Tracking of P2P Networks Group 6 John Paul Kalapurakal Ronak Kamdar

Introduction P2P Networks Is someone tracking P2P Networks? Ad hoc networks Cumulative bandwidth Exploits diverse connectivity 2. Examples: Ares, BitTorrent, eDonkey etc 2. Is there someone tracking the P2P networks for illegal content sharing

Background and Motivation P2P What is it? Who uses it? What is it used for? How to monitor?

The Problem Statement How likely is it that a user will run into a fake user and thus run the risk of a law-suit? Understand the effort that content providers are putting into trawling P2P networks Justify the efforts of the P2P community to isolate “fake users”

Block List List of suspect IP address ranges of fake users Intention Provided by anti-RIAA software or security groups Intention Identify monitoring entities Who owns them? Government and corporate organizations Educational and internet advertisement firms Media Firms Not all block list IP addresses are monitoring users Assume worst case scenario

BOGON IPs IP blocks not allocated to ISPs and organizations plus all other IP block that are reserved for private or special use by RFCs Such IP Block should not be used or accessible on the internet Used by individuals that try to avoid being identified Used in activities such as DoS attacks, email abuse, hacking, and other security problems Cannot be monitored using IP-WHOIS lookup Most of the BOGON IP ranges point to either ARIN or RIPE IP ranges IP-WHOIS : Locate the operator employing the anonymous blocks ARIN – American Registry of Internet numbers RIPE – European IP networks

Test Bed PlanetLab 90 days Customized Gnutella client 50 Nodes Each client initiates 100 queries on music US – Hot 100 hits Europe – Top 50 hits Asia – Top 50 Hits Nodes made to switch between UP and leaf nodes. PlanetLab is a group of computers available as a testbed for computer networking and distributed systems research. It was established in 2002 and as of October 2007 was composed of 825 nodes at 406 sites worldwide.

Results Analyzed 100 GB of TCP Header 100% probability of P2P nodes running into entities 12-17% of all distinct IPs contacted by each node were blocklisted IPs

Results The top five blocklisted IPs ranges contribute to nearly 94% of all blocklisted IPs Avoiding these IP ranges can reduce probability to about 1%

Results Only about 0.5% of these blocklist IPs belong to media companies 71% of blocklisted IPs belong to government and corporate organizations Very little presence of media companies for tracking content However, the possibility of hiring other corporations to track users is not rules out

Results Geographical location does play a role in the number of blocklisted IPs contacted 1. There is geographical bias in tracking P2P users 2. There difference can be attributed to a. Difference in user behavior b. Local prevalence and difference in level of monitoring by entities.

Results Ultra peers and Leaf Nodes have equal probability of associating with blocklisted IPs with less then 5% variation Constantly switching nodes between UP’s and Leaf nodes UP’s are hit more in WC and Europe while Leaf nodes are hit more in EC and Asia

Results 99.5% of blocklisted IPs are BOGON IPs, commercial, educational, etc. 1. This is because the users are trying to conceal their identity

Related Work Anti-RIAA/MPAA software Enable programs to block computers owned by organization from accessing users of P2P networks Modeling and analysis of P2P systems based on performance metrics How is it different from this work? Anti software used to block organizations are now built into the applications Current work focuses on tracking the P2P networks as compared to performance metrics of P2P networks

Critique Next step is to analyze the accuracy and completeness of the blocklists, and the speed with which a new blocklisted entity is flagged The authors themselves present the next step which is to analyze … We feel that this information is necessary for the completeness of the paper

Summary and Conclusions A naïve user is practically guaranteed to be monitored Other factors Top five blocklisted IPs Geographical bias Equal opportunity trawling

Questions