From: kurt kruegel (kurt@xxxxxxxxxxxx)
Date: Fri Feb 15 2002 - 17:04:54 GMT-3
good luck ,
since media players dynamicly find themselves a transport
h323 than tcp, udp
i didn't know they'll also try 80 , knowing everone in the world relies on 80
being there (what a nightmare)
i was going to say it would be best done on a pix by blocking outbound
media connection but 80 ,,,, ugh.
"Church, Chuck" wrote:
> Anyone,
>
> Has anyone had luck blocking Windows Media Player from streaming
> audio sites? I've been looking at Sniffer traces this morning, but don't
> see anything that NBAR could block. The first packet after the connection
> is established looks like this:
>
> GET /jazzfmstation HTTP/1.0
> Accept: */*
> User-Agent: NSPlayer/7.1.0.3055
> Host: mediaservices1.webpage-marketing.com
> Pragma:
> no-cache,rate=1.000000,stream-time=0,stream-offset=0:0,request-context=12856
> 9540
> ....
>
> After that, every packet coming from the server is interpreted as
> 'Graphics Data' by Sniffer, but is actually the compressed audio. Any
> ideas?
>
> Thanks,
>
> Chuck Church
> Sr. Network Engineer
> CCIE #8776, MCNE, MCSE
> US Tennis Association
> 70 W. Red Oak Lane
> White Plains, NY 10604
> 914-696-7199
This archive was generated by hypermail 2.1.4 : Thu Jun 20 2002 - 13:46:24 GMT-3