That's those forged TCP reset packets again. It wouldn't help if you blocked them because they
are also sending them to the uploaders as well.

I sort of get the concept of what they're doing, but could you elaborate a bit? I'm a little foggy on the process, I suppose. It looks like I'm getting valid upload requests (as far as the originating addresses are concerned. Instead, they are bogus, and the end result is that legitimate uploads are being blocked, as BS (and Phex, now) is being swamped. Does that sound about right? Blocking addresses wouldn't work, because they're hijacking legit addresses, right?

The thing is, I do have a considerable amount of computer resources to throw at the problem, which I would love to do, just to counter what they're doing. A better understanding of the latter might give me some idea of what I could do with the former. I'd be interested to see what firing up Phex on a parallel processor Unix machine might accomplish. If nothing else, it might keep them quite busy keeping up with it.

Cheers,

Nick

PS (Why is Limewire evidently impervious to these attacks? It just cooks along, with 5 or 10 users getting through consistently.)