[Snort-users] Chat/IM

Mark.Schutzmann at ...10438... Mark.Schutzmann at ...10438...
Wed Apr 14 09:19:06 EDT 2004


Krisa,

As this is a fairly frequently asked question, I am suprised that we still
have not gotten a good answer. I can tell you that I have successfully been
blocking P2P and Chat for a while now using a few combination layers of
security. I am working to develop a document that will hopefully outline
this in more detail. For now, I can tell you that I am using firewall rules
to block Yahoo, MSN and AIM/ICQ servers in combination with a customized
block list for Snort with FlexResp and NTop to monitor any additional chats
that crop up. Please let me know if a solution like this would be worth the
documentation.

Best Regards,
Mark




                                                                                                                                                  
                      "Rowland, Krisa W                                                                                                           
                      ERDC-ITL-MS Contractor"             To:       "'snort-users at lists.sourceforge.net'" <snort-users at lists.sourceforge.net>     
                      <Krisa.W.Rowland at ...11641...        cc:                                                                                     
                      army.mil>                           Subject:  [Snort-users] Chat/IM                                                         
                      Sent by:                                                                                                                    
                      snort-users-admin at ...4626...                                                                                                
                      ceforge.net                                                                                                                 
                                                                                                                                                  
                                                                                                                                                  
                      04/13/2004 02:26 PM                                                                                                         
                                                                                                                                                  
                                                                                                                                                  




Does anyone have an effective way of blocking chat/IM?


Krisa Rowland
ERDC Information Assurance Team
(SAIC Contractor)
3909 Halls Ferry Rd.,  Bldg. 8000
Vicksburg, MS 39180
601-634-2493
krisa.w.rowland at ...3768...












More information about the Snort-users mailing list