Network Associates Nabs "wiretap" Tool

CNET News ^ | August 26, 2002, 1:36 PM PT | Robert Lemos

[anymouse]

Security company Network Associates said Monday that it had purchased a small start-up whose software lets corporations and others "wiretap" their computer networks.

With its acquisition of Lindon, Utah-based Traxess, Network Associates adds a product complementary to its own Sniffer network-management system, said Sandra England, the company's executive vice president for business development, and the person who closed the deal.

With Traxess' DragNet program, "we can stream to disk everything that is happening on the network," England said. "It can give you far more capability to see what an intruder has done."

While the system could easily be used to track unauthorized uploads to a network--uploads by hackers, for instance--it could also be used to tap e-mail, printing jobs, instant messaging discussions and even voice-over-IP phone calls.

"It is completely transparent to the user," said England, who envisions companies using the software to see what is going on around their network and the government using it to investigate employees and hackers. While Network Associates hasn't approached law enforcement agencies yet, the network-tapping software could add considerable teeth to the FBI's own network-tapping program, known as DCS-1000 or, formerly, as "Carnivore."

DragNet is still being tested, but its biggest plus, according to England, is its ability to keep up with an enormous volume of network traffic. The product is designed to stream data to storage at gigabit speeds, but Network Associates didn't reveal how different-sized networks might affect speeds during operation.

Many segments of the technology market are still struggling, but computer security has remained strong and is the focus of many larger companies' acquisition strategies.

Network Associates' announcement comes a month after rival Symantec revealed that it would be buying three security companies. England said the Network Associates move wasn't a response to its competitor.

After acquiring more than 40 companies from 1994 to 1998, Network Associates took a break to restore profitability and integrate its new additions. The Traxess deal is Network Associates' first buyout in four years.

"We did a hiatus, because we had a lot to incorporate," England said.

[anymouse]

BTW, Network Associates pretty much controls the Internet through it's control of the domain name registry.

[HEY4QDEMS]

Allot of good Carnivore did to prevent 9/11.

Always remember that under no circumstance is safety more important than your liberty.

[thatsnotnice]

With Traxess' DragNet program, "we can stream to disk everything that is happening on the network," England said. "It can give you far more capability to see what an intruder has done."

Is that a big deal? Why not just set up a workstation with some *BSD or Linux variant, plug it into the network, and run your favorite packet sniffer? If you hook it up to a network that has any traffic at all you’re going to have a nice fat file full of garbage to sift through. It’s easier to just snoop traffic to/from ip’s of machines you are interested in.

There was a guy at a company I worked at that always had inside info on things going on in the company. He brought in a laptop every day and plugged it into a four-port hub in his cubicle and sniffed traffic from the CEO’s workstation. He never let us in on it until after he’d left for another company... works both ways.

[triggerhappy]

You're thinking of Network Solutions a subsidiary of VeriSign.

Network Assoc. makes McAfee software.

[anymouse]

Ping.

[anymouse]

Doh! You're right I mixed the two socialist companies up. :)

[NRA2BFree]

Thanks for the Ping. 8-) Do I need tinfoil for this one? LOL

[TechJunkYard]

With Traxess' DragNet program, "we can stream to disk everything that is happening on the network," England said.

Why not just set up a workstation with some *BSD or Linux variant, plug it into the network, and run your favorite packet sniffer?

Ah, but read a little further...

.. its biggest plus, according to England, is its ability to keep up with an enormous volume of network traffic. The product is designed to stream data to storage at gigabit speeds..

Sounds like the thing would need its own SAN to keep up with the data rates.

There was a guy at a company I worked at... brought in a laptop every day and plugged it into a four-port hub in his cubicle and sniffed traffic from the CEO's workstation.

That trick will work on a hub, but not on a switched network. You'd see broadcast or multicast traffic only. Nortel (I think.. or was it Fluke?) has a network mapping package that uses SNMP. I'd love to know how DragNet can sniff everything.