[Dshield] Kazaa inquiry to dst port 80?
jsage at finchhaven.com
Sun Nov 24 18:05:58 GMT 2002
On Thu, Nov 21, 2002 at 05:57:53PM -0600, Josh Ballard wrote:
> > Thought this a bit odd. Notice that the destination port on my end is
> > TCP:80
> > Usually I'd see TCP:1214 on my end.
> As per the options in the newest KaZaA client, if it "feels" filtered,
> the next thing it does is attempt to run on port 80. Pretty much KaZaA
> is doing a pretty good job of beating most firewalls right now, but I
> did say most. I've even heard from some of the commercial companies
> that say they are a couple weeks out of having updates of their software
> out to "fix" this. I've got a semi-standing solution, though I'm in the
> middle of research on this. Hope that helps.
I'm not actually filtering Kazaa on 1214, but there's no Kazaa client
there either: I'm running my little ACK_hole proggie, which sits on a
port and accepts packets, all the while dropping them much like the
UNIX discard service.
Forest: a collection of trees
PGP key: http://www.finchhaven.com/pages/gpg_pubkey.html
Fingerprint: C493 9F26 05A9 6497 9800 4EF6 5FC8 F23D 35A4 F705
More information about the list