How to block BitComet

[Stiflerz]

Hello bitcomet friends.

I have problem which I need to solve. I work in company, and I need to block all (or atleast most) peer to peer traffic. Most ppl use bitcomet, so I got question. Is there any reasonable way, how to block BitComet? Incoming port can be randomized, whats about outgoing port? Which bitcomet uses ?

Or any other sollution? Mass port block isnt an answer for me! We cant phisicly check all computers - they are to many...

[greywizard]

BitComet uses random ports for outgoing connections. There is no specific method for blocking just BitComet. And it wouldn't do you much good, since once the users figured that out they could very well switch to another BitTorrent client. And there are dozens of them.

You need a method to block peer-to-peer traffic, period. There are specific tools which some of the ISPs use to this end. I'm not aware which are the names of the tools, since I've never been interested in this very much.

One simple and fast solution which would partially solve your issue, would be to block in your firewall, all incoming ports to your network, except those on which you have servers listening and register those which are open for the IPs of the servers you are using (if you have any servers behind NAT). But that's something you should have done already anyway, if I come to think about it.

Or is your network lying there with all the ports unblocked, like a house with all the doors and windows open, all the lights on and nobody home? :D

This would render all their clients in "no listening" mode and would greatly reduce the speed at which they can download, thus releasing some of the stress on your network. However, if they switch to a client which support NAT traversal or choose very well seeded tasks, this wouldn't pose too much of a obstacle.

Another possible solution would be a proxy firewall, which filters traffic on a per-protocol basis. In this you could allow only certain protocols to run, while denying all other connections be they outbound or inbound.

As I said in the beginning there are tools that some ISPs use for traffic shaping which, I believe, use deep-packet-inspection. You would need a firewall-like tool which can and will perform checks on the payload and upper-layer headers inside the packets going out from your network. They usually inspect the content of all packets and drop those who don't meet the criteria defined in their filters (where you can put BitTorrent protocol headers or any other P2P protocol patterns, for that matter).

Since you said nothing about your network's topology, there isn't much else that comes to mind now.

Here are some links you might want to check:

http://forum.imfirewall.us/forum/default.aspx?g=posts&m=76

http://www.ipp2p.org/

http://www.dslreports.com/forum/remark,17006353

http://www.zeropaid.com

/bbs/showthread.php?t=26680

http://serverfault.com/questions/82055/block-p2p-downloading-in-my-office

http://searchcio-midmarket.techtarget.com/expert/KnowledgebaseAnswer/0,289625,sid183_gci1023730,00.html

http://forums.anandtech.com/showthread.php?t=19746http://serverfault.com/questions/1515/soho-throttle-bittorrent-traffic-from-problem-users

[kluelos]

If you are trying to block the use of P2P applications at work, the first thing you need to put in place is a disciplinary policy. Enforce it through management, not through technology. If your people are defying your policy and P2P'ing anyway, you have far more and worse problems than you think, and your attention needs to be on that.

This is a *management* problem, and it does not *have* a technological solution. If your supervisor is incompetent enough to insist that you find one, don't actively cooperate in destroying what little faith and trust remains in your department. Just outlast the SOB, he'll be gone soon enough. Think about it: your supervisor tells people not to do something, and they defy him. This is a powder keg with the fuse already lit.

For if you can't sit down with your people and talk to them like responsible adults, have them respond to you like responsible adults, you're already borked beyond repair. Think about polishing up the resume.

[Stiflerz]

to greywizard: Tnx for the link under, I found the http://www.ipp2p.org/ before, gave my boss to check out can he import thing like this into our firewall... So far this looks best way to do, just we just started to search around possible ways...

to kluelos: there are such a policy already, but if the ppl who are using these are over u, u cant do anything... Well u can try, but thats way to much problems...

We could try to block most of torrent clients, that would reduce most of users...

So looks like there are no "weak spots" for clients