Am Dienstag 12 Juni 2007 21:25 schrieb Albert Hopkins: > On Tue, 2007-06-12 at 20:09 +0200, Florian Philipp wrote: > > [EMAIL PROTECTED] ~ $ sudo tcpdump -vvns 1600 dst port 21 > > Password: > > tcpdump: listening on eth1, link-type EN10MB (Ethernet), capture size > > 1600 > > bytes > > 18:37:12.543965 IP (tos 0x8, ttl 64, id 27970, offset 0, flags [DF], > > proto: > > TCP (6), length: 60) 192.168.1.2.45269 > 89.57.3.60.21: S, cksum > > 0x8013 > > (correct), 1866573467:1866573467(0) win 5840 <mss > > 1460,sackOK,timestamp > > 6212569 0,nop,wscale 5> > > 18:37:12.544426 IP (tos 0x8, ttl 64, id 17977, offset 0, flags [DF], > > proto: > > TCP (6), length: 60) 192.168.1.2.45288 > 89.57.3.60.21: S, cksum > > 0x98ab > > (correct), 1867615712:1867615712(0) win 5840 <mss > > 1460,sackOK,timestamp > > 6212569 0,nop,wscale 5> > > 19:07:52.537852 IP (tos 0x8, ttl 64, id 17709, offset 0, flags [DF], > > proto: > > TCP (6), length: 60) 192.168.1.2.36423 > 89.57.3.60.21: S, cksum > > 0x3a4e > > (correct), 3820262832:3820262832(0) win 5840 <mss > > 1460,sackOK,timestamp > > 6672541 0,nop,wscale 5> > > [...] > > 27 packets captured > > 54 packets received by filter > > 0 packets dropped by kernel > > It's been a while since I looked at tcpdump, but this looks like > yourself connecting *to* an FTP server (or I should say an external > connection on port 21). > > > In the past Tiscali (my ISP) did not stop file sharing, they just > > slowed it > > down to 10-12k. > > But they don't slow down FTP? FTP *is* (client/server) file sharing. > > -- > Albert W. Hopkins
It seems they try to recognize some kind of signature/footprint/whatever which is typical for file sharing. Apparently they don't check ports that are heavily used due to performance issues or false positives.
pgpJI5HgfcBcY.pgp
Description: PGP signature
