Re: [HiPPIE-Users] Hippie algorithm

[Josh B. <jo...@oo...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hey Nirav,
	Thanks for your mail.  I'd be glad to expound a bit on how HiPPIE  
functions processing packets and classifying protocols.  Basically,  
instead of relying on something like regular expressions and their  
limitations, HiPPIE uses "functional signatures," in that each packet  
is actually processed by a function within the protocol classifiers to  
deteremine whether the packet contains that protocol or not.
	So, ultimately, that function could contain anything.  It could  
contain a simple string search/check to look for certain bytes  
indicative of certain protocols, or do more complex things like  
compare sizes of packets against size indicators within the packet,  
check for certain opcodes that go with certain protocols, and so  
forth.  Basically, the sky is pretty much the limit.  Ultimately, to  
answer the question for how a certain protocol is classified, you'd  
actually have to look at that protocols module to find out, and those  
are available under your kernel source under net/hippie/proto/.  Let  
me know if you have any more questions, and I'd be glad to answer.   
Thanks
Josh

On Dec 17, 2008, at 1:12 PM, Trivedi, Nirav wrote:

> Josh,
> I had a very basic question about how HIPPIE performs  
> classification.  It’s going beyond performing a simple Regular  
> Expression match for protocol signatures on packets (as is done with  
> L7 filter), but I’m not clear as to what the actual algorithm  
> entails.  Could you perhaps provide a brief description?  I would  
> like to understand the full benefit of HIPPIE’s approach.  Thanks.
>
> -Nirav
> ------------------------------------------------------------------------------
> SF.Net email is Sponsored by MIX09, March 18-20, 2009 in Las Vegas,  
> Nevada.
> The future of the web can't happen without you.  Join us at MIX09 to  
> help
> pave the way to the Next Web now. Learn more and register at
> http://ad.doubleclick.net/clk;208669438;13503038;i?http://2009.visitmix.com/_______________________________________________
> HiPPIE-Users mailing list
> HiP...@li...
> https://lists.sourceforge.net/lists/listinfo/hippie-users

-----BEGIN PGP SIGNATURE-----

iEYEARECAAYFAklJVRQACgkQYj4wn+b+JWZsswCgkeL17qNflMFaVmtOOuAy6ucx
6UsAn35ev7+HEtr0EEVytUTDO7Dbt+YI
=GFWM
-----END PGP SIGNATURE-----