# How to block all traffic which matches BitTorrent-DHT? **URL:** \ **Category:** Help\ **Created:** [October 9, 2023, 6:53pm UTC](https://forum.suricata.io/t/how-to-block-all-traffic-which-matches-bittorrent-dht/4034 "2023-10-09T18:53:39Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![juef](https://avatars.discourse-cdn.com/v4/letter/j/c37758/32.png) [@juef](https://forum.suricata.io/u/juef)\ **Post date:** [October 9, 2023, 6:53pm UTC](https://forum.suricata.io/t/how-to-block-all-traffic-which-matches-bittorrent-dht/4034/1 "2023-10-09T18:53:39Z")
Hi, I’ve created a rule ```auto drop bittorrent-dht any any -> any any (msg: "Block torrent traffic"; priority:1; sid:1000000; rev:1;) ``` in logs it’s marked as `"action":"blocked"`, however traffic is not blocked, BitTorrent-DHT still works. Web-viewer: evebox Suricata version: 7.0.0 OS: Debian GNU/Linux 12 (bookworm) Installed from backports packages. IPS/inline mode using nftables. **UPD** I’ve replaced `alert` by `drop` for rules that detect such traffic, i.e.: ```auto sed -e '/torrent/Is/^alert/drop/g' \ -e '/dht/Is/^alert/drop/g' \ /var/lib/suricata/rules/suricata.rules \ > /var/lib/suricata/rules/custom.rules ``` But still no luck, torrents are not blocking. ![2023-10-10_13-55](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/2X/4/456b112be9d21fcbba1587700f4018381844fe67.png) ---
**Author:** ![Andreas\_Herz](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/andreas_herz/32/52_2.png) [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)\ **Post date:** [October 26, 2023, 8:11pm UTC](https://forum.suricata.io/t/how-to-block-all-traffic-which-matches-bittorrent-dht/4034/2 "2023-10-26T20:11:44Z")
How are you running Suricata and how does the config look like? Changing the rules is not enough, you need to make sure that you run IPS mode instead of IDS. ---
**Author:** ![juef](https://avatars.discourse-cdn.com/v4/letter/j/c37758/32.png) [@juef](https://forum.suricata.io/u/juef)\ **Post date:** [October 26, 2023, 9:00pm UTC](https://forum.suricata.io/t/how-to-block-all-traffic-which-matches-bittorrent-dht/4034/3 "2023-10-26T21:00:05Z")
nftables snippet: ```auto table inet filter { chain forward { type filter hook forward priority 0 queue flags bypass,fanout to 0-1 policy accept } } ``` In `/lib/systemd/system/suricata.service` I’ve replaced `ExecStart` by: ```auto ExecStart=/usr/bin/suricata -D -c /etc/suricata/suricata.yaml --pidfile /run/suricata.pid -q 0 -q 1 ``` Is it enough to run it in IPS mode? However, for sure, blocking other requests via `dns.query`, `http.host`, `tls.sni`, and `quic.sni` (by the way, what is the equivalent for `http2` to block some host?) is working. ---
**Author:** ![juef](https://avatars.discourse-cdn.com/v4/letter/j/c37758/32.png) [@juef](https://forum.suricata.io/u/juef)\ **Post date:** [October 26, 2023, 9:10pm UTC](https://forum.suricata.io/t/how-to-block-all-traffic-which-matches-bittorrent-dht/4034/4 "2023-10-26T21:10:50Z")
Config file is almost default: [suricata.yaml](https://forum.suricata.io/uploads/short-url/lX6jDL43EFEyAeRqPtGDuxYg9R7.yaml) (82.1 KB) `bittorrent-dht` enabled ---
**Author:** ![Andreas\_Herz](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/andreas_herz/32/52_2.png) [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)\ **Post date:** [October 30, 2023, 4:50pm UTC](https://forum.suricata.io/t/how-to-block-all-traffic-which-matches-bittorrent-dht/4034/5 "2023-10-30T16:50:14Z")
Can you provide the stats.log as well as the related eve.json output for those flows that should have been blocked, and also the alert event? ---
**Author:** ![juef](https://avatars.discourse-cdn.com/v4/letter/j/c37758/32.png) [@juef](https://forum.suricata.io/u/juef)\ **Post date:** [November 13, 2023, 10:11pm UTC](https://forum.suricata.io/t/how-to-block-all-traffic-which-matches-bittorrent-dht/4034/6 "2023-11-13T22:11:22Z")
Sorry for the late reply. (eve.bittorrent-dht.json filtered by `grep torrent < eve.json | perl -pe 's|"src_ip":".*?"|"src_ip":""|g' | perl -pe 's|"dest_ip":".*?"|"dest_ip":""|g' | perl -pe 's|ipv6=.*?"|ipv6="|g'`) With only ```auto sed -e '/torrent/Is/^alert/drop/g' \ -e '/dht/Is/^alert/drop/g' \ /var/lib/suricata/rules/suricata.rules \ > /var/lib/suricata/rules/custom.rules ``` [eve.bittorrent-dht.json](https://forum.suricata.io/uploads/short-url/fVZNzPPG3v7hK5mIkrD6gOi5V45.json) (100.1 KB) [stats.log](https://forum.suricata.io/uploads/short-url/vqOjPKNIMV5FCT2LjWZBJaMBRSU.log) (83.3 KB) Torrent that was already added was downloading. With additional rule: ```auto drop bittorrent-dht any any -> any any (msg: "Block torrent traffic"; priority:1; sid:1000186; rev:1;) ``` [stats.log](https://forum.suricata.io/uploads/short-url/tWjcxRV2wNURlvz9Uqd8puKeiZ8.log) (53.8 KB) [eve.bittorrent-dht.json](https://forum.suricata.io/uploads/short-url/hz24yOV4egkB7WRQLiWuuVcMaG5.json) (96.7 KB) New torrent wasn’t downloading (as http tracker gives no response). Tested with [debian torrent](https://cdimage.debian.org/debian-cd/current/amd64/bt-cd/) and [transmission client](https://github.com/transmission/transmission). However if torrent was added via magnet URL, then run it without suricata for some time, and then again with suricata, torrent still downloading. ---
**Author:** ![Andreas\_Herz](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/andreas_herz/32/52_2.png) [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)\ **Post date:** [December 12, 2023, 9:13pm UTC](https://forum.suricata.io/t/how-to-block-all-traffic-which-matches-bittorrent-dht/4034/7 "2023-12-12T21:13:23Z")
> [@juef](#): > > However if torrent was added via magnet URL, then run it without suricata for some time, and then again with suricata, torrent still downloading. So for new connections the block works but for established connections it does not work? ---
**Author:** ![Atharv\_Deshpande](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/atharv_deshpande/32/2688_2.png) [@Atharv\_Deshpande](https://forum.suricata.io/u/Atharv_Deshpande)\ **Post date:** [February 20, 2024, 10:12pm UTC](https://forum.suricata.io/t/how-to-block-all-traffic-which-matches-bittorrent-dht/4034/8 "2024-02-20T22:12:33Z")
yes exactly, any suggestions on how can i patch this problem