Agreed. better use Snort to detect the P2P signature (and send TCP reset if you want) because ports blocking (either moving or not) can be bypassed by using a local personal proxy (in the user's own workstation) + a HTTPTunnel free client. By doing this, it seems impossible to block any kind of applications by port-blocking method, cause most companies mostly to allow HTTP (eventhough via proxy)
cheers, albert "Jason Bethune" <[EMAIL PROTECTED]> Sent by: [EMAIL PROTECTED] 09/16/2003 01:06 AM To: <[EMAIL PROTECTED]> cc: Subject: RE: [Full-Disclosure] Blocking Music Sharing. Snort is one tool used by alot of IT guys to block file sharing programs. THe trouble with these programs is that they have built in port "movers" that will scan the local network to find an available port to work on. Scripting is one way to do it....but that mostly just alerts you to the fact that there is traffice being used on your network for file sharing. I would like to know an exact way to block file sharing as well... Jason Bethune <?xml:namespace prefix = o ns = "urn:schemas-microsoft-com:office:office" /> IT Specialist Town of <?xml:namespace prefix = st1 ns = "urn:schemas-microsoft-com:office:smarttags" />Kentville 354 Main Street Kentville, NS B4N 1K6 www.town.kentville.ns.ca From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Johnson, Mark Sent: Monday, September 15, 2003 1:37 PM To: [EMAIL PROTECTED] Subject: [Full-Disclosure] Blocking Music Sharing. Due to the legal issues, I am trying to block access to sites like Kazaa and Limewire in the office. If I am not mistaken, these networks can use different ports each time, so there is no way to block it at the firewall. Is this right? And if so, what is the best way to block access to these types of sites? Many thanks, Mark J. ---------------------------------------------------------- The information contained in this communication is intended solely for the use of the individual or entity to whom it is addressed and others authorized to receive it. It may contain confidential or legally privileged information. If you are not the intended recipient you are hereby notified that any disclosure, copying, distribution or taking any action in reliance on the contents of this information is strictly prohibited and may be unlawful. If you have received this communication in error, please notify us immediately by responding to this email and then delete it from your system. Ernst & Young is neither liable for the proper and complete transmission of the information contained in this communication nor for any delay in its receipt. Note: If you have received a delivery failure report, it may be due to the change in the Ernst & Young e-mail domain from "eyi.com" to "ey.com". Could you please make the necessary amendment, if required, and resend the message. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html