Subject: Re: Re: Re: [P2Prg] about papers on blocking P2P communications

From: "Jason" <[email-masked]>
Date: Thu, 13 Oct 2005 02:38:36 +0800

Dear Rob,

Yes, I agree with you that port mornitoring is not useful to block even the organizations plan to. Many living protocols use permitted HTTP to run their own protocols. However, by analyzing protocol's pattern or characteristic value, it is able to block and it seems some what efficient. Manully analyzing protocols is a tough work, automatic analyzing is a good way.

As to the question that why to block p2p communications, it is hard to answer. They always have their reasons (e.g. some UK's universities). Therefore, we still have the needs to play such a never-ending game: monitor VS. anti-monitor. 

So, if someone may read related papers or be working on this, I welcome the discussions.

sincerely,
jason	
10/11/2005
======= 2005-10-10 13:14:14 =======

>On Mon, Oct 10, 2005 at 08:43:36AM +0800, Jason wrote:
>> Dear Rob,
>> 
>>	Yes!I am looking for papers on filtering or blocking algorithms
>> that could be used in firewall systems. I have done some fundamental
>> research on filtering P2P communications using characteristic value
>> method. However, I cannot find other filtering approachs except for the
>> traditional ip ports filtering method, to do comparison. Hope someone
>> could help.
>
>Not to be too pesimitic, but from an academic standpoint, it's an
>impossible problem.  Any time you let two machines communicate, they
>could be running any arbitrary protocol on top of the communication.
>Allow only valid http connections through the firewall, people will
>write IP over http (forgot the rfc, but it exists)... try to validate
>the traffic, people will encrypt it.  I don't think there is much room
>for good solutions in this space... my intuition is the best you can do
>is raise the bar so that people have to keep changing their code...
>
>Good luck,
>
>- Rob
>.
>.

= = = = = = = = = = = = = = = = = = = =

_______________________________________________
P2prg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/p2prg

---

From: Luca Caviglione <[email-masked]>
Date: Wed, 12 Oct 2005 20:58:08 +0200

Hi all,
I wrote a paper for the p2p journal some times ago. The p2pjournal is available
on-line here http://p2pjournal.com/issues/Jan04.pdf
It is somewhat related to your needs. Maybe it will be inspiring.

Best Regards,

Luca

Quoting Jason <[email-masked]>:

> Dear Rob,
>
> Yes, I agree with you that port mornitoring is not useful to block even the
> organizations plan to. Many living protocols use permitted HTTP to run their
> own protocols. However, by analyzing protocol's pattern or characteristic
> value, it is able to block and it seems some what efficient. Manully
> analyzing protocols is a tough work, automatic analyzing is a good way.
>
> As to the question that why to block p2p communications, it is hard to
> answer. They always have their reasons (e.g. some UK's universities).
> Therefore, we still have the needs to play such a never-ending game: monitor
> VS. anti-monitor.
>

----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.