Akamai & UPD ports canning

In the last week I have noticed a increase in UPD port scanning taking place on my network in the last three days. So as you may be aware I'm quite happy to look at the log files from the ADSL router and publish the findings. I have posted a number of entries on this and now have a static page with the monthly results.

However I was surprised to find a pattern in the scanning, with a particular company's network being responsible. In this case it is Akamai who's network appears to doing these scans.

IP Address	Country	Owner	Attempts
124.40.51.a	Japan	Akamai	1
208.46.117.b	USA	Akamai	15
209.107.220.c	USA	Akamai	16
209.170.97.d	USA	Akamai	7
213.248.117.e	UK	Akamai	9
217.212.238.f	France	Akamai	7
217.212.238.g	France	Akamai	6
69.22.151.h	USA	Akamai	15
69.22.151.i	USA	Akamai	11
69.22.151.j	USA	Akamai	4
72.246.k.l	USA	Akamai	9
Total			100

Akamai is an Internet content delivery network headquartered in Cambridge, Massachusetts, US.
However they also use a form of peer-to-peer networking using end-users' computers. When users request a download of some large files served by this system, they are prompted to download and install "Akamai NetSession Interface", a download manager used to reduce download time and increase quality but also this software is also a peer-to-peer server, delivering content cached on the user's computer to other users' computers.

The user agreement describes this vaguely as

 "You agree that the Software may send and receive commands and data related to participating publishers’ digital information ("Published Content") to and from the Akamai network and other Akamai NetSession Interfaces to facilitate the downloading of Published Content."

An overview of their Akamai NetSession Interface can be found at http://www.akamai.com/html/solutions/client_overview.html

Now I do have "Akamai NetSession Interface", it was installed when downloading Adobe's Captivate software to trial as a means of producing training presentations. Now I should of read the user agreement in more detail but having a 100 UDP scans to ports on my computer is 3 days is a bit intrusive.  The scans occur as I turn the computer on, and it is a various number each time.

There is a console added to the control panel that allows some control monitoring of their software and it is possible to stop the service through the console, however it does not give a lot of detail of any files uploaded or downloaded, in my case it just lists the two files I downloaded.

I will be looking at this in more detail and be blogging more in the future.