An old thread is revived :-)

l7-filter is getting replaced by a new daemon tentatively named cdpid (ClearOS Deep Packet Inspection Daemon). It pulls in the nDPI library for much improved protocol detection. We'll have more details coming out in November and expect to see something released in the very early part of 2016.

The software is already in alpha -- here's some debug output from my home network this morning.

# DNS lookups caught on the wire

ens34: DNS.Facebook: 192.168.4.1:53 <-> 192.168.4.156:61943 [Host: www.facebook.com] [SSL/C: N/A] [SSL/S: N/A]

ens34: DNS.Facebook: 192.168.4.1:53 <-> 192.168.4.156:57168 [Host: scontent-yyz1-1.xx.fbcdn.net] [SSL/C: N/A] [SSL/S: N/A]



# Pulling out SSL certificate information during HTTPS handshake (will make it possible to block SSL sites transparently)

ens34: SSL.Facebook: 31.13.74.1:443 <-> 192.168.4.156:54615 [Host: N/A] [SSL/C: www.facebook.com] [SSL/S: N/A]

ens34: SSL.Facebook: 31.13.80.12:443 <-> 192.168.4.156:54616 [Host: N/A] [SSL/C: scontent-yyz1-1.xx.fbcdn.net] [SSL/S: N/A]



# Who's playing Candy Crush in the middle of the day?

ens34: DNS: 192.168.4.1:53 <-> 192.168.4.184:41614 [Host: candycrushsodamobile.king.com] [SSL/C: N/A] [SSL/S: N/A]

ens34: HTTP: 185.48.81.172:80 <-> 192.168.4.184:58182 [Host: candycrushsodamobile.king.com] [SSL/C: N/A] [SSL/S: N/A]



# Bittorrent (encrypted)

ens32: BitTorrent: 89.212.120.77:36269 <-> 192.0.172.199:51413 [Host: N/A] [SSL/C: N/A] [SSL/S: N/A]

ens32: BitTorrent: 32.214.157.239:61568 <-> 192.0.172.199:51413 [Host: N/A] [SSL/C: N/A] [SSL/S: N/A]

ens32: BitTorrent: 47.55.64.199:13664 <-> 192.0.172.199:51413 [Host: N/A] [SSL/C: N/A] [SSL/S: N/A]

Hi guys

Just wanted to know what the status of the protocol filter is? Need to find a good way to block P2P traffic

Every time we restart the l7-filter project, something comes along and derails it. It definitely has a Duke Nukem Forever kind of vibe.

using transparent proxy wont work

Dirk Albring wrote:

Are you referring to the protocol filter? It's running on my ClearOS 6.4 box.

How did you get it running? and are you using the transparent proxy at the same time?

An l7-filter rewrite is slowly getting off the ground. Release dates haven't been set.

Are you referring to the protocol filter? It's running on my ClearOS 6.4 box.