Unable to block Spotify App on a Mac-book

I read the thread about this and have done what is said, tarpit Spotify in Application Control. This is the paid version of Spotify downloaded on an Mac-book pro. The web site is blocked but they can open their application and play all they want. I've tired blocking known IP, I can see that Spotify is being blocked when they open the application, but this app can still play. It is getting around UT and streaming music. I have all the streaming blocked but the Spotify App has figured out a way around UT. Does anyone have a what to block this?

Located in the US. Using UT Build: 12.2.1 Full paid version.

What do you see in the session viewer? How did it identify the session and what metadata is present on the sessions?

Quote:

---

Originally Posted by dmorris

What do you see in the session viewer? How did it identify the session and what metadata is present on the sessions?

---

That is part of the problem. I don't see spotify in the reports as being passed. I do see it being blocked.

not the reports, the session viewer.
you need to look at the current sessions when running spotify.

it should look like this:
http://demo.untangle.com/admin/index.do#sessions

Quote:

---

Originally Posted by dmorris

not the reports, the session viewer.
you need to look at the current sessions when running spotify.

it should look like this:
http://demo.untangle.com/admin/index.do#sessions

---

I see. I will get the user back to try again get back with some information.

When you do, just look to isolate which sessions are related to spotify.
Are they http? https? over SSL? what does application control think they are?
If https - to what site? whats the cert?
its usually pretty easy to identify something about them that you can block without affecting other traffic.
its 99.9% they'll be http or https so you'll be able to block with web filter rules.

Quote:

---

Originally Posted by dmorris

When you do, just look to isolate which sessions are related to spotify.
Are they http? https? over SSL? what does application control think they are?
If https - to what site? whats the cert?
its usually pretty easy to identify something about them that you can block without affecting other traffic.
its 99.9% they'll be http or https so you'll be able to block with web filter rules.

---

There is nothing is listed with Spotify. There are several blank with IP only that i can see the data being used for the streaming. I block the IP that is streaming and spotify goes of line, then a few minutes later it comes back on line and there is a different IP with no indication of what the information is. It appears to be on port 80. The latest IP I blocked was 104.154.127.34 (104.154.127.0/24). It says there is no match under Application control lite. All the fields are blank under Application Control and Web Filter. I was able to get his to stop accessing spotify for now by blocking these IP's 104.154.126.38,104.154.127.205,104.154.126.7,104.154.127.230,104.154.127.181,104.154.127.0/24,104.154.126.2/24. I'm sure I did not do this correct and if Spotify adds and IP I will be out of luck. How can this traffic be identified?

you need to view the other information in that session.
If its port 80, what HTTP host is it? what URL? what user agent? etc you may need to manually add the columns using the drop down at the top to view the information you need.

Blocking by IP is not going to work.

Quote:

---

Originally Posted by dmorris

you need to view the other information in that session.
If its port 80, what HTTP host is it? what URL? what user agent? etc you may need to manually add the columns using the drop down at the top to view the information you need.

Blocking by IP is not going to work.

---

I did add the columns and they were blank. The Spotify app is invisible.

I'm using version 12.x I see you sent me a link to 13.x to take a look at the sessions. Does that make a difference?

Can you take a screenshot and circle the sessions in question?
They are blank? Are you running web filter?

Visually 13 is a bit different, but the information is the same.