Blocking Kazaa

Blocking Kazaa

[Jean-Rene Cormier]

Anybody know a way of blocking Kazaa? I've tried the string matching way
but it doesn't seem to work. I tried logging all connections from  my
windows desktop so I could see to which port it connects and it connects
to so many different port that you basically need to block ports 1000 to
4000 but after that it connects to port 80 which obviously I can't
block. I installed ethereal on the windows desktop to check which string
I could filter but couldn't find anything useful.

Anybody have an idea what can be done? I'm thinking another option would
be to block the IP of the servers but there seem to be quite a list...
that's if it doesn't just try some random IPs...

Jean-Rene Cormier

Re: Blocking Kazaa

[SBlaze]

I don't know much about Kazzaa I never used it...but you said you checked the
connection ports right? What about source ports. Check both the source and the
destination port(s) and see if you see any consistencies. Sometimes you don't
need to block ALL ports just the ones that initiate a connection.

Hope this helps
SBlaze

--- Jean-Rene Cormier <jean-rene.cormier@cipanb.ca> wrote:
> Anybody know a way of blocking Kazaa? I've tried the string matching way
> but it doesn't seem to work. I tried logging all connections from  my
> windows desktop so I could see to which port it connects and it connects
> to so many different port that you basically need to block ports 1000 to
> 4000 but after that it connects to port 80 which obviously I can't
> block. I installed ethereal on the windows desktop to check which string
> I could filter but couldn't find anything useful.
> 
> Anybody have an idea what can be done? I'm thinking another option would
> be to block the IP of the servers but there seem to be quite a list...
> that's if it doesn't just try some random IPs...
> 
> Jean-Rene Cormier
> 
> 


=====
"Winky is not knowing how sir, winky is not knowing how?" -=Winky / Harry Potter and the Goblet of Fire=-"

__________________________________
Do you Yahoo!?
Yahoo! SiteBuilder - Free, easy-to-use web site design software
http://sitebuilder.yahoo.com

Re: Blocking Kazaa

[Jean-Rene Cormier]

I haven't checked the source ports but I doubt after all they did to get
around firewalls that they would put fixed source ports. Though I'll
check it out, you never know.

Jean-Rene Cormier


On Fri, 2003-08-22 at 14:23, SBlaze wrote:
> I don't know much about Kazzaa I never used it...but you said you checked the
> connection ports right? What about source ports. Check both the source and the
> destination port(s) and see if you see any consistencies. Sometimes you don't
> need to block ALL ports just the ones that initiate a connection.
> 
> Hope this helps
> SBlaze
> 
> --- Jean-Rene Cormier <jean-rene.cormier@cipanb.ca> wrote:
> > Anybody know a way of blocking Kazaa? I've tried the string matching way
> > but it doesn't seem to work. I tried logging all connections from  my
> > windows desktop so I could see to which port it connects and it connects
> > to so many different port that you basically need to block ports 1000 to
> > 4000 but after that it connects to port 80 which obviously I can't
> > block. I installed ethereal on the windows desktop to check which string
> > I could filter but couldn't find anything useful.
> > 
> > Anybody have an idea what can be done? I'm thinking another option would
> > be to block the IP of the servers but there seem to be quite a list...
> > that's if it doesn't just try some random IPs...
> > 
> > Jean-Rene Cormier
> > 
> > 
> 
> 
> =====
> "Winky is not knowing how sir, winky is not knowing how?" -=Winky / Harry Potter and the Goblet of Fire=-"
> 
> __________________________________
> Do you Yahoo!?
> Yahoo! SiteBuilder - Free, easy-to-use web site design software
> http://sitebuilder.yahoo.com

Re: Blocking Kazaa

[SBlaze]

http://www.securitymetrics.com/portscan.adp

Above is an online port scanner. It scans for Kazzaa openings(among other
things). It seems to think that Kazzaa is open always on 1214. As I said before
I am not sure as I do not use Kazzaa. If you find anything out about this I
will gladly write up something on my web site to show other users how to block
Kazzaa as it seems to come up alot.

Thanks
SBlaze


--- Jean-Rene Cormier <jean-rene.cormier@cipanb.ca> wrote:
> I haven't checked the source ports but I doubt after all they did to get
> around firewalls that they would put fixed source ports. Though I'll
> check it out, you never know.
> 
> Jean-Rene Cormier
> 
> 
> On Fri, 2003-08-22 at 14:23, SBlaze wrote:
> > I don't know much about Kazzaa I never used it...but you said you checked
> the
> > connection ports right? What about source ports. Check both the source and
> the
> > destination port(s) and see if you see any consistencies. Sometimes you
> don't
> > need to block ALL ports just the ones that initiate a connection.
> > 
> > Hope this helps
> > SBlaze
> > 
> > --- Jean-Rene Cormier <jean-rene.cormier@cipanb.ca> wrote:
> > > Anybody know a way of blocking Kazaa? I've tried the string matching way
> > > but it doesn't seem to work. I tried logging all connections from  my
> > > windows desktop so I could see to which port it connects and it connects
> > > to so many different port that you basically need to block ports 1000 to
> > > 4000 but after that it connects to port 80 which obviously I can't
> > > block. I installed ethereal on the windows desktop to check which string
> > > I could filter but couldn't find anything useful.
> > > 
> > > Anybody have an idea what can be done? I'm thinking another option would
> > > be to block the IP of the servers but there seem to be quite a list...
> > > that's if it doesn't just try some random IPs...
> > > 
> > > Jean-Rene Cormier
> > > 
> > > 
> > 
> > 
> > =====
> > "Winky is not knowing how sir, winky is not knowing how?" -=Winky / Harry
> Potter and the Goblet of Fire=-"
> > 
> > __________________________________
> > Do you Yahoo!?
> > Yahoo! SiteBuilder - Free, easy-to-use web site design software
> > http://sitebuilder.yahoo.com
> 


