Application Signature

[MedoZero]

Hi again ;)
What about application signature , i mean can snort prevent application that use HTTP to connect thought it . p2p have these HTTP signature which can be seen and prevented by other firewall like MS-ISA . I am not here talking only about p2p , no i talk also about ppl who use proxies to connect their chat application ( Yahoo-MSN-ICQ etc ) and bypass snort chat rules . So any ideas?

[Cry Havok]

Snort is an IDS/IPS, not a proxy.  I assume you meant Squid?  Squid can block by user agent.