P2p Privacy Update 1.5 - 06.02.2003

[fozzys1]

not sure about this can somebody help?

if u use zonealarm firewall do u need peerguardian?

i thought firewalls did the work 4 u

[Switeck]

Dang, I gotta sort this whole new list by ip ranges, kill all the overlaps, and see how it fits into my old one -- which is already over double its length.

If you don't hear as much from me for the next day or so -- that may be why.

Originally posted by fozzys1@3 June 2003 - 04:23
not sure about this can somebody help? 

if u use zonealarm firewall do u need peerguardian?

i thought firewalls did the work 4 u

Zone Alarm probably won't block the kinds of sniffing the RIAA/MPAA/BSA is doing, because it appears as either 'allowed web traffic' or 'Kazaa Lite++ traffic' -- which you HAD to allow to get Kazaa Lite++ working in the first place. The only exception to that is if you have Zone Alarm (Pro?) block incomming connections by ip range -- which is what Peer Guardian does.

Peer Guardian makes no distinction on how you connect, only on who you connect to by ip address. I don't even know if it blocks UDP connections -- it may only block TCP connections.

[dingdongding]

pg just blocks tcp/icp connections

and fozzys1 unfortunately you can't import ips (in this case the pg ips) into za pro- the ones i know you can do that with are agnitum outpost and sygate pro- so if you stick with za pro just keep your pg updated (that's what i do)

[Switeck]

Here's the overlaps I found in the new list and how it stacked up against my old list:

new: (range too small/large?)
RIAA:12.150.191.0-12.150.191.255
was:
RIAA:12.150.190.0-12.150.191.255


new:
Massachusetts Institute of Technology:18.250.2.150
Patriot-Media-Communications:24.225.128.0-24.225.223.255


new: (Range WAY TOO SMALL)
Replies with <search>..exe:38.144.198.24
Replies with <search>..exe:38.144.198.150
was:
Mutella BOT:38.144.68.0-38.144.198.255


new:
Sony-Network-Taiwan-Limited:61.64.232.198
Sony-Network-Taiwan-Limited:61.64.128.0-61.64.255.255
Australian Federal Police:61.88.128.38
www.amcrecords.com:62.72.107.0-62.72.107.255
IFPI.de:62.156.153.103-62.156.153.104
IFPI Germany:62.156.146.128-62.156.147.127
IFPI Germany:62.156.153.0-62.156.153.255
P2P Overflow:62.210.138.0-62.210.138.255
Studios Guillaume Tell / Paris,France:62.210.176.134
MediaForce:63.76.173.32-63.76.173.47


new: (wrong range&#33
MPAA:63.199.57.96-63.199.57.128
was:
MPAA:63.199.57.120-63.199.57.127

new:
Web Sense:63.212.171.0-63.212.171.255


new: (ranges wrong/too small&#33
OverPeer:64.14.37.128-64.14.37.159
OverPeer:64.14.40.160-64.14.40.191
OverPeer:64.15.224.0-64.15.255.255
OverPeer:64.15.226.96-64.15.226.127
OverPeer:64.15.228.16-64.15.228.191
was:
OverPeer:64.14.0.0-64.14.255.255
OverPeer:64.15.224.0-64.15.255.255


new:
IRMA (Mail):64.32.128.0-64.32.255.255
Big Champagne:64.49.254.0-64.49.254.255
Audible Magic:64.62.143.64-64.62.143.95


new: (overlapping&#33
Audible Magic:64.71.166.0-64.71.166.255
Audible Magic:64.71.166.128-64.71.166.191
changed to:
Audible Magic:64.71.166.0-64.71.166.255


new: (range too small&#33
Overpeer:64.75.4.192-64.75.4.223
was:
Overpeer:64.75.0.0-64.75.63.255


new: (duplicate PLUS range too small&#33
C&DCop:64.106.170.128-64.106.170.191
UnknownC&DCop:64.106.170.128-64.106.170.192
was:
C&DCop-HiSpeed Hosting:64.106.0.0-64.106.255.255


new:
IRMA:64.152.0.0-64.153.0.0
IRMA:64.158.221.50
Presence Studios Westport/Westport, CT:64.159.2.41


new: (range too small&#33
MPAA Subdel Valerie Bourne:64.166.187.128-64.166.187.158
was:
MPAA:64.166.187.128-64.166.187.192


new:
P2P port scanner:64.201.104.2


new: (range too small&#33
MediaDefender:64.225.202.0-64.225.202.255
MediaDefender:64.225.292.0-64.225.292.127
was:
MediaDefender:64.224.0.0-64.226.255.255


new:
Media signature Virtual Portal Corporation:65.101.193.0-65.101.193.255


new: (range too BIG?)
Cyveillance:65.118.41.0-65.118.41.255
was:
Cyveillance:65.118.41.192-65.118.41.255


