TRC: Advanced Network Tracing Tool

2014-02-16 13:28:11 | Post by: Yuri
Blog entry cover image.

While TRC definitely was not one of the biggest project that Disclosure ever had to work on, its usefulness and usability should not be underestimated. It does not really do anything that cannot be done using existing command line as well as online tools but does it in a unified action providing a single stop service point for a user's network tracing needs. What does this tool actually do?

Well, in short, it works as a dashboard providing instant access to wealth of information about a specific web server on the Internet, like the registration data of a domain name, its IP address info and a comprehensive traceroot that presents data in an easy to read table format. It also has a couple other features specific to the purposes of the organisations that use this particular tool.

Speaking about the users of the software, the tool has been adopted by Inhope, an international umbrella organization for 43 Internet hotlines (at the time of writing) operating in 38 countries of the world, mainly in Europe, but also in the USA, Australia, Canada and Russia. These hotlines take reports from the public in their respective countries about content that is suspected to be illegal and that is hosted online.

As one might expect, the hotlines attempt to locate where the content is hosted, should it indeed prove to be illegal. Quite often the material would be located outside of the country, especially if we are talking about smaller countries' hotlines but to define that reliably the content analysts working at the hotline have to perform so called network tracing, an attempt to find out where the material is hosted.

There were really no guidelines on how to perform this network tracing and every hotline has their own ways to do that using the tools of their choice. Not all of the hotlines are big enough to employ technical staff that would assist in streamlining the process so generally it can be time consuming and rather error prone. Further on, the content would have to be reported to the hosting country, and possibly to the local police force, which again adds even more overhead to the process.

That was a problem that TRC attempted to solve. Not only it gets all the necessary information that would help to locate the web service in question in a quick streamlined manner, it is also able to automatically forward the report to Inhope which then can be sent to the country that the report pertains to. It also has a police report generation facility that generates PDFs to be emailed to the local law enformcement authorities, should the hotline require it.

After Inhope learned about the Irish hotline having had much success with the tool, they officially requested to use it as a recommended tracing tool for the participating hotlines, as inconsistency of the tracing process among the hotlines was a growing problem, as Inhope grew itself. Of course since ISPAI (the hosting organisation of the Irish Internet hotline) as a trade organisation of Internet service providers is strictly against abuse of the Internet as a means of distribution of illegal content, Inhope's request was fulfilled without much deliberation, with ISPAI holding the distribution rights.

The software itself was designed to be as easy to use as theoretically possible, taking into the account the potentially huge variation of technical expertise of the staff working at the hotlines. In order to do some tracing the user only needs to supply it with a URL of the web resource being traced after which all the information is fetched automatically. You can refer to the Projects page of this website where you can find an entry for the tracing tool with a slideshow of its screenshots to get an idea how it operates.

Trc contains a number of references to the official whois servers used for domain information retrieval which makes getting it fairly straight-forward. However sometimes network tracing of some obscure little known top level domains is necessary, for which the tool may not have a predefined whois server record. Yet this is not such a serious problem, the official whois server for a specific top level domain could be found by an analyst by themselves using the Internet and added to the tool's registry manually by editing a simple configuration file.

Overall the tracing tool turned out to be an excellent example of doing a lot with a little, of how a rather simple application developed literally in two or three weeks can make life a lot easier for its users. It has been in use for only slightly over a year but already saved countless hours of work to people whose task is to make the Internet a safer place for all and who can now devote this time to being more productive at making the world a better place.