Re: classifying P2P traffic

[David Boyer <David () BVU EDU>]

We're using a Fortigate 500A, and it's working well for us. Our traffic logs indicate it's catching our P2P traffic. 
For encrypted traffic like Ares it uses the signature of the initial (unencrypted) handshake and stops it at that 
point. It also uses signatures to properly classify P2P traffic on random ports or other service ports, (like port 80).

> > > "Youngquist, Jason R." <jryoungquist () CCIS EDU> 8:49 AM 1/29/2008 >>>
What devices are you using to monitor P2P traffic and how well are they
working for you?  Is there some P2P traffic that you believe your
monitoring software isn't catching?  Ie. encrypted traffic, outdated P2P
definitions from the vendor, etc.


Thanks.
Jason Youngquist
jryoungquist () ccis edu