Gnutella Forums

Gnutella Forums (https://www.gnutellaforums.com/)
-   Gtk-Gnutella (Linux/Unix/Mac OSX/Windows) (https://www.gnutellaforums.com/gtk-gnutella-linux-unix-mac-osx-windows/)
-   -   When will GTK-Gnutella 1.0.1 for MacOSX be released? And does GTK have a default port? (https://www.gnutellaforums.com/gtk-gnutella-linux-unix-mac-osx-windows/102603-when-will-gtk-gnutella-1-0-1-macosx-released-does-gtk-have-default-port.html)

Lord of the Rings January 3rd, 2014 09:24 AM

When will GTK-Gnutella 1.0.1 for MacOSX be released? And does GTK have a default port?
 
2 Attachment(s)
I hadn't used GTK for half a year (MacOSX version.) I opened it up & it connected to 4 other GTK hosts with port 59345. 3 of these would have been blocked via the Hostiles list used for BearShare & LW.
I upgraded to the MacOSX GTK 1.0.0 and noticed a GTK host being listed as hostile. After checking versions I read the other GTK hosts listed as being hostile is a bug. Any idea when the MacOSX update for 1.0.1 will be released?

I realise the update for Linux & Windows was only released 31 Dec.

The only GTK host it didn't list as being hostile was a 2007-07-07 version which coincidentally was using port 59345.
Dare I say it, my connection files I provide for Phex & LW both have 4 GTK hosts with this port & two of those I connected to. This now makes me somewhat suspicious of hosts with this port when 3 were from USA & two from Brazil. Just seems too coincidental to be trusted. Or is this a default port for GTK-Gnutella?

Port 27016 are spambots, and port 7001 upload-sucker bots. If port 59345 is also used by bots, I'd have no idea what their purpose is, unless someone can educate me.

Also upon quitting GTK, it crashed in the process.
Exception Type: EXC_BAD_ACCESS (SIGABRT)
Exception Codes: KERN_INVALID_ADDRESS at 0x0000000000000010
Crashed Thread: 0 Dispatch queue: com.apple.main-thread

Edit: 9+10 Jan 2014. Seems I found another two bots in the 50.58.238.x. range (this one is supposedly a static ip). I was listing all the hosts I was connecting to over a period of time. Seems a dozen & half of same ip address, just different port (between 6000-7000) but all LimeWire/4.12 (Pro), (no specific 4.12 sub-version, which suggests it is a fake ID, especially since LW 5 versions supposedly do not connect to versions below LW 4.14). I was connected to 4-7+ of these at a time whilst being a peer using LPE.
I'm aware GTK is not interested in bot listings to block, so I'll simply add it to the bot lists I've added to the BS & LW blocklists. I'm not 100% certain but seems same ip as the one that browsed me immediately I connected to the network, and same host address as did so on multiple occasions in early Jan & mid-late December. There was a previous individual listing in the hostiles for this /24 sub-range (which I added in 30 August 2012), which now makes 3.
Recorded as bot ip's.

Attachment 6469 . . . Attachment 6471
Couple snaps joined, from 9th & 11th January.
I didn't keep a list of all these connections but of the 9 ports I saw used today varied between 6509-6599.

Lord of the Rings January 11th, 2014 11:16 PM

1 Attachment(s)
Quote:

Originally Posted by Lord of the Rings (Post 373457)
...
Edit: 9+10 Jan 2014. Seems I found another two bots in the 50.58.238.x. range (this one is supposedly a static ip). I was listing all the hosts I was connecting to over a period of time. Seems a dozen & half of same ip address, just different port (between 6000-7000) but all LimeWire/4.12 (Pro), (no specific 4.12 sub-version, which suggests it is a fake ID, especially since LW 5 versions supposedly do not connect to versions below LW 4.14). I was connected to 4-7+ of these at a time whilst being a peer using LPE.
I'm aware GTK is not interested in bot listings to block, so I'll simply add it to the bot lists I've added to the BS & LW blocklists. I'm not 100% certain but seems same ip as the one that browsed me immediately I connected to the network, and same host address as did so on multiple occasions in early Jan & mid-late December. There was a previous individual listing in the hostiles for this /24 sub-range (which I added in 30 August 2012), which now makes 3.
Recorded as bot ip's.
...
I didn't keep a list of all these connections but of the 9 ports I saw used today varied between 6509-6599.

