Re: Snort Inline DAQ AFpacket with Openappid: BANDWIDTH Question

[Tarek Ben Soltane via Snort-users <snort-users () lists snort org>]

Thank you  Alberto,

I will check your link.

Tarek

On Mon, Dec 25, 2017 at 12:38 PM, Alberto Colosi via Snort-users <
snort-users () lists snort org> wrote:

> If I'm not wrong , utorrent open its traffic after         INIT
> (like tor)
>
>
> if u cut the INIT, it will not continue. By now I can't help on identify
>   INIT   ip and ports but u could see easily.
>
>
> after it I'm unsure all utorrent services works the same
>
>
> as approach I think better to check datagram instead of TCP / UDP ports as
> if I'm not wrong, it can be changed.
>
>
> see if this pdf on sans help            http://bit.ly/2C3IxBX
>
>
>
>
>
> ------------------------------
> *From:* Snort-users <snort-users-bounces () lists snort org> on behalf of
> Tarek Ben Soltane via Snort-users <snort-users () lists snort org>
> *Sent:* Monday, December 25, 2017 12:22 PM
> *To:* snort-users () lists snort org
> *Subject:* [Snort-users] Snort Inline DAQ AFpacket with Openappid:
> BANDWIDTH Question
>
> Dear All,
>
> Thank you for reading me.
>
> I am running Snort Inline as the title states and I am also running
> Openappid. I have created a custom rule to stop Utorrent as follow;
>
> drop tcp any any -> any any (msg:"POTENTIAL Use of
> uTorrent";flow:from_client;appid: uTorrent; sid:100006 ;
> classtype:policy-violation; rev:1;)
>
> When I use the browser and try access www.utorrent.com, Snort
> successfully Blocks the request.
> μTorrent® (uTorrent) - a (very) tiny BitTorrent client
> <http://www.utorrent.com/>
> www.utorrent.com
> The official µTorrent® (uTorrent) torrent client for Windows, Mac, Android
> and Linux-- uTorrent is the #1 BitTorrent download client on desktops
> worldwide.
>
>
> Here is my question:
> Is it possible to block/drop uTorrent "traffic"?
>
> Let's say I already have a torrent file downloading using Utorrent
> application, Can I prevent that file from using bandwidth?
>
> INFO:
> I am running snort as follow:
> snort -q -k none -P9000 -u snort -g snort -c /etc/snort/snort.conf -i
> enp4s0f1:enp11s0f1 -Q -D
>
> Thanks all,
> Tarek
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists snort org
> Go to this URL to change user options or unsubscribe:
> https://lists.snort.org/mailman/listinfo/snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest
> Snort news!
>
> Please follow these rules: https://snort.org/faq/what-is-
> the-mailing-list-etiquette
_______________________________________________
Snort-users mailing list
Snort-users () lists snort org
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette