What do you think this client is doing. He/she is doing this kind of stuff all day [image]

That looks like P2P using Random Ports. You might want to consider limiting TCP connections down to a certain number. Or impliment some P2P rules.

i looks like a p2p but when i go to IP/Firewall/Connections … there aren’t any connections detected as P2P for this user and i’ve got this rule in firewall 3 ;;; Drop P2P chain=forward p2p=all-p2p connection-state=established action=drop

could be encrypted uTorrent or Azureus

it seems they have advanced in their technology in hiding from this filter rule. here in forums macgaiver posted configuration that could fight that “bastardo” :slight_smile:

it seems they have advanced in their technology in hiding from this filter rule. here in forums macgaiver posted configuration that could fight that “bastardo” :slight_smile: you mean this thread? http://forum.mikrotik.com/t/firewall-rule/8179/1

these can’t be dropped? Not easily - deep packet inspection isn’t possible due to the encryption. Other means of tagging the packets will need to be devised and I think that’s easier said than done. I haven’t specifically looked at such traffic although if they’re anything like Skype traffic…

there is a simple variant make list of torrent servers and block it block and ports biger then 1024

That seems like a nice idea - if one exceeds (for example) 300 connections - HE will have problems with other progs (messengers, browsers, send/recv emails…) Btw, how to limit number of connections for pppoe user(s)?? D.

where can i obtain a list of torrent servers?

Torch screen capture - What do you think he/she is doing?

RouterOS General

kolorasta November 30, 2006, 2:54pm 6

you mean this thread? http://forum.mikrotik.com/t/firewall-rule/8179/1