Re: p2p traffic detect (torrents)

[Joel Esler <jesler () sourcefire com>]

On Oct 31, 2012, at 10:29 AM, Dmitry Korzhevin <dmitry.korzhevin () stidia com> wrote:

> Guys, can you please advice best way to detect torrents? For now i use only one rule in my /etc/snort/snort.conf 
> configuration file:
>
> /etc/snort/rules/local.rules:
>
> alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg: "torrent"; content:"GET"; content:"torrent"; sid:1100021; rev:1;)
>
> But i don't think it is best of snort can do to detect torrents.. I downloaded latest snortrules-snapshot-2931.tar.gz 
> file from site snort.org using my oinkcode, i see, archive have some king of p2p.rules files..
>
> How should i need to connect this p2p.rules to my snort?

Take a look in the pua-p2p.rules category.  You should see torrent rules in there.


--
Joel Esler
Senior Research Engineer, VRT
OpenSource Community Manager
Sourcefire

------------------------------------------------------------------------------
Everyone hates slow websites. So do we.
Make your web apps faster with AppDynamics
Download AppDynamics Lite for free today:
http://p.sf.net/sfu/appdyn_sfd2d_oct

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!