Setup an inline sniffer, or examine router logs. Correspond IP Address > MAC
Address > Username > Real Name and then fire them.
I know this is a technical list and would defer the question to anyone who
wants to raise some wicked f00 to state a solution.
This is more a management/personnel issue. If you have folks that are blantanly
downloading torrents at work, I'm sure they have chat clients running tunelling
and out your SOCKS server. You can spend money and effort to control them or
root them out and remove them. You have enough folks in the world that would
like to abuse your network. Your employees shouldnt be one of them.
Jay
----- Original Message -----
From: Ove Dalg?rd Hansen [mailto:odh@itq.dk]
To: focus-ids@securityfocus.com
Sent: Wed, 07 Mar 2007 20:38:29 +0100
Subject: Bittorrent - utorrent
Hello Everyone,
I am in a bit of trouble,
On a network where i am configuring IDS - using ASA5510 + SSM module, we try to
deny access to Bittorrent downloads - it consumes quite a bit of bandwith and
is not allowed by the company's policy.
We try to filter bittorrent which succedes - but the utorrent changes protocol
and goes by the SSL port 443 and thereby circumvent the IDS, since its not
possible to see the encrypted traffic.
Does anyone out there have a good idea of how i am to solve the issue?
Best Regards
Ove Hansen
IT-Quality A/S
Banemarksvej 50F
Denmark - 2605
------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to
http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw
to learn more.
------------------------------------------------------------------------
------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to
http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw
to learn more.
------------------------------------------------------------------------
