Unabel to block Gnutella

[slerbeton79]

Hello all I am unable to block gnutella p2p.  Attached it my current config, all others work (bittorent fasttrack etc) but programs that use gnutella network (limewire/frostwire etc) are not blocked.  I also tried the match protocol gnutella file-transfer "*" without luck.

any ideas?

[Talha Ansari]

May be the p2p software is using some sort of encryption. You may try one method. On the users pc when you start gnutella check 'netstat -an' from command prompt and find out the destination ip address and the port number that the p2p program uses to communicate. Once you got hold of this you may create an extended access-list to drop all traffic by mentioning the destination ip address and the port number.

You can also take a sniffer trace and find out the destination ip address and the port number.

Hope that helps...

[andrew.prince]

Read the below link

http://www.cisco.com/en/US/tech/tk543/tk757/technologies_tech_note09186a0080094ac5.shtml

http://www.cisco.com/en/US/tech/tk543/tk757/technologies_tech_note09186a0080094ac5.shtml#t3

HTH>

[slerbeton79]

The issue with gnutella is that each time the application opens it creates new connections to random ip's and ports.

Anybody?

[Talha Ansari]

Atleast take sniffer capture on your end user desktop and observe if there is some common port number(s) or common destination ip(s) which could be blocked.

[slerbeton79]

Instead of keep going to user's pc, I installed frostwire on my test machine and the program defaulted to TCP port 22486, and since that is not usual port gnutella pdlm montors, I added that port to the gnutella pdlm as well as created a custom one with that port. The next time the gnutella client loads it detects it cannot connect on 22486 tcp port so it connects on another random port in my case is port 54387.   Any other ideas?

[andrew.prince]

1) Install a proxy server and force all internet traffic thru it.

or

2) Block all TCP/UDP ports higher than 1024, then deal with the applications on a per time basis.

or

3) Install a security client on the user machines to stop unauthorised applications from running.

or

4) Amend you AD policy to not allow users to install software on the machines

Plenty of servers.

[cadet alain]

Hi sheldon,

The other p2p programs you are blocking but they have the same dynamic behaviour of changing ports so why gnutella is not blocked?

Furthermore NBAR is doing L7 inspection so the port can be anything it will recognize specific datapayload for gnutella.

Can't these protocols use normal apps ports not blocked like www? so blocking ports > 1024 will be useless.

Maybe you can mark good traffic and then based on that marking drop bad traffic?

Regards.

[Shelley Bhalla]

Gnutella applications are smart. When they cannot connect they morph  their signatures to see which one can. And everytime this happens

it is on a random port.

Not being intrusive to  other good traffic, it is always recommended to not block but severely  throttle the P2P traffic. This way the connection is made hence the  signature morph does not happen but the connection speed is so less that  users are discouraged to use the application completly.

If the user database is large and this is a huge annoyance that you want to control at any cost... Try Cisco SCE1010 as a product. This is a DPI device which has a lot of features that help ISP, Universities and schools amongst other.

Regards

Shelley.

[slerbeton79]

Thank you everyone for all your help.  I will end up having to throttle it instead of blocking.  The only thing I find strange is all other peer to peer traffic is completely blocked. Even trying to circumvent myself the router identifies it all and blocked, but for gnutella which is the worst for pirate software the cisco pdlm can't stop it.

[Shelley Bhalla]

Gnutella is nasty for morphing signatures and trying to get out to the internet ins one way or the other. Seriously you are not alone in this battle. A lot of Gnutella was/is due to limewire/frostwire. Good news is that Limewire is closing shop in 2011 so soon this will be a thing of the past.

Ofcourse there are other Gnutella apps out there but majot chunk was limewire. There is rumors that even though limewire was shut down there are still some backdoors open. They all will close by 2011.

Please rate any posts that helped you.

Regards,

Shelley

Cisco TAC