Block MSN file transfer: impossible mission?

Leave a reply

Block MSN file transfer: impossible mission?


  It is convenient to transfer files via messengers like msn/live, yahoo, icq…  But it is also necessary for organizations to block unauthorized file transfers to keep their networks safe.


  However, messenger software uses several ways to avoid being blocked. They use dynamic ports, encrypted connections, variety connection type to bypass network firewall.


  Let me take msn as an example. By our test, there have four type of msn file transfer as described below:


  1. For two buddies, if one of them is connected to internet directly, direct connection will be established to transfer files. This is the quickest way. There has three type of direct connections with dynamic ports which is negotiated by two sides.


  1.1) Direct TCP connection.


  1.2) Direct TCP connection use TLS encryption.


  1.3) Direct UDP transmission.


  2. If direct connection can not be established, msn servers can act as a relay server to transfer files. The file transfer packets will be among with normal msn messages.


  As you can see from above, there is no way to block msn file transfer simply by blocking some ports in the firewall. The firewall should be smart enough to recognize msn file transfer direct connections, and it shall be able to pick up file transfer packets from normal msn messages.


  Block MSN File Transfer


  Internet Monitor


  Block P2P


 


 

IMFirewall P2P Classify Engine Introduction

Leave a reply

IMFirewall P2P Classify Engine Introduction


1    Introduction


IMFirewall Software is a professional Internet filtering software provider. We focus on Internet information security and providing customers with a comprehensive approach to manage the Internet usage of enterprise network since founded in 2004. By 2007-10, protocols number supported in our pattern database has reached over 90. And our pattern analysis team is monitoring and analyzing protocols everyday.


2       Supported Pattern Type


Three pattern types are supported:


1.      Signature Pattern


You may call it digit signature. As most p2p programs do not has a fix port range nor central servers. The only way to match them is by signature match. IMFirewall pattern matching engine scans every connection for signature of existing protocols..


2.      Port Pattern


IMFirewall pattern matching engine can also recognize protocols by port or port range.


3.      HTTP Pattern


Because more and more protocols are using HTTP protocol or HTTP tunnel to communicate, our pattern-matching engine also checks http mime-header for signatures. HTTP pattern is powerful to recognize http-based protocols.


3       Pattern Matching Speed


We test the speed of each pattern when new pattern found, the standard speed is 20,000 matches in 1 second.


4       Quick Response for New (Updated) Protocols


As protocols may vary from time to time, it is necessary to keep the pattern database up to date in time.


We have a protocol/programs monitoring system, which will monitor the website and files on official websites of each protocol. Once there is a change, the system will notify our protocol analysis team to test it.


This makes us a quick response for new (updated) protocols. Usually, a updated protocol can be added to our pattern database in 2-3 business days.


 


Links: Supported protocols list of WFilter


 


How to Block Bittorrent and bitcomet using WFilter

Leave a reply

Someone told me WFilter can not block bittorrent downloading. So I did some research yesterday.


I downloaded both bittorrent and bitcomet from their official website. I also downloaded an availble torrent file from bittorrent.com.


Turning “Block P2P” on in WFilter console, then use bitcomet to download, the download never begined. However, when I use bittorrent to download, it will start downloading after trying for a few seconds.


This is really interesting. Since WFilter can detect and block bittorrent traffic using pattern match, this should not happen. So what’s the reason? After detailed analysis of the network traffic, I found bittorrent also download data directly from bittorrent.com using http protocol. That means bittorrent not only use p2p downloading, but also can download files directly from the website.


Knowing that, I added “bittorrent.com” in the black list of wfilter’s website black&white list, then did the download again. Aha, bittorrent never be able to download any files.


 


 

WFilter configuration examples.

Leave a reply

Here we’ve added some configuration examples of wfilter:




























# Title Description

1
 Website Black/white List Configuration Example of website black and white list configuration.

2
 Email Black/White List Configuration Example of email black and white list configuration.

3
 ID based Black/White List Configuration Example of ID based black and white list configuration.

4
 Example of Blocking QQ Examples of blocking QQ, blocking QQ file transfer and QQ id black&white list configuration.

5
 Example of Blocking MSN Examples of blocking MSN, blocking MSN file transfer and MSN id black&white list configuration.

WFilter deployment examples.

Leave a reply

We’ve added some wfilter deployment examples in pratice.
























