IPP2P, an extension to iptables to identify P2P traffic written by Eicke Friedrich.
This software is still in beta stage although it seems to run pretty stable. Use at your own risk!


Installation Instructions:
--------------------------
-modify the Makefile (change source dir for the kernel and netfilter sources and the netfilter version)
-make
-copy libipt_ipp2p.so to the iptables lib dir (/usr/lib/iptables/)
-insmod ipt_ipp2p.o
-create your rules


Versions:
---------
Currently IPP2P is tested to be working together with:
 -Linux-Kernels (from kernel.org) 2.4.18, 2.4.19, 2.4.20, 2.4.21, 2.4.22, 2.4.23
 -iptables (from netfilter.org) 1.2.7a, 1.2.8, 1.2.9
You can try to run IPP2P with different kernel or iptables versions. Feel free to contact me
with any kind of feedback or problems you may encounter. See section "Contact" at the end of this
document.


Help:
-----
After installing you can get help about IPP2P by typing

 iptables -m ipp2p --help

This prints out the current version of IPP2P, a list of all available options and some hints.
 

Hints:
------
IPP2P identifies P2P patterns in TCP packets only, you have to specify -p tcp for each rule
to make sure the modul only gets TCP traffic. Have a look at section "How it works" for an example.


How it works:
-------------
IPP2P is intended to be used together with connection marking. As IPP2P only recognizes some packets
(usually at the beginning) of a P2P connection it does not make sense to be used alone. An example for 
a working setup:

 iptables -A PREROUTING -t mangle -p tcp -j CONNMARK --restore-mark
 iptables -A PREROUTING -t mangle -p tcp -m mark ! --mark 0 -j ACCEPT
 iptables -A PREROUTING -t mangle -p tcp -m ipp2p --ipp2p -j MARK --set-mark 1
 iptables -A PREROUTING -t mangle -p tcp -m mark --mark 1 -j CONNMARK --save-mark

As result every packet belonging to a identifyed P2P connection is marked with "1". 

 tc filter add dev eth0 parent 1:0 protocol ip prio 4 handle 1 fw classid 1:11
 tc filter add dev eth1 parent 2:0 protocol ip prio 4 handle 1 fw classid 2:11

Using HTB and these filters would put all packets marked with "1" into a class per device (eth0&eth1 here). 
Limiting the bandwidth of this class you could limit the bandwidth given to P2P connections.


TODO:
-----
-DOCUMENTATION 
-more P2P networks coming soon (OpenNap, Soulseek, etc.)
-more testing


Contact:
--------
Any suggestions or hints are more than welcome. Write a message to
 e<dot>friedrich<at>uni<dot>de 
and please put the word IPP2P into the subject of the mail otherwise it will automatically
be treated as spam.