Carnivore bugs the heck out of me, but it also intrigues me, because I didn't understand how it works. One can easily write a "sniffer" program that listens in on any traffic, but I wondered how it can listen in on ALL traffic.
It can't. You see, a sniffer can only see what is going by, and all traffic doesn't travel the same route. So, the best that Carnivore could do is place one of these units (Carnivore is not just software, it's hardware too) on each of the major transfer points in the US (like Mae-West), but then it has to look at EVERYTHING. That's a daunting task, but even if we assume that Carnivore is a massive machine with RAID arrays to the ceiling, it STILL can't grab everything because Internet data is packetized. If the feds are looking for keywords, and you place the keyword at the end of the message, it is too late to start grabbing. So, in order to get complete messages, the have to grab and store EVERYTHING. Forget it, that ain't gonna happen.
The information provided on their web site makes sense... and that is that they use ISPs like telcos and place a Carnivore unit at the ISP. That greatly limits the traffic they have to listen to, and they can even hone in on a specific IP.
If Carnivore is listening to this board, it means there's a unit at TFL's ISP. 10-4?
A bird in the woods is worth six in the dish.
[This message has been edited by Mikul (edited July 26, 2000).]