Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1, Administration Manual

Page: 965 / 1026

sos5.1.0 info This protocol anomaly is a Gnutella message with a search
criteria field that does not end with a NULL character. P2P:AUDIT:GNUTELLA-SEARCH
sos5.1.0 info This protocol anomaly is a Gnutella server response that
does not use the expected syntax. Correct syntax for Gnutella
0.4 is: GNUTELLA OK<CR><LF>; correct syntax for Gnutella
0.6 is: GNUTELLA/0.6 200 OK<CR><LF>. P2P:AUDIT:GNUTELLA-SVR-RESP
sos5.1.0 info This protocol anomaly is a Gnutella message with a TTL
that exceeds the user-defined maximum. The default TTL
is 8. The Gnutella RFC recommends an 8 to 10 TTL maximum
for Gnutella messages. P2P:AUDIT:GNUTELLA-TTL
sos5.1.0 info This protocol anomaly is a Gnutella message with a connect
string that does not conform to Gnutella RFC or the
requesting Gnutella version is not 0.4 or 0.6. P2P:AUDIT:GNUTELLA-UNSUP-VER
sos5.1.0 info This signature detects requests to a BitTorrent tracker
website. Users may be querying the tracker to look for files
to download. P2P:BITTORRENT:TRACKER-QUERY
sos5.1.0 info This signature detects 'scrape' requests to a BitTorrent
tracker website. Users may be querying the tracker to look
for files to download. P2P:BITTORRENT:TRACKER-SCRAPE
sos5.1.0 info This signature detects use of the Direct Connect Plus Plus
(DC++) file sharing client. P2P:DC:DC-PP-ACTIVE
sos5.1.0 info This signature detects version checks by eDonkey 2000, a
peer-to-peer file sharing client. The eDonkey client
occasionally checks its own version number to ensure that
the client is current. P2P:EDONKEY:CLIENT-VER-CHECK
sos5.1.0 info This signature detects Gnutella client connection requests.
Because Gnutella does not use a fixed port number, this
signature searches TCP connections to port 1024 and higher
by default. P2P:GNUTELLA:CONNECT
sos5.1.0 info This signature detects GNUTella server responses to a
connection request. Because GNUTella does not use a fixed
port number, this signature searches TCP connections to
port 1024 and higher by default. P2P:GNUTELLA:CONNECTION-OK
sos5.1.0 info This signature detects Gnutella server responses to a
connection request. Because Gnutella does not use a fixed
port number, this signature searches TCP connections to
port 1024 and higher by default. P2P:GNUTELLA:CONNECTION-OK-V06
sos5.1.0 info This signature detects activity by the peer-to-peer (P2P) file
sharing client MLDonkey, a multi-protocol P2P file sharing
application. P2P:MLDONKEY:CLIENT-ACTIVE
sos5.1.0 info This signature detects a Skype client request (to a central
server) that checks for the latest version of the client
software. P2P:SKYPE:VERSION-CHECK
915 Copyright © 2010, Juniper Networks, Inc.
Appendix E: Log Entries