[c-nsp] Nbar for bittorrent/gnutella2?

[Church, Chuck]

Can't really speak for the gnutella2 one (didn't know it existed), but
the bittorrent one with size 4125 bytes seems pretty accurate.  I don't
believe it watches all ports though, just the ones defined in the PDLM:
tcp 6881 6882 6883 6884 6885 6886 6887 6888 6889 .    


Chuck Church
Lead Design Engineer
CCIE #8776, MCNE, MCSE
Netco Government Services - Design & Implementation Team
1210 N. Parker Rd.
Greenville, SC 29609
Home office: 864-335-9473
Cell: 703-819-3495
cchurch at netcogov.com
PGP key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x4371A48D 


-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Sean Watkins
Sent: Wednesday, December 15, 2004 1:29 PM
To: 'cisco-nsp at puck.nether.net'
Subject: [c-nsp] Nbar for bittorrent/gnutella2?

Hi,
Anyone have any success with the new PDLMs on CCO for bittorrent or
gnutella2? 

It appears a bunch is leaking; gnutella2 likes to use port 80 now, which
the
internal http pdlm catches, and bittorrent.. Who knows!

Anyones experiences?
Sean Watkins
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/