On 08-05-09 08.25, Reyk Floeter wrote:
quoted text
> On Fri, May 09, 2008 at 10:40:18AM +0530, Srikant Tangirala wrote:
>> for all the common protocols? With my little bit
>> of knowledge what I figure is that we need some
>> piece of software(s) which understands each protocol
>> thoroughly, can look at raw packets in real-time
>> and detect the protocol being used. Even then,
> 
> ah, i'm just looking at your mail again - you a are kidding, there is
> no way to do content inspection in "real-time". go and use linux where
> you can use stupid and dangerous stuff in the kernel. this is not what
> openbsd is about.

There are actually commercial products that can do this. The ones I know 
about is Sandvine, Allot and Procera Networks. I know at least Sandvine 
does the bandwidth limiting in a very ugly way with the spoofed RST's 
that we've heard about from Comcast in the US.

The only product I've had hands on experience with is PacketLogic from 
Procera Networks (disclamer: I work for them). In one case it had no 
problem identifying the traffic in real time on two links pushing a 
total of 2,5Gbps (~6-700Gbps in both directions over four interfaces). 
This was in sweden, so the traffic pattern is pretty easy, a looot of 
BitTorrent. In cases with a lot of short lived connections, a system 
like this has a hard time keeping up with 2,5Gbps.

I know there are a lot of buzzwords that you have to see through in this 
market of DPI/DFI, but there are actually systems capable of identifying 
traffic on layer7 in realtime, although commercial.

/Johan