Sunday, May 16, 2010

what is in my packet net?

a boring post, to start: i'm just going to go through the list of what packets i caught during a 780 second capture. skype was on, as was xdict and its incessant search for the kingsoft mothership, which is currently routed to ARKIV itself.

first on the list:
robtex suggests that this is some sort of porn locus, responsible for porn spam and who knows what else. sent one packet from their http port 80 to my port 19246, which is for i don't know.

multiple, periodic IGMP signals, labeled "membership report". i see this all the time, sent to apparently, this is just to establish my presence on the network, so that the routers and other whoever know i'm here.

there were 8 apparent skype contacts through port 34268. what i understand is that this is how different skype hosts find eachother. what i don't understand is why for me it's always 34268, while its always different ports for the others. could it be that for them it's always their number? maybe i'm a member of a particular skype class - the port 34268 class. really, i have no idea. these are always UDP packets, call and response, usually just once, always intiated by ARKIV. and, as i mentioned before, i see them even when skype is off, but ARKIV doesn't respond then.

BROWSER: host announcement. i assume this is something like the "membership report" above, but i don't know what makes it different - ARKIV runs a browser service, and there are browser elections, to select a browser which will keep track of all the potential browsers.. argh.

here is a succinct description: packet from, originating from Argentina, from port 1217 to 1434 - 1434 was the way in for something called the SQL slammer worm. SQL is a microsoft database server program - what i received was a single SSRP packet, which is a protocol specially designed for use with the SQL thingie. anyways, one hit, nothing else (presumably i am not running an SQL database server).

so really, that's it. i found a paper on principles of routing in between networks, but haven't read it yet. my learning progress is stalling.

No comments:

Post a Comment