network configurable. Its not always a simple matter of blocking
a particular port. If your handy with network programming (with
perl or java or any network-useful language) you might want to
consider blocking unwanted protocols by setting up a daemon or
similar utility to sniff for protocol fingerprints and reject
them at the application layer. All protocols announce what they
are in the first few packets (at least I'm pretty sure they all
do...)
Of course this method will become useless when p2p developers
start using ssl and other secure transport methods, which they
are bound to do soon.
Amir S Mesry writes:
Little bit more info would help people on the list, maybe post your
pf.conf with ip's xxx.xxx out and a simple diagram of your network
setup. Look like your not blocking on the internal interface from what
your describing possibly.
Amir Mesry
[EMAIL PROTECTED]
Cadillac Jack, Inc.
http://www.cadillacjack.com/
Network & Systems Administrator
2420 Meadowbrook Parkway
Duluth, GA 30096
770-865-0034 -----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf
Of Bryan Irvine
Sent: Tuesday, September 14, 2004 3:34 PM
To: [EMAIL PROTECTED]
Subject: blocking gnutella
I can't seem to get gnutella to break.
gnutella = "{" 6346 6348 8436 "}"
block out quick proto { udp tcp } from any to any port $gnutella
block in quick proto { udp tcp } from any to any port $gnutella
pftop still shows connection on 6346 though, ideas?
--Bryan
