How to block p2p for specific hosts with IPS-4255

[b.carbery]

I have just received an IPS-4255 with v6 software and am learning to configure it.

I want to maintain a list of known p2p abusers in our network and block their ip addresses using the IPS. At the moment the IPS is not in inline mode so I want to use TCP resets.

1) When a test machine starting downloading a bittorrent I see an event, and all the peer destination addresses, but if I start another torrent I do not see another event.

2) How do I only send TCP resets for specific hosts? I created an event variable but am unsure how to apply it.

3) Will sending TCP resets over a SPAN from a Cat6500 (latest sw, sup etc) work?

thanks

[armando]

Why go thru all that just block it at the router level and drop it there.

[b.carbery]

Two good reason come to mind:

1) You can't block traffic that uses dynamic ports with an ACL (notwithstanding nbar)

2) If I can't do it easily with the IPS, why do I need an IPS?

[rnaydenov]

Take a look at event action overrides and event action filters. With these you can enable/disable signature for specific addresses