Re: [LARTC] How to fight with encrypted p2p

[Andrew Beverley]

 I believe that whole question is in topic. 
 Is there any way to recognize ( and then shape ) p2p traffic which is 
 encrypted?
 Modern p2p clients have this ability moreover some of them have this enabled 
 by default. 
 Now I'm using ipp2p for iptables but as I know this doesn't recognize 
 encrypted traffic.

One way to do this is to look for the style of traffic. For example, I
look for lots of connections from one PC to port numbers above 1024.
This will also incorrectly recognise some other traffic, but on the
whole it works well for me.

The following are some examples using connlimit (now included in vanilla
kernel) and ipset (see http://ipset.netfilter.org/)

# first look for style of traffic and log that client to an ipset
iptables -t mangle -A FORWARD -o ppp0 -p tcp --dport 1024: \
-m connlimit --connlimit-above 10 -j SET --add-set p2p src
iptables -t mangle -A FORWARD -o ppp0 -p udp --dport 1024: \
-m connlimit --connlimit-above 10 -j SET --add-set p2p src
iptables -t mangle -A FORWARD -i ppp0 -p tcp --sport 1024: \
-m connlimit --connlimit-above 10 -j SET --add-set p2p dst
iptables -t mangle -A FORWARD -i ppp0 -p udp --sport 1024: \
-m connlimit --connlimit-above 10 -j SET --add-set p2p dst

# then shape traffic above port 1024 for those detected clients
iptables -t mangle -A FORWARD -o ppp0 -p tcp --dport 1024: \
-m set --set p2p dst -j MARK --set-mark 60
iptables -t mangle -A FORWARD -i ppp0 -p tcp --sport 1024: \
-m set --set p2p dst -j MARK --set-mark 60
iptables -t mangle -A FORWARD -o ppp0 -p udp --dport 1024: \
-m set --set p2p dst -j MARK --set-mark 60
iptables -t mangle -A FORWARD -i ppp0 -p udp --sport 1024: \
-m set --set p2p dst -j MARK --set-mark 60


Regards,

Andy Beverley


___
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

[LARTC] ipp2p: Unaligned access in search_all_ed2k on sparc64

[Jaime Fordham]

Hey guys,

I've just built a sparc64 (Ultra/5) based firewall with ipp2p compiled
as a module and I'm constantly getting the following message in my logs:

Kernel unaligned access at TPC[100f8490] search_all_edk+0x20/0x4c
[ipt_ipp2p]

I'm running the following versions:

- Kernel 2.6.22
- ipp2p 0.8.2-r4
- iptables 1.3.8-r1


Any thoughts?
___
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc