Quantcast
Channel: Sophos User Bulletin Board
Viewing all articles
Browse latest Browse all 14361

[8.940016] IDS blocking bittorrent tracker and scrapper connections

$
0
0
New with 8.840016. IDS blocking both bittorrent from tracker connections and scrapper requests. Reason for both: "Potential Corporate Privacy Violation." Did not happen before this version.

IDS by default blocks bittorrent from connecting to tracker. Rule invoked is 2180:

Code:


2012:05:01-23:33:40 astaro snort[2341]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="PUA-P2P BitTorrent announce request" group="500" srcip="***.***.xx.xx" dstip="xx.xx.***.***" proto="6" srcport="62588" dstport="80" sid="2180" class="Potential Corporate Privacy Violation" priority="1" generator="1" msgid="0"


IDS by default blocks bittorrent from connecting to scraper. Rule involved is 16281:

Code:


2012:05:01-23:39:42 astaro snort[2341]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="PUA-P2P BitTorrent scrape request" group="500" srcip="***.***.xx.xx" dstip="xx.xx.xx.xx" proto="6" srcport="62806" dstport="80" sid="16281" class="Potential Corporate Privacy Violation" priority="1" generator="1" msgid="0"

Disabling both rules allows bittorent to work correctly.

Viewing all articles
Browse latest Browse all 14361

Trending Articles