On Tuesday 25 Mar 2003 08:08, Luman wrote: [detecting P2P] I am not sure, but you could potentially use tcpdump (patched if necessary) to monitor trafic. You could try to detect where there are lots of incoming requests to nodes on specific ports, the analyze those shortlisted packets, and if it is P2P, you could then bounce them. If you leep good logs of what you find, you could try to detect when the port floats away and re-configure your filters. You could also use port scanning to see if it is a genuine idle period or if the port has genuinely moved. I hope your router is fairly heavyweight, as you will need a lot of power to process and analyze packets in anything near real-time. Alternatively, you could cheat. :-) You could specify that traffic on certain well known ports (ssh, http(s), ftp, smtp, pop3(s), imap(s)) goes over the good link. You could then periodically check this traffic to make sure it is not masqueraded P2P. Everything else, you can divert over the cheap link and/or lower it's priority. Effectively, you can white-list traffic, instead of black-listing it. Good luck. Gordan
