do FAQ Q: How can I use l7-filter to redirect some of my traffic (to a proxy, etc.)?
A: You pretty much can't, at least not in any straightforward way. L7-filter can't possibly identifiy what protocol a connection is using until it sees a packet with data in it. For TCP, this is the third packet, far too late to start redirecting anything. (Convoluted schemes involving duplicating all your packets until you get a match may be possible, but we don't recommend it.) For UDP, it could work, providing that l7-filter gets enough data in the first packet to make a decision. This is not our focus, however. This can be done if you match on some quality that every packet has (such as port or IP number) rather than using l7-filter. On 3/21/06, Fabiano Pires <[EMAIL PROTECTED]> wrote: > O módulo de iptables "layer 7 filter" identifica o skype (segundo o > próprio site - http://l7-filter.sf.net). > Fabiano > > Em 21/03/06, Márcio Luciano Donada<[EMAIL PROTECTED]> escreveu: > > -----BEGIN PGP SIGNED MESSAGE----- > > Hash: SHA1 > > > > Romulo Sousa wrote: > > > Boa tarde pessoal, > > > > > > Gostaria de saber se o snort barra o skype. Acontece que tenho um > > > rede onde muitos usuários estão a utilizando para conexão com o > > > skype. Isso tá gerando uma demanda muito grande de banda. Pelo que > > > estou vendo, o iptables não resolve já que as portas que o skype > > > utiliza são aleatórias. Ouvi dizer que o snort resolve isso. > > > Agradeceria se alguém pudesse colaborar com essa informação e, se > > > possível, um link sobre uma documentação na internet. > > > > > > Abraço a todos, > > > > > > Romulo Sousa > > > > > > > > Se achar algo, divulge na lista. > > > > []'s > > > > - -- > > Atenciosamente, > > Márcio Luciano Donada > > T.I. Aurora Alimentos - Chapecó(SC) > > Cooperativa Central Oeste Catarinense > > Telefones (49)33213161 ou (49)33213182 > > mdonada at auroraalimentos dot com dot br > > -----BEGIN PGP SIGNATURE----- > > Version: GnuPG v1.4.2.2 (FreeBSD) > > > > iD8DBQFEIGjxyJq2hZEymxcRAm/YAJ4n4dKNR3/C0iHagrPA+R9araj5ZACgoSBp > > 5/Gc7yMTF00n0b8cYTvgGac= > > =G8hy > > -----END PGP SIGNATURE----- > > > > > > -- > > To UNSUBSCRIBE, email to [EMAIL PROTECTED] > > with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED] > > > > > > > -- > Abraços, > Fabiano > >
