topic Re: Torrent in General Topics

Torrent

HartkentlyNua — Thu, 07 Nov 2013 08:16:57 GMT

Hello Guys,

Have anyone of you noticed something regarding torrent(bittorrent, transmission..etc..)?

We received a report that a torrent app which is transmission is able to evade the app detection of Palo Alto NGFW.

I tested it in my lab, I use Bittorrent and I saw that it can really breach Palo Alto NGFW and successfully downloaded a file.

We traced the logs and sessions, we noticed that these torrent is using other app such as teredo, unknown-tcp, and unknown-udp.

I don't know if this has happened before but its new to me. We are expecting that if we block bittorrent, we dont have to block other apps, Isn't that how it should work?

Thank you.

Regards,

Hartkently

Re: Torrent

kadak — Thu, 07 Nov 2013 16:27:25 GMT

Hello Harkently,

What content version is your PAN firewall running on ?

Regards,

Kunal Adak

Re: Torrent

Phoenix — Fri, 08 Nov 2013 00:39:08 GMT

Hello Torrent,

If the application was not identified properly there are couple things which may have happened

> The application would have changed their signature which is not updated on PAN apps content yet

> There may be an issue in identifying the app because bittorent opens predict session and tries to map the child sessions as the traffic flows.

For any further clear analysis it would be nice to take flow basics and packet captures to understand what was the traffic and how the PAN analysed the apps to narrow down the issue.

Thanks

Re: Torrent

HartkentlyNua — Fri, 08 Nov 2013 04:52:43 GMT

Hi Kunal,

currently the content version is 404-2015, I believed that is the latest update..

Thanks.

Regards,

Hartkently

Re: Torrent

HartkentlyNua — Fri, 08 Nov 2013 04:54:34 GMT

If I'm not mistaken there hasn't been any update regarding bittorrent these past few weeks. I tried relaying this to PAN but what we did was just take the other app that bittorrent uses and put it on the block list. that way we are able to control bittorrent again.

thanks..