Endpoint Protection

 View Only

What do P2P Applications do and How to block Peer to Peer Applications (P2P) using Symantec Endpoint Protection? 

Oct 13, 2009 06:24 PM

 What is Peer to Peer (P2P) Application?

 P2P is nothing but just Peer to Peer networking. As we have Server - Client Model and Peer to Peer network in the same way these P2P applications work. You need a P2P program that will be installed on your computer it creates a community of P2P application users and it creates a virtual network between these users. For the user it will look as it is in a Peer to Peer network and he can share files from his local computer and download files shared by other users. It is very similar to our Instant Messaging like Yahoo, AOL or GTalk where even though to whom we are taking to are on a different network but a virtual network is created where it looks we are on a same network and we can share files and chat. The P2P application has been very much in demand from last couple of years. A P2P application is mainly used for sharing Music, Movies, Games and other files.

 What are the disadvantages of Peer to Peer (P2P) Application?

Is it estimated that for any given ISP 60 to 80% of their traffic is consumed by P2P traffic. So even in your office if people are using P2P application they will consume a huge amount of bandwidth without production.P2P application is very famous for distributing Pirated software. Your users might be using pirated software on their computers and Auditors will never appreciate that. Symantec Underground Economy says that "The annual global cost to businesses of software piracy in one 2007 study puts the cost at nearly $40 billion"

You can never trust the file you are downloading from a remote user in P2P environment.90% of the files contain malwares. Thus if your users are using P2P application there is very high rate of Virus Outbreak in your network that too very frequently. In 2008 10% of malware were propagated via P2P applications. Even the very infamous W32.Downadup also propagated and updated itself via P2P applications.

P2P is a very famous mechanism for distributing Bots, Spywares, Adware, Trojans, Rootkits, Worms and other types of malwares.

Since it is very easy to change the port for these P2P applications it is very difficult to block this traffic. It is strictly not advised to have P2P application allowed in your network. Enterprises should take measures to prevent P2P clients from being installed on any computers on the network. End users who download files from P2P networks should scan all such files with a regularly updated antivirus product.



How to block Peer to Peer Applications (P2P) using Symantec Endpoint Protection ?

There are 3 ways of blocking Peer to Peer Applications on your network using Symantec Endpoint Protection.

1. Blocking Peer to Peer Applications using Intrusion Prevention System

 Open Symantec Endpoint Protection Manager

Click on Policies -> Intrusion Prevention -> Edit Intrusion Prevention Policies .go to Exceptions -> Click on Add.

Then under Show Category scroll it down and Select Peer to Peer.

On the bottom right hand side of the policy click on Select all -> click next

Action -Block

Log - Log the Traffic

Click OK then Click OK on the policy and assign it to all the client groups.

Then Select All ->Click Next

Click Ok then OK on the Policy and then assign it to all the groups.

2.Blocking Peer to Peer Applications using Application Control of Application and Device Control

Since these Peer to Peer (P2P) Application is software installed on your computer so you can block the Process used for running these applications. As they are complete software so if the user tries to rename the main process name the application will not work. So you can block these processes using Application control.


For more help you can refer this Document:http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007092616264848


3. Blocking Peer to Peer Traffic using Symantec Endpoint Protection Firewall.

You can block the P2P traffic using Symantec Endpoint Firewall in this case even if the user has any P2P applications installed those applications won't be allowed to connect to the internet. Since it is very difficult to track the port number for the application as they can be easily changed by the user. So you can block the Inbound/Outbound traffic from the P2P processes.

In the Symantec Endpoint Protection Manager go to Policies -Firewall -Edit Firewall Policy - Rules- Add Rule -Click Next

In the Rule type select Application and click next

Select Define an Application and Click Next

In the File Name type the name of the process and click Next

Click Add More and add the name of other P2P application processes.

Click Finish.

Rename the rule to something like "Blocking P2P" so that you can identify.

Under Action change Allow to Block.

Under Logging Change it to "Write to Traffic Log".



Note : Most of the P2P application use Torrent file to download files from other P2P application so make sure when Creating a Firewall rule or Application Control rule block *.torrent file.

