Re: Bit Torrent?

[David Koren <koren@hanover.edu>]

I have noticed this too, I believe that, at least here, it is caused by a
P2P app called Ares (www.softgap.com).  At least it claims to be p2p.  I had
a single user taking up about a third of our pipe with this program.  It's
easy to tell if a computer has this program installed, simply connect to the
machine on port 80 as it is a normal web server.  Which is why it shows up
as inbound and outbound web traffic.

David Koren
Network Services Specialist
Hanover College



----- Original Message -----
From: "Scott Nickerson" <Scott.Nickerson@dal.ca>
To: <packeteer-edu@lists.Stanford.EDU>
Sent: Tuesday, January 14, 2003 3:56 PM
Subject: Bit Torrent?


> We are observing a huge increase in what 'appears' to be legitimate
> inbound web traffic.  We know that this has got to be new file sharing
> applications but are stumped as to how to keep a cap on the problem.
> Back in September our problem was our outgoing pipe was full.
> Packetshaper pretty much solved that problem for us, but now that it
> does not appear to be able to classify this http traffic that is not
> really user/browser generated. We are stuck.
>
> Anyone else experiencing this?  For now we have partitioned our
> residences and are allowing them only a third of our inbound pipe.  That
> is not really fair and students are complaining that regular web
> browsing is crippled.  Any ideas?  Have the file sharing applications
> outgrown our ability to detect and deprecate?
>
>
> Scott Nickerson
> Dalhousie University
>
>
> -----Original Message-----
> From: owner-packeteer-edu@lists.Stanford.EDU
> [mailto:owner-packeteer-edu@lists.Stanford.EDU] On Behalf Of John
> Stigall
> Sent: January 9, 2003 4:31 PM
> To: packeteer-edu@lists.Stanford.EDU
> Subject: Re: Gnutella? Bit Torrent?
>
>
> Bit Torrent? Has this been discussed before? This is a file sharing app
> that finds bits and pieces of files on multiple sites, makes multiple
> TCP download sessions, while serving the same file back to other users.
>
> -John Stigall
> Indiana University
>
> ----- Original Message -----
> From: "Printy, Darrin J. " <dprinty@stcloudstate.edu>
> To: <packeteer-edu@lists.Stanford.EDU>
> Sent: Friday, December 13, 2002 4:14 PM
> Subject: Gnutella?
>
>
> > Last night after midnight, our Outbound traffic shot up like a rocket.
>
> > Primarily it was ResNet traffic.  Fortunately I had a limit on
> > Outbound ResNet traffic set so the rest of the campus hasn't really
> > noticed.  We are running 5.3 on our 4500 PacketShaper and all was
> > running well since the update.
> >
> > The problem I am having with it is:
> > 1. It was an immediate increase at around 12:36am Central Time. 2. It
> > has been sustained ever since (unless I throttle Default class) 3. It
> > will show up in Discovered ports, but is so spread out it's not
> > conclusive. 4. If I trottle back the Discovered ports with a tight
> > partition, it moves to the Default group (like KaZaA did).
> > 5. When I look into a traffic flow of a top IP, I am seeing some
> > Gnutella-cmd but most of the Svc Type column is blank with multiple
> > outside IP's communicating.
> >
> > Has anyone else experienced this?
> > Is there a new version of Gnutella or KaZaA out?
> >
> > Darrin Printy
> > ResNet Coordinator
> > St. Cloud State University
> >
> > -++**==--++**==--++**==--++**==--++**==--++**==--++**==--++**==--++**
> > This message was posted through the Stanford mailing list server. To
> > subscribe/unsubscribe, send email to majordomo@lists.stanford.edu with
>
> > "subscribe packeteer-edu" or "unsubscribe packeteer-edu" as the body.
> Archive
> > is at http://www.stanford.edu/group/networking/netlists/
> >
> >
> >
>
> -++**==--++**==--++**==--++**==--++**==--++**==--++**==--++**==--++**
> This message was posted through the Stanford mailing list server. To
> subscribe/unsubscribe, send email to majordomo@lists.stanford.edu with
> "subscribe packeteer-edu" or "unsubscribe packeteer-edu" as the body.
> Archive is at http://www.stanford.edu/group/networking/netlists/
>
> -++**==--++**==--++**==--++**==--++**==--++**==--++**==--++**==--++**
> This message was posted through the Stanford mailing list server. To
> subscribe/unsubscribe, send email to majordomo@lists.stanford.edu
> with "subscribe packeteer-edu" or "unsubscribe packeteer-edu" as the body.
Archive
> is at http://www.stanford.edu/group/networking/netlists/
>


-++**==--++**==--++**==--++**==--++**==--++**==--++**==--++**==--++**
This message was posted through the Stanford mailing list server. To
subscribe/unsubscribe, send email to majordomo@lists.stanford.edu
with "subscribe packeteer-edu" or "unsubscribe packeteer-edu" as the body.  Archive
is at http://www.stanford.edu/group/networking/netlists/