[Snort-users] Chat/IM

Matt Kettler mkettler at ...4108...
Tue Apr 13 15:08:11 EDT 2004

At 03:26 PM 4/13/2004, Rowland, Krisa W ERDC-ITL-MS Contractor wrote:
>Does anyone have an effective way of blocking chat/IM?

Unplug the ethernet cable? (Ok, while that _is_ effective I doubt it's what 
you want).

More realistically, you could use snort with snortsam or inline-snort. 
Couple either with the IM rules that come with snort, and a few more that 
pop up on snort-sigs every so often.

It's not flawless, but it does provide a blocking mechanism and does nail a 
lot of cases.

More information about the Snort-users mailing list