Ethical Hacking Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package. | Computer Forensics Training at InfoSec Institute Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors. |

| Subject: | Re: can Hopster traffic be blocked? |
|---|---|
| Date: | Thu, 12 Aug 2004 10:38:30 +0200 |
Any suggestions on how I can block hopster (and other similar socks based tunneling applications) from tunnelling out.I bet all my weekend beers that the only way out is content filtering done at the proxy level. Maybe squidguard/dansguardian could help. Or snort. Otherwise .. IBM websense.
My first try would be iptables with strings module loaded. Check all allowed http ports for CONNECT strings. The second try (for more detailed analysis) would be squid in transparent mode. With squid you can add traffic analysis software and look for long-running connections with "bad" upload/download rates. The typical proxy connection will have a different access pattern (longer connections, different connection times, higher upload rates) than normal HTTP traffic. Using CONNECT can be detected as well. You will get a more comprehensive Image of what your users are doing, with forensic info, if you like. Greetings, Stefan Osterlitz
| <Prev in Thread] | Current Thread | [Next in Thread> |
|---|---|---|
| ||
| Previous by Date: | LIDS 1.2.2rc2 for Linux kernel 2.4.27 released, Yusuf Wilajati Purna |
|---|---|
| Next by Date: | Re: Attempts to push spam through apache, Andy Smith |
| Previous by Thread: | Re: can Hopster traffic be blocked?, Michael Ekstrand |
| Next by Thread: | LIDS 1.2.2rc2 for Linux kernel 2.4.27 released, Yusuf Wilajati Purna |
| Indexes: | [Date] [Thread] [Top] [All Lists] |