OK, here's my problem. I am trying to block the IM feature of Google. In GMail, you can 'reply in chat', and IM between people. You can also download googletalk.exe and run that IM. I have successfully blocked AIM, yahoo, MSN, and ICQ, but GTalk is kicking my butt!

I've done internet searches, and some suggestions were to block talk.google.com:443 and talk.google.com:5522. I use a web filter program called Sentian N2H2, and I blocked those web sites.

As a further step, I spoofed the DNS name pointing talk.google.com to 127.0.0.1. So, pinging that name resolves to the loopback adress.

None of that works......

I installed googletalk, and signed in sucessfully. When I run a netstat, I see this:

TCP MIS_004:1764 po-in-f125.google.com:5222 TIME_WAIT
TCP MIS_004:2176 an-in-f166.google.com:http ESTABLISHED
TCP MIS_004:2184 mail.comcast.net:pop3 TIME_WAIT
TCP MIS_004:2186 od-in-f147.google.com:https TIME_WAIT
TCP MIS_004:2187 od-in-f147.google.com:https TIME_WAIT
TCP MIS_004:2190 po-in-f125.google.com:5222 ESTABLISHED
TCP MIS_004:2191 eo-in-f189.google.com:http LAST_ACK

It appears to me that google talk somehow streams its list of servers to the client and tries to connect to them.

This is a complex issue and google is out-geeking us. I need to block GTalk, yet leave google.com and Gmail open. Anyone have any ideas?

John Carr
Network Analyst

Let me also mention what I think the real problem is here.

I believe that GTalk has been rewritten since many of these blocking solutions on the net have been posted. One solution mentioned 4 IP addresses on 4 different ports you needed to block. Fine. We went into our internet router (cisco 1841) and blocked those IP's. We thought we had it working, becuase when I went to sign it, it looked like it was timing out. But after about 2 min, GTalk found a way to get in! Grrrr. a netstat command showed new google servers with DIFFERENT IP addresses.

So, the question is, is there a list of google servers out there?

Or better yet, is there a way to block *-in-*.google.com? Those wildcards don't seem to work, or I haven't found a way to do it. Maybe I'm overcomplicating it. Maybe there's a simple solution.

John Carr
Network Analyst

My new Linksys wrvs4400n's block google talk by clicking a radio button.

looks to me like you should be blocking port 5222 on the router

Imagine the power if you knew how to internet search

You might want to contact support services for Sentian N2H2, to find out if you're able to block "*-in-*.google.com", with wildcards.

Also, you should run a packet capture from your machine, to find out what is really going on here. Ethereal or Wireshark will do the packet sniff task.

I'll look into that, but I think N2H2 is our web filter and only handles http requests. I don't think googletalk uses http requests to connect.

John Carr
Network Analyst