=====
"Winky is not knowing how sir, winky is not knowing how?" -=Winky / Harry Potter and the Goblet of Fire=-"

__________________________________
Do you Yahoo!?
Yahoo! SiteBuilder - Free, easy-to-use web site design software
http://sitebuilder.yahoo.com

Re: Blocking Kazaa

[Stephen Smoogen]

Kazzaa uses 1214 for only certain traffic (talking to its supernodes).  
We found that blocking 1214 was insufficient for stopping people from
using Kazzaa as it uses a bunch of dynamic ports and searches of DNS
ranges. [Blocking the DNS ranges seems to be futile as they seem to have
changed several times.] The only thing I have heard that might be useful
is to combine snort with iptables in that snort figures out who inside
your network is using Kazzaa and then you block that IP address via 
iptables. Now how you get the two to work together? That is the 64k 
questions :(


On Fri, 22 Aug 2003, SBlaze wrote:

>http://www.securitymetrics.com/portscan.adp
>
>Above is an online port scanner. It scans for Kazzaa openings(among other
>things). It seems to think that Kazzaa is open always on 1214. As I said before
>I am not sure as I do not use Kazzaa. If you find anything out about this I
>will gladly write up something on my web site to show other users how to block
>Kazzaa as it seems to come up alot.
>
>Thanks
>SBlaze
>

-- 
Stephen John Smoogen            smoogen@lanl.gov
Los Alamos National Labrador  CCN-5 Sched 5/40  PH: 5-8058
Ta-03 SM-261  MailStop P208 DP 17U  Los Alamos, NM 87545
-- So shines a good deed in a weary world. = Willy Wonka --

RE: Blocking Kazaa

[George Vieira]

well if it help, use squid to block anything to the kazaa servers (whatever they are..)since kazaa tries to use port 80, a transparent proxy would be good in this case..

Thanks,
____________________________________________
George Vieira
Systems Manager
georgev@citadelcomputer.com.au

Citadel Computer Systems Pty Ltd
http://www.citadelcomputer.com.au

Phone   : +61 2 9955 2644
HelpDesk: +61 2 9955 2698
 

-----Original Message-----
From: Jean-Rene Cormier [mailto:jean-rene.cormier@cipanb.ca]
Sent: Friday, August 22, 2003 9:50 PM
To: netfilter@lists.netfilter.org
Subject: Blocking Kazaa


Anybody know a way of blocking Kazaa? I've tried the string matching way
but it doesn't seem to work. I tried logging all connections from  my
windows desktop so I could see to which port it connects and it connects
to so many different port that you basically need to block ports 1000 to
4000 but after that it connects to port 80 which obviously I can't
block. I installed ethereal on the windows desktop to check which string
I could filter but couldn't find anything useful.

Anybody have an idea what can be done? I'm thinking another option would
be to block the IP of the servers but there seem to be quite a list...
that's if it doesn't just try some random IPs...

Jean-Rene Cormier

RE: Blocking Kazaa

[Stephen J. McCracken]

A link found on another list describing how Kazaa tries to bypass
filters...

http://lists.q-linux.com/pipermail/ph-isp/2003-May/003234.html


On Sat, 2003-08-23 at 20:47, George Vieira wrote:
> well if it help, use squid to block anything to the kazaa servers (whatever they are..)since kazaa tries to use port 80, a transparent proxy would be good in this case..
> 
> Thanks,
> ____________________________________________
> George Vieira
> Systems Manager
> georgev@citadelcomputer.com.au
> 
> Citadel Computer Systems Pty Ltd
> http://www.citadelcomputer.com.au
> 
> Phone   : +61 2 9955 2644
> HelpDesk: +61 2 9955 2698
>  
> 
> -----Original Message-----
> From: Jean-Rene Cormier [mailto:jean-rene.cormier@cipanb.ca]
> Sent: Friday, August 22, 2003 9:50 PM
> To: netfilter@lists.netfilter.org
> Subject: Blocking Kazaa
> 
> 
> Anybody know a way of blocking Kazaa? I've tried the string matching way
> but it doesn't seem to work. I tried logging all connections from  my
> windows desktop so I could see to which port it connects and it connects
> to so many different port that you basically need to block ports 1000 to
> 4000 but after that it connects to port 80 which obviously I can't
> block. I installed ethereal on the windows desktop to check which string
> I could filter but couldn't find anything useful.
> 
> Anybody have an idea what can be done? I'm thinking another option would
> be to block the IP of the servers but there seem to be quite a list...
> that's if it doesn't just try some random IPs...
> 
> Jean-Rene Cormier
> 
> 
> 

blocking kazaa

[Fadel]

Hi there,

I got a trouble in my network while trying to block Kazaa.
I tried to drop port 1214 with this rule:

iptables -A FORWARD --dport 1214 -j DROP

but this doesn't work. so I did sniffing to see what kind of packets and
ports kazaa uses and I saw that it searches for servers in different ports.
later, I read in various texts around the net, but all recommend to block
port 1214 and kazaa site. this probably worked in version 1.

how could I block kazaa, since I need accept connections in high ports?

sorry for the bad english.

regards,

phadell
-------------------------------------------------
Esta mensagem foi enviada
por Siteplanet WebMail.

RE: blocking kazaa

[George J. Jahchan, Eng.]

You need a PacketShaper, check it out at: http://www.packeteer.com/