encapsulated protocols?

["Mark Horn [ Net Ops ]" <mhorn () funb com>]

Hello,

Lately, I've noticed an increasing number of network protocols that are
encapsulating themselves over existing protocols.  And then using some of
our proxies to navigate anywhere on the Internet.

Most recently I discovered VXTreme, a video streaming protocol.  The
client is a browser plugin.  It is able to communicate through the
firewall by contacting the configured HTTP proxy, and opening up a URL
which points to a remote VXTreme server.

This kinda scares me.  One of the premises of running a firewall is that
you explicitly deny any protocol that is unknown.  Well, if new protocols
are encapsulating themselves into known protocols, how can you keep a
handle on what protocols are running through the firewall?

The end result is that any protocol can traverse the firewall.  You simply
need to get the "plugin" to the inside, and then you're home free.  Does
anyone have any clever ideas as to how to prevent this encapsulation
trick?

-- 
Mark Horn <mhorn () funb com>

PGP Public Key available at: http://www.es.net/hypertext/pgp.html
PGP KeyID/fingerprt: 00CBA571/32 4E 4E 48 EA C6 74 2E 25 8A 76 E6 04 A1 7F C1