Take the 2-minute tour ×

My university has installed Cisco Clearaccess on their network, which means that anyone using the wired network has to login. I came in after the removed the requirement that you must install this huge piece of software that installed Synaptic antivirus (which is huge) and several other things.

My question though is why is this necessary? They do not block websites or have an enforced proxy server, so "Filtering" isn't a reason. Accountability isn't a problem because if all computers didn't have public IP's that made them easily identifiable and had private IP's (eg my states public school network), they can't track who did what unless they logged everything, which with several thousand people using the network simultaneously would be impractical to (mainly I'm asking here how the public school system was able to do that but the university can't). Heck, requiring computers to be updated isn't a problem since they removed the enforced software install and opened up support for Linux and Mac. And all of this is irrelevant because my university has the unique configuration of allowing Xbox's and PS3's to connect and get mostly full internet access, meaning that all a student has to do is change their MAC address to one in the ranges that all XBox's have, meaning every reason that they could come up with is irrelevant. I use this loophole to run a few headless Linux server's where I can't login since they don't have browsers. The only reason I can think of is to forcibly limit non-tech savvy to 2 computers. However the tech savvy have trouble because they dual boot, which Clearaccess defines as 2 computers.

This is leaving me wondering exactly why many universities have strict Cisco Clearaccess software installed. Is it to abide by a legal requirement? Is it because "We were Windows only for years and enforced Clearaccess software installation, but even though now we've lifted the Clearaccess requirement and Windows requirement, we don't feel like removing the software". What's the real reason?

share|improve this question

closed as off topic by Iain, mailq, SvW, Chris S, Tom O'Connor Nov 1 '11 at 0:18


You should ask the university's system administrators why they have this policy. For all we know it's because they own goats. –  Iain Oct 31 '11 at 19:29
Well with many many universities doing this ( google.com/search?q=clearaccess%20site%3a%2a.edu ) I would think there would be some publicly known common wisdom on why –  TheLQ Oct 31 '11 at 19:35
System Administrators are lazy. So there are only two reasons they do anything. 1. The College's board (or their boss, direct or indirect) made a policy decision and the Admins are implementing it, along with its ramifications. 2. It's a legal or para-legal requirement (most commonly privacy laws or DMCA related). Since boards are generally also lazy, it's probably the latter. </TongueInCheek> –  Chris S Oct 31 '11 at 20:46
add comment

1 Answer

It is about accountability. They can and almost certainly do log which public IPs are assigned where, and the corresponding NAT mappings.

The Xbox and PS3 loophole is probably not considered important, because those machines (in the normal case) run captive operating systems that are intended to be content consumption devices — and aren't so likely to provoke DMCA violations, which is basically what this is all about.

The subterfuge with altering your MAC address to connect without registering is likely in violation of your schools' acceptable use policy, and could probably get you disconnected from the network or even expelled (whether that seems over the top is a different question — and not one for this site).

Turning to speculation: they allow you to run Linux or Mac OS because they're an academic environment and the IT people don't want to be jerks. Don't make them be jerks — follow the rules.

share|improve this answer
Seconded. Don't make us/sysadmins be dicks. We can but we don't want to because, quite frankly, we've got more important and more interesting things to do with our time. Don't push it otherwise you you face the unspeakable: no internet. –  tombull89 Oct 31 '11 at 20:43
My thing with NAT is that if someone complains to the school with the DCMA, they would have to log all traffic or at least connections for everyone in order to figure out which computer created the connection. When every public school in the state is on the same network, that's not possible –  TheLQ Oct 31 '11 at 21:05
Sure it is. But that sounds like another question. –  mattdm Oct 31 '11 at 21:09
@TheLQ monitoring what a few thousand people are doing is easy. I worked for an ISP, and we knew what each of our 5M users was doing online. –  mrdenny Oct 31 '11 at 21:36
To echo with mattdm and mrdenny said, it's both possible and probable given the access control they've setup. –  Doug Nov 3 '11 at 18:12
add comment