new: (ranges too small AND overlap&#33
MediaForce:65.192.0.0-65.192.0.255
MediaForce:65.217.219.0-65.217.219.255
www.mediaforce.com:65.217.219.192-65.217.219.255
MediaForce:65.223.0.0-65.223.255.255
MediaForce:65.233.255.0-65.233.255.255
was:
MediaForce:65.192.0.0-65.224.255.255


new: (ranges overlap&#33
RIAA:65.244.101.001-65.244.101.255
RIAA:65.244.101.1-65.244.101.255
RIAA.COM:65.244.101.222-65.244.101.222
was:
RIAA:65.244.101.0-65.244.101.255


new:
Fake MP3s:66.28.0.0-66.28.0.0


new: (range too small&#33
CogentSystems:66.28.148.0
was:
Cogent:66.28.0.0-66.28.255.255


new: (range too small&#33
GAINCME:66.35.247.0-66.35.247.255
GAINCME:66.35.229.0-66.35.229.255
was:
GAINCME:66.35.192.0-66.35.255.255


new:
Universal Studios (ns3.mca.com):66.77.124.7
Replies with <search>:66.111.54.167-66.111.54.182
XBMC.COM:66.117.2.0-66.117.2.255
P2P Scanner:66.118.181.4


new: (range too small&#33
Retspan:66.150.161.133-66.150.161.136
was:
Dotster.com-Retspan:66.150.161.128-66.150.161.159


new:
BMI (Broadcast Music, Inc.):66.212.125.0-66.212.125.255
Audible Magic:66.220.31.128-66.220.31.159
popupad.net:66.230.219.137


new: (range too small&#33
Fake MP3 file:66.250.24.2-66.250.24.9
Cogent:66.250.32.227-66.250.32.242
was:
Cogent:66.250.0.0-66.250.255.255


new: (new range better than old?)
Telecom italia:80.180.73.96-80.180.73.136
Telecom Italia:80.180.123.205
was:
Telecom Italia:80.180.0.0-80.180.127.255


new:
Secure Group:80.239.22.64-80.239.22.127
BSA.at:81.16.38.0-81.16.38.31
IFPI Germany:81.91.161.0-81.91.161.31
Right Track Studios/New York, NY:129.250.2.220
World Music Group:129.250.5.115
Crescent Moon Studios/Miami, FL:130.94.0.170
Ardent Studios UK:144.232.11.245
Remote Recording Services/New York/Philadelphia:144.232.26.2
Bertelsmann group world wide (includes BMG Music):145.228.0.0-145.228.255.255
National Music Publishers of America:152.63.18.25
Misra records:152.63.66.13-152.63.66.13
Verve Music Group/Los Angeles Ca:152.63.113.57
Universal Music Enterprises/Los Angeles:152.63.113.65
MCA Records:152.63.113.69
Universal Music Group/(Motown Records)/Los Angeles:152.63.113.69
Universal Classics /Los Angeles Ca:152.63.113.69-152.63.113.69
Police of Switzerland:164.128.37.17-164.128.223.145
British Phonographic Industry:166.63.167.10
Metro-Goldwyn-Mayer:166.90.148.200
MCA:167.167.0.0-167.167.255.255


new: (but being in AOL&#39;s webspace means they&#39;re probably dynamic&#33
BayTSP:172.178.102.3


New:
Palisade Systems:192.188.162.0-192.188.162.255

new: (range too small?)
Fake Porn:192.217.228.226
was:
FBI:192.217.228.0-192.217.228.255


new: (OVERLAPING&#33
Universal Studios:192.251.66.0-192.251.66.255
Universal Studios:192.251.67.1-192.251.67.255
Universal Studios (gate.mca.com):192.251.67.9
Universal Studios (ns2.mca.com):192.251.67.132
converted to:
Universal Studios:192.251.66.0-192.251.67.255


new: (overlapping&#33
World Intellectual Property Organization:193.5.88.0-193.5.95.255
WIPO.ORG:193.5.93.80
was:
WIPONET:193.5.88.0-193.5.95.255


new:
IFPI Belgium:193.74.19.0-193.74.19.255
GEMA - German Copyright Society:193.108.8.0-193.108.15.255
Sabam (Belgian Society of Authors, Composers and Publishers):193.121.26.01-193.121.27.255
Federale politie - Police federale (BELGIUM):193.121.83.1-193.121.83.255
IFPI Germany:193.158.124.0-193.158.125.255
Dutch Covernment:193.172.176.0-193.172.177.255
French Department of Defense:193.252.72.142
Prefecture de police de Paris:193.252.228.0-193.252.228.255
it.cw.net used by Guardia di Finanza (Italy):194.79.208.0-194.79.208.255
Finnish Police:194.89.205.0-194.89.205.255
www.emigroup.com:194.129.73.0-194.129.73.255
APP:195.6.115.38


