Breach Security has a product called BreachView SSL that passively decrypts SSL traffic for an IDS without terminating the SSL session. The product comes as either a software plug-in or an appliance.
http://www.breach.com/products_breachviewssl.asp ko -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Panayiotis Psihoyios Sent: Thursday, March 08, 2007 10:01 AM To: 'Ove Dalgård Hansen'; [email protected] Subject: RE: Bittorrent - utorrent Since it is going through SSL (and no IDS can look into SSL), you have two options: Plan A: Deny SSL traffic, but that usually this is not possible, Plan B: Let your users out through a proxy server, which will identify non-browser traffic using http/s header inspection. Configure your firewall to permit HTTP/S out only from your proxy and not your clients. Regards, Panayiotis -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Ove Dalgard Hansen Sent: Wednesday, March 07, 2007 9:38 PM To: [email protected] Subject: Bittorrent - utorrent Hello Everyone, I am in a bit of trouble, On a network where i am configuring IDS - using ASA5510 + SSM module, we try to deny access to Bittorrent downloads - it consumes quite a bit of bandwith and is not allowed by the company's policy. We try to filter bittorrent which succedes - but the utorrent changes protocol and goes by the SSL port 443 and thereby circumvent the IDS, since its not possible to see the encrypted traffic. Does anyone out there have a good idea of how i am to solve the issue? Best Regards Ove Hansen IT-Quality A/S Banemarksvej 50F Denmark - 2605 ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=in tro_sfw to learn more. ------------------------------------------------------------------------ ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw to learn more. ------------------------------------------------------------------------ ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw to learn more. ------------------------------------------------------------------------
