Re: Possible Fix for Dynamic Querying?...and kill Spammers to boot!

> I don't think any of these solutions may work. I have also thought
some of
> them in the past, but nothing really valuable can come out. Consider the
> following scenario: a malicious peer is connected to Gnutella as a
legitimate
> peer and instead of replying to every Query it routes, it just
changes the IP
> address of every QueryHit it routes. That is, the malicious peer
does not
> inject spam QueryHits in the system, but changes the identity carried by
> legitimate QUeryHits in the system. 
> 
> How can you fight this one? Also, this attack may be more stealthy.
Inject 10
> malicious peers (very easy) and let them change 1 of 10 QueryHits they
> route... 

Dynamic querying needs to be made more robust even if there were no
spammers and intentional malicious hosts. Or, like previous posters
have said, it needs to be dropped like a bad habit.

All of my suggestions are to deal with known problems, much of which
does not originate from spammers. Lots of people try to share
"C:"...with all the problems that creates. Others try to share
super-popular files...and their connection gets hit by 1000+ incoming
requests a minute as a result. Others are behind a D-Link router in
DMZ mode. DOH! ><

There's some crazy yahoos out there that either intentionally or
accidentally are echoing traffic, others that are flipping the ip
order...so 1.2.3.4 becomes 4.3.2.1, and some that like to report lan
ips or my favorite 0.0.0.0 as source addresses.

Your malicious peers (example) would get lost in their noise alone. ^.^

Sanity checking should probably be done by UltraPeers on ip in query
hits. Whether enough information COULD be revealed that way to unmask
a malicious (or miscoded) peer is a different matter...and I don't
give much hope for that either.