Re: [gentoo-user] No torrent upload

[Florian Philipp]

Am Dienstag 12 Juni 2007 21:25 schrieb Albert Hopkins:
> On Tue, 2007-06-12 at 20:09 +0200, Florian Philipp wrote:
> > dsl@HOMER_GENTOO64 ~ $ sudo tcpdump -vvns 1600 dst port 21
> > Password:
> > tcpdump: listening on eth1, link-type EN10MB (Ethernet), capture size
> > 1600
> > bytes
> > 18:37:12.543965 IP (tos 0x8, ttl  64, id 27970, offset 0, flags [DF],
> > proto:
> > TCP (6), length: 60) 192.168.1.2.45269 > 89.57.3.60.21: S, cksum
> > 0x8013
> > (correct), 1866573467:1866573467(0) win 5840 <mss
> > 1460,sackOK,timestamp
> > 6212569 0,nop,wscale 5>
> > 18:37:12.544426 IP (tos 0x8, ttl  64, id 17977, offset 0, flags [DF],
> > proto:
> > TCP (6), length: 60) 192.168.1.2.45288 > 89.57.3.60.21: S, cksum
> > 0x98ab
> > (correct), 1867615712:1867615712(0) win 5840 <mss
> > 1460,sackOK,timestamp
> > 6212569 0,nop,wscale 5>
> > 19:07:52.537852 IP (tos 0x8, ttl  64, id 17709, offset 0, flags [DF],
> > proto:
> > TCP (6), length: 60) 192.168.1.2.36423 > 89.57.3.60.21: S, cksum
> > 0x3a4e
> > (correct), 3820262832:3820262832(0) win 5840 <mss
> > 1460,sackOK,timestamp
> > 6672541 0,nop,wscale 5>
> > [...]
> > 27 packets captured
> > 54 packets received by filter
> > 0 packets dropped by kernel
>
> It's been a while since I looked at tcpdump, but this looks like
> yourself connecting *to* an FTP server (or I should say an external
> connection on port 21).
>
> > In the past Tiscali (my ISP) did not stop file sharing, they just
> > slowed it
> > down to 10-12k.
>
> But they don't slow down FTP?  FTP *is* (client/server) file sharing.
>
> --
> Albert W. Hopkins

It seems they try to recognize some kind of signature/footprint/whatever which 
is typical for file sharing. Apparently they don't check ports that are 
heavily used due to performance issues or false positives.