Cox has been almost continuously running reset attacks in my area. After much experimentation, I've found no way to counter this - at least with Bearshare.

Inexplicably, Limewire runs just fine, and seems to largely ignore the flood of killed connections, allowing uploads at capacity.

I *have* found that I can kill the software they're using, by overwhelming it. They're using something like pdump to do the packet insertions. As one of my experiments, I used something similar to what they have, on a very fast machine (a Sun fire server) with a different non-Cox IP. I set it up to generate several million packets a minute, all aimed at my Bearshare box. I spoofed the originating IP (to one of their internal Cox addresses, which ought to have them scratching their heads ), and hit the go button. Took out their packet tool, in short order. Alas, it sort of acted like a standard DNS attack, and crashed their server a little after that.

While I will admit that it was satisfying to give them a bit of their own medicine, it's not the sort of thing a responsible adult makes a habit of - plus, if you really make an annoyance of yourself, they'll eventually track you down, spoofed IP or not.

So, I am now back to running Limewire, much as I dislike the thing. Does none of us any good to have a dedicated machine with 120+gb of stuff shared, if none of you can reach it. Until we figure out how to keep them from pegging our data as P2P and tampering with it, some of us just aren't going to be able to use Bearshare.

Incidentally, I think the way to go might be as the torrents are doing - packet encryption. Kinda hard to do when we're running ancient beta versions of the software, though.

Cheers,

Nick