Snort mailing list archives
Re: how to block P2P with snort
From: Sylvain BERTRAND <sbertran () metz supelec fr>
Date: Wed, 31 Mar 2004 23:05:44 +0200
Charles Lacroix wrote:
My problem is not really to decide what I should block on the user's side when I detect P2P trafic. I already use a home made perl script that parses the /var/log/snort/alert file and automatically inserts a rule to disconnect the user. So I can afford to cut the user off the Internet, and even come to his place and check out his computer. The real problem for me is that most of the P2P trafic isn't detected by snort default P2P rules. And I wan wondering if there were an unofficial set of rules that would block most of the P2P trafic (false positives are ok!).On Wednesday 31 March 2004 12:50, Sylvain BERTRAND wrote:Hi everyone, I'm new on this ML (first day), and i already use Snort to monitor stuff. I assume this question has already been asked but I can't find any good answer: how to block P2P with snort? I'm currently using rules/p2p.rules but it's not enough (250 broadband users behind my fw... all of them students who want to leech a lot). What do you suggest? Sincerely, Sylvain BERTRANDHi there, i am also working on a similar project. Use swatch to monitor your alert log file, then parse the alert with some perl script that will generate you iptables rules to block what ever you want. On my side, i decided to completely block the user from accessing web, and at the same time, send an email to the admin so that he can manually unblock the user later on after they had a talk with the boss. But from what i can see, generating more complexe iptables rules could be better. You could block only src_addr going to dest_addr taken from your alert file. This way it would block current connections and not affect the rest of the connection. unfortunatly, you will have to build some sort of mecanisme to clean up your iptables rules aftera while.Later Charles
Sylvain
Current thread:
- how to block P2P with snort Sylvain BERTRAND (Mar 31)
- Re: how to block P2P with snort Charles Lacroix (Mar 31)
- Re: how to block P2P with snort Sylvain BERTRAND (Mar 31)
- Re: how to block P2P with snort Charles Lacroix (Mar 31)
- Re: how to block P2P with snort Sylvain BERTRAND (Mar 31)
- Re: how to block P2P with snort Charles Lacroix (Mar 31)