Ares

From Protocolinfo

Ares is an open source P2P filesharing program.

Contents 1 Identification 1.1 Ports 1.2 l7-filter 1.3 IPP2P 2 See also

[edit] Identification

[edit] Ports

By default, Ares listens on TCP port 23302 and giFT-Ares listens on TCP port 59049. However, it seems empirically that most file transfers occur on unpredictable ports.

[edit] l7-filter

l7-filter uses the ares pattern. It is tested with Ares 1.8.8.2998 and 1.9.1.3110.

This pattern catches only client-server connect messages. This is sufficient for blocking or some types of accounting, but not for shaping, since it doesn't catch the actual file transfers. The file transfers themselves appear to be encrypted or at least obfuscated.

Since Ares is open source, it might be possible to write a better pattern by reading its source code. One could also try reading the source of giFT-Ares. Actual documentation of the protocol appears to be hard to find.

[edit] IPP2P

IPP2P can match Ares using the --ares option. Their page says that it can only drop Ares traffic. Presumably they are in the same boat as l7-filter.

[edit] See also

• Wikipedia's Ares article