Layer-7 Packet Classifier for Linux 0.4 (Userspace)

Layer-7 Packet Classifier for Linux is a classifier for Linuxs Netfilter that identifies packets based on application layer data. It can classify packets as Kazaa, HTTP, Jabber, Citrix, Bittorrent, FTP, Gnucleus, eDonkey2000, etc., regardless of port. It complements existing classifiers that match on IP address, port numbers and so on.
Our intent is for l7-filter to be used in conjunction with Linux QoS to do bandwith arbitration ("packet shaping") or traffic accounting.
Main features:
- Patches for Linux 2.4 and 2.6
- Support for TCP, UDP and ICMP over IPv4
- Uses Netfilters connection tracking of FTP, IRC, etc
- Examines data across multiple packets
- Number of packets examined tunable on the fly through /proc
- Number of bytes examined tunable at module load time
- Distinguishes between new connections (those still being tested) and old unidentified connections
- Gives access to both Netfilter and QoS (rate limiting) features
- With the Netfilter "helper" match, you can distinguish between parent and child connections (e.g. ftp command/data)
Enhancements:
- Added man page.
- Added ./configure to check for libraries.
- Made patterns directory user selectable.
- Counts all packets now, not just those with application layer data. I think this is better because it avoids holding connections forever if they keep sending empty packets. On the other hand, now connections can evade l7-filter by sending a bunch of empty packets at the beginning. Perhaps a more complex approach may be necessary at some point.
- Made number of packets user selectable. Defaults to 10 (not 8).
- Organized pattern file parsing code better.
- Made buffer length user selectable. Made buffer dynamically allocated. It is now only kept when needed instead of for the whole life of the connection. Buffer is dumped to the screen (if in verbose mode) when (1) too many packets have passed without a match or (2) connection is closed without a match.
- Now checks for ip_conntrack_netlink module.
- Various tweaks.
Enhancements:
- Using only part of the Netfilter packet mark, defined by a bitmask, is now allowed.
- The configure script was improved.