From mboxrd@z Thu Jan 1 00:00:00 1970 From: Matthias Weingart Date: Tue, 25 Mar 2003 12:44:52 +0000 Subject: Re: [LARTC] Intelligent P2P detection Message-Id: List-Id: References: In-Reply-To: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: lartc@vger.kernel.org On Tue, Mar 25, 2003 at 11:21:34AM +0100, Kim Jensen wrote: > services or external services where the destination port is above 1024 can > then easily be marked and tracked (at least in theory, I haven't played with This does not help, because often they use port 80 or 25 or so. But e-mule is using some fixed ports (4426 or similar?) as control connection (like passive ftp). A module that is analysing that control traffic (similar to ftp) and determine the ports that are then used by the transfer connections should be able to mark all e-mule packets; but I have not seen a implementation of this yet. However there are sources of P2P servers/clients available, and it should be possible to implement such a tool or I should better say different tools for different P2P-software ;-(. (and maybe not for all kind of that software). I agree with you, it would be fine to have such a tool. Matthias _______________________________________________ LARTC mailing list / LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/