Page 1 of 2
Filtering fakes
Posted: Fri Dec 31, 2004 10:55 am
by Rat
Over on the filebreech forum 'Six' wrote:I was reading the WinMX newsgroup this morning and found something I thought was quite interesting. A user reported that blocking the IP ranges of 209.11.134.* and 209.10.143.* in his firewall (he uses Kerio, but others also have this option) has improved his primary connection, because the 'fakers' use those port ranges. The improvement comes from freeing up the bandwidth normally used by the fakers, thus allowing legitimate users to feed off of them.
It was also reported that filtering searches by adding -Shared to the bottom search box also helps because the fakers tend to share from C:\My Shared Folder, although it wasn't mentioned if this was for audio or video filtering. Through my own experimentation I've found that c:\My Music (note the lower case 'c' for the drive letter) is also being used as a fake shared folder and that -Shared -Music works even better for filtering both audio and video searches. Of course the filtering will exclude quite a few legitimate sources from searches, but queuing, doing a search for alternatives, clearing the top search box and searching again using the HASH alone should remedy that.
Using my secondary (dial up) connection, a normal 'MP3 Audio - Any Bitrate/Any Connection' search for Lil Jon yields several thousands of results with varying frequencies between 320 and 128000, but using the filter I received only 489 results (all except for a couple were seemingly legitimate with a 'normal' frequency of 44100).
A normal video search for both Dodgeball and Shark Tale also turns up an extreme number of results, but a filtered search yielded only 94 and 100 results respectively, with no outlandish numbers under the Status/Server column as is common with fakes.
Try using the filter yourself, especially if you're after newer releases. It could save you from some headaches.
I'm trying this right now. It appears to work. Also, my client connects much faster (a second or two at most) having blocked those IP ranges. Amazing.[/quote]
Posted: Fri Dec 31, 2004 1:22 pm
by battye
I'm interested in this, also, where can I download Kerio? I have Sygate but I don't want to continue using it.
Posted: Fri Dec 31, 2004 1:25 pm
by Rat
http://www.kerio.com/kpf_home.html
I've blocked the IPs in sygate tho.
Posted: Fri Dec 31, 2004 6:38 pm
by Red XIII
Interesting...now if i could just get my router to work

Posted: Tue Jan 04, 2005 7:45 am
by ZaRdOz420
eeeeek!
why would any sane person do away with sygate?

Posted: Tue Jan 04, 2005 7:49 am
by battye
I like Kerio

Posted: Tue Jan 04, 2005 4:17 pm
by Red XIII
I used sygate and it was very good, but it did prevent me from doing a primary connection on winmx

Posted: Tue Jan 04, 2005 6:16 pm
by quicksilver
Thats what firewalls are suposed to do , they work better when set up correctly

Posted: Wed Jan 05, 2005 12:13 am
by Red XIII
Which means im keeping it off when i want to primary connect again!!

Posted: Wed Jan 05, 2005 12:16 am
by quicksilver
Hmm the last words of a madman, RIP Reds XP

Posted: Wed Jan 05, 2005 8:08 am
by battye
quicksilver wrote:Hmm the last words of a madman, RIP Reds XP


Posted: Thu Jan 06, 2005 1:48 am
by Red XIII
Are you kidding!? My router is so f-ed up right now aint a trojan that could get through!

Range Blocking
Posted: Sat Mar 12, 2005 7:58 am
by quicksilver
I have been doing a bit of research recently and was studying the flooders IP ranges and one whole range stood out as worth blocking
the 61.0.0.0 to 61.255.255.255 range .
This is being used by Sony Sanyo and Panasonic to flood WinMx from, and is the single most important range I can see being used.
There are some others run by Globix and Media Sentry in the 204 and 209 ranges (they like to shift around a bit to keep you on your toes

).
I dont often get any material from Japan, and I,m sorry that innocent folk within that range will suffer but WinMx is under attack
and the enemy is doing a lot of the attacking from there ,so I would urge you if you can to block that range and see the dramatic drop in flooding.
For those interested, Peer Guardian and Protowall will cover theses ranges too but they seem to not be doing the entire range, and thats
how the flooders are able to keep being effective .
Posted: Sat Mar 12, 2005 9:59 am
by battye
Posted: Sat Mar 12, 2005 12:42 pm
by Bender979
http://mxcontrol.sourceforge.net/module ... =1&thold=0
http://mxcontrol.sourceforge.net/module ... oad&cid=23
If I have some more time, I will modify the patch to automatically update the list of blocked IP's from the web. I might also include the channellist patch and an automatic filter to sort out files with odd bitrates and filenames that are likely to be "fake" (configurable)
Only if I have time though, lol.