Well, that's an interesting idea but it doesn't always work exactly like that.
Part of my job involves banning p2p users from our (extensive) network. Violators usually come to my attention from a router getting choked up by excessive bandwidth or by users on that net complaining of slow connections. When I investigate, usually I don't even look for the common ports but rather I look for the IP's passing the most traffic. Then I dump all traffic for that IP. If that IP is passing heavy traffic to and from, say, 5 or more hosts then it's pretty easy to see what's going on. I prefer to use this method of weeding out p2p users because it still allows people to use p2p for legitimate uses such as downloading iso's with bittorrent and such. Just my $0.02.
Slashdot Mirror
Well, that's an interesting idea but it doesn't always work exactly like that.
Part of my job involves banning p2p users from our (extensive) network. Violators usually come to my attention from a router getting choked up by excessive bandwidth or by users on that net complaining of slow connections. When I investigate, usually I don't even look for the common ports but rather I look for the IP's passing the most traffic. Then I dump all traffic for that IP. If that IP is passing heavy traffic to and from, say, 5 or more hosts then it's pretty easy to see what's going on. I prefer to use this method of weeding out p2p users because it still allows people to use p2p for legitimate uses such as downloading iso's with bittorrent and such. Just my $0.02.