Wireless Access

 View Only

  • 1.  DPI and bittorrent

    Posted Oct 25, 2022 02:42 PM
    Edited by brownco Oct 25, 2022 03:59 PM

    Hello, we have a segregated network that is just for wifi and we received a DMCA from the ISP about bittorrenting from one of the wifi users.  Our fortinet firewalls don't have the licensing for blocking applications at that level so I enabled DPI on the Aruba6.5 controllers and added the following policies 2 weeks ago:


    IPv4 any any appcategory peer-to-peer     deny
    IPv4 any any app bittorrent                         deny
    IPv4 any any app bittorrent-application     deny
    IPv4 any any app bitvaulttorrent                 deny


    I turned logging and I don't see anything triggering the firewall deny policy I've added; however, we have received another DMCA notice.


    Any thoughts on how I can identify the device/user that is hosting bittorrent files on the network if the firewall isn't catching it? Or, has anyone added additional rules that may help?

    (I have about 75 APs and an equal number for RF protect and PEF licenses)

    Thanks!



  • 2.  RE: DPI and bittorrent
    Best Answer

    Posted Oct 25, 2022 03:31 PM

    Brownco,

    Maybe time for a Wireshark packet capture. Likely on the suspect controller or the wired uplink. I found this reference for bittorrent specific filters:

     

    https://www.wireshark.org/docs/dfref/b/bittorrent.html

     

    I hope this helps.

    Thanks,

    Brad

     






  • 3.  RE: DPI and bittorrent

    Posted Oct 26, 2022 08:16 AM
    Could it be that the drops happen on your first rule, appcategory peer-to-peer? That does not have a log.

    Also, protocols like Bittorrent try to avoid firewalls, detection, and change their behavior to achieve that. Being on the most recent firmware on your controller may improve detection as well.

    I'm not sure if you can expect a 100% detection/block on Bittorrent. Having a case opened with TAC may have that question answered.

    ------------------------------
    Herman Robers
    ------------------------
    If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

    In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
    ------------------------------



  • 4.  RE: DPI and bittorrent

    Posted Oct 26, 2022 12:28 PM
    Hi Herman, thanks for pointing that out.  I have re-added the first rule and included logging. Does this mean if a device triggers this rule it will show up in Controller > Firewall Hits  ?  I also turned on "Blacklist" if triggered but haven't seen anything in Controller > Blacklist Clients yet so I think somehow this persons bittorrent client is finding away around the aruba detection as you mentioned.
    Original Message


Related Content