up vote 1 down vote favorite
share [g+] share [fb]

I am trying to block Skype using Snort and iptables. I read a lot of papers and blocked the port, keywords and patterns which skype uses. But it is still not blocked.

My question is: if Skype uses HTTP port 80 or https port 443, how does the computer recognize this packet as a Skype packet and not as a Web packet? This might help me in blocking Skype.

link|improve this question
An "intelligent" packet inspection technique must be used -- it must inspect the actual data to decide what to do. As pointed out, there is no way to separate Skype from normal HTTP/HTTPS traffic without looking into it further -- barring the ability to filter based on other endpoint characteristics. (HTTPS inspection is generally problematic without breaking the implied security through a proxy ;-) In any case, likely better on superusers. – pst Nov 19 '11 at 22:13
Are you writing a program to block skype or what? – Shawn Mclean Nov 19 '11 at 22:16
No, I am not writing a program. I am just using Snort and iptables and trying to block skype with some p2p rules. – Vin Nov 19 '11 at 22:46
@pst: Right. So what does the computer look at further when it sees the 80/443 port headers to forward the packet to the Skype application ? – Vin Nov 19 '11 at 22:47
feedback

migrated from stackoverflow.com Nov 19 '11 at 22:40

This question came from our site for professional and enthusiast programmers.

1 Answer

up vote 0 down vote

Here is a link to article presenting a Snort rule to block Skype: http://www.md3v.com/block-skype-with-snort

The signature we are looking here is "17 03 01 00" which is the reply given to a client logging in.
If you are curious make sure to have a look at this page: http://www1.cs.columbia.edu/~salman/skype/

link|improve this answer
Hi Shadok, I have already tried doing all that. But still it is not getting blocked. One more point is, I am not able to see signature 17 03 01 in my dumps for some reason. I have in fact used the same rules you have mentioned above. – Vin Nov 22 '11 at 19:29
Unfortunately I don't have a Snort instance at hands to test them right now but I can assure you that in the up-to-date rules those are present, see sid:5998 and sid:5999 here: snort.org/search – Shadok Nov 23 '11 at 14:35
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.