Member Avatar for Duki

Hey everyone,

We (the place I work at) are getting a dedicated P2P T1 line to our main office. I'm not sure if this is going to be used for WAN traffic only, or also for internet.

If it is going to be used for internet, I want to block all P2P and bittorrent applications. I don't want anyone thinking, "Yay, T1... BitTorrent here I come!" and hogging up all the bandwidth.

My plan as of now is to use ACLs to block every port I can find that pertains to bittorrent or any other p2p client. Does anyone have a better suggestion?


Also, on a side note: how does streaming (i.e., if someone were to stream music or videos all day) affect internet speeds?

  • 4 Contributors
  • 5 Replies
  • 403 Views
  • 1 Year Discussion Span
  • Latest Post Latest Post by billythehamster

Dani AI

Generated

Good call raising this now, — a few practical steps and traps to avoid so a dedicated T1 doesn’t turn into a bandwidth free‑for‑all.

Port ACLs alone are fragile. Instead treat this as policy + enforcement + visibility. If the T1 will carry Internet traffic, segment it (separate VLANs/subnets) and apply edge policies; if the T1 is strictly for WAN links, route only the intended hosts to it. Since you mentioned a FireBox, enable its application/control and IPS features and keep those signature sets up to date (see ). That buys you the best chance of identifying P2P flows without relying on ports.

Concrete controls to deploy:

  • Apply application-aware blocking (UTM/DPI or app control) on outbound Internet policies; block or throttle P2P families.
  • Add per-host or per-subnet bandwidth caps and QoS so top talkers can’t starve business apps.
  • Use DNS/web filtering or proxying to block known torrent/tracker sites and to force HTTP(S) traffic through an inspection proxy.
  • Collect NetFlow/sFlow/IPFIX so you can find and isolate heavy users; then enforce via firewall or NAC.
  • If you’re on older gear (PIX 515E, ), supplement it with a proxy/UTM appliance or upgrade — PIX-era firewalls lack modern app-ID.

Testing and caveats:

  • Test in a lab before wide rollout. Validate by checking logs and flow records rather than trusting simple port denies.
  • Be aware of encrypted/obfuscated P2P: DPI can miss it, and SSL inspection has legal/privacy implications. Where detection fails, fall back to rate limits, user controls, and AUP enforcement.

Streaming impact: sustained audio/video consumes steady bandwidth (tens to thousands of kbps per stream depending on quality). Many concurrent streams will aggregate fast — use QoS and per-user caps to protect core services.

Recommended Answers

All 5 Replies

Member Avatar for bxperts

Are u using anykind of Hardware/Software firewall at the edge of your network???

If yes you have hardware firewall then it won't be difficult as firewall manufactures are providing IPS signatures to block your desired traffic.

If not then you can use software firewall on your NAT/Edge PC to block certain type of traffic.

Member Avatar for Duki

yes, we're going to be using FireBox

Member Avatar for billythehamster

You can run bit torrent on any port that you like. I even think that like MSN messenger it will default to port 80 to download stuff if it can't access the internet on any port. This means that it is not an application that can be stopped by denying certain ports you need something that is more intelligent.

If you are going to use a Firebox (Watchguard Firewall) I know they do a UTM version which should be able to block BitTorrent stuff. Check their documentation.

If not then you will need to invest in some kind of web proxy solution that can identify BitTorrent packets and not just block on a port by port basis.

Member Avatar for shaik_chan

We are using. . cisco pix 515e can any one tell me which ports i have to set to deny...

thanksin advance

Member Avatar for billythehamster

We are using. . cisco pix 515e can any one tell me which ports i have to set to deny...

thanksin advance

You can't block it just using a PIX 515 Bit Torrent works on any port including port 80 (www traffic). The only way to stop it is with a proxy server.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.