[Snort-users] Snort Inline DAQ AFpacket with Openappid: BANDWIDTH Question

Alberto Colosi alcol at hotmail.com
Mon Dec 25 06:38:13 EST 2017

If I'm not wrong , utorrent open its traffic after         INIT        (like tor)

if u cut the INIT, it will not continue. By now I can't help on identify     INIT   ip and ports but u could see easily.

after it I'm unsure all utorrent services works the same

as approach I think better to check datagram instead of TCP / UDP ports as if I'm not wrong, it can be changed.

see if this pdf on sans help            http://bit.ly/2C3IxBX

From: Snort-users <snort-users-bounces at lists.snort.org> on behalf of Tarek Ben Soltane via Snort-users <snort-users at lists.snort.org>
Sent: Monday, December 25, 2017 12:22 PM
To: snort-users at lists.snort.org
Subject: [Snort-users] Snort Inline DAQ AFpacket with Openappid: BANDWIDTH Question

Dear All,

Thank you for reading me.

I am running Snort Inline as the title states and I am also running Openappid. I have created a custom rule to stop Utorrent as follow;

drop tcp any any -> any any (msg:"POTENTIAL Use of uTorrent";flow:from_client;appid: uTorrent; sid:100006 ; classtype:policy-violation; rev:1;)

When I use the browser and try access www.utorrent.com<http://www.utorrent.com>, Snort successfully Blocks the request.
μTorrent® (uTorrent) - a (very) tiny BitTorrent client<http://www.utorrent.com/>
The official µTorrent® (uTorrent) torrent client for Windows, Mac, Android and Linux-- uTorrent is the #1 BitTorrent download client on desktops worldwide.

Here is my question:
Is it possible to block/drop uTorrent "traffic"?

Let's say I already have a torrent file downloading using Utorrent application, Can I prevent that file from using bandwidth?

I am running snort as follow:
snort -q -k none -P9000 -u snort -g snort -c /etc/snort/snort.conf -i enp4s0f1:enp11s0f1 -Q -D

Thanks all,
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20171225/693e0db5/attachment.html>

More information about the Snort-users mailing list