I was wondering... Nowadays, P2P applications are getting very so
sophisticated. They can use different ports, use external connection
bouncers, tunnel connections in SSL, SSH,... and maybe copying other
techniques like tunnelling with UDP (UDP inside UDP).
We can't have a 100% bullet-proof solution against this kind of
activities inside our networks, but we can sure as hell try! Lately
I've detected an abnormal SSL bandwidth consumption (~4 Mbit/s), which
I bet that it isn't coming from HTTPS,POP3S,IMAPS connections.
How to deal with this? Some points that occurred to me:
1. Take note of remote SSL peers and block them at the perimeter firewall
This won't solve the problem, because there could be a large number of
different P2P servers/bouncers/insecure Proxies, and some P2P apps
already have built-in proxy scanners. Unfeasible solution if done by
hand.
2. With Snort, Snortsam and a firewall (e.g. iptables), one could
detect proxy scans and dynamically block the connections. Could this
be done with bleedingsnort rules? Im sure some of Snort's input
plugins should be able to detect these specific scannings. This could
be a practicable solution.
3 Hunt local p2p users.
3.1 Detect proxy scans, get the local machine IP and mac address, warn
or punish user.
3.2 Detect mac spoofing and mac flooding.
Can Snort detect this kind of activity?
Best Regards,
Pedro Fortuna
-------------------------------------------------------
This SF.Net email is sponsored by:
Sybase ASE Linux Express Edition - download now for FREE
LinuxWorld Reader's Choice Award Winner for best database on Linux.
http://ads.osdn.com/?ad_id=5588&alloc_id=12065&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
