Difference between revisions of "Geaiez"

From AMule Project FAQ
Jump to: navigation, search
Line 1: Line 1:
<pre>
+
Geaiez is known to be a [[client]] which repeteadly requests for you shared files list. It has been often rumoured to be a [http://www.riaa.com/default.asp RIAA]/[http://www.mpaa.org MPAA]/[http://www.cia.gov CIA]/[http://www.fbi.gov FBI] [[client]] trying to get (illegally) a list of illegally shared files and the [http://www.ietf.org/rfc/rfc0791.txt IP]s of the people shareing them.
#!/bin/bash
+
  
# Create special MLDONKEY chain
+
In fact, it has been concluded that is false. Or at least not absolutely true.
iptables -t filter -N MLDONKEY
+
iptables -t filter -F MLDONKEY
+
  
# Create the logdrop chain to log & drop a packet
+
It seems that [http://www.morpheus.com Morpheus] [[client]]s, based on [[mlDonkey]], instead of generating a random 6 characters long username by default, it uses a specific username as default (just as [[aMule] uses ''http://www.amule.org'' or [[eMule]] uses ''http://emule-project.net'') which is (guess what?) '''geaiez'''. Not only that, but also, [[mlDonkey]] [[client]]s apparently request for all shared files to all those [[client]]s they connect to.
iptables -t filter -N MLDONKEY_LOGDROP
+
iptables -t filter -F MLDONKEY_LOGDROP
+
iptables -t filter -A MLDONKEY_LOGDROP -j LOG --log-prefix "MLDONKEY"
+
iptables -t filter -A MLDONKEY_LOGDROP -j DROP
+
  
# Jump to the special MLD chain at the end of the INPUT chain (commented out)
+
So, what seems to be like a single [[client]] requesting repeatedly for your shared files list, is in fact many [[client]]s requesting for your shared files list every time they connect to you.
#iptables -t nat -A INPUT -j MLDONKEY
+
  
# List of ip ranges to ban
+
Anyway, allthough there are no proves which lead to assure there is some government behind those [[client]]s, you should keep your eyes wide-open: don't allow other [[client]]s to get a list of your shared files if you have anything private being shared (we already assume you do '''not''' share copyrighted stuff!).
iptables -t filter -I INPUT 1 -s 38.113.0.0/16 -j MLDONKEY_LOGDROP
+
iptables -t filter -I INPUT 1 -s 38.115.0.0/16 -j MLDONKEY_LOGDROP
+
iptables -t filter -I INPUT 1 -s 38.117.0.0/16 -j MLDONKEY_LOGDROP
+
iptables -t filter -I INPUT 1 -s 38.118.0.0/15 -j MLDONKEY_LOGDROP
+
iptables -t filter -I INPUT 1 -s 65.19.175.0/24 -j MLDONKEY_LOGDROP
+
iptables -t filter -I INPUT 1 -s 66.54.0.0/16 -j MLDONKEY_LOGDROP
+
iptables -t filter -I INPUT 1 -s 66.117.0.0/16 -j MLDONKEY_LOGDROP
+
iptables -t filter -I INPUT 1 -s 207.234.0.0/16 -j MLDONKEY_LOGDROP
+
</pre>
+

Revision as of 23:25, 28 October 2004

Geaiez is known to be a client which repeteadly requests for you shared files list. It has been often rumoured to be a RIAA/MPAA/CIA/FBI client trying to get (illegally) a list of illegally shared files and the IPs of the people shareing them.

In fact, it has been concluded that is false. Or at least not absolutely true.

It seems that Morpheus clients, based on mlDonkey, instead of generating a random 6 characters long username by default, it uses a specific username as default (just as [[aMule] uses http://www.amule.org or eMule uses http://emule-project.net) which is (guess what?) geaiez. Not only that, but also, mlDonkey clients apparently request for all shared files to all those clients they connect to.

So, what seems to be like a single client requesting repeatedly for your shared files list, is in fact many clients requesting for your shared files list every time they connect to you.

Anyway, allthough there are no proves which lead to assure there is some government behind those clients, you should keep your eyes wide-open: don't allow other clients to get a list of your shared files if you have anything private being shared (we already assume you do not share copyrighted stuff!).