Become a fan of Slashdot on Facebook

 


Forgot your password?
Close
typodupeerror
×
Software The Internet

Blocking Kazaa 2.0? 86

Posted by Cliff from the for-when-it-becomes-a-nuisance dept.
coder_ asks: "Has anyone had success blocking the latest versions of this annoying P2P application in a network-wide context? Previously, people have been told to block a specific port, etc, yet as expected, Kazaa has found an easy solution to this. Apparently, when a connection via default port is not available, Kazaa makes encrypted http requests through port 80, making it rather difficult to now block. If anyone has had success in doing so, I would love to hear from you."
This discussion has been archived. No new comments can be posted.

Blocking Kazaa 2.0? More

Blocking Kazaa 2.0?

Comments Filter:

  • What's it connecting to? (Score:5, Insightful)

    by tunah ( 530328 ) <sam&krayup,com> on Tuesday February 11, 2003 @04:58AM (#5277840) Homepage
    Just block all connections to the authorisation/logon server. Problem solved?

  • Depends on the situation (Score:5, Insightful)

    by GreyWolf3000 ( 468618 ) on Tuesday February 11, 2003 @05:07AM (#5277857) Journal
    If you're adminning a corporate environment where the only things that the employees should have access to is email and browsing, you could cap their bandwidth. If you're at a school, you might want to try blocking access to the login websites (there's a username/pass system in KaZaA, right?), and forget the bandwidth cap entirely, since students may want to download monster .iso files or something.

  • ideas... (Score:1, Flamebait)

    by Anonymous Coward
    If you work for an ISP or are a corporate lapdog for big media, STFUB. It won't work and you'll only piss off your paying customers who'll jump to your competitors. Your company will nosedive into the ground - and I'll laugh.

    If you are in a corporate or educational environment (and internet bandwidth is supposed to be a productive asset) - there are no precise technical solutions that you can use given the variety of transport options and changing protocols. A few options:

    (1) Train your users not to use disallowed software, pointing out bandwidth problems. Then threaten, make the consequences clear (see if it improves). Then take action if bandwidth usage is still bad and start temporarily suspending accounts a day at a time - although double-check they aren't using bandwidth for legitimate purposes first.

    (2) Throttle bandwidth based on average usage over the past hour or so with walking averages. I'm sure this would be easy to set up with a software firewall. After a long leaching session, see how they enjoy the internet at 1 kbit/s.
    • What about the mom/pop ISPs that don't want to get sued for not 'removing the copyrighted media from their network' once they've been notified by the DMCA 'police?' They are legally responsible for making sure the content is removed from their network one way or another. For this 'group' of companies, it's either piss off a few of your most (bandwidth) expensive customers, or face a potentially (extremely) expensive lawsuit.

      • Re:ideas... (Score:3, Insightful)

        by toast0 ( 63707 )
        blocking kazaa or the file trading program of the day doesn't equal removing the copyrighted media, does it?

        • Is the file accessible on the ISPs network, where they would be responsible (and could be criminally prosecuted) for it?
          • my point is, that if somebody is sharing it w/ file sharing program of the day today, and you block that, tommorow they will probably share it with file sharing program of tommorow.
            • And we'll figure out how to block that.

              There are 2 obvious solutions to the problem.
              • they can quit sharing/distributing copyrighted material (which _is_ breaking the law)
              • we can ask them to do business somewhere else

              Their business is valuable, but is it valuable enough to justify the legal liability?

              I don't really care what they download--that's their business. It's when they start (re)distributing copyrighted material from an IP that we're legally responsible for. The customer is paying for bandwidth and I, personally, think they deserve the right to do whatever they want with it, as long as they're not infringing on the rights of others. If we don't stop the customer, we're just an accessory to the crime.

              No, I dont' work for or even like the RIAA. Neither do I own any audio CDs nor do I have any MP3s. I don't sympathize with them at all. They've screwed up their own business and that of their employees (the artists).

