topic Re: Application dependency in General Topics

Application dependency

clyde.franklin — Thu, 09 Mar 2017 21:22:10 GMT

if I'm denying BitTorrent traffic do I need a rule as well for its web-browsing dependacy?

Re: Application dependency

reaper — Thu, 09 Mar 2017 21:48:53 GMT

yes

you'll need a rule where web-browsing is processed so when bittorrent sends out it's http connections it can get allowed as webbrowsing at first, but then blocked when the application morphs into bittorrent

Re: Application dependency

TranceforLife — Sat, 11 Mar 2017 19:21:11 GMT

Hello All,

Does it mean that l need both applications "bittorrent" and "web-browsing" inside one rule with action deny? Will it match with my usual (normal) web-browsing traffic that will be denied as well?

Re: Application dependency

reaper — Mon, 13 Mar 2017 09:31:51 GMT

no they don't need to be in the same rule, you just need web-browsing somewhere in the policy (preferably below the bit-torrent block rule)

it's because bit-torrent uses http to get to certain parts or as a file transfer method, but just like most web-based applications (facebook,...) it starts out as a normal web-browsing session that only becomes 'bad' after a few packets (once AppID sees torrenting)

once AppID recategorizes your app, a session that was first allowed for web-browsing on rule #2, will now go through another security policy check and hit rule #1 which blocks bit-torrent