RE: P2P Services and IDS

[Alvey Robert W KPWA <AlveyRW () kpt nuwc navy mil>]

Check out www.zeropaid.com They've got a huge listing of P2P services and
you can usually find the ports they use on the homepages (listed so people
behind firewalls know what ports to open:).

-----Original Message-----
From: jburzenski () americanhm com [mailto:jburzenski () americanhm com] 
Sent: Tuesday, November 25, 2003 1:47 PM
To: security-basics () securityfocus com
Subject: P2P Services and IDS


Does anyone have an updated list of well known p2p ports?  

I'm also looking for any Snort rules to detect p2p activity.  Snort out of
the box comes with some rules for Gnutella, Kazaa, Napster and BitTorrent
but I want to be able to detect hosts running some of the more obscure p2p
clients as well (bearshare, grokster, etc.).  I have to imagine someone else
has done this already but I can't find the information anywhere.  Hopefully,
someone on this list has some resources.  Otherwise, I'll start reinventing
the wheel on Monday...

Thanks,

Jason

---------------------------------------------------------------------------
----------------------------------------------------------------------------

---------------------------------------------------------------------------
----------------------------------------------------------------------------