IPP2P. How to set the max length of the analyzed data?

IPP2P. How to set the max length of the analyzed data?

[Egorkin Igor]

Hello!

 From http://l7-filter.sourceforge.net/HOWTO-kernel

 > By default, l7-filter looks at the first 10 packets or 2kB, whichever 
is smaller.
 > You can alter the number of packets at any time through 
/proc/net/layer7_numpackets.
 > (i.e. "echo 16 > /proc/net/layer7_numpackets".) In l7-filter versions 
2.0 and forward,
 > you can alter the number of bytes at module load time: "modprobe 
xt_layer7 maxdatalen=N".
 > (ipt_layer7 in old versions), where N is in bytes.
 > This should be used cautiously, since performance may decrease 
drastically with larger data sizes.
 > To prevent you from accidentally bringing down your network, there is 
an artificial limit of 65536 imposed.


I could not find a similar option for IPP2P.
May be inside the module already exists some limits?

-- 
Igor

Re: IPP2P. How to set the max length of the analyzed data?

[Andrew Beverley]

On Sat, 2013-02-16 at 17:37 +0400, Egorkin Igor wrote:
> I could not find a similar option for IPP2P.
> May be inside the module already exists some limits?

IPP2P is not maintained anymore. Have you looked at nDPI instead? I've
never tried it, but it seems to be the packet inspector du-jour.

Andy

Re: IPP2P. How to set the max length of the analyzed data?

[Egorkin Igor]

On 02/16/2013 06:39 PM, Andrew Beverley wrote:
 > IPP2P is not maintained anymore. Have you looked at nDPI instead?
 > I've never tried it, but it seems to be the packet inspector du-jour. 
Andy

nDPI is hard to compile with netfilter.
OpenDPI is not available anymore.

IPP2P is distributed with Debian/Ubuntu (xtables-addons package), so 
minimum compiling required.

-- 
Igor