Re: Is anyone using 'react' to block the use of Gnutella?

["Frederick Garbrecht" <fgarbrecht () ecogchair org>]

Hi Scott
Perhaps this doesn't apply, but have you checked the actual packet content
to be sure that the triggering traffic is really Gnutella?  I was seeing
alot of these alerts also, but upon looking at the packets it turned out
that one of our users was connecting to some web-based external mail server
which was triggering alerts.
Fred
----- Original Message -----
From: "Vieth, Scott" <svieth () mail mcw edu>
To: <snort-users () lists sourceforge net>
Sent: Monday, September 23, 2002 3:38 PM
Subject: [Snort-users] Is anyone using 'react' to block the use of Gnutella?


> Hi:
>
> Snort is telling me that we have folks using Gnutella to send/receive
files
> from other Gnutella users on the Internet.  I've blocked all the 'easy'
TCP
> ports on the firewall to stop P2P file sharing.  But the P2P protocols are
> still getting through. I think they are getting more "firewall-smart".
>
> Since Snort can 'see' the folks who are running Gnutella, could I use
> 'react' to block/disrupt/close those connections?
>
> Just wondering....
>
> Thanks,
>
> -Scott Vieth
> Medical College of Wisconsin
>
>
>
> -------------------------------------------------------
> This sf.net email is sponsored by:ThinkGeek
> Welcome to geek heaven.
> http://thinkgeek.com/sf
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users




-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users