Monday, October 18, 2010


One small thing, which I don't have on hand - the other night, I switched on the network monitor and saw an exchange I'd never seen before: ARKIV (my computer) sent an ARP packet to Jingping's computer, which is on the same local network - immediately, her computer responded with two UDP skype packets. ARKIV's skype was turned off. Is skype constantly checking incoming messages to see if they come from an address in its routing tables - in that case why was Jingping the only computer that got an ARP packet? Was the ARP packet sent by some active skype process? Mysteries, mysteries...

(These conversations suggest that skype knows enough to adjust its routing for LANs - so instead of IP addresses it needs to be routing to MAC addresses, or something.)

Wednesday, October 13, 2010


Ok, here's something slightly interesting. It has to do with Skype - the only traffic I can see here that isn't building business, or something I'm doing (webpages, ftp, updates, etc.) is Skype, so I guess that's what I live with until I go figure out something new.

Anyways, I've mentioned before about how my Skype account seems to use port 34268 to advertise its existence - UDP packets go in and out through that port, and sometimes a link gets established with one of the associated addresses, and a conversation starts - i.e. my computer gets used as a relay in the Skype network. Sometimes I see the UDP packets go out, looking for another node, and nothing comes back - they go out a few more times, and give up.

So, what I noticed is that tonight, my computer is sending RTP packets, which I haven't seen before, rather than UDP packets. RTP is apparently used for transferring video and audio, especially with VOIP applications. So, Skype is looking for someone accepting video/audio streams, trying to establish an RTP network? I have no idea.

Each of those RTP messages was reciprocated with a UDP response, by the way. Nothing else followed, however - there's a single conversation going on through Skype, leisurely exchanging TCP packets every few dozen seconds, so I would assume this is a text conversation - but it's a one-sided conversation, since my computer is communicating only with one other address! If I were relaying a conversation, I should see connections with two other hosts, not one. Maybe some sort of routing table content is being transferred, updated, etc., very slowly?

That's all I've got.

Sunday, October 03, 2010

Private networks are boring

Just as the title says. Since moving into this new apartment, I've been viewing the internet only from within private networks, at home or in the lab. It's very boring. Here, as there, I see absolutely nothing but the browsing traffic and attendance updates between the hosts and the server. Nothing from outside, ever.

I haven't done anything, learned anything internet-wise, since moving here. This is the reason.

Before, when I had that public Comcast address, it was like living on the street, and all the random scans and searches that passed by every other minute were like other street people, bumping around and looking for somebody to take advantage of, or just exploring as I was doing, scanning this or that node, looking for something interesting.

The private network is like living in... an apartment building, or a suburban neighborhood, where all you ever see are your neighbors, and all they're ever doing is routine, everyday, necessary things, which aren't interesting at all except in that they're being done and that they're done every day, routinely - routine has a quality all its own, but it's not much fun to watch.

I need to figure out how to watch traffic from other hosts. It's time to expand my abilities.