Layer 7 filtering

[Marcin Jessa]

Hi guys.

As many of you may know it's PITA to filter bittorrent traffic.
One of the most successful ways is to inspect layer 7 packets.
Is this possible with any of firewalling systems avaliable for NetBSD?

Cheers,
Marcin.

--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-***@muc.de

[Michael Richardson]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Marcin> As many of you may know it's PITA to filter bittorrent
Marcin> traffic. One of the most successful ways is to inspect

Don't. It won't work. People and programs are way too adaptable.

Marcin> layer 7 packets. Is this possible with any of firewalling
Marcin> systems avaliable for NetBSD?

QoS the traffic that you care about to an appropriate level of
service.

- --
] ON HUMILITY: to err is human. To moo, bovine. | firewalls [
] Michael Richardson, Xelerance Corporation, Ottawa, ON |net architect[
] ***@xelerance.com http://www.sandelman.ottawa.on.ca/mcr/ |device driver[
] panic("Just another Debian GNU/Linux using, kernel hacking, security guy"); [

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
Comment: Finger me for keys

iQEVAwUBRDR/2ICLcPvd0N1lAQK1NQf/Tf0fS6qsbovM6Y8MS3uBSy28PUfX5N8t
/2N7Tpdr1pe6Qw/+/+nRRCb2MtjnKMFRqZ0G02wZlhRV4LobroTDz1jdYmbp3WSN
vxS52Mcet1tBOJiTFNn/rcUePpRKlhXFf90rxkN0VASICIQjL8Ey3ZqINNLfDYk9
nA0mN4PvxZ0NST7GWOVOHr7hm0bzcnbJ/DPhinTX0y+wZSQSt07c4bsIuaqtsCGa
YseKsIZHpz8uRk0TPuaMLkNpRsM8qC9HPaLWCcSlfdmbMwrjwHVXdR2cgzhgry1j
S7747YFMHGrzEQ1Cro/4ZFyzf4FZBjLhL0ubW8qe6r0VpHDEvnaWyw==
=AwJ5
-----END PGP SIGNATURE-----

--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-***@muc.de

[Marcin M. Jessa]

Post by Michael Richardson
Marcin> As many of you may know it's PITA to filter bittorrent
Marcin> traffic. One of the most successful ways is to inspect
Don't. It won't work. People and programs are way too adaptable.

I both agree and disagree. I know of products which can filter at application
level with success. There are always walk arounds but they're hard to figure
for a "normal" user.

Post by Michael Richardson
Marcin> layer 7 packets. Is this possible with any of firewalling
Marcin> systems avaliable for NetBSD?
QoS the traffic that you care about to an appropriate level of
service.

This is not doable without being able to match layer 7 traffic.
You cannot really do this for specific ports (80,443 etc.) as these ports can
be (ab)used for something else than what's intended.



Cheers,
Marcin.


--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-***@muc.de