Hi Chris, On Wed, Oct 18, 2006 at 02:31:48PM +0100, Chris Wilson wrote:
> I'd be interested to know if anyone has combined layer 7 classification > with pmacct's traffic aggregation. For example, I would like to combine > all Kazaa traffic (per minute) into a single counter. It's already there, you can get a look to the "VIII. Quickstart guide to packet classifiers" chapter in EXAMPLES. pmacct is using l7-filter stuff to do the job. So you can just get classifiers of your interest from their website, push them on your disk, and let pmacct know where they are. Also, pmacct supports shared object classifiers. This means you can grab code of your interest (ie. kazaa) from ipp2p, make it a shared object, build the hooks (you can look into the existing edonkey example) and push the file in the classifiers directory. That's pretty much the way to follow for all non string-oriented protocols. > use this hook in pmacct to grab data from the conntrack table. I don't > want to classify in user space because I also want to do traffic shaping > on P2P flows, which seems to require it to be done in the kernel, and I > don't want to do it twice. Yes, traffic shaping between interfaces should be better done in kernel. And i fully agree with you: doing the job twice is not great idea. So, if you can see a way to, say, get the flows from libpcap and classification infos from the kernel, just let me/us know as it sounds a good idea! Cheers, Paolo _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
