Re: stop microsoft p2p

[Julian Gomez <kluivert () tm net my>]

On Thu, 27 Mar 2003, Bennett Todd wrote:

(snip rest)

> remotely, and there's no "connection" to drop. But maybe some of
> the ICMP tricks will work. Fortunately, designing robust protocols
> without the help of TCP is hard enough that few people try; an IPS
> can carry you a long way.
>
> If you want to play with the IPS approach, you could build snort
> with flexresp enabled and play with that.

Or you could try one of the tools from Dug Song's dsniff package, I used
to have quite some fun with it killing off non-compliant users which used
IM clients in the office :-)

But that was laborous, and to make it easier will probably mean Snort
again for most people, so snort+flexresp inbuilt would be easier than
tying it separately to an external program.
_______________________________________________
firewall-wizards mailing list
firewall-wizards () honor icsalabs com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards