1. Unstructured P2P networks by example:Gnutella 0.4,Gnutella 0.6 张旭彤 杨蕊鸿 马骕 林晔

2. Introduction The Protocol Studying Gnutella Query/Advertis e approach Attacking the network Extension of 0.6 1999 2001 Gnutella Version 0.4 Version 0.6 Discussion Gnutella removes the single point of the failure of centralized maintenance servers. Goals: flexibility, scalability, reliability and anonymity. NapsterGnutella 1999-20012000-now File sharing systemFile sharing protocol Centralized P2P networkDecentralized/Hybrid P2P network Top of TCP/IP at application levelOn TCP/IP at application level

3. Gnutella Protocol version 0.4 The Protocol Introduction Studying Gnutella Query/Advertis e approach Attacking the network Extension of 0.6 How to establish a Gnutella network ? 4points: 1.Descripterheaders 2.Message types 3.Firewalls 4.Routing

4. The Protocol Introduction Studying Gnutella Query/Advertis e approach Attacking the network Extension of 0.6 Descriptor headers Message types Firewalls Routing Special issue: TTL—only way of avoiding a network flooding &resulting poor bandwith Descriptor Headerscontents Descriptor IDIdentifier of the sender(no IP) Payload DescriptorMessage type TTL(Time To Live )The maximum number of forwards until this message is removed from the network HopsNumber of nodes passed Payload LengthLength of the following messages’ descriptor

5. The Protocol Introduction Studying Gnutella Query/Advertis e approach Attacking the network Extension of 0.6 Descriptor headers Message types Firewalls Routing Finding friends: PING——search for other servents PONG——respond other’s call Resource retrieval: QUERY——search for a certain data QUERY HIT——respond to QUERY Pushing data: PUSH——purpose in case of firewalled servents

6. The Protocol Introduction Studying Gnutella Query/Advertis e approach Attacking the network Extension of 0.6 Descriptor headers Message types Firewalls Routing Solution: providing a chance for requesting client to push data Problem: the servent wanna share a resource, but situated behind a firewall.

7. The Protocol Introduction Studying Gnutella Query/Advertis e approach Attacking the network Extension of 0.6 Descriptor headers Message types Firewalls Routing PONG and Query Hit messages are routed at the same path like the incoming PING and Query messages. PING & QUERY  broadcast message  flooded to every node until TTL is outline PONG & QUERY HIT :have the same Descriptor_ID as PING &QUERY message.

8. Studying Gnutella IntroductionThe Protocol Query/Advertis e approach Attacking the network Extension of 0.6 Gnutella Traffic Network Structure Gnutella network traffic in protocol version 0.4 Queries with QueryHit message compared to all queries Number of responding QueryHits belonging to one Query message

9. Studying Gnutella IntroductionThe Protocol Query/Advertis e approach Attacking the network Extension of 0.6 Gnutella Traffic Network Structure Network structure over the day

10. Query/Adverti se approach Introduction Studying Gnutella The Protocol Attacking the network Extension of 0.6 Flaws of the Gnutella network Using Publish/Subscrib e services... in the end Query/Advertise approach

11. Introduction Studying Gnutella The Protpcol Attacking the network Extension of 0.6 The Query Hit attack The Pong attack Going even one step further A Distributed Denial of Service attack exploiting the Query Hit messages in Gnutella protocol version 0.4 Attacking the network Introduction Studying Gnutella The Protocol Extension of 0.6 Query/Advertis e approach

12. Introduction Studying Gnutella The Protpcol Attacking the network Extension of 0.6 The Query Hit attack The Pong attack Going even one step further A Distributed Denial of Service attack exploiting the Ping messages in Gnutella protocol version 0.4 Attacking the network Introduction Studying Gnutella The Protocol Extension of 0.6 Query/Advertis e approach

13. Introduction Studying Gnutella The Protpcol Attacking the network Extension of 0.6 Protocol extensions Restructuring the network Extension of 0.6 Introduction Studying Gnutella The Protocol Query/Advertis e approach Attacking the network Connection initialization: Handshaking sequence GNUTELLA CONNECT/0.6 User-Agent: BearShare/1.0 Pong-Caching: 0.1 GGEP: 0.5 GNUTELLA/0.6 200 OK User-Agent: BearShare/1.0 Pong-Caching: 0.1 GGEP: 0.5 Private-Data: 5ef89a

14. Query/Adverti se approach Introduction Studying Gnutella The Protpcol Attacking the network Extension of 0.6 Protocol extensions Restructuring the network Extension of 0.6 Introduction Studying Gnutella The Protocol Query/Advertis e approach Attacking the network X-Try headers X-Try: 1.2.3.4:1234, 5.6.7.8:5678

15. Query/Adverti se approach Introduction Studying Gnutella The Protpcol Attacking the network Extension of 0.6 Protocol extensions Restructuring the network Extension of 0.6 Introduction Studying Gnutella The Protocol Query/Advertis e approach Attacking the network UltrapeerQuery routing protocol

16. Thank You