    List of Known Peer to Peer Applications and its main Process

Client Name
LimeWire.exe LimeWire p2p
emule.exe eMule p2p
kazaa.exe KaZaA p2p
zultrax.exe Zultrax p2p
Shareaza.exe Shareaza p2p
morpheus.exe Morpheus p2p
mlnet.exe MLNET Malware
kiwialpha.exe KiwiAlpha Spyware
KCeasy.exe KCeasy p2p
imesh.exe iMesh p2p
gnucleus.exe GNUCLEUS Malware
gift.exe Gift Virus/Worm
edonkey.exe eDonkey Malware/p2p
edonkey2000.exe eDonkey Malware/p2p
bittorrent.exe Bittorrent Torrent
BCDC++ .exe    
Ares.exe Ares Malware/p2p
abc.exe ABC Virus/Worm/Torrent
Azureus.exe  Vuze  p2p
bitcomet.exe BitComet Torrent/Malware
Pruna.exe Pruna Malware
Acquisition.exe Acquisition p2p/Malware
coolstreaming.exe Cool Streaming Malware/Torrent
ctv.exe CTV p2p/Malware
Tvants.exe Tvants Torrent
PPlive.exe PPlive p2p
peercast.exe Peercast p2p
iceshare.exe IceShare p2p

I have attached the Firewall and Application & Device Control policy to block P2P Applications.

0 Favorited
1 Files
zip file
Application and Filewall Policy.zip   24 KB   1 version
Uploaded - Feb 25, 2020

Tags and Keywords


Jan 06, 2014 05:58 AM


I don't have P2P rules in the dropdown, is there an update I should apply or download the ruleset from somewhere?

Jan 03, 2014 07:02 AM

"Thumbs up," adding another helpful cross-reference....

How to use Symantec Endpoint Protection to block or log legitimate but unauthorized software usage

Mar 08, 2013 12:26 AM

It was started working after restart the PC.

Feb 25, 2013 11:21 PM

I imported attached application and device control .dat file to block P2P applications. Applied to some group and then tested by installing and launching P2P applications e.g. bearshare.exe, utorrent.exe  on some Windows 2008 64 bit and I SEP client didn't block these applications.


Correct me if I'm testing it in wrong way?



Aug 22, 2012 06:12 AM

Yes that sounds great idea, but unfortunately it is impossible to do that by installing the SEP client v 12.1 as Unmanaged. am I right ?

Jun 02, 2012 03:45 AM

Great , VeryHelpfull Articalls, Thank you

May 08, 2012 07:21 AM


Very helpfull article.


May 03, 2012 07:47 PM

I don't know that there are soooo many p2p out there. I only knew limewire and utorrent.



Jan 17, 2012 09:29 PM

Can it also be applied to IP Messanger? Pls check and let us know.

Jul 20, 2011 09:49 AM

@ VK,


Please see this post - Firewall and Application Control Policy to Block Peer to Peer Applications


Make sure you apply the policy to your client(s). Note that you should also be running a client to protect your manager.




Jul 20, 2011 03:22 AM


Please do help me to block the p2p on my network, I am using Symantec Endpoint Protection manager, i configured SEP manager as detailed above, but still its not blocked.

