afx114
join:2005-01-18
San Diego, CA
| reply to manifest
Re: Cox dropping (not blocking) Gnutella traffic
Here's an upload attempt using -nettt ... windump output on top, Bearshare console output on the bottom.
000000 00:06:25:ea:40:b9 > XX:XX:XX:XX:XX:XX, ethertype IPv4 (0x0800), length 62: IP 24.243.4.6.1773 > 192.168.X.X.MYPORT: S 790131918:790131918(0) win 65535
000090 XX:XX:XX:XX:XX:XX > 00:06:25:ea:40:b9, ethertype IPv4 (0x0800), length 62: IP 192.168.X.X.MYPORT > 24.243.4.6.1773: S 107096962:107096962(0) ack 790131919 win 65535
061333 00:06:25:ea:40:b9 > XX:XX:XX:XX:XX:XX, ethertype IPv4 (0x0800), length 60: IP 24.243.4.6.1773 > 192.168.X.X.MYPORT: . ack 1 win 65535
015100 00:06:25:ea:40:b9 > XX:XX:XX:XX:XX:XX, ethertype IPv4 (0x0800), length 635: IP 24.243.4.6.1773 > 192.168.X.X.MYPORT: P 1:582(581) ack1 win 65535
004598 00:06:25:ea:40:b9 > XX:XX:XX:XX:XX:XX, ethertype IPv4 (0x0800), length 60: IP 24.243.4.6.1773 > 192.168.X.X.MYPORT: R 790132500:790132500(0) win 10240
000360 00:06:25:ea:40:b9 > XX:XX:XX:XX:XX:XX, ethertype IPv4 (0x0800), length 60: IP 24.243.4.6.1773 > 192.168.X.X.MYPORT: R 790145003:790145003(0) win 10240
005326 00:06:25:ea:40:b9 > XX:XX:XX:XX:XX:XX, ethertype IPv4 (0x0800), length 60: IP 24.243.4.6.1773 > 192.168.X.X.MYPORT: R 790132506:790132506(0) win 10240
000381 00:06:25:ea:40:b9 > XX:XX:XX:XX:XX:XX, ethertype IPv4 (0x0800), length 60: IP 24.243.4.6.1773 > 192.168.X.X.MYPORT: R 790145009:790145009(0) win 10240
Upload from 24.243.4.6 ("BearShare 4.6.2.1") Processing request
--REQUEST--
GET /uri-res/N2R?urn:sha1:PZWSAFKCQSRZ32CZSKXBUH4VCMMH7M2K HTTP/1.1\r\n
Host: IP.IP.IP.IP:MYPORT\r\n
User-Agent: BearShare 4.6.2.1\r\n
Range: bytes=3932160-4194303\r\n
X-NAlt: IP.IP.IP.IP:MYPORT\r\n
X-Gnutella-Content-URN: urn:sha1:PZWSAFKCQSRZ32CZSKXBUH4VCMMH7M2K\r\n
X-Connection-Type: Broadband\r\n
FP-1a: \r\n
FP-Auth-Challenge: NAAVOYFU5T7NZJ666YT5VCJDRICINWJM\r\n
Content-Disposition: inline; filename="somefile.mp3"\r\n
X-Features: browse/1.0, queue/0.1\r\n
X-Node: 24.243.4.6:6346\r\n
X-Queue: 0.1\r\n
\r\n
--RESPONSE--
HTTP/1.1 401 Authorizing\r\n
Server: BearShare 4.7.0b57\r\n
Content-Length: 0\r\n
FP-1b: \r\n
X-Features: chat/0.1, queue/0.1\r\n
\r\n |
|
manifest
bitches
join:2004-08-14
Hartford, CT | reply to afx114
afx114: can you do the equivalent of -nettt in windump? |
|
EL_TB
join:2003-05-03
Fairfax, VA
1 edit | reply to Starkiller
Mine works but it is slow.
I hope Cox isnt charging me for a crippled net connection. Once they start blocking(dropping) it all the time I'm moving to something else. I bet most people at school will too. |
|
Starkiller
@cox.net | reply to Razr1
In AR too,
Nothing but BitTorrent works.
With Winmx and the like, they wont connect to anything. |
|
Razr1
join:2004-11-30
Fort Smith, AR | reply to afx114
dude, im in arkansas, and none of them work. bearshare, kazaa, shareaza. i cant download or even get a search going.
irc works fine.
how can i make p2p work again...arrrgghhh. |
|
afx114
join:2005-01-18
San Diego, CA
2 edits | reply to afx114
Nevermind, I was able to filter it out myself.
