[Snort-users] Hunting down P2P users
pedro.fortuna at ...11827...
Tue Oct 26 14:26:03 EDT 2004
I was wondering... Nowadays, P2P applications are getting very so
sophisticated. They can use different ports, use external connection
bouncers, tunnel connections in SSL, SSH,... and maybe copying other
techniques like tunnelling with UDP (UDP inside UDP).
We can't have a 100% bullet-proof solution against this kind of
activities inside our networks, but we can sure as hell try! Lately
I've detected an abnormal SSL bandwidth consumption (~4 Mbit/s), which
I bet that it isn't coming from HTTPS,POP3S,IMAPS connections.
How to deal with this? Some points that occurred to me:
1. Take note of remote SSL peers and block them at the perimeter firewall
This won't solve the problem, because there could be a large number of
different P2P servers/bouncers/insecure Proxies, and some P2P apps
already have built-in proxy scanners. Unfeasible solution if done by
2. With Snort, Snortsam and a firewall (e.g. iptables), one could
detect proxy scans and dynamically block the connections. Could this
be done with bleedingsnort rules? Im sure some of Snort's input
plugins should be able to detect these specific scannings. This could
be a practicable solution.
3 Hunt local p2p users.
3.1 Detect proxy scans, get the local machine IP and mac address, warn
or punish user.
3.2 Detect mac spoofing and mac flooding.
Can Snort detect this kind of activity?
More information about the Snort-users