Subject: updated "Napster_subnets.boulder" file
From: Dave Plonka (plonka@doit.wisc.edu)
Date: Sun Jan 21 2001 - 14:42:27 CST
FlowScan users, Attached you'll find an updated version of the "Napster_subnets.boulder" file that was supplied with FlowScan distributions. Unless you already have such a file that includes all the subnets listed there, I suggest that you install this newer file, and restart FlowScan to improve the accuracy of FlowScan's Napster identification. You may recall that back in September, I reported the migration of napster.com to 64.124.41.0/24. Before that, it was generally thought that they used 208.49.228.0/24, 208.184.216.0/24, 208.49.239.240/28, 208.178.175.128/29, and 208.178.163.56/29. Now it appears that Napster has resumed general use of 208.184.216.*, 64.124.41.*, and 64.224.114.* (specifically .33) for its application. This was discovered by passive analysis of IP headers, which is roughly how FlowScan identifies Napster traffic. I haven't yet determined exactly when this occurred, probably in early to mid January. I don't believe that this change is generally known since those addresses have not appeared in public databases of Napster servers such as this: http://www.napigator.com/list.php At any rate, an accurate list of such address ranges is important for FlowScan to accurately identify Napster traffic based solely on IP header info. e.g.: http://wwwstats.net.wisc.edu/CampusIO/io_services_bits/io_services_bits_2d.png Dave -- plonka@doit.wisc.edu http://net.doit.wisc.edu/~plonka ARS:N9HZF Madison, WI
This archive was generated by hypermail 2b25 : Sun Jan 21 2001 - 15:23:00 CST