# Title Description

1
 Deploy WFilter using Dlink2366 Using Dlink2366 port mirror switch to deploy WFilter.

2
 Deploy WFilter using Quidway S5012p Using Huawei QuidwayS5012p to deploy WFilter.

3
 Wireless Network Monitoring Example Example of wireless network monitoring

4
 Deploy WFilter using cisco 2950 Example of deploy WFilter using cisco 2950 with ISA Server.

How to block msn file transfer?

Leave a reply

MSN, also called as live messenger is widely used. Windows Live Messenger gives you brilliant ways to connect and share your photos (and other stuff). Contact lists, emoticons, instant access to your friends.


However, sending and receiving files using MSN will face some security risk. External users can send files that might contain viruses or malicious code to users on the internal network. In addition, a liability risk arises if employees use the file transfer feature to share copyrighted music, movie or software files in violation of the law.


How to block msn file transfer?


MSN transfers files using dynamic ports which are negotiated. So it is impossilbe to block msn file transfer ports.


WFilter provides a efficient way to block msn file transfer. By using WFilter, It is very easy for you to detect and block MSN file transfers.


A more detailed example can be found here:


Example of blocking msn

How to block P2P traffic using WFilter

Leave a reply

A pure peer-to-peer network does not have the notion of clients or servers, but only equal peer nodes that simultaneously function as both “clients” and “servers” to the other nodes on the network. This model of network arrangement differs from the client-server model where communication is usually to and from a central server.


Some networks and channels such as Napster, OpenNAP and IRC server channels use a client-server structure for some tasks (e.g. searching) and a peer-to-peer structure for others. Networks such as Gnutella use a peer-to-peer structure for all purposes, and are sometimes referred to as true peer-to-peer networks, although Gnutella is greatly facilitated by directory servers that inform peers of the network addresses of other peers.


As you can see from above, a peer-to-peer network is complex and it is almost impossible for you to block p2p in the router or the gateway.


WFilter provides a efficient way to block p2p traffic by signature match. By using WFilter, It is very easy for you to detect and block p2p traffic and file downloading.


WFilter related features:



  • Detect p2p traffic in your network.
  • Implement a policy to block certain p2p traffic.
  • Support over 30 p2p protocols, cover most common p2p softwares.
  • Define a file extension list forbidden from being download.

 

How to block AIM using WFilter

Leave a reply

AOL Instant Messenger (often referred to as “AIM”) is an instant messaging application that allows registered users to communicate in real time via text, voice, and video transmission over the Internet. It is maintained by AOL LLC. The official website is www.aim.com.

AIM is widely used all over the world. However, employees are using AIM to chat privacy topics, send and receive files, which will decrease working productivity, waste time and raise security risk.

So it is important to block AIM in enterprise network.


How to block AIM in your network?


AIM messenger can connect in several ways. Default is TCP port 5190. However, if you block AIM port 5190 in your firewall. It will turn to use port 80, 443 instead. And also, AIM messenger can use a HTTP/SOCK4/SOCK5 proxy server to reach the server. Even the worth, AIM traffics through port 80 using HTTP protocol, if you allow your employees to browser website, the 80 port must be available. And AIM has official clients, and many unofficial clients like gaim, trillian are also popular.
So, is blocking AIM mission impossible?

Of course not, but professional internet filter tools are needed. To block aim traffic, it needs the blocking aim tool has the ability to pick up aim traffic from large amount of connections.

I recommend you use WFilter to block aim, block msn and block messenger.


WFilter related features:



  • Monitor AIM and ICQ messenger usage.
  • Record chat contents of AIM and ICQ.
  • Record files transfered by AIM/ICQ.
  • Implement a policy to block AIM/ICQ or certain AIM/ICQ accounts.
  • Block AIM file transfers, block icq file transfers.
  • Support offical messenger client and other third party clients like gaim, trillian.


 


WFilter other monitor features:


Chat Monitor, MSN Messenger Chat Monitor, Yahoo Chat Monitor and other instant messenger monitor, block MSN, block Yahoo, block AIM, and other instant messenger block, block p2p, block p2p traffic, filter internet, block internet, internet monitor, monitor employee internet activity…



Wireless network monitoring example

Leave a reply

Wireless communication brings fundamental changes to data networking and telecommunications. Now days, more and more organizations and home users build up wireless networks. And in many situations, wired networks and wireless networks exist together. This topic demonstrates a solution to monitor wireless networks internet activities.


A typical network contains both wired and wireless networks:



To monitor both the wired network and the wireless network, we add a tplink port mirror switch TL-SL2210WEB here.


Port1 of it is connected to the router, port2 connected to WFilter and port3 connected to the wireless Access Point.


The port mirror configuration is as below:


 



By now, you can monitor all the wireless computers.