Re: Filtering out P2P traffic



Damjan,

You may be interesed in Snort (http://www.snort.org/) and Snortsam
(http://www.snortsam.net/). Snort has existing rules to detect use of many
types of P2P traffic, and Snortsam is a patch/plugin to Snort to allow dynamic
updating of various flavours of firewalls, including IPFilter. As far as I'm
aware, both work on current versions of Solaris. I've used this on Linux, and
it's fantastic.

Damjan Perenic wrote:
Hello!

In an educational institution I use Solaris 10 on the gateway between
internet and internal network. I would like to filter out P2P traffic.
But since the P2P clients can use any port which is open for traffic, I
would need to do content-based filtering.

Is possible to block P2P traffic with the IPFilter included in Solaris
10? I see in the IPFilter FAQ
(http://www.phildev.net/ipf/IPFques.html#ques36), that you can do
"simple matching of content for TCP session startup" on the first 16
bytes. But that means I need to find out what to match for all P2P
protocols. Also, I could not find on docs.sun.com if this kind of rules
are supported in IPFilter integrated in Solaris 10.

I do not want to block anything else except P2P. There are many
protocols which I would like to go though like SSH, VNC, RDC etc.

What options are there to build such filter on Solaris? Is there any
other free/cheap option to do it? If not, is it possible to slow down
P2P traffic via IPQoS?


Regards,
Damjan






Relevant Pages

  • ipfilter ipf.conf on solaris 10 problems
    ... I am having problems moving from SunScreen 3.2 from Solaris 9 to ipfilter as ... pass in quick on dmfe0 proto icmp from any to 1.1.1.40/32 icmp-type 11 ...
    (SunManagers)
  • Re: Solaris 10 - ARG!
    ... solaris 10's SVC. ... shows no ipfilter, yet another command to start the pfil server... ... restart pfil, no errors. ...
    (comp.unix.solaris)
  • Re: Wrt54G is a FW appliance?
    ... >> You've been told more than once already that Sun ship and support IPFilter ... >> You could try claiming that Sun and Solaris are somehow 'unproven'...... ... Sun ships IPFilter *on* Solaris as *standard*. ...
    (comp.security.firewalls)
  • Solaris 10 - ARG!
    ... I've admin'ed solaris for a little while - I'm trying hard not flame ... along with ipnat (ipfilter). ... not working for a while a co-worker says to use routeadm. ... svcadm restart pfil, no errors. ...
    (comp.unix.solaris)
  • Re: Sniffering tool.
    ... Snoop comes with solaris. ... You'll need libpcap for either. ... You need to d/l a precompiled ...
    (Focus-SUN)