Re: [LARTC] Intelligent P2P detection

[Matthias Weingart <lartc@pentax.boerde.de>]

On Tue, Mar 25, 2003 at 11:21:34AM +0100, Kim Jensen wrote:

> services or external services where the destination port is above 1024 can 
> then easily be marked and tracked (at least in theory, I haven't played with 

This does not help, because often they use port 80 or 25 or so. But e-mule
is using some fixed ports (4426 or similar?) as control connection (like
passive ftp). A module that is analysing that control traffic (similar to
ftp) and determine the ports that are then used by the transfer connections
should be able to mark all e-mule packets; but I have not seen a
implementation of this yet. However there are sources of P2P servers/clients
available, and it should be possible to implement such a tool or I should
better say different tools for different P2P-software ;-(. (and maybe not
for all kind of that software).  I agree with you, it would be fine to have
such a tool.

        Matthias
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/