Fwd: Re: [LARTC] Intelligent P2P detection

Fwd: Re: [LARTC] Intelligent P2P detection

[Gordan Bobic]

On Tuesday 25 Mar 2003 08:08, Luman wrote:

[detecting P2P]

I am not sure, but you could potentially use tcpdump (patched if necessary)
 to monitor trafic. You could try to detect where there are lots of incoming
 requests to nodes on specific ports, the analyze those shortlisted packets,
 and if it is P2P, you could then bounce them. If you leep good logs of what
 you find, you could try to detect when the port floats away and re-configure
 your filters. You could also use port scanning to see if it is a genuine
 idle period or if the port has genuinely moved.

I hope your router is fairly heavyweight, as you will need a lot of power to
process and analyze packets in anything near real-time. Alternatively, you
could cheat. :-)

You could specify that traffic on certain well known ports (ssh, http(s),
 ftp, smtp, pop3(s), imap(s)) goes over the good link. You could then
 periodically check this traffic to make sure it is not masqueraded P2P.
 Everything else, you can divert over the cheap link and/or lower it's
 priority.

Effectively, you can white-list traffic, instead of black-listing it.

Good luck.

Gordan

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/