Need some help with snort

hdavy2002 · Aug 9, 2009, 3:40 AM

HI all,

Greetings. I have been using snort on the WAN side. It does it's job in blocking IP of offenders. I was thinking of using it on my LAN side.

I tried once and it was blocking IP of my users. The problem was that quite often users would call me saying that they cannot access the internet. So I would have to go manually and unblock them.

Snort is great, I was wondering, if there is anyway, snort could be used to block just the application rather than whole users computer.

I hope you understand what I mean, lets say: I enable block skype, then snort should only block skype, rather than completely blocking the users computer from accessing the internet.

Any suggestions?

Thanks all.

serialdie · Aug 9, 2009, 4:04 AM

To accomplish that you nee to block the protocols or ports.

memodan · Aug 10, 2009, 3:24 AM

@serialdie:

To accomplish that you nee to block the protocols or ports.

Is it possible to clarify

thanks