Tracking Skype usage in Websense

[SteveHolley]

Hi there

 

We have recently allowed Skype on our curric network, and will be using Websense to track and report usage. Does anyone know the URL that Skype uses for the actual comms side of things, rather than just messaging or adverts? I think it might be ui.skype.com?

 

Thanks

SteveH

[CensorNet]

Skype usage is really hard to track. As it is a peer to peer application it uses many different IP's over SSL tunnels to connect to other Skype users and lots of random port numbers. If Websense can do L7 filtering you can probably manage it but I don't think you could rely on a particular domain name to identify Skype.

 

This is a detailed explanation of Skype protocol (not for the faint hearted!)

 

http://www.blackhat.com/presentations/bh-europe-06/bh-eu-06-biondi/bh-eu-06-biondi-up.pdf

[tom_newton]

Our anonymous pal from censornet has got it fairly spot on there. We're working on ways to track skype, but you can't do it by URL, and even when you can its "is using skype/is not using skype" kind of granularity

[CensorNet]

Sorry, didn't mean to be anonymous It's Tim here - MD of CensorNet.

 

I'll try and set a sig in the settings

[SteveHolley]

Thanks for the very useful info on Skype - I am hoping that we can do something similar to our tracking of Conficker with Websense. You can't actually see the activity par say, but you can see a signature pattern that is detectable. I will let you know how I get on !

 

SteveH

[Arthur]

The IT Administrators Guide for Skype has some details on how it works along with settings which can be used to force it through a HTTPS or SOCKS5 proxy.

 

http://download.skype.com/share/business/guides/skype-it-administrators-guide.pdf

[garethEds]

Sorry, didn't mean to be anonymous It's Tim here - MD of CensorNet.

 

I'll try and set a sig in the settings

 

Hi Tim,

 

Welcome to the party.

 

Gareth

[garethEds]

Our LEA refuse the use of Skype for the exact reasons - you cannot track it due to it using higher end ports above 1024, The LEA doesn't allow these ports - not even for staff.

 

It was brought up today in a meeting at Swansea LEA.

 

It also opens up the issue of child protection (which is outside this topic).

 

Gareth