Posted by db on 10/03/05 02:40

"fred-bloggs" <fred-bloggs@hahahotmail.com> wrote in message
news:43408c3e$0$30203$892e7fe2@authen.white.readfreenews.net...
> "db" <@ .> wrote in
> news:43406978$0$15058$ed2619ec@ptn-nntp-reader02.plus.net:
>
>>
>> "fred-bloggs" <fred-bloggs@hahahotmail.com> wrote in message
>> news:43404eb2$0$78704$892e7fe2@authen.white.readfreenews.net...
>>> "Billy Joe" <see.id.line@invalid.org> wrote in
>>> news:dPadnZgogOsyrKLeRVn- hw@adelphia.com:
>>>
>>>> Somehow I see their people and our people sitting at consoles and
>>>> typing madly like the schlockiest of TV melodramas with the fastest
>>>> typist(s) hoisting one for the queens ;-0)
>>>>
>>>
>>> Just read this (mind the wrap)
>>> http://www.latimes.com/business/la-fi-piracytwo2oct02,1,6430710.story?
>>> coll=la-headlines-business
>>> <quote>
>>> Overpeer takes advantage of the Internet's inability to tell who's at
>>> the controls of any computer online. The software lets a single
>>> computer pretend to be more than 10,000 people, none of which look
>>> any different to the untrained eye from real users on a peer-to-peer
>>> network. <unquote>
>>>
>>> So, we have several thousand faking secondaries sitting on the same
>>> IP?
>>>
>>> --
>>> fred
>>
>> Across a handful of IP addresses, yeah, that's what they do. A very
>> small number of addresses really (see blocklists).
>>
>
> I've just done a quick (not entirely accurate) analysis of your list and
> in summary of the 6745 entries
> IP address :port range :x number of distinct ports used
> 64.248.57.132:33349-60907:x112
> 66.166.198.203:32790-60907:x227
> 67.101.77.191:32812-60817:x112
> 68.165.91.118:32886-60698:x127
> 70.51.124.42:32798-60874:x119
> 81.156.180.20:32786-60249:x139
> 81.158.250.176:32953-60754:x84
> 86.134.204.87:33109-60960:x169
> 88.111.21.211:32948-60907:x64
>
>
> --
> fred

Nice one. :)

Easy kill with a rule like;
block in log quick proto tcp from any port > 32768 to any port = 6699

[Back to original message]