Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Hie, As per my network policy, we have to block all torrent traffic from network. To do this, I used to block all ports above 1024 on my firewall/proxy devices. But due to this, many other applications which use non-standard ports are not able to function, specially the mobile applications and a wide community of users are complaining because of this.

So, is there any effective way of blocking torrents in my torrent?
A minimum number of ports, or few specific ports, or application level filtering?

We have Cisco Iron Port Security and Cisco ASA 5500 Firewall devices.

share|improve this question
2  
Just block all ports. –  CodesInChaos Sep 10 '13 at 12:15
    
Sorry, a new user. Not very well versed with the etiquettes of this forum. –  Adi Sep 10 '13 at 12:22
    
No worries Adi - but the tour page has a lot of good info –  Rory Alsop Sep 10 '13 at 12:35
    
+1 to @CodesInChaos for Pandemic –  Rory Alsop Sep 10 '13 at 12:36
1  
This is primarily a layer 8 issue. –  Sammitch Sep 10 '13 at 22:43

4 Answers 4

You have a number of ways to restrict torrents:

  • Blocking ports: this doesn't work, because p2p traffic can use pretty much any port (even ones below 1024)
  • Deep inspection: looking at traffic and blocking based on type can help you a lot, however encrypted traffic all looks alike
  • Destination filtering: this may also help a bit, but you'd have to maintain a large blacklist
  • Volume: if a user is downloading/uploading large amounts of traffic then investigate

  • Controlling the applications installed on the computers on your network through Group Policy or a real world policy. Disallow all p2p applications, and if anyone breaches the policy don't let them use the network/fire them/fine them/whatever

share|improve this answer

BitTorrent can run on any port, and can be wrapped inside SSL, so blocking by ports or traffic data isn't going to get you anywhere.

My suggestion would be to block HTTP traffic on any port which matches the tracker announce protocol, as per the specification. This won't work if the tracker is running on HTTPS, but most don't. It also won't prevent DHT from working, but that's unlikely to matter too much.

Additionally, you can monitor traffic to see if large amounts of data are being transferred to a single user, and take action based upon that.

My opinion is that this isn't a technical issue - it's a policy issue. Make all your users sign a usage policy that explicitly bans the use of file-sharing networks and systems, including BitTorrent, and ensure that appropriate punishments can be enforced should people violate that policy.

share|improve this answer
1  
Torrenting with DHT only is easily possible, and trackers aren't limited to a specific port. –  CodesInChaos Sep 10 '13 at 12:16
    
I agree that torrent can run on any port, but i suppose that only applies to Outgoing ports, not incoming ports. So can we do something considering that? –  Adi Sep 10 '13 at 12:19
    
Nope - any port @Adi –  Rory Alsop Sep 10 '13 at 12:31
1  
Also bear in mind that some people use bittorrent for legitimate business purposes like downloading linux distros and other large bricks of software. –  Sammitch Sep 10 '13 at 22:42

The most effective way is to install a Unified threat management box or a Next generation firewall. These boxes are capable of doing a layer 7 inspection and can identify the applications and users. To get a taste of what it is, try playing with the free Sophos UTM available here.

share|improve this answer

The best solution could be to use Kerio Control / firewall. It has an option to block torrents, called P2P Eliminator. Note that you'll need a server with 2 NICs.

Below a wiring diagram:

Internet link....NiC 01[ Server with Kerio Control ]Nic 02....Ethernet cable to the switch
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.