Author Topic: WinMX Network Analysis (6 months worth of data) (Read 9864 times)

Bieb · « **on:** February 01, 2011, 08:58:32 am »

Just wanted to share this information with everyone on here as I don't think anything has been done for this long of period before.

Six months ago I developed a plugin for my custom chat bot that parks in Pri's room that monitors the WPN network taking note of every unique packet that it intercepts via 15 primary connections. It takes note of the packet type, and validates that each packet is within the range of a correct packet payload for that packet type. It splits the information into String Searches(manual user searches), hash searches (auto find sources), room list refreshes, and other (various network packets that users cannot directly interfere with). Downtime of the bot is up to 5 minutes per month maximum.

These are the results. Sorry about the percentages on the top two sections, there was nothing I could do with the graph software I was using.

It seems as though the network activity is somewhat static and is not decreasing nor increasing at any significantly noticeable rate.

PDF:

http://dl.dropbox.com/u/1381482/graph.pdf

I also uploaded a screenshot of the pdf in case someone doesn't have adobe reader.

These are the raw numbers:

Hash Searches, Room List Refreshes, String Searches, Total (Other is calculated by subtracting Hash searches, string searches, and room list refreshes from total)

690545769 607456 17641172 832888115 08/2010
740257240 671998 20469900 871748688 09/2010
722597471 623394 15842839 839113355 10/2010
699421904 864263 15038870 826828523 11/2010
784631308 725547 16417801 927528940 12/2010
749775231 643644 15167082 863569723 01/2011

White Stripes · « **Reply #1 on:** February 01, 2011, 10:40:54 am »

AFS seems to be doing its job... tho it would be interesting to know if those hash searches are finding or just looking...

...considering the amount of hash searches vs string searches id say there are quite a few stuck incompletes out there...

GhostShip · « **Reply #2 on:** February 01, 2011, 07:08:33 pm »

The reason for the obvious skew in this data towards a high level of hash searches is simply because normal user string searches are artificially limited in their network travel as opposed to hash searches that can reach a far wider network "search horizon", as long as this aspect of the figures is taken into account we can use this information as a benchmark for a later period perhaps.

Well done Bieb, such data and your overall conclusion is reassuring to many of us who are always looking at such things to gauge the community's strength and mood

Bieb · « **Reply #3 on:** February 01, 2011, 11:55:24 pm »

I will post another update in 6 months or sooner if deemed necessary. But if anyone does go in the Renegades room all you need to do is type "!wpnstats" to see the current month's statistics so far, and "!oldstats" to see the information above from previous months.

MinersLantern · « **Reply #4 on:** February 17, 2011, 03:39:42 am »

Very interesting.
What happens to me though is that I can do 'find sources' or search for alternates and still get poor returns. If I do a plain text type search, I get better results on the already partially dled files. Why is that? Does the original WinMX have a different timeout for hash searches than 'new' searches? I can let it run for days on its own without doing any searches manually and it will find few (if any) files. I do a manual search and presto! I get many more files showning that I can queue on. (the partials) and they are not fakes since they often start and complete. Also strange.. Is that I can search for something that I never have searched for before. When I do that, I get all kinds of hits and files get done scary fast. If that takes more than a few days however, the searches returned decrease greatly. Not a computer issue since I can reboot and if I do, things get worse on the files I just searched for a day ago before the reboot. (me thinks the infidel ones are up to more sneaky tricks). Very good work. We need much more analysis of the WPN. Strategy can and probably does change much more often by the 'flooders' or anyone else messing with the network than is realized.

GhostShip · « **Reply #5 on:** February 17, 2011, 04:02:55 am »

Rest assured our strategy changes to match theirs MinersLantern, we see all sorts of tricks and attacks, some from winmx folks on their fellows and many from the gloabl cartel organisations who like to try to sneak in and think no one is watching, I like them to think that as it makes the protection groups job easier and all this goes on under folks noses, thankfully we are as good at the game as they are.

Its hard to assses atm whether we are gaining or losing folks as there are plenty of new folks about but obvious losses due to folks losing employment etc, there are some ways to mess with users still but in all cases its a matter of balancing the harm against the remedy and we like to think we have kept the balance ok, so yes there is always sneaky work going on but no its nothing to be concerned about.

White Stripes · « **Reply #6 on:** February 17, 2011, 07:59:55 am »

@miners -- an old app called quickmx was good for the problem you're having... at least it was when it worked...

Joshua203 · « **Reply #7 on:** February 24, 2011, 08:50:52 am »

Quote from: Silver Stripes on February 17, 2011, 07:59:55 am

.. at least it was when it worked...

acually there is no reason why it would not work.. it's just close to impossible to find and needs an older version of MX to be able to run

..I guess AutoRetry might also be a nice try to get arround this problem?

Greetings,
...Joshua203

White Stripes · « **Reply #8 on:** February 24, 2011, 09:41:15 am »

...still have it from when it was patched to work with the 'new' winmx 3.31 ..... still have 3.31 too

quickmx is, in effect, an autoretry..... a rather brute force autoretry but its what gave me gigabytes upon gigabytes of data that would otherwise had fallen to the neverstart incomplete pile back before the shutdown....

the network is too thin to realisticly use it anymore ..... but in its heyday mixing quickmx with winmx was the closest thing to one of todays common torrent downloads as you could get...

ahhh nostalga... aint it great?

Joshua203 · « **Reply #9 on:** February 24, 2011, 10:16:33 am »

Imagine if you would use both combined hehehe

Nostalgia hmm even the sounds alone but also the startup screen brings up nice memories of exploring all winmx's possibilities hehehe ....oopooh I feel all warm inside all of the sudden ..LMAO

White Stripes · « **Reply #10 on:** February 24, 2011, 01:08:10 pm »

not possible... quickmx was a hack that relied on a large network size.... winmx doesnt scale well compared to newer transfer methods...

but a little wishfull thinking never hurt anyone...

Joshua203 · « **Reply #11 on:** February 25, 2011, 08:55:02 am »

LOL ..I have a feeling I was n't clear enough ...I did not mean combine torrents and MX Silver

White Stripes · « **Reply #12 on:** February 25, 2011, 02:11:40 pm »

i knew you ment to run them side by side but for winmx to match torrent in 'rapid fire' multisource without straining the network would require a rework of the winmx network.... effectively making it 'not winmx' ...

Bieb · « **Reply #13 on:** January 16, 2012, 10:20:38 am »

I've added some pretty graphs to go along with the new version of my network monitoring app I just finished. The data for the last 17 months from the old monitor is displayed under historic stats and it's quite interesting to look at if you have the time.

Starting for February 2012, it will not longer be accurate to compare these newer months with the previous.

http://winmxunlimited.net/tools/network-statistics/

GhostShip · « **Reply #14 on:** January 16, 2012, 01:09:24 pm »

I dont really see much of interest there Josh your stats confirm simply that the damage I predicted nearly a year ago now, has in fact taken place.

I hope all those who where duped by speeches of high morality and talk of monopoly see the real reason Michael Jones published such damaging information, it seems he was simply jealous of the fact winmxworld was still here whilst he had left the community in 2007 amid talk of the whole network collapsing, once again his predictions where shown to be worthless.

Cheers anyway Josh

White Stripes · « **Reply #15 on:** January 16, 2012, 02:47:08 pm »

why is the data before feb 2012 considered 'incorrect' ? wouldnt the data before the attacks began be valid as well?

Bieb · « **Reply #16 on:** January 16, 2012, 08:53:55 pm »

The last 17 months are valid if you're comparing them to each other, but since I'm retiring that version of my monitor and replacing it with the new one, it will not be valid to compare past to future data.

achilles · « **Reply #17 on:** January 16, 2012, 10:35:37 pm »

What kind of changes did you make to your monitor?

achilles · « **Reply #18 on:** January 16, 2012, 10:47:12 pm »

Can Your monitor detect malicious traffic on the network? Can it be used to detect flooders and data miners? Let's say if the current attacks were stoped then would it be useful in creating blacklist?

Bieb · « **Reply #19 on:** January 17, 2012, 12:11:04 am »

It is not that detailed of monitor. It only holds the last five minutes of data (which takes up at least 800MB of memory) and it is only storing the bare necessities to make sure packets are not counted twice and it keeps track of total packets and their type for the whole month. It's essentially a passive counter.

It does keep track of which attack types are going on, and all of this information is provided in the network stats api I provide that anyone is able to use if they so choose to do so. The same stats are used in the Renegades room for announcing if the network is under attack or not and which type of attack as you have probably seen when you have been in there.