[Snort-users] Snort Inline DAQ AFpacket with Openappid: BANDWIDTH Question

Tarek Ben Soltane tbsoltane at gmail.com
Mon Dec 25 06:22:19 EST 2017


Dear All,

Thank you for reading me.

I am running Snort Inline as the title states and I am also running
Openappid. I have created a custom rule to stop Utorrent as follow;

drop tcp any any -> any any (msg:"POTENTIAL Use of
uTorrent";flow:from_client;appid: uTorrent; sid:100006 ;
classtype:policy-violation; rev:1;)

When I use the browser and try access www.utorrent.com, Snort successfully
Blocks the request.

Here is my question:
Is it possible to block/drop uTorrent "traffic"?

Let's say I already have a torrent file downloading using Utorrent
application, Can I prevent that file from using bandwidth?

INFO:
I am running snort as follow:
snort -q -k none -P9000 -u snort -g snort -c /etc/snort/snort.conf -i
enp4s0f1:enp11s0f1 -Q -D

Thanks all,
Tarek
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20171225/ec2dddc0/attachment.html>


More information about the Snort-users mailing list