[Dshield] Kazaa inquiry to dst port 80?

John Sage jsage at finchhaven.com
Sun Nov 24 18:05:58 GMT 2002


Josh:

On Thu, Nov 21, 2002 at 05:57:53PM -0600, Josh Ballard wrote:
> > Thought this a bit odd. Notice that the destination port on my end is
> > TCP:80
> > 
> > Usually I'd see TCP:1214 on my end.
> 
> As per the options in the newest KaZaA client, if it "feels" filtered,
> the next thing it does is attempt to run on port 80.  Pretty much KaZaA
> is doing a pretty good job of beating most firewalls right now, but I
> did say most.  I've even heard from some of the commercial companies
> that say they are a couple weeks out of having updates of their software
> out to "fix" this.  I've got a semi-standing solution, though I'm in the
> middle of research on this.  Hope that helps.

Interesting.

I'm not actually filtering Kazaa on 1214, but there's no Kazaa client
there either: I'm running my little ACK_hole proggie, which sits on a
port and accepts packets, all the while dropping them much like the
UNIX discard service.

Thanks..


- John
-- 
Forest: a collection of trees

    PGP key: http://www.finchhaven.com/pages/gpg_pubkey.html
Fingerprint: C493 9F26 05A9 6497 9800  4EF6 5FC8 F23D 35A4 F705




More information about the list mailing list