[ANNOUNCE] Layer-7 Filter for Linux QoS

[Ethan Sommer]

We have written a filter for the QoS infrastructure that looks at the 
data segment of packets and uses regular expressions to identify the 
protocol of a stream of traffic regardless of port number.

Many peer-to-peer programs (such as Kazaa and Gnucleus) will change to 
use a different port (including well known ports such as, say, 80) if 
they find that they can get better throughput there. That means that the 
port based filtering is no longer sufficient. However, by analyzing the 
application layer data, we can differentiate Kazaa from non-Kazaa HTTP, 
and lower the priority of whichever we deem to be less important. :)

It is a filter in the existing QoS infrastructure, so it can be used in 
conjunction with u32 filters, HTB or CBQ scheduling, SFQ queueing etc, 
etc...

Commercial companies sell devices which do layer-7 classification for 
anywhere from $6000-$80,000 depending on the bandwidth required. If we 
can build a comprehensive set of patterns I don't see any reason why 
Linux can't beat the pants off the commercial devices; we already have 
excellent queueing, and scheduling.

Our home page is http://l7-filter.sourceforge.net/ but if you want to 
skip right to the downloads go to 
http://sourceforge.net/projects/l7-filter/ (there is a kernel patch, a 
patched version of tc, and some sample patterns for HTTP, POP3, IMAP, 
SSH, Kazaa, and FTP.) You'll notice the patch is a somewhat large, most 
of that is regexp code.

We're still working on it. It currently only does TCP for example... Do 
you guys/gals have any comments/suggestions/etc? I suspect that this is 
a post 2.6 thing, but it is very non-invasive (it only adds approx. 2 
lines of code that would affect anything if the user were not using the 
layer-7 filters,) so I still have a little bit of hope.

Ethan Sommer
Matt Strait
Justin Levandoski