In the below TCPDump you will see a Bell South customer attempt to download a file from me. He makes two attempts. (LOCAL.PORT is me, note PORT is NOT 6346, but another random port, with NAT port forwarding, so I am effectively not firewalled)
1ST ATTEMPT
19:56:00.598539 IP adsl-1-139-33.clt.bellsouth.net.50736 > LOCAL.PORT: S 910058714:910058714(0) win 65535
19:56:00.598624 IP LOCAL.PORT > adsl-1-139-33.clt.bellsouth.net.50736: S 591457694:591457694(0) ack 910058715 win 65535
19:56:00.714254 IP adsl-1-139-33.clt.bellsouth.net.50736 > LOCAL.PORT: . ack 1 win 65535
19:56:00.725367 IP adsl-1-139-33.clt.bellsouth.net.50736 > LOCAL.PORT: P 1:251(250) ack 1 win 65535
19:56:00.731713 IP adsl-1-139-33.clt.bellsouth.net.50736 > LOCAL.PORT: R 910058965:910058965(0) win 10240
19:56:00.732075 IP adsl-1-139-33.clt.bellsouth.net.50736 > LOCAL.PORT: R 910071468:910071468(0) win 10240
19:56:00.736472 IP adsl-1-139-33.clt.bellsouth.net.50736 > LOCAL.PORT: R 910058971:910058971(0) win 10240
19:56:00.736840 IP adsl-1-139-33.clt.bellsouth.net.50736 > LOCAL.PORT: R 910071474:910071474(0) win 10240
2ND ATTEMPT
19:57:01.850407 IP adsl-1-139-33.clt.bellsouth.net.50747 > LOCAL.PORT: S 2222769745:2222769745(0) win 65535
19:57:01.850485 IP LOCAL.PORT > adsl-1-139-33.clt.bellsouth.net.50747: S 2025320299:2025320299(0) ack 2222769746 win 65535
19:57:01.982241 IP adsl-1-139-33.clt.bellsouth.net.50747 > LOCAL.PORT: . ack 1 win 65535
19:57:01.993511 IP adsl-1-139-33.clt.bellsouth.net.50747 > LOCAL.PORT: P 1:251(250) ack 1 win 65535
19:57:01.999252 IP adsl-1-139-33.clt.bellsouth.net.50747 > LOCAL.PORT: R 2222769996:2222769996(0) win 10240
19:57:01.999618 IP adsl-1-139-33.clt.bellsouth.net.50747 > LOCAL.PORT: R 2222782499:2222782499(0) win 10240
19:57:02.003452 IP adsl-1-139-33.clt.bellsouth.net.50747 > LOCAL.PORT: R 2222770002:2222770002(0) win 10240
19:57:02.003816 IP adsl-1-139-33.clt.bellsouth.net.50747 > LOCAL.PORT: R 2222782505:2222782505(0) win 10240
EQUIVALENT BS LOGS (one for each attempt):
Upload from 65.1.139.33 ("LimeWire/4.0.8") Processing request
--REQUEST--
GET /uri-res/N2R?urn:sha1:RJXSPMRB6EZO36USTVEQREOP6XFAM5KX HTTP/1.1\r\n
HOST: XXX.XXX.XXX.XXX:PORT\r\n
User-Agent: LimeWire/4.0.8\r\n
X-Queue: 0.1\r\n
X-Gnutella-Content-URN: urn:sha1:RJXSPMRB6EZO36USTVEQREOP6XFAM5KX\r\n
Range: bytes=0-99999\r\n
X-Features: queue/0.1\r\n
\r\n
--RESPONSE--
HTTP/1.1 206 Partial Content\r\n
Cache-Control: no-cache\r\n
Server: BearShare 4.7.0b54\r\n
Content-Type: audio/mpeg\r\n
Content-Length: 100000\r\n
Content-Range: bytes 0-99999/6213632\r\n
X-Gnutella-Content-URN: urn:sha1:RJXSPMRB6EZO36USTVEQREOP6XFAM5KX\r\n
X-Create-Time: 1082000768000\r\n
X-Features: chat/0.1, queue/0.1\r\n
\r\n
--RESPONSE FILE--
fileBytes: 6213632
szFileName: "somefile.mp3"
szBaseName: "D:\some\path" |
|
afx114
join:2005-01-18
San Diego, CA
| reply to afx114
Ok I have WinDump set up, but there's so much garbage flying through the pipe it's hard to see anything. Can someone help me test? I'll give you a file to search for, you try and grab it from me, and I'll filter your IP in WinDump so I can see just the upload traffic. |
|
