The current state of anonymous file-sharing - Marc's Blog

4.4.2 Scalability problems in the Gnutella Network
The way that searches are being relayed though the network poses the risk of your
directly connected nodes acting quite similar to "smurf amplifiers" in a smurf IP Denial-
of-Service attack (more information: CERT Advisory CA-1998-01 Smurf IP Denial-of-
Service Attacks 5 ). In network technology, a smurf attack consists of sending spoofed
ICMP echo (aka "ping") packets to a large number of different systems. The resulting
answers will be directed to the spoofed IP address and put heavy load on the PC behind
that IP. In Gnutella this can happen if a node starts searching for a term that will most
likely result in lots of hits (e.g. just the file extension ".mp3").
As a solution to this problem, the equality of all nodes was divided into two classes with
the introduction of the (not yet finished) Gnutella Specifications 0.6[6]:
Ultrapeers and leaves.
An Ultrapeer is a node with an high-bandwidth connection to the internet and enough
resources to be able to cope with. It also acts as a pong cache for other nodes. The
"leaves" (which are the "outer" Nodes, similar to the leaves on a tree) are connected
to an ultrapeer and the ultrapeers themselves are connected to other ultrapeers. In
the Gnutella Client Limewire, there usually there are 30 leaves per Ultrapeer, each leaf
usually connected to 3-5 ultrapeers and the ultrapeers themselves maintain 32 intra-
ultrapeer connections. Upon connecting, the leaves send the equivalent of a list of shared
files (represented by cryptographic hashes of the shared filenames. See the "QRP"
chapter) to their ultrapeer. After the exchange of information, search requests that
probably won’t result in a response usually don’t reach the leaves anymore and are
instead answered answered by their ultrapeers. Interestingly, the same situation took
place in regular computer networks too. Gnutella transformed from a big broadcasting
network (Hubs) to a "routed" network in which the ultrapeers act as routers between
the network segments. this way, broadcasting gets limited to a minimum and the overall
traffic is reduced. The current state of gnutella is that leaves don’t accept Gnutella
connections. They search for ultrapeers and initiate connections to them instead.
To sum this up, we can basically say that there are 3 kinds of connections in the Gnutella
Network:
1. A leaf connected up to an ultrapeer (3 connection slots)
2. An ultrapeer connected to another ultrapeer (32 connection slots)
5 http://www.cert.org/advisories/CA-1998-01.html
21