              /pointer
              • I think it'd be appropriate to pass the legal buck onto the client. If the RIAA comes knocking and says 'you have this on your network', you notify the customer, and ask them to either take off the network or declare that it is not in violation of their license to share it like that. Then when the RIAA comes back, you show them the declaration, and tell them to pursue the matter with your client.

                • While I'd love to be able to do that, our lawyers told us we couldn't. If your lawyers are telling you something different, please share!

                  /pointer

  • Packeteer (Score:5, Informative)

    by gatorade123 ( 133969 ) on Tuesday February 11, 2003 @05:37AM (#5277982) Homepage
    Just upgrade you packeteer packetshaper to version 5.3.0. This image has new code to specifically handle KaZaA 2.0.

  • More information needed (Score:4, Informative)

    by Zocalo ( 252965 ) on Tuesday February 11, 2003 @05:52AM (#5278042) Homepage
    Could you possibly be more general? Seriously, you are going to need to give people a better idea of your network setup unless you only want general answers on this, most of which will be moot in you environment.

    That said, there are *plenty* of approaches to the problem of killing KaZaA (and KaZaA Lite), but they rather depend on the network infrastructure. You certainly need to filter the standard ports used by the program, and forcing all port 80 traffic through a filtering proxy server nay be of use. Also, P2P in general seems to need a fair amount of UDP traffic - depending on your setup it might be possible to restrict that to just those ports you require.

  • Why not just use Web proxies (Score:5, Insightful)

    by DrSkwid ( 118965 ) on Tuesday February 11, 2003 @06:03AM (#5278080) Journal
    There's not much reason for most people to have any other net access than Web via proxy.

    If you've got every box in the company NATd then you are being hoisted by your own petard really.

    Giving Lusers software installation rights on terminals may save you some annoying "but I need MSN" bullshit but when they cram Bonzi Buddy and whatever other crap they can find in there you are risking your network and pushing your support costs up.

    I'd rather be seen as some sort of network nazi than have to try and use ssh into a remote site at 1 second per character. I found who was running Napster and since that day I'm the annoying guy that curtails people's "rights" and "freedoms".

    If you want a compromise let one machine be a p2p client. You can get Gnutella clients with a web front end so anyone on the LAN can submit queries on the same box and then throttle that box's bandwith during working hours & let it roam free when the bandwith is underutilized.

    If people kick up a fuss, sack them.

    • "There's not much reason for most people to have any other net access than Web via proxy."

      Please, get a clue.
      The Internet is going to evolve into much more than mere websurfing. And I personally see IM as a very good way to communicate. It is a lot less invading than a telephone call, and a lot quicker than an e-mail.

    • Would a proxy work?

      With the number of ISPs implementing transparent proxies upstream of their clients, I would risk saying that kazaa must have something in place to circumvent the proxy.

      Please excuse my lack of technical insight. I'm just part of a user comitee of an institution struggeling against malicious abusers.
    • One person or team has to take responsibility of software installations, otherwise you are wide open to virus, trojans and to have not copyrighted software installed without your knowledge.

      • Exactly - it might not be the popular answer, but you are there to work. It sucks, but it is somebody else's money that's going into your pockets or bank account or whatever. It's their machines, their network, their time, their money. You're just a very expensive body which if they could figure out a way to replace you, they wod.

        Mind you, I've seen this go in bad directions - I worked for one company that was so closed minded that it hurt productivity because they refused to even examine the acquisition of new versions of tools.

        But P2P stuff? I don't see any reason for needing this on your desktop at all at work. Considering the last thing you need are the RIAA or MPAA cops or even your national police force coming in with a warrant for your arrest. That kind of negative PR can really mess up a company.

        If you really have a great desire to get your hands on the N'Sync single, wait until you get home, or borrow it from one of your friends. Sheesh.

    • There's not much reason for most people to have any other net access than Web via proxy.



      This is the "Blocking KaZaA" thread. You want "Stupid Security" further up the page.

    • There's not much reason for most people to have
      HTTP access at work... just firewall port 80
      and be done with it.

