Messenger Systems

[bazcurtis]

Hi,

Could someone please tell me the best way to block messenger systems at the firewall. Do they use port 80? We would like to block all systems not just ms messenger.

Any help most welcome.

Best wishes

Michael

 

[carrr]

You'll find this white paper useful for identifying the ports asociated with different IM systems:

http://documents.iss.net/whitepapers/X-Force_P2P.pdf

 

[carrr]

Also, check out some of these:

http://www.anidirect.com/downloads/wp/BlueCoat/BCS_imsecurity_wwwdl.pdf

http://www.isp-planet.com/business/im_block_bol.html

http://www.connect.more.net/lists/technic/2003.09/0527.html

 

[keno44]

i have gone down this path before and here is what i did. i could constantly review all the new ports, protocols, tricks that messenger systems use. this would take a lot of time with administration. we decided to use Akonix Enforcer. this box is cabled to a span port on a switch right inside our FW. it detects P2P protocols and IM traffic. it also updates itself with the latest protocol/port changes (so i have been told). when it detects such traffic, it sends a TCP reset packet back to the source host killing the session and logs the activity. a popup msg also appears at the client. very, very slick. with their L7 product, you can create policies allowing certain users IM capabilities or force clients to use a certain IM app. we do not allow IM for compliance reasons, and until our attorney says its okay, Akonix is the way to go.

 

[Spirit]

Can I throw a spanner in the works here?

http://www.http-tunnel.com/html/

This nice wee tool will send ANYTHING through port 80 so I'd always say block every port you don't specifically need and run software audits on a regular basis.

Grrrrrr.......

Iain

 

[segment]

In throwing in a spanner... I'd like to add, depending on the users in your network, many services can be configured to use proxies even if you're only allowing say http (port 80). If someone is skilled they can even parse data through the same port while an httpd is running. I've seen it done a while back with a program called datapipe.c ... I think this would be above and beyond what the original poster wanted to know, but something others might like to know.

sil

http://www.politrix.org

 

[Chr1sUK]

I was going to say what Segment said.

Alot of UK universities try to block certain software, such as Kazaa etc, and block IM file sending...using a proxy you can get around this.

Your average Joe Bloggs office worker won't know this though, so no need to worry too much