Re: ddos-stacheldraht server-spoof alerts ( Was: What is this?)

["Stephen P. Berry" <spb () MESHUGGENEH NET>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


In message <200102162157.QAA15478 () narq avian org>, *Hobbit* writes:

> Windows napster clients attempt to ping everyone in the results list from
> a song search, to attempt to get speed metrics on who might be the best to
> download from.  So yes, that's usually 100 separate and distinct pings
> everytime one of the lusers searches for a tune.

I believe that in fact -all- Napster clients attempt to do this by
default.

The interesting thing isn't that they're pinging but rather:

        -A whole bunch of clients appear to creat echo requests
         with the same ICMP ID (decimal 666)[0]
        -Not all clients (or even the majority of them[1]) exhibit
         this behaviour






- -Steve

- -----
0       Several orders of magnitude more frequently than one would expect
        if the IDs were selected randomly.
1       Based on the traffic I've observed on the wire.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.3 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE6jbaJG3kIaxeRZl8RAnvKAKDPMeAMWL3wRiwVdV5GGLBtHEjTDQCg48tO
6Rnj1ykVlAkke/nEF6eYGcU=
=d4Cu
-----END PGP SIGNATURE-----