On Tue, Mar 25, 2003 at 11:21:34AM +0100, Kim Jensen wrote:
> services or external services where the destination port is above 1024 can
> then easily be marked and tracked (at least in theory, I haven't played with
This does not help, because often they use port 80 or 25 or so. But e-mule
is using some fixed ports (4426 or similar?) as control connection (like
passive ftp). A module that is analysing that control traffic (similar to
ftp) and determine the ports that are then used by the transfer connections
should be able to mark all e-mule packets; but I have not seen a
implementation of this yet. However there are sources of P2P servers/clients
available, and it should be possible to implement such a tool or I should
better say different tools for different P2P-software ;-(. (and maybe not
for all kind of that software). I agree with you, it would be fine to have
such a tool.
Matthias
