topic Re: Skype-Probe sessions increase dramtically when blocking skype in General Topics

Skype-Probe sessions increase dramtically when blocking skype

migration — Thu, 10 Mar 2011 08:28:47 GMT

Hi All,

Seem to be having a bit of a problem with skype-probe.

I have a PA-500 in Vwire mode behind a PIX FW, the customer wishes to block Skype traffic.

Observations:

1. On the ACC the ammount of skype-probe traffic far exceedes any other traffic in terms of sessions

2. The ammount of bytes of skype-probe traffic is roughly in relation to the amount of skype bytes

3. When enabling a skype only block rule (still allowing skype-probe) the active session count sky rockets

The sessions that increase dramatically are from skype-probe these sessions go from a current 4,000 sessions to 50,000+ in a matter of under a minute until the skype block rule is disabled.

Any help and insight will be greatly appreciated

Cheers

Marc

attached is screen shots of skype-probe session count for last hour

Re: Skype-Probe sessions increase dramtically when blocking skype

dwhyte — Fri, 11 Mar 2011 21:56:11 GMT

Please reference the "Controlling Skype" document in knowledge point from the support.paloaltonetworks.com support portal.

Re: Skype-Probe sessions increase dramtically when blocking skype

KGC — Sat, 12 Mar 2011 00:19:36 GMT

My understanding is that you need to allow skype-probe traffic through to establish a connection, and then block the actual skype traffic once the Skype client believes it has connected. This prevents Skype from going evasive, but it does create a confusing situation on the client where it appears to be connected successfully, yet calling does not actually work.

Re: Skype-Probe sessions increase dramtically when blocking skype

migration — Mon, 14 Mar 2011 07:07:39 GMT

skype-robe is allowed in a rule.

The rule set look like this:

Source Zone	Dest Zone	Source	Dest	Source User	Application	Service	Action
Trust	Untrust	any	any	any	skype	any	deny
Trust	Untrust	any	any	Known Users	Various Apps (Incl skype-probe)	any	allow

Before skype is disabled the session count for skype-proble is high, as soon as you deny skype on the PA the skype-probe sessions go through the roof, as said earlier from about 4k sessions to 40k sessions in seconds.

Re: Skype-Probe sessions increase dramtically when blocking skype

reaper — Mon, 14 Mar 2011 12:07:23 GMT

try setting the allow skype-probe rule before the block skype rule, this may help decrease the number of probe connections

Re: Skype-Probe sessions increase dramtically when blocking skype

migration — Tue, 15 Mar 2011 08:38:09 GMT

will give it a go and provide feedback once done.

Regards

Marc

Re: Skype-Probe sessions increase dramtically when blocking skype

migration — Wed, 16 Mar 2011 11:12:11 GMT

Hi,

With a skype-probe allow rule above the skype block rule, we still experience the same volume of sessions

Marc