FW: Kazaa question

["John Hackett" <John_Hackett@TAMU-Commerce.edu>]

Look for the protocol "SMTBF" in your tree.  Using Ethereal and the top
talkers/listeners analysis in the packetshaper I discovered that this was
actually Kazaa-related activity.  It never generates any significant amount
of traffic so it is probably a command-and-control mechanism.  This seems to
make more sense as students would not likely be using the Attachmate Lantern
Gateway that SMTBF is supposed to be (something to do with airline
reservation systems if I remember correctly).

I have had similar occurrences with the "MATIP" and "PEPGate" protocols but
they rarely show up and I have yet to nail them down. 

John Hackett
Network Engineer
Computing, Telecommunications & Information Services
Texas A&M University-Commerce
John_Hackett@tamu-commerce.edu
Ph. (903)468-3246
Fax(903)886-5415
 

-----Original Message-----
From: Mike Diggins [mailto:diggins@McMaster.CA] 
Sent: Friday, January 17, 2003 8:17 PM
To: packeteer-edu@lists.Stanford.EDU
Subject: Kazaa question


I was experimenting with Kazaa and my packet shaper this afternoon (6500
running 5.3 software). I downloaded the latest v2 client, installed it on
a laptop and checked that I could connect, search and download music. I
then configured the Kazaa policy to DISCARD and restarted my Kazaa client.
I was still able to connect (slower than normal though) and search for
music. However, I was not able to download anything. It would try but
fail.

The purpose of this was to verify Kazaa wasn't "sneaking through". I don't
normally block it altogether but I do limit it. I find the behaviour
acceptable but wonder if it's expected. Should I still be able to connect
and search?

-Mike
-++**==--++**==--++**==--++**==--++**==--++**==--++**==--++**==--++**
This message was posted through the Stanford mailing list server. To
subscribe/unsubscribe, send email to majordomo@lists.stanford.edu
with "subscribe packeteer-edu" or "unsubscribe packeteer-edu" as the body.
Archive
is at http://www.stanford.edu/group/networking/netlists/
-++**==--++**==--++**==--++**==--++**==--++**==--++**==--++**==--++**
This message was posted through the Stanford mailing list server. To
subscribe/unsubscribe, send email to majordomo@lists.stanford.edu
with "subscribe packeteer-edu" or "unsubscribe packeteer-edu" as the body.  Archive
is at http://www.stanford.edu/group/networking/netlists/