      (As an added bonus, this offers protection
      against the expenses associated with viewing of
      pr0n, political subversion, and posting to
      slashdot on the company dime.)

  • Fire 'em (Score:5, Funny)

    by Captain Large Face ( 559804 ) on Tuesday February 11, 2003 @06:13AM (#5278105) Homepage

    Three suggestions:

    1. Ensure Kazaa can't be installed in the first place by locking down user rights.
    2. Fire anyone who has it installed.
    3. Give me their job.

    NOTE: I am not a SysAdmin, but these options are from a layman's POV.

  • LART (Score:2)

    by Bastian ( 66383 )
    It seems like the nature of peer-to-peer can be exploited here. Does the protocol Kazaa uses provide some way to locate hosts on its networks? From there you chould just grep for IP's that belong to you and trace from there to a physical computer.

    From there, all you need is a good application of some LART to the user of said p2p software, preferably in the form of disciplinary (read: vigilante) action.

    Of course, everyone will probably think you're an asshole. This is best mitigated by having an official policy behind you. That, or you can just LART everyone into submission.

  • Carrot-stick approach? (Score:3, Funny)

    by Bazman ( 4849 ) on Tuesday February 11, 2003 @07:37AM (#5278372) Journal
    I just set up a NAT box for a room full of students with their own laptops. I cant control the software on them, but I can control the network. I let through webproxy and ssh ports, which is all they can really ask for in order to do their work.

    But the traffic is large and constant. Are they streaming radio, Kazaa'ing? I dont know. But they do want IMAP access to mailservers - doing SSH to a unix box and running 'pine' isn't enough for them - they want clicky clicky. So here's the deal. If that constant traffic goes, and it just looks like you are browsing, I'll enable IMAP access. Streaming traffic disappears.

    All I need do is keep an eye on the packet counts. And save a stick for later - they're bound to want to use our printers at thesis-delivery time...

  • Education (Score:2, Informative)

    by FungiSpunk ( 628460 )
    If your in a corporate environment, get management to lay down an internet usage policy. Fire people who break it. They did that at one place I was working and the network traffic dropped by 75% in about 2 days. Fired 6 people, for playing online games and using P2P nets. With management on your side, fear is a strong weapon.
    • It's much easier to contain things like this with management than with technical means. I find that simply having a "talk" with users that break such policies take care of the problem. Give them that "big brother is watching you" feeling ang 99% of your problems will be taken care of.
  • I'd guess KaZaA's "HTTP" traffic would be easily distinguishable from other HTTP traffic. E.g. Hogwash [sourceforge.net] can "drop or modify specific packets based on a signature match".

  • CAR (Score:1)

    by rf600r ( 236081 )
    Don't block the port; rate limit it.
  • First of all: I understand why you want to block it.

    However, I believe that for each measure there will be a counter-measure and at some point it actually hurts either productivity or freedom of users. Well, while 'freedom' is not necessarily what the users should have in a computing environment, it may hinder creativity in the sense that each time somebody has some free time and likes to try some crazy idea he has to ask for permission, and will most likely be disencouraged tampering with the system.

    Depending on how serious the problem is, I would try arguing with people, asking for integrity and common sense instead of imposing rules. If the problem is serious, however, go ahead and block everything which is not on the 'positive' list. To stop unwanted traffic, allow only high volume traffic to a list of 'allowed' ip addresses.
    If traffice exceeds the allowed amount, you can make your proxy return a polite message instead of the wanted content.
  • Do you have an IDS system? I know our Real Secure network sensor will pick up almost all P2P apps. I just shut down a user running one.

  • Issues to consider (Score:3, Interesting)

    by Pointer80 ( 38430 ) on Tuesday February 11, 2003 @11:00AM (#5279447)
    A lot of posters are suggesting allowing Kazaa on the author's network, but ratelimiting it. This question is really to you. Have you received complaints from the DMCA 'police' yet? If so, how have you responded--if at all--to the complaint?

