Re: Feasability of Protocol Filtering

[Eicke Friedrich <tady@gmx.net>]

Matt Skidmore wrote:
> the downside to this is, say you want to reject SSH traffic. you
> issue the command to reject it based on protocol. if there is a
> connection already in progress it probably wouldnt get it unless
> there are some telltale signs in the data packets, but since you 
> can at least identify the initial connection packets you could at
> least stop additional connections.
Yes, you are absolute right. But i don't see a way to change this. For
p2p the already
established connections are not worth any effort. At some point the
file is completly
transfered (kazaa) or the transfered segment has to be acknowlegded
(edk). My match will
find this ack and treat the following packets as p2p-traffic.

> I would be interested in seeing what you have so far. as for CPU
> and RAM concerns, I thought about this a bit myself. it could also
> intoduce latency as well.
I can send you the source-code if you want to.

Regards,
Eicke.