WinMX Network Analysis (6 months worth of data)

[GhostShip]

From Joshs data he does indeed have the capability to detect the attackers as the userbase is far from dynamic over a long time period also his IP was detected scanning secondary users some months ago by the anti flooder team, thus leaving the suspicion with some folks that he could be aiding the attackers but thats another story ... 

[Bieb]

I'm not sure exactly what you mean by scanning secondary users as you can't directly communicate with a winmx client on secondary. However if you mean when Lagerlout was wondering why I was requesting primary nodes from his cache server more often that needed it was explained to him that it was due to an old application (circa 2009) that was requesting primaries from his cache server on the secondary ports (where this "secondary scanning" logic must come from).

That piece of crap app was simply left open in a vm and forgotten about and that was dealt with appropriately.

I make almost all of my WinMX applications to be completely cache server independent, and the only ones that do use them are these crap apps from way back when that were written vb.net (cringe).

[White Stripes]

so what will be different in the new data vs the old?

[Bieb]

so what will be different in the new data vs the old?

Well the new data should cover at least 95% of the entire network compared to the old one (significantly more primary connections).  I also am keeping track of malformed packets (aka flagged on the stats graphs) so even if someone sends out a room list refresh with one extra byte it will be marked as invalid or "flagged".

Then everything is wrapped up in a pretty graph lol.   Or you can view the raw data with the api.