Hernandez Huerta Higinio wrote:
Who can help me?
We would like to detect Skype connections by TCP 80 port, does somebody know
a snort rule?
Why only port 80? skype uses almost any port number.
In fact, Skype is about the worst application there is for writing IDS
rules for. It appears to start as follows:
Attempt TCP connection on variety of ports to a variety of Internet IP
addresses - 60-80 in total (?,sorry it's been a few weeks since I looked
- so not sure) which are the Skype "Addressbook" servers
If that doesn't work, it'll also try over port 80 and port 443 - trying
to find a way out
If that doesn't work, it will look at proxy server settings (even
reading HTTP_PROXY under Unix!) and will route via existing proxy servers
Then when a "conversation" starts, it'll try talking P2P to the other
host directly using UDP (random ports), TCP (random ports), TCP-fixed
(port 54045 by default)
If that fails, it'll try routing the call via the Addressbook servers
TCP port 443 (i.e. it looks like HTTPS traffic)
If that fails, it'll route as above via proxy server settings
On top of that, all traffic is encrypted using some proprietary method.
So you can't see it very well via pattern-matching rules.
On top of all that(!!), it doesn't remember what previously worked. We
have egress filtering and proxy servers (so only routing via "HTTPS" via
our proxy works), and yet our firewalls are continually blocking TCP and
UDP packets from internal Skype users (thankfully only me at the moment
:-).
I wish once it found that only proxy-connections worked, that it would
stop trying the other methods (or at least stick to one port). It's
really ruining any Event Correlation techniques I've been doing with our
firewall logs :-(
BTW: I have had some success with catching the voice traffic with the
following rule.
alert tcp $HOME_NET any -> any any (msg:"P2P CHAT Skype VoIP
Initialization";flow:to_server,established;
content:"|8046010301002d0000001000000500000400000a0000090000640000620000080000030000060100800700c0030080060040020080040080|";depth:112;classtype:policy-violation;sid:1000013;
rev:1;)
Jason
-------------------------------------------------------
This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
Use IT products in your business? Tell us what you think of them. Give us
Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more
http://productguide.itmanagersjournal.com/guidepromo.tmpl
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
