Shaper not support napster?

iredden · Fri Feb 11, 2005 12:09 am

The following is a user hammering our system with napster.

17:47:10.479959 xx-153-hse.wireless.xxxxxxx.xx.xx.62296 > SA-Lib50-165.xxxxxx.edu.6699: . ack 2193203501 win 63974 (DF)
17:47:10.479979 xx-153-hse.wireless.xxxxxxx.xx.xx.62296 > SA-Lib50-165.xxxxxx.edu.6699: . ack 1 win 63974 (DF)
17:47:10.587137 xx-153-hse.wireless.xxxxxxx.xx.xx.62296 > SA-Lib50-165.xxxxxx.edu.6699: P 0:101(101) ack 117 win 63858 (DF)
17:47:10.587167 xx-153-hse.wireless.xxxxxxx.xx.xx.62296 > SA-Lib50-165.xxxxxx.edu.6699: P 0:101(101) ack 117 win 63858 (DF)
17:47:11.988960 xx-153-hse.wireless.xxxxxxx.xx.xx.62296 > SA-Lib50-165.xxxxxx.edu.6699: . ack 160 win 63815 (DF)

I found on the net, port 6699 is napster.

[root@Wireless Server] ip firewall mangle> add p2p

all-p2p
any
bit-torrent
blubster
direct-connect
edonkey
fasttrack
gnutella
soulseek
warez
winmx

Will napster be supported in 2.9, or is this something not even on the table?

Here is my rule setup:

/ip firewall mangle
remove [f]
/queue tree
remove [f]
/ip firewall mangle
add mark-flow=p2p-out p2p=all-p2p action=passthrough
/ip firewall mangle
add mark-flow=p2p-in p2p=all-p2p action=passthrough
/queue tree
add name="p2p-in" parent=tower-link flow=p2p-in limit-at=128000 max-limit=256000
/queue tree
add name="p2p-out" parent=ether1 flow=p2p-out limit-at=128000 max-limit=256000

While running with these rules, here is the result:

[root@Wireless Server] queue tree> print packets
Flags: X - disabled, I - invalid, D - dynamic
# NAME PARENT FLOW LIMIT-AT PACKETS
0 p2p-in tower-link p2p-in 128000 0
1 p2p-out ether1 p2p-out 128000 0

and

[root@Wireless Server] ip firewall mangle> print
Flags: X - disabled, I - invalid, D - dynamic
0 p2p=all-p2p action=passthrough mark-flow=p2p-out

1 p2p=all-p2p action=passthrough mark-flow=p2p-in

Any help appreciated.

GJS · Sat Feb 12, 2005 2:26 am

Try emailing support@mikrotik.com. I have found that the protocols covered are not very well documented. Also ask them if the traffic can be throttled or just blocked. For example, warez traffic can only be blocked, not throttled, as it seems that only the packets that initate connections can be marked. Actual transfers are not caught.

'Hope that helps.

iredden · Sun Feb 13, 2005 10:12 am

Have already spoken to them, and they are looking at adding Napster support.

However, the packets that are originating from our network appear to be a mass exploitation attempt. The data being sent (roughly decoded) "GET xxxxxxxxx C:\Documents and Settings\". The header of the packet is also mangled. I have been looking through CERT advisories however have not found anything similar to what I can see constantly on our network.