Napster is the peer-to-peer filesharing program that started it all. While the official Napster servers have been shut down, unofficial ones are still running, using the same (or nearly the same) protocol. Documentation of the protocol is available here.
In Napster 126.96.36.199 clients use:
- [OUT] TCP 80 port - HTTP for audio listings and downloading, search, licensing, and requests.
- [OUT] TCP 53 port - DNS name resolution requests.
- [OUT] TCP 443 port - SSL requests for member information.
- [OUT] TCP 554 port - RTSP streaming audio requests.
In the P2P editions of Napster:
- Servers tend to run on TCP ports 8888 or 7777, but many run on other ports.
- Clients default to TCP port 6699 for file transfers, but this also can be easily changed by the user.
l7-filter uses the napster pattern. Testing shows that some connections may be missed if you only have l7-filter look at the first 10 packets, as it does by default. Increasing this number somewhat helps avoid this problem.