Inevitably some of the local-machine entropy sources will be static or
externally influenced. That's the whole point of using several. If
using one source was sufficient... we would just use that one and be
done with it. :)
The questions to ask are
* is this collective snapshot of local machine state sufficiently unique?
* is this local-machine state externally controllable within realistic
orders of complexity?
netstat reflects local machine state of all sockets, including local
ones, and including local details like tcp in-q and out-q. snmp can
query MIBs such as ethernet wire stats, gaining entropy from
pause/collision/etc. frame statistics.
A set of mitigated network interrupt events is far, far more predictable
and controllable than the collective state of a machine's network
sockets, or the electrical state of the ethernet LAN link.
For network-interrupt randomness to be subverted in some cases, one
might need only to increase overall network traffic to a certain level.
Jeff
--
