Blocking Skype Supernode Packets

[alex.dersch]

Hello,

i would like to ask if there is a way to block skype supernode packets on an IPS module. The reason why i want to block these application is because when skype starts on host in my network i establishes about 100 connections all over the globe.

thanks for any hints

alex

[Scott Fringer]

Alex;

  This action may be possible by creating a custom signature that detects a Skype super-node packet and then takes the action of denying the packet.

  This requires a few details to be successful:

• packet details that are specific to a super-node connection attempt
• the sensor to be configured for inline operation

  You should then be able to create a custom signature using the appropriate signature engine as outlined here:

http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/idm/idm_signature_definitions.html

Scott