Back

Linux Daily LinuxDaily.net

L7-filter -- Application Layer Packet Classifier for Linux

L7-filter is a classifier for Linux's Netfilter that identifies packets based on application layer data. It can classify packets as Kazaa, HTTP, Jabber, Citrix, Bittorrent, FTP, Gnucleus, eDonkey2000, etc., regardless of port. It complements existing classifiers that match on IP address, port numbers and so on.

Our intent is for l7-filter to be used in conjunction with Linux QoS to do bandwith arbitration ("packet shaping") or traffic accounting.

To download, see our Sourceforge project page

Documentation

All pages on this site are accessible through links right here! Some images and scripts are linked from these pages. Pages are cross-linked for convenience, but nothing is more than two clicks from here.

Absolutely essential reads

• README
• HOWTO-kernel or HOWTO-userspace
• List of supported protocols

Before asking questions on the mailing list, read these

• FAQ
• Compatibility with various kernel versions
• Known problems
• Performance data
• How to use l7-filter to analyze traffic without inserting it directly into your traffic flow
• Protocolinfo.org - A wiki devoted to the identification of network protocols with a focus on l7-filter

l7-filter development docs

• Technical details
• Protocols we'd like to support
• Pattern writing HOWTO - how to match a new protocol or improve an existing pattern

Feature overview

• Patches for Linux 2.4 and 2.6
• Support for TCP, UDP and ICMP over IPv4
• Uses Netfilter's connection tracking of FTP, IRC, etc
• Examines data across multiple packets
• Number of packets examined tunable on the fly through /proc
• Number of bytes examined tunable at module load time
• Distinguishes between new connections (those still being tested) and old unidentified connections
• Gives access to both Netfilter and QoS (rate limiting) features
• With the Netfilter "helper" match, you can distinguish between parent and child connections (e.g. ftp command/data)

More documentation

• Netfilter: The official documentation. Highly recommended.
• Linux QoS: Linux QoS doesn't come with documentation. The Linux Advanced Routing & Traffic Control HOWTO is the best attempt we have found to explain its mysteries. It remains rather mysterious, sad to say.
• More on l7-filter: Designing and Implementing Linux Firewalls and QoS using netfilter, iproute2, NAT and l7-filter, Lucian Gheorghe, ISBN 1904811655.

How can I help?

• Found a bug, typo or something out of date? Report and/or fix them.
• Test our patterns and report your experiences on protocolinfo.org or our mailing list.
• Write new patterns.
• Do performance testing and send us your results.
• Translate our documentation into other languages.
• Make better icons for the protocols page.
• Write a front-end that makes traffic shaping easy for people who aren't Linux gurus.

Contact us

Submissions, complaints, criticism, praise, comments? l7-filter-developersATlists.sourceforge.net (you must subscribe first). Need help? l7-filter-users(a)lists.sf.net. You can also e-mail Matthew Strait directly at dong AT users DÖT sf D0T net>, but posting to the list is prefered. Alternatively, bug reports, requests for features, and patches may be submitted through our Sourceforge page.

Related software

Front-ends that support l7-filter (not tested by us)

• Zeroshell
• Untangle
• QOS-L7
• NuFace
• MasterShaper
• k-shaper
• DD-WRT
• Connexion

Similar (open source/partially open source) projects

• IPP2P - A Netfilter module that identifies Peer-to-Peer traffic. It uses functions compiled into the kernel rather than regular expressions that are loaded from user space.
• Ourmon
• Bandwidth Arbitrator for Linux
• HiPPIE

Homepage: http://l7-filter.sourceforge.net/