[Henchman21]

Never tapped a port, eh?

Edited to not be so flippant: I work in HFT/finance where recording all traffic is required I think by law and definitely for one's own sanity. We're able to maintain nanosecond trades while capturing ALL the traffic. It has zero impact on the traffic. This is normal, widely used tech. Think stuff like Ixia passive taps and/or Arista Metamako FPGA-based tap/mux devices.

[Aurornis]

> Never tapped a port, eh?

I have. I have a background in high speed networking.

Have you ever paused for a moment to consider how much infrastructure would be required to send 80% of data on the internet across the country and into a single datacenter in Virginia?

If you've worked in HFT, you can probably at least start to imagine the scale we're talking about.

[reactordev]

It’s not a single data center, it’s about 200 of them.

[suhputt]

the time it takes for light to travel from los angeles to virginia is 12 - 16 ms, round trip is 30ms lets say - that is a noticeable delay, and it could be easily disproven that 80% of traffic is literally routed through VA

now.. could they just copy the traffic and send it to VA on a side channel? probably?

[metadat]

And how useful would this information be? srcIP:port_dstIP:port pairs with almost all traffic encrypted. Pretty boring from a sigint pov.

Instagram, YouTube, misc Web traffic, and torrents, with a side of minutae.

I'm certain the three letter agencies yearn for the days before letsencrypt was de facto.

[NGRhodes]

i used to work, 15 years ago, on a (permissive, not covert) monitoring service for a UK national public service, the NHS spine core. We used switches to mirror ports and capture traffic in promisciouse mode on a few dozen servers split across a few datacentres that all the traffic went througg. We had certs installed to decode https. We could get enough hardware to do this step easily, but fast enough storage was an issue, we had 1 petabyte of usable storage across all sitesn that could hold a few days of content. We aimed to get this data filtered and forwarded into our central Splunk (seperate storage) and also into our bespoke dashboards within 60s. We often lagged...

[rtkwe]

The point they were making was that you could tell via ping times if the traffic was literally being routed through VA unnecessarily because the extra unavoidable light speed delay that extra distance would add between a user and the server if they weren't already very near to VA. Could be mirrored via the type of monitoring you're talking about but that'd only get you mostly encrypted traffic unless the 90s cypherpunk paranoia turns out to have been true.

[wasabi991011]

But you are only tapping your own data that's already passing by you not? Not 80% of the internet that has nothing to do with you.