new: (corrected range?)
BSA.lv:195.13.160.32-195.13.160.163
was:
BSA.lv:195.13.160.32-195.13.160.63


new:
EMI Electrola GmbH (Germany):195.14.240.128-195.14.240.159
IFPI:195.40.0.128-195.40.0.255
IFPI:195.40.1.0-195.40.1.255
IFPI (mail):195.40.39.5
French Military Police:195.46.218.178
ADAMI (Society of civil rights for performing artists, France):195.68.59.1-195.68.59.7
Direccion General de la Policia (SPAIN):195.76.172.0-195.76.172.255
GuarDia di Finanza (Italy):195.94.0.0-195.94.255.255
Interpol:195.101.232.0-195.101.232.255
Alpa Association:195.102.60.40-195.102.60.50
Puk Recording Studios/Gjerlev,Denmark:195.122.136.8
BMG Ariola München GmbH (Germany):195.143.92.132-195.143.92.188
Sacem:195.154.72.0-195.154.72.255
Gigasoft:195.215.6.42
Edel Records GmbH (Hamburg/Germany):195.222.252.0-195.222.252.127


new: (range too small?)
Red Led Studios / Madrid,Spain:198.66.34.66
was:
MPAA:198.63.0.0-198.66.255.255


new: (corrected range?)
Double Click:199.95.206.0-199.95.207.255
doubleclick.net:199.95.207.0-199.95.208.0
was:
doubleclick.net:199.95.207.0
doubleclick.net:199.95.208.0
converted to:?
doubleclick.net:199.95.206.0-199.95.208.0


new:
Festival Mushroom Records/Sydney Au:202.139.113.106


new: (better range?)
BSA.com.au:203.26.16.0-203.26.31.255
was:
BSAA.com.au:203.147.240.0-203.147.240.255


new: (overlapping&#33
Double Click:204.178.112.170
md1.doubleclick.net:204.178.112.170
was:
md1.doubleclick.net:204.178.112.170


new: (better range?)
Double Click:205.138.3.0-205.138.3.255
was:
gd11.doubleclick.net:205.138.3.62


new:
CAAST.org:205.150.75.0-205.150.75.255
Media signature Tomas Jablonski:205.170.26.0-205.170.26.255
Interliant:206.129.0.0-206.129.0.255
BESS:206.129.1.0-206.129.1.255
US Customs:206.241.30.0-206.241.31.255
BSAPERU.org:207.150.221.96
IRMA:208.162.216.0-208.162.219.255


new: (repeated&#33
RIAA:208.192.0.0-208.192.255.255
RIAA:208.192.0.0-208.192.255.255
was:
RIAA:208.192.0.0-208.192.255.255


new:
The Allegro Group:208.196.168.0-208.196.175.255
RIAA:208.207.98.25


new: (overlaps&#33
MPAA:209.67.0.0-209.67.255.255
MPAA:209.67.1.131
was:
MPAA-Cable&Wireless:209.67.0.0-209.67.255.255


new: (range too small?)
gd17.doubleclick.net:209.67.38.99
was:
MPAA-Cable &amp; Wireless:209.67.0.0-209.67.255.255


new:
Grayzone.com:209.68.4.0-209.68.4.255


new:
Web Sense:209.132.98.0-209.132.98.255
Web Sense:209.132.99.0-209.132.99.255
simplified to:
Web Sense:209.132.98.0-209.132.99.255


new:
Warner Music Group:209.203.64.0-209.203.127.255


newoverlapping&#33
www.baytsp.com:209.204.130.0-209.204.253.255
BayTSP:209.204.128.0-209.204.191.255
BayTSP:209.204.128.0-209.204.253.255
corrected to:
BayTSP:209.204.128.0-209.204.253.255


new:
bannerfarm.ace.advertising:209.255.6.77
ACCS:210.160.94.192-210.160.94.199
Universal Entertainment GmbH, Berlin/Germany (Universal Music Group):212.1.49.0-212.1.49.31
Politie.nl:212.19.195.8
DR3NET:212.37.45.0-212.37.45.15
DR3NET:212.37.47.0-212.37.47.15
Warner Music (Germany):212.79.56.128-212.79.56.187
http://www.arsproductions.com:212.12...212.123.28.255
BumaStemra:212.123.224.160-212.123.224.191
Telecom Italia >>> BSA Host:212.131.0.0-212.131.255.255
KOCH International Multimedia:212.152.174.0-212.152.174.127
MG Sound Studios/Vienna,Austria:212.227.116.140
Capri Digital Studios/Isle of Capri, Italy:213.186.35.203
Zomba Records:213.210.18.0-213.210.18.255


