RE: Chat/IM

["Rowland, Krisa W ERDC-ITL-MS Contractor" <Krisa.W.Rowland () erdc usace army mil>]

I think it definitely would.  I have since blocked a few chat sites and a
few default ports which seem to have slowed down my chat traffic for now.
But this will probably be until the users take another route.  Thanks for
the help.

Kria

-----Original Message-----
From: Mark.Schutzmann () Omron com [mailto:Mark.Schutzmann () Omron com]
Sent: Wednesday, April 14, 2004 11:20 AM
To: Rowland, Krisa W ERDC-ITL-MS Contractor
Cc: 'snort-users () lists sourceforge net'
Subject: Re: [Snort-users] Chat/IM



Krisa,

As this is a fairly frequently asked question, I am suprised that we still
have not gotten a good answer. I can tell you that I have successfully been
blocking P2P and Chat for a while now using a few combination layers of
security. I am working to develop a document that will hopefully outline
this in more detail. For now, I can tell you that I am using firewall rules
to block Yahoo, MSN and AIM/ICQ servers in combination with a customized
block list for Snort with FlexResp and NTop to monitor any additional chats
that crop up. Please let me know if a solution like this would be worth the
documentation.

Best Regards,
Mark




 

                      "Rowland, Krisa W

                      ERDC-ITL-MS Contractor"             To:
"'snort-users () lists sourceforge net'" <snort-users () lists sourceforge net>

                      <Krisa.W.Rowland@erdc.usace.        cc:

                      army.mil>                           Subject:
[Snort-users] Chat/IM

                      Sent by:

                      snort-users-admin () lists sour

                      ceforge.net

 

 

                      04/13/2004 02:26 PM

 

 





Does anyone have an effective way of blocking chat/IM?


Krisa Rowland
ERDC Information Assurance Team
(SAIC Contractor)
3909 Halls Ferry Rd.,  Bldg. 8000
Vicksburg, MS 39180
601-634-2493
krisa.w.rowland () erdc usace army mil