6

The L7-filter project appears to be 15 years old, requires kernel patches with no support for kernels past version 2.6, and most of the pattern files it has appear to have been written in 2003.

Usually when there's a project that is that old, and that popular, there are new projects to replace it, but I can't find anything more recent for Linux that does layer 7 filtering.

Am I not looking in the right places? Was the idea of layer 7 filtering abandoned entirely for some reason? I would think that these days, with more powerful hardware, this would be even more practical than it used to be.

2
  • 1
    They are sometimes referred to as Application Firewalls; also see Application firewall. I think you just get an all-in-one nowadays.
    – user56041
    Commented Aug 30, 2018 at 21:39
  • @jww The fact vendors nowadays are mixing a cooking pot of different solutions in their products does lend to confusion. An example of a WAF is modsecurity. It would be overkill to use l7 traffic shapping to protect an apache server against applicational attacks. It would not be so effective also Commented Aug 31, 2018 at 6:20

2 Answers 2

8

You must be talking of (the former) project Application Layer Packet Classifier for Linux, which was implemented as patches, for the 2.4 and the 2.6 kernels.

The major problem with this project, is that the technology which it proposed to control, quickly outpaced the usefulness and efficacy of the implementation.

The members of the project, also had no time (and money) to further invest in outpacing some advancements of the technology, as far as I remember, and then sold the rights to the implementation, which killed for good an already problematic project.

The challenges this project/technology has faced over the years are, by no particular order:

  • adapting the patches to the 3.x/4.x kernel versions;
  • scarcity of processing power - in several countries, nowadays the speed of even domestic gigabit broad will demand ASICs to do efficient layer 7 traffic-shapping;
  • bittorrent started using heavy obfuscation;
  • HTTPS started being used heavily to encapsulate several protocols and/or to avoid detection;
  • peer-to-peer protocols stopped using fixed ports, and started trying to get their way by any open/allowed port;
  • the rise of ubiquitous voIP and video in real time, that makes traffic very sensitive to even small time delays:
  • the widespread use of VPN connections.

Heavy R&D was then invested heavily, into professional traffic shaping products.

The state of the art ten years ago, involved already specific ASICs and (heavy use) of heuristics, for detecting encrypted/obfuscated traffic.

At the present, besides of more than a decade of experience in advanced heuristics, with the advancement of global broadband, traffic-shapping (and firewall) vendors, are also using peer-2-peer sharing in real-time, of global data, to enhance the efficacy of their solutions.

They are combining advanced heuristics, with real time profiling / sharing data from thousands of locations in the world.

It would be very difficult, to put together a open source product, that will work as efficiently as an Allot NetEnforcer.

Using open source solutions, for the purpose of infra-structure bandwidth health, it is not so usual, anymore, trying to traffic shape by the type/nature of traffic that IP address is using at the network level.

Nowadays, for generic traffic control and protecting the bandwidth capacity of the infra-structure, the usual strategy is (besides firewalling), without using advanced traffic shaping hardware, allocating a small part of the bandwidth per IP address.

1

Netifyd is an open source deep packet inspection alternative to l7-filter. It was developed by the last maintainer of the l7-filter project and it's available for Linux and BSD. No kernel hacking required.

Detecting encrypted protocols and things like modern BitTorrent is tricky, but certainly solvable. Keep in mind, deep packet inspection goes beyond just detecting protocols (which was the focus of the l7-filter project). For example, Netify DPI can detect weak ciphers in an SSL conversation - often a sign of a device running old firmware.

As Rui F mentioned, ASICs or dedicated hardware is required for sustained multi-gigabit speeds. However, at the edge of the network, DPI can be deployed on run-of-the-mill computer hardware - even at 1 gigabit speeds. It does take some horsepower to run - about the same as an effective intrusion detection/prevention engine. Generally, only the first 10-ish packets of a network conversation are processed, so it's able to run in tight spaces.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .