Craig_W Posted January 19, 2007 Posted January 19, 2007 Does anybody know the best way to block the use of P2P file sharing applications such as Limewire?
Craig_W Posted January 19, 2007 Author Posted January 19, 2007 Is that done by specifying the port? I tried to find out what port Limewire uses, but it has an option which finds an available port.
webman Posted January 19, 2007 Posted January 19, 2007 You could restrict users from running executables?
GrumbleDook Posted January 19, 2007 Posted January 19, 2007 Block all ports except those that you want to use ... this usually means that nothing goes in our out unless it is from or for a specified machine. Are you going through you EMBC connection? By default file sharing ports should be turned off ... if not then have a word with .ICT or Fujitsu services. If you are running your own firewall then you need to configue this to block it ... standard ports for KaZaA are 1214 outbound and 1214-8000 inbound ... for Limewire block TCP 6346 and UDP 6346. This is not a complete fix but will sort the bulk of problems. We also run CounterSpy as our anit-spyware / malware app ... and it is configured to autmatically uninstall most P2P applications.
Craig_W Posted January 19, 2007 Author Posted January 19, 2007 Yes we are with EMBC. I will look into the things that you have suggested, and see how it goes. Thanks
tom_newton Posted January 25, 2007 Posted January 25, 2007 Most p2p stuff is "port agile" - if you block one port it uses, it'll move tpo another. As such, only Grumbledook's idea has a hope of working. Add to that some layer7 filtering, or proxies on ALL open ports... and you'd get very good coverage.
Geoff Posted January 26, 2007 Posted January 26, 2007 Also consider an IDS (eg Snort) to detect anyone attempting to use any P2P apps. It's best placed on your firewall (so your firewall can react and shut them down) but you can put it on your core switch (using port mirroring) if you simply want to monitor the situation.
Nij.UK Posted January 26, 2007 Posted January 26, 2007 Craig We are with EMBC aswell, and as far as i know you are unable to use P2P software, as it just wont connect.... I would have a word with the service desk if the students are able to get P2P software to connect
GrumbleDook Posted January 26, 2007 Posted January 26, 2007 It is likely to be tunneling through port 80 which means either the filtering is not fully on or there are other issues ... do you have single sign on enables? Do you have any other sort of filter / cache other than the EMBC setup?
adent Posted January 27, 2007 Posted January 27, 2007 I hear the new version of Schoolguardian inspects the traffic in such a way to block P2P -regardless of port agility or proxying through http. Just a thought - maybe Tom can confirm?
Sylv3r Posted January 28, 2007 Posted January 28, 2007 They are various products available to buy that throttle the bandwith for p2p / messenging programs. They are not cheap though and will set you back about £1,000. http://ipoque.com/en/p2p_filter.html is something I have had on trial before and I liked the product but I couldn't justify spending money on it as it is not such an issue here. http://www.lynanda.com/products/software-for-corporations/traffic-filtering/lynanda-skype-filter Appears to be an open source peice of software that detects p2p traffic but not sure how could or successful it is.
Sylv3r Posted January 28, 2007 Posted January 28, 2007 http://ipp2p.org/ Is another opensource product.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now