Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 7 replies
  • Subscribers 1 subscriber
  • Views 1297 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

[7.500] Skype being blocked

Tribmos
Upgraded to 7.5 today and now i'm receiving Intrustion Prevention Alerts for skype

Classification : Potential Corporate Privacy Violation IP protocol
Snort IDs : 5693, 5998

The packets are therefore getting dropped.  However skype is allowed and I cannot find the setteing that is causing the blocks.

under IM/P2P skype is set to "log"


This thread was automatically locked due to age.
Parents
  • 0
    2009:10:23-08:12:11 asg-lic snort[32022]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="P2P Skype client login startup" group="613" srcip="XX.XX.XX.XX" dstip="XX.XX.XX.XX" proto="6" srcport="45479" dstport="443" sid="5998" class="Potential Corporate Privacy Violation" priority="1"  generator="1" msgid="0"

    So from that i got 5998, there is another one but has 5693

    Unless those are the wrong values i need to put in the IntrustionPre->advanced->modify rule (disable)
Reply
  • 0
    2009:10:23-08:12:11 asg-lic snort[32022]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="P2P Skype client login startup" group="613" srcip="XX.XX.XX.XX" dstip="XX.XX.XX.XX" proto="6" srcport="45479" dstport="443" sid="5998" class="Potential Corporate Privacy Violation" priority="1"  generator="1" msgid="0"

    So from that i got 5998, there is another one but has 5693

    Unless those are the wrong values i need to put in the IntrustionPre->advanced->modify rule (disable)
Children