[Top] [All Lists]

[Fwd: [ANNOUNCE] Layer-7 Filter for Linux QoS]

To: linux-net@xxxxxxxxxxxxxxx
Subject: [Fwd: [ANNOUNCE] Layer-7 Filter for Linux QoS]
From: "David S. Miller" <davem@xxxxxxxxxx>
Date: 18 May 2003 20:01:39 -0700
Cc: netdev@xxxxxxxxxxx, sommere@xxxxxxxxxxx
Sender: netdev-bounce@xxxxxxxxxxx
I'm forwarding Ethan's announcement here.  Ethan, you'll get
better reception to your ideas if you post them to the correct
place.  Most networking hackers do not read linux-kernel due to
the sheer volume of traffic there :-)

David S. Miller <davem@xxxxxxxxxx>
--- Begin Message ---
To: linux-kernel@xxxxxxxxxxxxxxx
Subject: [ANNOUNCE] Layer-7 Filter for Linux QoS
From: Ethan Sommer <sommere@xxxxxxxxxxx>
Date: Sun, 18 May 2003 21:23:45 -0500
Sender: linux-kernel-owner@xxxxxxxxxxxxxxx
User-agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.4b) Gecko/20030515 Thunderbird/0.1a
We have written a filter for the QoS infrastructure that looks at the data segment of packets and uses regular expressions to identify the protocol of a stream of traffic regardless of port number.

Many peer-to-peer programs (such as Kazaa and Gnucleus) will change to use a different port (including well known ports such as, say, 80) if they find that they can get better throughput there. That means that the port based filtering is no longer sufficient. However, by analyzing the application layer data, we can differentiate Kazaa from non-Kazaa HTTP, and lower the priority of whichever we deem to be less important. :)

It is a filter in the existing QoS infrastructure, so it can be used in conjunction with u32 filters, HTB or CBQ scheduling, SFQ queueing etc, etc...

Commercial companies sell devices which do layer-7 classification for anywhere from $6000-$80,000 depending on the bandwidth required. If we can build a comprehensive set of patterns I don't see any reason why Linux can't beat the pants off the commercial devices; we already have excellent queueing, and scheduling.

Our home page is but if you want to skip right to the downloads go to (there is a kernel patch, a patched version of tc, and some sample patterns for HTTP, POP3, IMAP, SSH, Kazaa, and FTP.) You'll notice the patch is a somewhat large, most of that is regexp code.

We're still working on it. It currently only does TCP for example... Do you guys/gals have any comments/suggestions/etc? I suspect that this is a post 2.6 thing, but it is very non-invasive (it only adds approx. 2 lines of code that would affect anything if the user were not using the layer-7 filters,) so I still have a little bit of hope.

Ethan Sommer
Matt Strait
Justin Levandoski

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at
Please read the FAQ at

--- End Message ---
<Prev in Thread] Current Thread [Next in Thread>