Re: blocking p2p traffic

[Ravi <ravivsn () roc co in>]

Hi Yashodhan,
   - Snort have rules to identify p2p connections and uses flexresp to 
block the connections.
   - You are right that p2p applications changes port numbers in order 
to hide their identity, so use nessus to detect such p2p applications  
frequently and get the details. For this I suppose your IDS/IPS should 
have target intelligence. or develop target intelligence over nessus and 
snort.
Hope this helps,
-Ravi
ROCSYS Technologies Ltd
http://www.rocsys.com
Hyderabad
INDIA

Deshpande, Yashodhan wrote:

> Hi,
>
>    Any information regarding IDS/IPS software available which blocks p2p traffic? Or in general any information 
> regarding how to identify p2p application is running and may be configure firewall to block such traffic. In general it 
> is observed that such applications do not work on = single port and do port hopping. How to block them?
>
> Any inputs on the same would be appreciated.
>
>
> Thanks,
>
> Yashodhan
>
> ---------------------------------------------------------------------------
> Free 30-day trial: firewall with virus/spam protection, URL filtering, VPN,
> wireless security
>
> Protect your network against hackers, viruses, spam and other risks with Astaro
> Security Linux, the comprehensive security solution that combines six
> applications in one software solution for ease of use and lower total cost of
> ownership.
>
> Download your free trial at 
> http://www.securityfocus.com/sponsor/Astaro_focus-ids_040301
> ---------------------------------------------------------------------------
>
>
>  




---------------------------------------------------------------------------
Free 30-day trial: firewall with virus/spam protection, URL filtering, VPN,
wireless security

Protect your network against hackers, viruses, spam and other risks with Astaro
Security Linux, the comprehensive security solution that combines six
applications in one software solution for ease of use and lower total cost of
ownership.

Download your free trial at 
http://www.securityfocus.com/sponsor/Astaro_focus-ids_040301
---------------------------------------------------------------------------