have to login. And proxy will work the same.
- It is perfectly possible to log in from a router if it is, say, a Windows XP with Internet sharing enabled