May 07, 2010 09:21 AM

nice article

May 05, 2010 02:48 AM

If it was true that "90% of the files contain malwares [sic]", then P2P networks wouldn't be as popular as they are after a full decade on line. There are plenty of falsified, exaggerated and disingenuously presented statistics in the arguments of lobby groups so a good rule of thumb to keep in mind is that any factoid or number obviously intended to raise or work on people's fears deserves a healthy dose of scepticism and a hard second look at their source. Before quoting such numbers I would strongly advise any writer to consider the source and check to see if any authoritative and reliable research backs such claims. Simply repeating such claims as fact tends to erode one's own reputation and weaken one's arguments on their face; directly impairing your authority to enact policy on behalf of your company.
The real concerns about P2P for a business should be bandwidth usage as a matter of ownership and responsibility, not as a theoretical risk which could be doubted. On the topic of bandwidth many percentages are thrown about and extreme numbers such as "60 to 80%" reliably serve to identify those with a political agenda against P2P, nothing more. In a business environment bandwidth is to be used for business, not entertainment, and it is for that reason there should be no P2P usage at work at all, not for fears that it could theoretically have a negative effect. When you express it as a matter of present responsibility instead of as a theoretical risk against resources it becomes impossible to dispute or disagree on how much bandwidth is too much for personal use; because the possibility of personal use is no longer pitted against the needs of the company.
Malware is generally well covered by anti-virus defences and operating system policy enforcement against software installation by unqualified staff, which naturally would stop employees from installing P2P software as well. Such software-based policy enforcement would also reduce or eliminate the ability of malware to spread itself in a local network without human assistance. The greatest threat from malware remains to be targeted email attachments, the most recent example of which were directed against journalists in China and the military forces of India. Specifically crafted attacks tend to evade detection by anti-virus defences because nobody has signatures with which to recognize the custom software. Malware languishing on P2P networks does not enjoy such obscurity as alert eyes such as mine find and report them before they spread.
It is always easy to play on fears while advocating secure practices but it is far more effective to use sound reasoning and actual, supportable facts. You won't get full cooperation by employing weak arguments that only fool some of the people involved. Trying to work on fears with unreliable and unsupported statistics only results in resistance from the more intellectually mature and technologically knowledgeable members of your company, precisely the persons you should rely upon to show leadership and maturity in the workplace. That approach only results in a lack of grassroots support for policy, allowing resentment and distrust to grow when imposing a restriction or limit on the use of company resources. An approach which invites cooperation and trust with those that others look to for leadership is far more effective. Though it takes more care and thought at the start it tends to make your staff do most of your work for you by making security consciousness a part of your company culture, creating a positive environment where P2P usage becomes impossible and without creating resentment or resistance against policy.
Fear can be a powerful motivator for the moment but it's a bad foundation for company policy because it fades, healthy people are hard-wired to resist it and it rests on information which can be doubted or disproved. Make it a matter of ownership and responsibility and there's no struggle involved because you're not inviting debate on the facts.
P2P in itself is not risky. It is just another means of communication. When you manage your basic security needs such as keeping your anti-virus software current, only letting qualified staff install software and using only trusted sources for your software then you are properly protected from malware from all sources, no matter the form. If a company is not using this form of communication, such as for mass distribution of media or software updates, it does not belong on the company network. It's as simple as that. There's no need to rest on misinformation which was crafted to work on your fears.

Feb 05, 2010 07:27 PM

Thanks for the article especially for providing the zipped policies, it helped decrease garbage in our bandwidth.

Dec 17, 2009 01:52 PM

Sorry to beat a dead horse, but your pre-made policies saved me a lot of time!

Nov 22, 2009 03:27 PM


Thanks for posting this and many other articles!!!!!   

Nov 17, 2009 04:34 AM

Thank you vikram ist very useful for us.

Nov 12, 2009 02:22 AM


Nov 11, 2009 05:03 PM

thank you very much just implimented in our network you would be i was shocked by the sheer number of people using these in a work enviorment.

Nov 10, 2009 03:33 AM

I dont think it accepts importing or exporting a list, but I think it's better to add it one by one, so that it is controlled and for documentation purposes.

Nov 08, 2009 04:52 PM

I have taken this information and added it to my production envirionment and have made life easier and for myself. Thanks a million.

Nov 05, 2009 01:43 AM

is there a way wherein I will not input the exe file one by one in the Application control config?

Nov 01, 2009 12:21 PM

Thanks for the article...
This is truly benificial...

Oct 14, 2009 05:00 PM

This is really very helpful

Oct 14, 2009 10:21 AM

Great article Vikram. I am always telling my kids and their friends how they put their systems and home networks at risk when using P2P.  Most kids don't seem to care about these threats until their parents have been hit by something that they allowed into their home network by using some P2P application. I will make sure my teenager continues to spread the word at school about the threats of P2P filesharing.


Oct 14, 2009 06:54 AM

Nice article... 

Related Entries and Links

No Related Resource entered.