    Typically, I've heard of ISPs sending notices to customers asking them to remove the offending material. If the customer continues to download/share copyrighted material most ISPs will terminate the customers account. If the bandwidth isn't an issue and the customers business is valuable, it would make more sense to block Kazaa (for that customer; if you can't get them to stop sharing copyrighted content).

    I did some googling in mid-November of last year and came across some interesting usenet posts relating to the topic. One poster went through all the normal ports that Kazaa used and blocked each one. Then s/he noticed that it used port 80. Later I ran into some docs where someone was using iptables (there was a post on one of the snort mailing lists about this as well) to block Kazaa traffic using '-m' and the 'X-Kazaa' header that it uses. I haven't had time to play with this though. :(

    Good luck and please let us know what you find.

    /pointer

  • Commercial Shaper (Score:3, Informative)

    by GoRK ( 10018 ) on Tuesday February 11, 2003 @11:53AM (#5279898) Homepage Journal
    There's (sadly) not an easy way to do this with most OSS tools or a way to do this on (most) routers.

    The hard way: you could do it with a firewall, policy based routing or a L4 switch, and a transparent web proxy, but setup would be a bitch and if you are an ISP, you're going to have a lot of other headaches with a web proxy other than kazaa 2.

    The easiest way to successfully bandwidth-limit or block kazaa 2 clients as far as I have seen is by using one of the commercial traffic shaping hardware or software solutions that have the capability of looking at stuff higher than L4. packeteer, et/bwmgr for linux or freebsd, etc. are software tools that do this, and there is hardware such as L7 switches that can accomplish similar feats also.

    I haven't looked in a while at the new/upcoming Linux and BSD OS's ip matching rules. It's possible that there is now enough matchers to successfully block or bandwidth kazaa 2 on them, so it may still be worth investigating in lieu of paying big bucks for shaper hardware/software.

    ~GoRK
  • 1) Block Kazaa port
    2) Watch for Kazaa connection switching to port 80
    3) Sue under DMCA for circumventing your protection

  • Err...this is a pretty easy one (Score:3, Insightful)

    by 0x0d0a ( 568518 ) on Tuesday February 11, 2003 @01:28PM (#5280787) Journal
    Just use a transparent HTTP proxy. Only normal, unencrypted connections on port 80 will be handled. Others just stop dead.

    Of course, this is yet another stopgap solution, just like blocking the original port. When Kazaa 3 or whatever moves to 443, you're going to be pretty much SOL. That's just the way the Internet works. Information tends to move around.

    That's kind of too bad -- I'd love nothing more than to see Kazaa, the last of the major closed P2P protocols, go belly-up. I'm definitely rooting for the RIAA/MPAA on this one. Once it dies, people will be using open protocols. :-)

    My attitude is pretty much that you're better off throttling the bajeezus out of their traffic -- they exceed a quota, you clamp down on their rate. Trying to *block* something simply makes people try more solutions until they get around it, whereas data trickling in or out will usually keep them happy enough not to cause too many problems. The human side of things kind of has to be considered here.

    I'd also like to say that I really loathe transparent proxies (nothing wrong with opaque proxies -- I run one myself -- but *forcing* the user to do something just causes problems). I also hate people that firewall *anything* outgoing, and most things incoming. Causes lots of pain to the user, and not a lot of long term benefit. Eventually, everything except 80 outbound and 443 outbound are going to be firewalled. Then everything will end up using SOAP or tunneling over 443 to communicate just to get by. As a result, in a few years the Internet will be slower and less reliable, and security and ability to "control" what users do will be less there.

    My interests and work tend to lie in security, and I *still* think that most security-oriented admins have their heads up their asses. What's needed is a *good* fix, not a slapdash thing like firewalling off a port or two. Kazaa uses too much bandwidth? Provide an alternative that costs you less (a la the school that wanted to reduce P2P bandwidth -- they made a P2P filesharing app that only talked to other machines on the school network). Trying to perfectly control human behavior hasn't been practical since the dawn of time, and the introduction of the computer isn't going to make it suddenly feasible.
    • a la the school that wanted to reduce P2P bandwidth -- they made a P2P filesharing app that only talked to other machines on the school network

      been there. done that. Ok so it wasn't the school that did it and they offically do not approve it's usage of course but I had a group of friends that went ahead and did just that created a gnutella clone that worked only in the schools class B IP range and it works beautifully. It's now in the hands of new maintainers and 4th generation.

