Sad Day...

[Nick Storm]

Cox has been almost continuously running reset attacks in my area. After much experimentation, I've found no way to counter this - at least with Bearshare.

Inexplicably, Limewire runs just fine, and seems to largely ignore the flood of killed connections, allowing uploads at capacity.

I *have* found that I can kill the software they're using, by overwhelming it. They're using something like pdump to do the packet insertions. As one of my experiments, I used something similar to what they have, on a very fast machine (a Sun fire server) with a different non-Cox IP. I set it up to generate several million packets a minute, all aimed at my Bearshare box. I spoofed the originating IP (to one of their internal Cox addresses, which ought to have them scratching their heads ), and hit the go button. Took out their packet tool, in short order. Alas, it sort of acted like a standard DNS attack, and crashed their server a little after that.

While I will admit that it was satisfying to give them a bit of their own medicine, it's not the sort of thing a responsible adult makes a habit of - plus, if you really make an annoyance of yourself, they'll eventually track you down, spoofed IP or not.

So, I am now back to running Limewire, much as I dislike the thing. Does none of us any good to have a dedicated machine with 120+gb of stuff shared, if none of you can reach it. Until we figure out how to keep them from pegging our data as P2P and tampering with it, some of us just aren't going to be able to use Bearshare.

Incidentally, I think the way to go might be as the torrents are doing - packet encryption. Kinda hard to do when we're running ancient beta versions of the software, though.

Cheers,

Nick

[AaronWalkhouse]

I just use both simultaneously. BearShare is always set as an ultrapeer and the latest
LimeWire beta usually goes into ultrapeer mode to, so I hook them up to each other
as peers and my files keep flying out the door.
That's what I call idling on this box.

Wouldn't it be handy if someone came up with a teeny little bit of freeware that
stopped those illegal TCP reset packets and somehow every P2P user got a copy?

[Nick Storm]

Ha. I considered that, but thought it might cause problems, with the P2P packets not knowing where to go, even if each program was operating on a different port. Or, perhaps you're running them on separate machines? Still, you'd have the situation of both having the same (barring port differences) external IP address...?

I'm confused... (par for the course).

[AaronWalkhouse]

Not a problem at all for them. The port numbers and unique GUIDS make it all work seamlessly.
I even fire up a third UP when hunting the spam and trojans. Since my PC is the gateway for my
home network I don't need a router and all the port forwarding is handled in the extremely
simple ICS/Windows Firewall.