Setup an inline sniffer, or examine router logs. Correspond IP Address > MAC Address > Username > Real Name and then fire them.
I know this is a technical list and would defer the question to anyone who wants to raise some wicked f00 to state a solution. This is more a management/personnel issue. If you have folks that are blantanly downloading torrents at work, I'm sure they have chat clients running tunelling and out your SOCKS server. You can spend money and effort to control them or root them out and remove them. You have enough folks in the world that would like to abuse your network. Your employees shouldnt be one of them. Jay ----- Original Message ----- From: Ove Dalg?rd Hansen [mailto:[EMAIL PROTECTED] To: [email protected] Sent: Wed, 07 Mar 2007 20:38:29 +0100 Subject: Bittorrent - utorrent Hello Everyone, I am in a bit of trouble, On a network where i am configuring IDS - using ASA5510 + SSM module, we try to deny access to Bittorrent downloads - it consumes quite a bit of bandwith and is not allowed by the company's policy. We try to filter bittorrent which succedes - but the utorrent changes protocol and goes by the SSL port 443 and thereby circumvent the IDS, since its not possible to see the encrypted traffic. Does anyone out there have a good idea of how i am to solve the issue? Best Regards Ove Hansen IT-Quality A/S Banemarksvej 50F Denmark - 2605 ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw to learn more. ------------------------------------------------------------------------
------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw to learn more. ------------------------------------------------------------------------
