Re: [HiPPIE-Users] A couple of general question

[Greg O. <oli...@gm...>]

On Tue, Sep 14, 2010 at 4:51 PM, seba hauret <ha...@ho...> wrote:
>
>  greg,
>
> I do not know too deep how HIPPIE works, but I couldn't see any place where
> says that it could recognise RTP.
> The problem of Hippie is that it is a little complicate to make a pattern of
> a new protocol and if I remember well you have to recompile the kernel after
> you add a new pattern.
> What you mean with "active" mode? You want to use it in the middle of the
> traffic?
> You can do it using iptables/netfilter rules. You use Hippie to recognise
> the traffic and then you can make decisions using iptables.
>
> I know better L7-filter or ntop. L7 filter have some problems to detect RTP
> because the pattern that it use is very general but if you use conntrack
> (conntrack_sip or conntrack_h323) it detect almost all the RTP and SIP
> packets with no error. The problem is that it assign all of them like SIP.
> I do not know exactly how you want to define if you accept or deny the
> packets but i almost sure that Iptables with L7filter can do what you want.
>

The filter I am using for l7-filter is more precise that the generic
rtp filter since it is looking directly at the payload type.  The
classifications and all are generally working there, but glibc is
crashing all of the time.  I am in the process of rebuilding the
userspace on that box to see if I can fix it.

I was unsure of HiPPIE's capabilities since the docs were mentioned to
be a bit behind, so I just thought I would ask.

Thanks!
>
>> Date: Tue, 14 Sep 2010 16:12:54 -0500
>> From: oli...@gm...
>> To: hip...@li...
>> Subject: [HiPPIE-Users] A couple of general question
>>
>> Hi,
>>
>> I have been *trying* to use l7-filters for my purposes, but it keeps
>> crashing on me, so I am exploring alternatives. I ran across HiPPIE,
>> and while it seemed promising, I just need to verify a couple of
>> things.
>>
>> o Does the *active* mode work? I could not find any docs on it.
>>
>> o Is RTP supported in any way? I see rtsp is, but they are not
>> nearly the same thing as far as packet composition goes. I need to
>> grab the payload type from RTP packets and either drop or allow
>> depending on what it is.
>>
>> Can HiPPIE do this?
>>
>> Thanks
>>
>> -Greg
>>
>>
>> ------------------------------------------------------------------------------
>> Start uncovering the many advantages of virtual appliances
>> and start using them to simplify application deployment and
>> accelerate your shift to cloud computing.
>> http://p.sf.net/sfu/novell-sfdev2dev
>> _______________________________________________
>> HiPPIE-Users mailing list
>> HiP...@li...
>> https://lists.sourceforge.net/lists/listinfo/hippie-users
>