IDS mailing list archives
Re: Bittorrent - utorrent
From: Tremaine Lea <focus-ids () ddiction com>
Date: Thu, 8 Mar 2007 11:15:39 -0700
On 7-Mar-07, at 12:38 PM, Ove Dalgård Hansen wrote:
Hello Everyone, I am in a bit of trouble,On a network where i am configuring IDS - using ASA5510 + SSM module, we try to deny access to Bittorrent downloads - it consumes quite a bit of bandwith and is not allowed by the company's policy. We try to filter bittorrent which succedes - but the utorrent changes protocol and goes by the SSL port 443 and thereby circumvent the IDS, since its not possible to see the encrypted traffic.Does anyone out there have a good idea of how i am to solve the issue? Best Regards Ove Hansen IT-Quality A/S Banemarksvej 50F Denmark - 2605
I'd recommend looking at something like Bluecoat which allows you to examine the SSL traffic. The caveat being you'll want to exclude banking and financial institutions from inspection to avoid capturing/ compromising private user data.
Alternately, block all outbound 443 traffic after examining a months worth of logs to determine which is legit and which is questionable., then explicitly allow 443 to those sites. The better a job you do at identifying which are legit, the fewer follow up tickets you get to create further access.
Create a list of all destination IP's on 443 for $now -30days. At this point you can then use the linux sort utility to both organize the list and eliminate duplicates. From there you should be able to identify which are legitimate destinations.
Cheers, Tremaine Lea Network Security Consultant ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw to learn more. ------------------------------------------------------------------------
Current thread:
- Re: Bittorrent - utorrent, (continued)
- Re: Bittorrent - utorrent jhori (Mar 14)
- Message not available
- Fwd: Bittorrent - utorrent kevin fielder (Mar 14)
- Re: Bittorrent - utorrent Robert Schwartz (Mar 14)
- Re: Bittorrent - utorrent Tremaine Lea (Mar 14)
- Re: WAS: Bittorrent - utorrent NOW: Certificate Talk Randal T. Rioux (Mar 19)
- Re: WAS: Bittorrent - utorrent NOW: Certificate Talk Tremaine Lea (Mar 19)
- RE: WAS: Bittorrent - utorrent NOW: Certificate Talk Erick Jensen (Mar 20)
- Re: Bittorrent - utorrent Roland Turner (Security Focus) (Mar 14)
- Re: Bittorrent - utorrent Tremaine Lea (Mar 12)
- Re: Bittorrent - utorrent Stephen Clowater (Mar 12)
- RE: Bittorrent - utorrent Velasquez Venegas Jaime Omar (Mar 12)
- Re: Bittorrent - utorrent Tremaine Lea (Mar 19)
- Re: Bittorrent - utorrent David J. Bianco (Mar 19)