RE: Blocking Music Sharing.

["Albert Saerong" <Albert.Saerong () id ey com>]

Agreed. better use Snort to detect the P2P signature (and send TCP reset 
if you want) because ports blocking (either moving or not) can be bypassed 
by using a local personal proxy (in the user's own workstation) + a 
HTTPTunnel free client. By doing this, it seems impossible to block any 
kind of applications by port-blocking method, cause most companies mostly 
to allow HTTP (eventhough via proxy)

cheers,
albert





"Jason Bethune" <jbethune () town kentville ns ca>
Sent by: full-disclosure-admin () lists netsys com
09/16/2003 01:06 AM

 
        To:     <full-disclosure () lists netsys com>
        cc: 
        Subject:        RE: [Full-disclosure] Blocking Music Sharing.


Snort is one tool used by alot of IT guys to block file sharing programs. 
THe trouble with these programs is that they have built in port "movers" 
that will scan the local network to find an available port to work on. 
Scripting is one way to do it....but that mostly just alerts you to the 
fact that there is traffice being used on your network for file sharing. I 
would like to know an exact way to block file sharing as well...
 
Jason Bethune
<?xml:namespace prefix = o ns = "urn:schemas-microsoft-com:office:office" 
/> 
IT Specialist
Town of <?xml:namespace prefix = st1 ns = 
"urn:schemas-microsoft-com:office:smarttags" />Kentville
354 Main Street
Kentville, NS 
B4N 1K6
 
www.town.kentville.ns.ca
 

From: full-disclosure-admin () lists netsys com 
[mailto:full-disclosure-admin () lists netsys com] On Behalf Of Johnson, Mark
Sent: Monday, September 15, 2003 1:37 PM
To: full-disclosure () lists netsys com
Subject: [Full-disclosure] Blocking Music Sharing.

Due to the legal issues, I am trying to block access to sites like Kazaa 
and Limewire in the office.  If I am not mistaken, these networks can use 
different ports each time, so there is no way to block it at the firewall. 
 Is this right?  And if so, what is the best way to block access to these 
types of sites?
 
Many thanks,
Mark J. 


----------------------------------------------------------
The information contained in this communication is intended solely for the use of the individual or entity to whom it 
is addressed and others authorized to receive it.   It may contain confidential or legally privileged information.   If 
you are not the intended recipient you are hereby notified that any disclosure, copying, distribution or taking any 
action in reliance on the contents of this information is strictly prohibited and may be unlawful. If you have received 
this communication in error, please notify us immediately by responding to this email and then delete it from your 
system. Ernst & Young is neither liable for the proper and complete transmission of the information contained in this 
communication nor for any delay in its receipt.

Note: If you have received a delivery failure report, it may be due to the change in the Ernst & Young e-mail domain 
from "eyi.com" to "ey.com".  Could you please make the necessary amendment, if required, and resend the message.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html