[nsp] matching/limiting kazaa v2

Fri, 18 Oct 2002 11:45:33 -0500

This message is in MIME format. Since your mail reader does not understand
this format, some or all of this message may not be legible.

------_=_NextPart_001_01C276C5.C6F11B40
Content-Type: text/plain;
	charset="iso-8859-1"

	Mark, I've seen this too. A packet trace reveals a DNS lookup first
to webservice.musiccity.com

	This may or may not restrict the ability to search though, if you
delete his host entry from your DNS.

	Would you share your findings if you are able to contain this
traffic? 

Thanks,
Rick Cheung
NPI IT Wan Team, CCNP

-----Original Message-----
From: Mark Pace Balzan [mailto:mpb@melitacable.com]
Sent: Thursday, October 17, 2002 12:52 PM
To: cisco-nsp@puck.nether.net
Cc: Mark Pace Balzan
Subject: [nsp] matching/limiting kazaa v2

Hi All,

As you may know the standard version of kazaa works on TCP port 1214.
This has also been included as a pdlm in cisco NBAR, as fasttrack

However as of a few weeks now, a new version of the kazaa software has been
launched (kazaa v2), which seemingly works on dynamic ports, and my attempts
at matching/blocking/limiting this traffic has been so far unsucessful.

Has any one on the list had any sucess or is working on this issue. I'd be
glad to contribute my findings so far.

Ive also contacted TAC to see if a new pdlm can be released for this. Still
waiting for an answer.

Thanks in advance

Mark

_______________________________________________
cisco-nsp mailing list  real_name)s@puck.nether.net
http://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/

------_=_NextPart_001_01C276C5.C6F11B40
Content-Type: text/html;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =
charset=3Diso-8859-1">
<META NAME=3D"Generator" CONTENT=3D"MS Exchange Server version =
5.5.2653.12">
<TITLE>RE: [nsp] matching/limiting kazaa v2</TITLE>
</HEAD>
<BODY>

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Mark, I've =
seen this too. A packet trace reveals a DNS lookup first to =
webservice.musiccity.com

<P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <FONT SIZE=3D2>This may =
or may not restrict the ability to search though, if you delete his =
host entry from your DNS.</FONT>
</P>

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Would you =
share your findings if you are able to contain this traffic?

<P><FONT SIZE=3D2>Thanks,</FONT>
<BR><FONT SIZE=3D2>Rick Cheung</FONT>
<BR><FONT SIZE=3D2>NPI IT Wan Team, CCNP</FONT>
</P>
<BR>

<P><FONT SIZE=3D2>-----Original Message-----</FONT>
<BR><FONT SIZE=3D2>From: Mark Pace Balzan [<A =
HREF=3D"mailto:mpb@melitacable.com">mailto:mpb@melitacable.com</A>]</FON=
T>
<BR><FONT SIZE=3D2>Sent: Thursday, October 17, 2002 12:52 PM</FONT>
<BR><FONT SIZE=3D2>To: cisco-nsp@puck.nether.net</FONT>
<BR><FONT SIZE=3D2>Cc: Mark Pace Balzan</FONT>
<BR><FONT SIZE=3D2>Subject: [nsp] matching/limiting kazaa v2</FONT>
</P>
<BR>

<P><FONT SIZE=3D2>Hi All,</FONT>
</P>

<P><FONT SIZE=3D2>As you may know the standard version of kazaa works =
on TCP port 1214.</FONT>
<BR><FONT SIZE=3D2>This has also been included as a pdlm in cisco NBAR, =
as fasttrack</FONT>
</P>

<P><FONT SIZE=3D2>However as of a few weeks now, a new version of the =
kazaa software has been</FONT>
<BR><FONT SIZE=3D2>launched (kazaa v2), which seemingly works on =
dynamic ports, and my attempts</FONT>
<BR><FONT SIZE=3D2>at matching/blocking/limiting this traffic has been =
so far unsucessful.</FONT>
</P>

Has any one on the list had any sucess or is working =
on this issue. I'd be
 glad to contribute my findings so far.

Ive also contacted TAC to see if a new pdlm can be =
released for this. Still
 waiting for an answer.

<P><FONT SIZE=3D2>Thanks in advance</FONT>
</P>
<BR>

<P><FONT SIZE=3D2>Mark</FONT>
</P>

<P><FONT =
SIZE=3D2>_______________________________________________</FONT>
<BR><FONT SIZE=3D2>cisco-nsp mailing list&nbsp; =
real_name)s@puck.nether.net</FONT>
<BR><FONT SIZE=3D2><A =
HREF=3D"http://puck.nether.net/mailman/listinfo/cisco-nsp" =
TARGET=3D"_blank">http://puck.nether.net/mailman/listinfo/cisco-nsp</A><=
/FONT>
<BR><FONT SIZE=3D2>archive at <A =
HREF=3D"http://puck.nether.net/pipermail/cisco-nsp/" =
TARGET=3D"_blank">http://puck.nether.net/pipermail/cisco-nsp/</A></FONT>=

</P>

</BODY>
</HTML>
------_=_NextPart_001_01C276C5.C6F11B40--