topic Re: Custom user agent to block Skype in Web Security https://community.cisco.com/t5/web-security/custom-user-agent-to-block-skype/m-p/998521#M306 <HTML><HEAD></HEAD><BODY><P>Hello, <BR /><BR />Thanks for your reply. Can you let me know exactly where can I place this string? I've tried placing it under custom user agents to be blocked, but no luck. Thanks again! <BR /><BR /><PRE __jive_macro_name="quote" class="jive_text_macro jive_macro_quote">Armando,<BR /><BR />Also, I have heard that this is the regex to match Skype: <BR /><BR />[^(\n|\r)]+Skype/i</PRE></P></BODY></HTML> Tue, 11 Mar 2008 06:27:27 GMT armando.costilla_ironport 2008-03-11T06:27:27Z Custom user agent to block Skype https://community.cisco.com/t5/web-security/custom-user-agent-to-block-skype/m-p/998517#M302 <P>Hello Ironportians, <BR /><BR />I was wondering if any of you has info about the Custom User Agent that can be used to block Skype. Furthermore, I'd like to know if someone has tried blocking this application accross the WSA and if there's any piece of advice you can share. <BR /><BR />Thanks in advance!</P> Thu, 06 Mar 2008 03:37:48 GMT https://community.cisco.com/t5/web-security/custom-user-agent-to-block-skype/m-p/998517#M302 armando.costilla_ironport 2008-03-06T03:37:48Z Re: Custom user agent to block Skype https://community.cisco.com/t5/web-security/custom-user-agent-to-block-skype/m-p/998518#M303 <HTML><HEAD></HEAD><BODY><P>Armando,<BR /><BR />We are working on ways to better block Skype. Here is some information I can share about Skype.<BR /><BR />The problem with skype is that among opening random TCP/UDP ports it also listens to activity on ports 80 and 443. Therefore blocking skype is not possible unless we resort to "deep-packet" inspection, which is something that we don't currently do.<BR /><BR />There is an excellent presentation here on reverse-engineering Skype, which might help you with some more information with how this application works. <BR /><BR />http://www.secdev.org/conf/skype_BHEU06.handout.pdf</P></BODY></HTML> Sat, 08 Mar 2008 01:17:45 GMT https://community.cisco.com/t5/web-security/custom-user-agent-to-block-skype/m-p/998518#M303 jowolfer 2008-03-08T01:17:45Z Re: Custom user agent to block Skype https://community.cisco.com/t5/web-security/custom-user-agent-to-block-skype/m-p/998519#M304 <HTML><HEAD></HEAD><BODY><P>Armando,<BR /><BR />Also, I have heard that this is the regex to match Skype: <BR /><BR />[^(\n|\r)]+Skype/i</P></BODY></HTML> Sat, 08 Mar 2008 01:19:10 GMT https://community.cisco.com/t5/web-security/custom-user-agent-to-block-skype/m-p/998519#M304 jowolfer 2008-03-08T01:19:10Z Many thanks https://community.cisco.com/t5/web-security/custom-user-agent-to-block-skype/m-p/998520#M305 <HTML><HEAD></HEAD><BODY><P>Thanks indeed</P></BODY></HTML> Sat, 08 Mar 2008 03:51:50 GMT https://community.cisco.com/t5/web-security/custom-user-agent-to-block-skype/m-p/998520#M305 armando.costilla_ironport 2008-03-08T03:51:50Z Re: Custom user agent to block Skype https://community.cisco.com/t5/web-security/custom-user-agent-to-block-skype/m-p/998521#M306 <HTML><HEAD></HEAD><BODY><P>Hello, <BR /><BR />Thanks for your reply. Can you let me know exactly where can I place this string? I've tried placing it under custom user agents to be blocked, but no luck. Thanks again! <BR /><BR /><PRE __jive_macro_name="quote" class="jive_text_macro jive_macro_quote">Armando,<BR /><BR />Also, I have heard that this is the regex to match Skype: <BR /><BR />[^(\n|\r)]+Skype/i</PRE></P></BODY></HTML> Tue, 11 Mar 2008 06:27:27 GMT https://community.cisco.com/t5/web-security/custom-user-agent-to-block-skype/m-p/998521#M306 armando.costilla_ironport 2008-03-11T06:27:27Z Re: Custom user agent to block Skype https://community.cisco.com/t5/web-security/custom-user-agent-to-block-skype/m-p/998522#M307 <HTML><HEAD></HEAD><BODY><P>I recommend getting a packet capture to see exactly what User-agent Skype is using. I wouldn't be surprised if Skype changed to something else or found another way out to the internet. <BR /><BR />Skype is incredibly elusive and is extremely difficult to block without inline mode and deep packet inspection.</P></BODY></HTML> Wed, 12 Mar 2008 23:19:23 GMT https://community.cisco.com/t5/web-security/custom-user-agent-to-block-skype/m-p/998522#M307 jowolfer 2008-03-12T23:19:23Z