new: (simplified already...)
DoD Network Information Center:214.0.0.0-214.255.255.255
DoD Network Information Center:215.0.0.0-215.255.255.255
was:
DoD Network Information Center:214.0.0.0-215.255.255.255


new: (range too small&#33
OverPeer:216.35.73.128-216.35.73.159
was:
OverPeer:216.25.0.0-216.35.255.255


new:
Hexillion:216.46.246.238-216.46.246.238
Time Warner Telecom:216.64.128.0-216.64.191.255
Double Click:216.73.80.0-216.73.95.255
n-Case Ad Delivery:216.74.57.197-216.74.57.216


new: (range too small&#33
Sony Music Entertainment Inc.:216.74.128.0
OverPeer:216.74.134.128-216.74.134.159
Sony Music Entertainment Inc.:216.74.154.0-216.74.154.255
Sony Music Belgium:216.74.154.0-216.74.154.255
was:
Cable&Wireless-OverPeer:216.74.128.0-216.74.191.255


new:
Brussel politie - Police bruxelles:216.118.66.0-216.118.66.255
AFMA (American Film Marketing Association):216.120.77.0-216.120.77.255
Interliant:216.205.94.0-216.205.94.255
French Department of Defense:217.167.182.1-217.167.182.255


new: (overlaps&#33
IFPI:217.204.27.212-217.204.27.215
IFPI.com:217.204.27.214
IFPI (dr IFPI):217.204.27.214
changed to:
IFPI:217.204.27.212-217.204.27.215

[BaNe^]

Sorry but my english isn&#39;t that good, so what does overlap mean? Those ranges are from PG Ip database and i haven&#39;t modified those.....what the hell i should do with them?

[Switeck]

Originally posted by BaNe^@4 June 2003 - 10:10
Sorry but my english isn&#39;t that good, so what does overlap mean? Those ranges are from PG Ip database and i haven&#39;t modified those.....what the hell i should do with them?

Overlapping means 2 (or more) ip ranges share the same numbers -- so it&#39;s better to just have 1 range and eliminate an entry.

Fewer ip ranges blocked, even if they&#39;re bigger, should probably make Peer Guardian run faster.

See my other thread -- Switeck&#39;s Peer Guardian list for my modified list.

[BaNe^]

Originally posted by Switeck@4 June 2003 - 15:50
Here&#39;s the overlaps I found in the new list and how it stacked up against my old list:

new: (range too small/large?)
RIAA:12.150.191.0-12.150.191.255
was:
RIAA:12.150.190.0-12.150.191.255


.............
............

I think theyre all corrected now.....but theyre gonna be in next update

[Switeck]

Originally posted by BaNe^+4 June 2003 - 13:35--></span><table border='0' align='center' width='95%' cellpadding='3' cellspacing='1'><tr><td>QUOTE (BaNe^ @ 4 June 2003 - 13:35)</td></tr><tr><td id='QUOTE'><!--QuoteBegin--Switeck@4 June 2003 - 15:50
Here&#39;s the overlaps I found in the new list and how it stacked up against my old list:

new: (range too small/large?)
RIAA:12.150.191.0-12.150.191.255
was:
RIAA:12.150.190.0-12.150.191.255

I think theyre all corrected now.....[/b][/quote]Actually, it&#39;s one thing to consolidate the lists...

It&#39;s another to make sure they&#39;re correct.

For instance, this WHOIS info:

AMERICAN COUNCIL OF LIFE INSURERS AMERICAN257-190 (NET-12-150-190-0-1)
12.150.190.0 - 12.150.190.255

RECORDING INDUSTRY ASSOC OF AMERICA RECORDIN50-191 (NET-12-150-191-0-1)
12.150.191.0 - 12.150.191.255

yet...
RIAA:12.150.190.0-12.150.191.255
has both of them in its range.
Should p2p users consider "AMERICAN COUNCIL OF LIFE INSURERS" a hostile group?

But what if they no longer have that ip range and it IS now used by someone else...?

[Infested Cats]

When do you plan on coming out with the next version, or perhaps the more appropriate question is, how often do you put out a release?

[Switeck]

Originally posted by Infested Cats@4 June 2003 - 17:57
When do you plan on coming out with the next version, or perhaps the more appropriate question is, how often do you put out a release?

If you mean me, I&#39;m working daily to tweak the settings.
(But get the list I posted yesterday for the time being -- it&#39;s good for a stand-alone kazaa machine, just not if you want to surf the web on it.)
I&#39;ll be working off-and-on over the next few weeks to verify that the blocked ranges are accurate and relevant.

I can&#39;t promise when a breakthrough occurs, but the limiting factor seems to be my ability to connect ips through their shell companies (the ones listed using various WHOIS functions) back to who&#39;s really pulling the strings.