Re: Stopping outbound Kazaa

[Brian <bmc () snort org>]

On Thu, Feb 06, 2003 at 12:40:35PM -0500, Travis S. wrote:
> On a large 1 gbps full-duplex internet pipe, I want to prevent outside users from downloading files on Kazaa, 
> gnutella, etc from our network.  On the other hand, I don't want to stop our users from downloading these files from 
> the outside.
>
> Basically the idea is to manage the uncontrolled outbound stream so we have spare - right now it's pegged 100% usage.
>
> Has anybody figured out clever ways to accomplish this using snort or any other package?  Obviously I would prefer a 
> free solution, so it would be great if Snort could do this.

Well, you could use 1.9 and shoot down the connections with
flex response.  I havn't played with it recently, but it should work
fine.  

As far as rules for the p2p traffic, if you generate me some pcap, then
I can generate you rules.

-brian


-------------------------------------------------------
This SF.NET email is sponsored by:
SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See!
http://www.vasoftware.com
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users