[nsp] Blocking KAZAA and Co. on PIX

[Mike Lewinski]

Voll, Scott wrote:

> My understanding about applications like Kazaa is that it jumps around
> on different ports if it gets blocked.

Yep, including a preference for 80/tcp if needed.

> We ended up using a packeteer Packet Shaper to decrease the bandwidth so
> low that kazaa can work, but so slow that the user gets frustrated and
> quits.  

Prediction: now that L7 analysis tools like the Packet Shaper are widely 
deployed, the P2P networks will implement SSL and start running over 
443/tcp.

As I see it, when that happens the last possible recourse is to create 
per-user quotas.... Or treat it as a social problem and deal with it 
accordingly.

I wrote up a little description of the P2P problem for a rural internet 
coop that I help manage:

http://magnoliaroad.net/old/p2p.html

We've used a combination of rate-limiting and education to deal with the 
issue to date.