Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am trying to block Skype using snort and iptables. I read a lot of papers and blocked the port, keywords and patterns which Skype uses. But it is still not blocked.

My question is: if Skype uses HTTP port 80 or https port 443, how does the computer recognize this packet as a Skype packet and not as a Web packet? This might help me in blocking Skype.

share|improve this question

migrated from stackoverflow.com Nov 19 '11 at 22:40

This question came from our site for professional and enthusiast programmers.

    
An "intelligent" packet inspection technique must be used -- it must inspect the actual data to decide what to do. As pointed out, there is no way to separate Skype from normal HTTP/HTTPS traffic without looking into it further -- barring the ability to filter based on other endpoint characteristics. (HTTPS inspection is generally problematic without breaking the implied security through a proxy ;-) In any case, likely better on superusers. –  pst Nov 19 '11 at 22:13
    
Are you writing a program to block skype or what? –  Shawn Mclean Nov 19 '11 at 22:16
    
No, I am not writing a program. I am just using Snort and iptables and trying to block skype with some p2p rules. –  Vin Nov 19 '11 at 22:46
    
@pst: Right. So what does the computer look at further when it sees the 80/443 port headers to forward the packet to the Skype application ? –  Vin Nov 19 '11 at 22:47

2 Answers 2

Here is a link to article presenting a Snort rule to block Skype: http://www.md3v.com/block-skype-with-snort

The signature we are looking here is "17 03 01 00" which is the reply given to a client logging in.
If you are curious make sure to have a look at this page: http://www1.cs.columbia.edu/~salman/skype/

share|improve this answer
    
Hi Shadok, I have already tried doing all that. But still it is not getting blocked. One more point is, I am not able to see signature 17 03 01 in my dumps for some reason. I have in fact used the same rules you have mentioned above. –  Vin Nov 22 '11 at 19:29
    
Unfortunately I don't have a Snort instance at hands to test them right now but I can assure you that in the up-to-date rules those are present, see sid:5998 and sid:5999 here: snort.org/search –  Shadok Nov 23 '11 at 14:35

Regarding "how does the computer recognize this packet as a Skype packet and not as a Web packet?": The packet goes to whatever program is listening on the port. If Skype decides to use TCP/80 and accidentally starts to talk to a web server, the web server will be confused, throw an error (or refuse to reply) and Skype will give up. If a web client decides to connect to Skype, Skype will see the request and recognize it is not Skype.

That means that you cannot block Skype using the IP/Port info alone. Blocking based on the content with static rules assumes there is always a fixed signature. Since Skype is proprietary, the protocol may change at any time, making old rules useless. Skype is notoriously good at evading filters. I would not be surprised if they do somehting like adding a random key at the beginning and encrypting the rest of the traffic with Skype's proprietary version of RC4, either now or in the future. This would make it impossible to distinguish the traffic from random noise.

With port 443 traffic, they could also simply run a real SSL connection. This would make it very hard to distinguish (if done right) if you don't want to do traffic analysis (as in "amount and timing of traffic"). I don't know if they are doing it, but again, the proprietary protocol can change.

The most reliable way to keep users from using Skype may be scanning for the executables on the machines and/or LARTing users who violate policy by using it.

Also check for traffic on other ports. 80 and (more likely "or") 443 are probably just the minimum that Skype needs. It may be happy with some ports you missed, even if 80/443 are completely blocked. Check for UDP traffic!

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.