Re: How do i stop yahoo with netscreen.

[chort <chort () amaunetsgothique com>]

On Fri, 2003-08-29 at 00:24, iain wrote:
> Hi all
>
> been asked to block messenger programs on one of my sites, got msn, icq and
> aol beat.
>
> But yahoo tried everything, blocked 3 entire subnets and still no joy, any
> ideas.
> > From web searches this seems to be a hard one to stop, as it using multiple
> subnets and ports.
> Have used Judes recommendations in one of the archives with no success.
> After doing this it slowed down login but that was it.
>
> I am using a netscreen 5xp, blocking addresses and using the netscreen dns
> to resolve the IP addresses.
> I have all ports in denied, and all ports out apart from SMTP, pop3,
> traceroute, ping, ftp, http, https, 3389 blocked.
> The site has constant software changes so cant implement group policy.
> And the site has some very clued up staff as they do basic IT support
> themselves.
> The Dns relay box, ADSL router does not keep dns logs and i don't have a
> netscreen i can play with.
>
> Where am i going wrong???
>
> Thanks
>
> Iain

I'm sure someone has the exact information you're looking for, but you
could proactively discover it by putting a network sniffer on a machine,
then connecting to Yahoo! and see where it sends the initial traffic
(and where the responses come from).  Ethereal is one such free
solution.  There are many other sniffers.

-- 
Brian Keefer


---------------------------------------------------------------------------
Attend Black Hat Briefings & Training Federal, September 29-30 (Training), 
October 1-2 (Briefings) in Tysons Corner, VA; the world's premier 
technical IT security event.  Modeled after the famous Black Hat event in 
Las Vegas! 6 tracks, 12 training sessions, top speakers and sponsors.  
Symantec is the Diamond sponsor.  Early-bird registration ends September 6.Visit us: www.blackhat.com
----------------------------------------------------------------------------