topic Re: how to block mp3 ? in General Topics

how to block mp3 ?

LCMember4717 — Mon, 02 Jan 2012 14:30:41 GMT

hi ,

i just got a request from a custoer on how to block mp3.. so as currently PanOS doesnt detect it , can we add it as a signature ?

Re: how to block mp3 ?

rmonvon — Mon, 02 Jan 2012 18:48:49 GMT

You can write a custom app to detect .mp3 extension in HTTP. Enclosed is a custom appID to look for .jpg images written for PAN-OS verison 3.1.x. The signature is looking in the URI path and matching on the string ‘\.jpg HTTP’ without the quote. Typically the web request would look like this:

GET /images/twitter_corp.jpg HTTP/1.1\r\n

GET /images/logo.jpg HTTP/1.1\r\n

Please import this appID into the PA device and test. Once verified, you can clone the app and change the app to match .mp3.

Thanks.

Re: how to block mp3 ?

LCMember4717 — Tue, 03 Jan 2012 13:52:56 GMT

hi,

it did not work for the site which am testing for ill attach the screenshot, i also did several test on other site some of them show the extension up to .mp3 some not ...

Re: how to block mp3 ?

rmonvon — Tue, 03 Jan 2012 17:19:23 GMT

The custom signature is looking for pattern '.jpg HTTP' in the URI. If you changed the pattern to '.mp3 HTTP', then we are looking for this pattern and it must be an exact match. Your example has URI '...dh-wahshny.html HTTP/1.1' which does not contain '.mp3 HTTP'.

My suggestion will not catch all .mp3 files if the downloaded content does not end in .mp3 extension. You may want to contact your local Palo Alto account team and submit a feature request.

Thanks.

Re: how to block mp3 ?

Bart_Jocque — Fri, 06 Jan 2012 12:58:43 GMT

Maybe you try to make a data-filtering profile for the file-type mp3 ?

- Edit - seems indeed that mp3 is not amongst the supported file-types.

You could enter a feature request to add this file-type...

Message was edited by: Bart.Jocque

Re: how to block mp3 ?

LCMember4717 — Sun, 08 Jan 2012 08:18:26 GMT

well i dont think this even will work.. even if i tried to block a url with *.mp3 it wont work as some sites hide the extension from the url ..

Re: how to block mp3 ?

ksuuk — Mon, 30 Apr 2012 17:52:37 GMT

Now it does, mp3 and also mp4.

Re: how to block mp3 ?

mikand — Mon, 30 Apr 2012 18:54:45 GMT

Is it possible for you to attach your signature that works?

I think you must act on both fileextension aswell as mimetype if you write your own signature, something like:

fileext: .mp3

mime-type: audio/mp3 (or whatever its called)

however this can be evaded by using octet-stream as mime-type and then the client app will detect what this file is based on magic bytes.

If im not mistaken the file function in PA (when you select filetypes) will to both fileext, mimetype and magic bytes to detect files however the file detection in PA currently only works for http, ftp, smtp, pop3 and imap streams (if im not mistaken).

Re: how to block mp3 ?

ksuuk — Mon, 30 Apr 2012 19:56:56 GMT

No special signature, just now there's (I'm running 4.1.6) option to block mp3's and mp4's with File Blocking. See the attached image.

Re: how to block mp3 ?

LCMember4717 — Tue, 01 May 2012 14:10:02 GMT

it looks starting from 4.1.4 mp3 and mp4 can be added to file blocking profiles, i will test and update here guys.

Re: how to block mp3 ?

Asanka — Wed, 23 May 2012 06:09:08 GMT

Hi,

Still it is not working. Please try below and will it be there a perment solution?

http://www.hirufm.lk/musicdownloads/audio-93

Thanks,

Asanka