      Bandwidth usage is better (although last time I heard the connection was at nearly 100% usage for most of the waking hours) and best of all people don't have to go out to the internet to download their favorite Pr0n^N^N^N^N educational information :-)

      -CH
  • Wow, everyone's ignoring the simplest solution...

    Uninstall KaZaA from the computers, then block kazaa.com (and the other major filesharing program sites). That'll stop the vast majority of users from reinstalling it.
  • If you have the ability to shape traffic based on application, then surely you have the ability to log those packets. If they can be traced back to the user, then I say log them and send the user a bill at the end of the month for the bandwidth they're eating.

    As someone has already stated, the blocking/counter-blocking cycle can go on forever, so the only real way to solve the problem is through social engineering. For that, there's nothing quite as effective as hitting them where it hurts: right in the wallet!

    I don't know if that's a viable solution in your particular situation or not, but that's certainly the angle I would be persuing in your situation. It may simply be enough to add such a clause in your AUP and make sure everyone is advised of it, but in most situations it's helpful to make an example or two (per year, if you're at a school).

  • This is what we did at my workplace. We created a couple of "secret" shares on a server, and everyone dumps their pr0n & mp3s into the same repository.

    This cuts the duplicate files coming in on Kazaa. Sounds silly but it works.

    The reason we don't mind Kazaa is we pay for 3Gb/month, what we don't use is lost so we pull in what we can at the end of the month.
    • Get yourself a new hosts file, or update your DNS if you are responsable for one:

      NB: Updated hosts files are available on Kaz itself!

      I tried to post it below but the fsckin lameness filter squishes it!
    • at my workplace. We created a couple of "secret" shares on a server, and everyone dumps their pr0n & mp3s into the same repository Good move, now your workplace is condoning illegal file share and sexual harrassment.
      • > Good move, now your workplace is condoning illegal file share and sexual harrassment.

        Rhetoric like this only misses the point.

        The downloads are going to happen. One way cuts down the bandwidth use drastically.

        Leave the nonsense out of it.

  • Solution - inspect packets with Linux (Score:3, Informative)

    by zdzichu ( 100333 ) on Wednesday February 12, 2003 @06:01PM (#5290972) Homepage Journal
    Yay man, hve you ever heard about newsgroups archives? Or did you try to search a bit before asking /.?

    [gliwice.pl]
    Solution was invented while ago. Just block/trafshape any packets with X-Kazaa string. Like that:

    iptables -t mangle -I FORWARD 1 -i eth0 -m recent --update --seconds 60 --rdest --name kazaa -j kazza-out
    iptables -t mangle -I FORWARD 2 -i eth1 -m recent --update --seconds 60 --rsource --name kazaa
    iptables -t mangle -I FORWARD 3 -i eth1 -m string --string "X-Kazaa" -m recent --name kazaa --set --rsource
    iptables -t mangle -I FORWARD 4 -o eth1 -m string --string "X-Kazaa" -m recent --name kazaa --set --rdest -j kazza-out

    (You may want to change "Kazaa" into mixed-case version. But you KNOW that. You have analized Kazaa packets, you know how kazaa's headers look like. You are netadmin, don't you?)
  • Make a transparent proxy for all outgoing port 80 traffic. Only allow it to forward valid http requests (not encrypted over port 80. By default http doesn't support encryption with the exception of www-authentication). This would block that port 80 connection. Second find out which servers it is connecting to and block them. Third block all its standard ports.

Slashdot Top Deals

"Protozoa are small, and bacteria are small, but viruses are smaller than the both put together."

Close