Dan Kaminsky will share details of this technique, which will eventually be rolled into a free software tool, today at the Black Hat USA security conference in Las Vegas. The software can tell whether computers are treating some types of TCP/IP traffic better than others -- dropping data that is being used in voice-over-IP (VoIP) calls or treating encrypted data as second-class, for example.
Kaminsky calls his technique "TCP-based active probing for faults." He says that the software he's developing will be similar to the Traceroute Internet utility that is used to track what path Internet traffic takes as it hops between two machines on different ends of the network.
But unlike Traceroute, Kaminsky's software will be able to make traffic appear as if it is coming from a particular carrier or is being used for a certain type of application, like VoIP. It will also be able to identify where the traffic is being dropped and could ultimately be used to finger service providers that are treating some network traffic as second-class.
The security researcher said he is curious to see what people do with his software. "People are going to start looking [at networks] and who knows what they are going to find," he said.
