Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

As the IT administrator for my company I have been tasked with deciding what traffic to filter, shape, and othewise monitor on our network. What protocols, applications, and other network traffic do you commonly look for? Top items on our list for throttling or blocking based on bandwidth consumption and legality are bit-torrent, p2p, iTunes, blatant porn browsing, etc. From a technical standpoint this will be done using Cisco equipment such as a SCE or IPS.

share|improve this question

closed as off-topic by Magellan, Nathan C, mdpc, TheCleaner, Falcon Momot Sep 4 '13 at 18:37

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions seeking product, service, or learning material recommendations are off-topic because they tend to become obsolete quickly. Instead, describe your situation and the specific problem you're trying to solve." – Nathan C, mdpc, TheCleaner
If this question can be reworded to fit the rules in the help center, please edit the question.

Shopping Questions are considered Off-Topic here on ServerFault. Please see the Help section or Here for more info. If you are interested in having a way to ask these types of questions head over to the IT Shopping Questions Beta and post your question as a possible question for the beta and follow the proposal. – TheCleaner Sep 4 '13 at 18:28

Well, IMHO the best practice (for individual ports/protocols) is to filter EVERYTHING, and then selectively allow things. That will knock out a ton of stuff, and force your users to justify why they need X, Y, or Z.

Web filtering will have to be done via some sort of content filter (like Websence or similar), and those can be configured to death to block pretty much anything you want to block.

I personally hate content filters, but I can afford to be sanguine about them, since these days I'm always high enough on the tech totem pole to circumvent them. It's never a popular step, but it makes sense from both a security and a utilization standpoint.

share|improve this answer

Add in streaming media (YouTube/etc) although it may be more difficult to detect, depending on the solution you're using. It's also possible that someone somewhere may be able to give you a legit business case for some of these things (I'm of the belief that one can construct a legit business case for almost anything if one is sufficiently determined) so being able to define exceptions should be a prereq.

share|improve this answer

I use only SNMP enabled switches/routers and do MRTG graphs for everything. Then I use a Linux box as my gateway, and force all port 80 traffic to a Squid proxy via iptables, and use SARG reporting to see where people are surfing. You can block bittorrent ports, that can be defeated by tech-savvy users. I'd set up an iptables rule to look for "BitTorrent protocol" and force that through Squid.

share|improve this answer

DENY first, ALLOW second. only open the ports up that are critical to business (80/443, mail, etc). you can also run OpenDNS to do a lot of content blocking.

share|improve this answer

if you were tasked with deciding what traffic to filter, then you should look at your company's usage pattern instead, and make decisions based on that, and not on what others are doing and certainly not follow the "deny everything first" foolishness.

To help yourself with that you can start collecting network flows from your border router(s) during normal (non-filtered) usage and use them to analyze your utilization.

So here are some links to get you started:

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.