Snort mailing list archives
Re: Snort Inline DAQ AFpacket with Openappid: BANDWIDTH Question
From: Alberto Colosi via Snort-users <snort-users () lists snort org>
Date: Mon, 25 Dec 2017 11:38:13 +0000
If I'm not wrong , utorrent open its traffic after INIT (like tor) if u cut the INIT, it will not continue. By now I can't help on identify INIT ip and ports but u could see easily. after it I'm unsure all utorrent services works the same as approach I think better to check datagram instead of TCP / UDP ports as if I'm not wrong, it can be changed. see if this pdf on sans help http://bit.ly/2C3IxBX ________________________________ From: Snort-users <snort-users-bounces () lists snort org> on behalf of Tarek Ben Soltane via Snort-users <snort-users () lists snort org> Sent: Monday, December 25, 2017 12:22 PM To: snort-users () lists snort org Subject: [Snort-users] Snort Inline DAQ AFpacket with Openappid: BANDWIDTH Question Dear All, Thank you for reading me. I am running Snort Inline as the title states and I am also running Openappid. I have created a custom rule to stop Utorrent as follow; drop tcp any any -> any any (msg:"POTENTIAL Use of uTorrent";flow:from_client;appid: uTorrent; sid:100006 ; classtype:policy-violation; rev:1;) When I use the browser and try access www.utorrent.com<http://www.utorrent.com>, Snort successfully Blocks the request. μTorrent® (uTorrent) - a (very) tiny BitTorrent client<http://www.utorrent.com/> www.utorrent.com The official µTorrent® (uTorrent) torrent client for Windows, Mac, Android and Linux-- uTorrent is the #1 BitTorrent download client on desktops worldwide. Here is my question: Is it possible to block/drop uTorrent "traffic"? Let's say I already have a torrent file downloading using Utorrent application, Can I prevent that file from using bandwidth? INFO: I am running snort as follow: snort -q -k none -P9000 -u snort -g snort -c /etc/snort/snort.conf -i enp4s0f1:enp11s0f1 -Q -D Thanks all, Tarek
_______________________________________________ Snort-users mailing list Snort-users () lists snort org Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette
Current thread:
- Snort Inline DAQ AFpacket with Openappid: BANDWIDTH Question Tarek Ben Soltane via Snort-users (Dec 25)
- Re: Snort Inline DAQ AFpacket with Openappid: BANDWIDTH Question Alberto Colosi via Snort-users (Dec 25)
- Re: Snort Inline DAQ AFpacket with Openappid: BANDWIDTH Question Tarek Ben Soltane via Snort-users (Dec 25)
- Re: Snort Inline DAQ AFpacket with Openappid: BANDWIDTH Question Alberto Colosi via Snort-users (Dec 25)