[nsp-sec] Anyone else seeing a HUGE increase in TCP/1935 from Limelight Networks

[Guy Tal]

On 06/16/08 at 16:29, Sean Donelan allegedly typed:

> ----------- nsp-security Confidential --------
> 
> On Mon, 16 Jun 2008, John Fraizer wrote:
> >We've suddenly (since about 1600 GMT today) seen a huge increase in 
> >inbound traffic - a very unnatural curve on our graphs.  I have tracked 
> >this via flows to a large influx
> >of traffic from Limelight networks.
> 
> The PGA final round is this afternoon.  Could this be a streaming event?
> 
> TCP/1935 Adobe Macromedia Flash Real Time Messaging Protocol (RTMP)
>    "plain" protocol
> 
> Are you seeing it decrease now.  Tiger won.

Confirmed that there were two large streaming events (PGA and Eurocup) that night. I apologize about not getting back to you sooner about this, but I was in some fairly remote locations in June and didn't have reliable internet connections for most of the time. In the future, ping me directly at my work account so that I will get the notices on my blackberry. Thanks!

As a side note, can anyone think of a good reason why a hotel would block all outbound secure ports? I couldn't authenticate to anything, but was able to websurf no problem. That was really annoying in Brazil!

Regards,
Guy