Prioritize packets at user space

Prioritize packets at user space

[Ling Deng]

Hi there,
    I am doing a project on VoIP security. I need to implement a
Application layer gateway on top of the linux firewall. But I have no
clue how to do it, I hope someone can help me with it.

    The current firewall uses IP_QUEUE to pick up a packet,
authenticate it, then do something with the packet, and forward the
packet to the server. However, IP_QUEUE only has a single FIFO queue
(is this correct?), if the system is under a flooding attack, this
firewall can't help to reduce the effect of the attack.

    I want to add a priority on the firewall. To prioritize the
packets, deep packet inspection is needed, then packets need to be put
in different queues depending on the caller and callee numbers.

    Could anyone please give me some suggestion on how to make this happen?

    Thank you very much,

        Ling

Re: Prioritize packets at user space

[Grant Taylor]

On 3/5/2008 11:00 PM, Ling Deng wrote:
> I want to add a priority on the firewall. To prioritize the packets, 
> deep packet inspection is needed, then packets need to be put in 
> different queues depending on the caller and callee numbers.

If you can separate out the calls or mark them somehow, you could use 
Traffic Control to divide things in to different queues for you.  I'd 
suggest looking at SIP Express Router (presuming you are using SIP) as a 
local gateway to route the calls.  If you can get S.E.R. to either mark 
the packets of a call or to send them to different destinations (IP and 
/ or port) you could then use TC to prioritize.  You just have to help 
get the traffic split out (de-multiplexed) so that TC can work with it. 
  Presently TC does not (to my knowledge) have any way to identify what 
calls are what.  However I suppose you could get really creative with 
either the u32 or layer 7 matches and look for specific strings in the 
packet stream and decide what to do with them that way.  If you can get 
IPTables match extensions to differentiate your calls, you can mark them 
so that TC can work with them.

> Thank you very much,

You are welcome, and good luck.



Grant. . . .