On Sun, 30 Oct 2005, Andrew Gabriel wrote:
> I've had the same issue at home. Visitors used to get real IP
> addresses when they connected up their laptops. I found my DSL
> line was getting hammered by what I though was virus traffic
> initially, but turned out to be skype.
Just so - that's what seems to have set off the reported network
alarms here. It's most unusual for an individual node to be
communicating with thousands of different external IPs under normal
circumstances in a relatively short period of time, and it looks,
prima facie, as if the node has been compromised and is attacking the
rest of the Internet. At least in the kind of environment we're
accustomed to.
> I moved the visitor connections onto a 192.168.x.0 network with much
> outgoing also blocked in the firewall, and that reduced the problem.
> I hadn't realised until I read the PDF paper referred to http://arxiv.org/ftp/cs/papers/0412/0412017.pdf
> earlier in the thread that the real IP addresses could also
> have been a significant contributor to the issue.
Quite. As I read it, it says that any node with a public IP address
could become a "super" node, at the discretion of the software itself,
and in section 4.5 it says that media traffic between certain kinds of
NAT-ed node would be passed via a proxy process at a node with a
public IP address.
IINM that means that by participating with a public IP address you're
not only liable to be used for control and administrative traffic, but
also as a media relay (proxy).
As hairydog said, it's not unreasonable to grant the use of some of
your own resources in exchange for getting a service; the flip side
here is that when the resources aren't your own, you've no right to
give them away. In that sense, your visitors were (inadvertently)
doing much the same.
best
Re: Skype bypasses proxy 
Linear Mode
