Re: Filtering out P2P traffic



Damjan,

You may be interesed in Snort (http://www.snort.org/) and Snortsam
(http://www.snortsam.net/). Snort has existing rules to detect use of many
types of P2P traffic, and Snortsam is a patch/plugin to Snort to allow dynamic
updating of various flavours of firewalls, including IPFilter. As far as I'm
aware, both work on current versions of Solaris. I've used this on Linux, and
it's fantastic.

Damjan Perenic wrote:
Hello!

In an educational institution I use Solaris 10 on the gateway between
internet and internal network. I would like to filter out P2P traffic.
But since the P2P clients can use any port which is open for traffic, I
would need to do content-based filtering.

Is possible to block P2P traffic with the IPFilter included in Solaris
10? I see in the IPFilter FAQ
(http://www.phildev.net/ipf/IPFques.html#ques36), that you can do
"simple matching of content for TCP session startup" on the first 16
bytes. But that means I need to find out what to match for all P2P
protocols. Also, I could not find on docs.sun.com if this kind of rules
are supported in IPFilter integrated in Solaris 10.

I do not want to block anything else except P2P. There are many
protocols which I would like to go though like SSH, VNC, RDC etc.

What options are there to build such filter on Solaris? Is there any
other free/cheap option to do it? If not, is it possible to slow down
P2P traffic via IPQoS?


Regards,
Damjan