Meraki

pclark · ‎Oct 12 2017

I don't have any other systems but the IDS is able to give me the name of the song being downloaded over the BT client so I'm pretty sure it's legit. I guess I still don't see how an AP that is bridged is generating false positives that my IDS sees as outgoing Internet traffic. The AP is sending traffic but because all the traffic of the clients is going through the AP it makes sense that my IDS would Identify the AP as the device with the BT client on it from my way of thinking.

pclark · ‎Oct 12 2017

I wouldn't think it's not so much a false positive but rather there is a device behind/connected to the AP using bit torrent but because we are "bridging" my AP is what shows up on the IDS as the device using BitTorrent. I need to understand why the Layer 7 rules isn't blocking the device using BitTorrent/P2P once the traffic hits the AP.

pclark · ‎Oct 12 2017

We are bridging the wireless clients. I have instituted a Layer 7 firewall rule but that is why I'm asking because it doesn't seem to be working. I'm confused when you say I could be getting a false positive? Are you saying that the false positive is indeed BitTorrent traffic but it's not really on my wireless LAN because of the way it's configured? Thanks.

pclark · ‎Oct 12 2017

We have an IDS system that keeps detecting BitTorrent on our wireless network. The IP that comes across is an AP IP address. I look at the AP identified on the IDS log and don't see "BitTorrent" or P2P traffic from any clients but we have a lot of clients and could be missing it. I've added P2P networks to the Application firewall for the AP's but I'm still getting notified of BitTorrent traffic on my wireless network. Can anyone think of why my firewall rule may not be working correctly?

Meraki

Community

About pclark

pclark

Community Record

Badges

Re: Blocking P2P on wireless

Re: Blocking P2P on wireless

Re: Blocking P2P on wireless

Blocking P2P on wireless