L7 Classification and Policing in the pfSense Platform
Hélder Pereira · 2009
The typical paradigm of identifying network traffic resorting to IP packet fields or to a set of well-known ports is highly limitative. Due to profound ongoing changes on the way applications try to hide their true nature by, for instance, using non default communication ports, a new challenge is presented to the way traffic classification and policing is accomplished. We argue and demonstrate that application layer inspection is a possible and convenient approach to derive the correct application protocol. This detection and classification process is of paramount importance to allow an efficient control of traffic entering the network. Taking pfSense as a case study, we extend its current layer 3 and 4 classification scheme with layer 7 capabilities, providing a powerful solution to control traffic based on application patterns. The user can easily create a set of rules for layer 7 inspection, which will drive lower level traffic control. In addition, we also provide a mechanism to create automatically useful application inspection scenarios. I. INTRODUCTION