From mboxrd@z Thu Jan 1 00:00:00 1970 From: =?UTF-8?B?TGVvbmFyZG8gUm9kcmlndWVzIE1hZ2FsaMOjZXM=?= Subject: Re: [LARTC] shareaza Date: Sun, 11 Dec 2005 15:26:30 -0300 Message-ID: <439C6F56.6080107@solutti.com.br> References: <20051211144541.GA4079@ncrfgs3.ncrfgs> <439C462F.6050308@gmail.com> <20051211170044.GA4257@ncrfgs3.ncrfgs> <439C5E63.1060209@gmail.com> Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: <439C5E63.1060209@gmail.com> List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-bounces@lists.netfilter.org Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="macroman"; format="flowed" To: netfilter@lists.netfilter.org >> >> Is there any way to do that? How can I keep track of the >> traffic generated by shareaza only? >> > Perhaps you need something like l7-filter.sf.net ? > Maybe l7-filter is not necessary. For classifying P2P traffic, you=20 can use ipp2p module, available through patch-o-matic or newest code=20 from here http://ipp2p.org/ ! Seems that Shareaza is matched with --gnu !! [root@correio ~]# iptables -m ipp2p --help [ ........ ] IPP2P v0.7.2 options: --ipp2p Grab all known p2p packets --ipp2p-data Identify all known p2p download commands (obsolete) --edk [TCP&UDP] All known eDonkey/eMule/Overnet packets --dc [TCP] All known Direct Connect packets --kazaa [TCP&UDP] All known KaZaA packets --gnu [TCP&UDP] All known Gnutella packets --bit [TCP&UDP] All known BitTorrent packets --apple [TCP] All known AppleJuice packets (beta -=20 just a few tests until now) --winmx [TCP] All known WinMX (beta - need feedback) --soul [TCP] All known SoulSeek (beta - need feedback!= ) --ares [TCP] All known Ares - use with DROP only=20 (beta - need feedback!) --edk-data [TCP] eDonkey/eMule/Overnet download commands=20 (obsolete) --dc-data [TCP] Direct Connect download command (obsolete= ) --kazaa-data [TCP] KaZaA download command (obsolete) --gnu-data [TCP] Gnutella download command (obsolete) Note that the follwing options will have the same meaning: '--ipp2p' is equal to '--edk --dc --kazaa --gnu' '--ipp2p-data' is equal to '--edk-data --dc-data --kazaa-data --gnu-data= ' IPP2P was intended for TCP only. Due to increasing usage of UDP we=20 needed to change this. You can now use -p udp to search UDP packets only or without -p switch=20 to search UDP and TCP packets. See README included with this package for more details or visit=20 http://www.ipp2p.org Examples: iptables -A FORWARD -m ipp2p --ipp2p -j MARK --set-mark 0x01 iptables -A FORWARD -p udp -m ipp2p --kazaa --bit -j DROP iptables -A FORWARD -p tcp -m ipp2p --edk --soul -j DROP iptables -m ipp2p --help =20 [root@correio ~]# --=20 Atenciosamente / Sincerily, Leonardo Rodrigues Solutti Tecnologia http://www.solutti.com.br Minha armadilha de SPAM, N=C3=83O mandem email gertrudes@solutti.com.br My SPAMTRAP, do not email it