The evidence these are bad hosts via BearShare 5.1's console logs:

Peer in 50.58.238.243 ("LimeWire/4.12 (Pro)" 777 msgs) sending query with invalid address embedded in GUID field (192.168.1.123:7000).
Peer in 50.58.238.243 ("LimeWire/4.12 (Pro)" 620 msgs) sending query with invalid address embedded in GUID field (192.168.1.123:6561).
Peer in 50.58.238.243 ("LimeWire/4.12 (Pro)" 212 msgs) sending query with invalid address embedded in GUID field (192.168.1.123:6562).
Peer in 50.58.238.243 ("LimeWire/4.12 (Pro)" 624 msgs) sending query with invalid address embedded in GUID field (192.168.1.123:6518).
Peer in 50.58.238.243 ("LimeWire/4.12 (Pro)" 4 msgs) sending query with invalid address embedded in GUID field (192.168.1.123:6575).
Peer in 50.58.238.243 ("LimeWire/4.12 (Pro)" 544 msgs) sending query with invalid address embedded in GUID field (192.168.1.123:6564).

Attachment 6475 (small attached image to the left)

I connected to multitudes of them. Not forgetting their id must be fake because LW 5 versions do not connect to versions older than LW 4.14, which happened on several days prior to today.
The above constant messages stopped after I added the block of the address to the hostiles & restarted BearShare. (twice)

Edit: 16 January: 50.58.238.131 with identical port ranges is still active (added in 2012.)

MrJoe January 23rd, 2014 12:56 AM

Quote:

was using port 59345.
...
Just seems too coincidental to be trusted. Or is this a default port for GTK-Gnutella?
No, there is no default port, they are (should be) randomly chosen on the first startup.

Quote:

Any idea when the MacOSX update for 1.0.1 will be released?
Normally OSX versions are released within a couple of days after the source release.
Version 1.0.1 for OS X was released january 6, as you probably already have noticed.

Lord of the Rings March 5th, 2014 10:50 PM

Quote:

Originally Posted by Lord of the Rings (Post 373457)
...
The only GTK host it didn't list as being hostile was a 2007-07-07 version which coincidentally was using port 59345. ... This now makes me somewhat suspicious of hosts with this port when 3 were from USA & two from Brazil. Just seems too coincidental to be trusted. ...

One of these appears to be a bot that browses when you first join the network. I believe I did at one time put it onto the hostiles but then removed it last year or earlier.
It connected to me as a UP whilst i was an LPE UP but my MacOX Console log only shows one connection attempt, despite LW showing that it browsed me also. Unless early GTK versions had an effect of auto-browsing hosts when they connected to them?
I'd have thought a browse host request would come in a separate message. Unless both (connect & browse) sent within same packet(s) of information or continuation of a single message?
#.#12.208.195:59345 gtk-gnutella/0.96.4-14059 (2007-07-07; GTK2; Linux x86_64)
LPE pseudo ID: indigoSnip-208-195
It appears to be a 24/7 UP. Of course I have it on my connection lists for LW/Phex/BS, etc. but wondering if that's a bad idea.

Lord of the Rings March 7th, 2014 05:21 PM

Edit: I'll start a new thread, since this is really off-topic.


All times are GMT -7. The time now is 04:44 AM.

Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2024, vBulletin Solutions, Inc.
SEO by vBSEO 3.6.0 ©2011, Crawlability, Inc.

Copyright © 2020 Gnutella Forums.
All Rights Reserved.