1. What is thunder?
Thunder is a p2sp-based download software that greatly improves the download speed.
The principle of p2sp is not complex, that is, if multiple servers have the same file, when a user downloads this file from one of the servers, thunder will automatically find several other servers and download this file to speed up.
Thunder is a hooligans. When users do not receive any prompt and have no knowledge, they secretly upload their local files, ranking 7th in all network traffic statistics.
Thunder is stingy, not to mention that the source code is not open, and the principle is not open.
Thunder is smart. Her architecture is admirable ......
2 download Principle
Do you still remember Baidu's MP3 search? Search for an MP3 file on mp3.baidu.com. Baidu will list all the servers she knows (these servers are owned by others). You can click the connection on Baidu to download the MP3 file, instead of logging on to the real server.
Thunder automates the process and adds the function of determining the uniqueness of a file. Let's draw a picture to briefly describe it:
1.The user clicks the connection to the qq_1.exe file on 1.2.3.4
2. The Thunder on the user client obtains the unique check value of the file.
3. Thunder automatically searches its resource server to find the list of other servers that store the same file.
4. get the Directory and file name of the file on the server (the red part may be different from the file name in the original connection), [url] ftp: // 1.2.3.5/qq_2.exe [/url], [url] http: // 1.2.3.6/qq_3.exe [/url.pdf, for Internet users 1.2.3.7with qq.exe
5. Thunder automatically downloads different file blocks from the file to 1.2.3.5 and 1.2.3.6 to accelerate the download (purple part ).
6. the user sends a UDP resource request to the public network user 1.2.3.7
7.1.2.3.7 in response to a resource request, I have the file you want.
8. The user initiates a request to port 3077 of the public network user 1.2.3.7 and transmits data.
9. after the download is completed, if the server list of the file on the thunder resource server does not contain the server 1.2.3.4 that the user clicks to download, add the new server address to the server list (in blue) of the file ).Note:
1. steps 6, 7, and 8 in the above process imply a process: Determine whether the user is a public network user.
If the user is a public network user, the user's IP address and the port providing the download service will also be recorded in the resource server of thunder, and subsequent users can download from the user; section 3 describes this process.
2. How does Thunder differentiate different files? Many files have different names but the same content. Many files have the same names but different content. The search for Thunder's related information is just a few irrelevant nonsense words: thunder also uses the original file verification mechanism to ensure the correctness and integrity of the downloaded files. The method is unknown.
3. How can we view the list of resources found by thunder?
When thunder searches for a series of resource lists and tasks are not completed, a temporary file is created under the same download directory with the searched resource information, peer is the public network user that is found to include the file to be downloaded.
3 Protocol Parsing
The download process in Section 2 of the schematic diagram is the same as that in steps 2, 2, and 5. We cannot differentiate them. Well, let's make an article on 3, 4, and 6.
In addition to the various packets that the above user downloads a specific file, there are also resource information packets, file Block Transmission packets between the user and the user, determine whether the user is a public network user message, and so on.
1. Resource Request Message
Every time thunder sends a resource request to TCP port 3076 of 219.134.132.47, the address is written to the thunder software and is not obtained through DNS requests.
If this address is not available, it will switch to the other two replaceable addresses 219.134.132.42 and 219.134.132.86.
Webxunlei uses 219.134.132.46.
If this packet is filtered out, the thunder client cannot complete resource requests and cannot download from multiple points. After the packets are filtered out using TP, Thunder can only download the packets from the original connection, for example: The Protocol packet features are as follows: 2. Resource search Response Message
If this packet is filtered out, the thunder client will not be able to obtain the resource list and cannot download from multiple points.
The Protocol packet features are as follows: 3. file transmission between users (handshake packets)
Users can transmit file blocks. The following messages are the handshake packets before the start of the file block, Port 3077 is the listening port of the client, which is used to transmit local files to others. (If 3077 is unavailable, yes
To another port ). 4. Resource Information exchange messages between users 5. submit new resource information packets 6. Connect to the NAT test server Packet
Thunder will send a NAT test packet to statnat1.sandai.net every few minutes, that is, to tell Thunder's resource Server
Server, whether it is a public IP.
Because no message is returned, stun is used as the method to guess:
Place the IP address of the local machine in the payload of UDP. If the thunder server receives the packet, it will find the source address at the IP layer.
It is the same as the IP address in payload, that is, the public IP address. Otherwise, it is behind the firewall or needs
Nat can be connected to the public network.
The Protocol packet is as follows: Note:
Sandai.net is a website owned by Xunlei. It rarely appears independently.
Information, display the DNS request message of the advertisement.
4tp Filter
If TP arbitrarily filters thunder packets, you only need to set a traffic management and filter all packets whose destination address is 219.134.132.0/24, but it may report false positives. The following rules are more detailed to reduce false positives. 1. Filtering of user requests to server resources and resource response packets
Because the IP address of the thunder server is easy to replace, we recommend that you filter the DV:
Protocol: TCP
Source Port/destination port: 3076
Four starting Bytes: 0x29000000
2. Filtering of resource information interaction packets between users
UDP protocol
Port 3076
First four bytes 0x32000000
3. Filtering of file transmission (handshake packets) between users
Protocol TCP
The source or destination ports can be 3077 or 3078
The first four bytes are 0x29000000.
4. filter packets that submit new resource information
Protocol TCP
Target Port 3076
First four bytes 0x29000000
5. filter packets connected to the NAT test Server
UDP protocol
Target Port 3076
First four bytes 0x00000101 |
