IPP2P, an extension to iptables to identify P2P traffic written by Eicke Friedrich.
This software is under development but it seems to run pretty stable. Use at your own risk!


Installation Instructions:
--------------------------
-modify the Makefile (change "IUSER = -I/usr/src/iptables/include" to wherever iptables.h is located)
-type "make"
-copy libipt_ipp2p.so to the iptables lib dir (/usr/lib/iptables/)
-insmod ipt_ipp2p.o / ipt_ipp2p.ko
-create your rules


Versions:
---------
Currently IPP2P is tested to be working together with:
 -Linux-Kernels 2.6: 2.6.3, 2.6.4 
 -Linux-Kernels 2.4: 2.4.18, 2.4.19, 2.4.20, 2.4.21, 2.4.22, 2.4.23, 2.4.26
 -iptables (from netfilter.org) 1.2.7a, 1.2.8, 1.2.9
You can try to run IPP2P with different kernel or iptables versions. Feel free to contact me
with any kind of feedback or problems you may encounter. See section "Contact" at the end of this
document.


Help:
-----
After installing you can get help about IPP2P by typing

 iptables -m ipp2p --help

This prints out the current version of IPP2P, a list of all available options and some hints.
 

Hints:
------
IPP2P identifies P2P patterns in TCP packets only, you have to specify -p tcp for each rule
to make sure the modul only gets TCP traffic. Have a look at section "How it works" for an example.


How it works:
-------------
IPP2P is mainly intended to be used together with connection marking. As IPP2P only recognizes some but 
not all packets (usually at the beginning) of a P2P connection. You can prevent P2P from working by 
dropping all packets matched by IPP2P:

 iptables -A PREROUTING -t mangle -p tcp -m ipp2p --edk --kazaa --gnu --bit --apple --dc --soul -j DROP

For shaping P2P traffic connection tracking and its extension CONNMARK is needed. An example for a 
working setup using CONNMARK:

 iptables -A PREROUTING -t mangle -p tcp -j CONNMARK --restore-mark
 iptables -A PREROUTING -t mangle -p tcp -m mark ! --mark 0 -j ACCEPT
 iptables -A PREROUTING -t mangle -p tcp -m ipp2p --ipp2p -j MARK --set-mark 1
 iptables -A PREROUTING -t mangle -p tcp -m mark --mark 1 -j CONNMARK --save-mark

As result every packet belonging to a identifyed P2P connection is marked with "1". 

 tc filter add dev eth0 parent 1:0 protocol ip prio 4 handle 1 fw classid 1:11
 tc filter add dev eth1 parent 2:0 protocol ip prio 4 handle 1 fw classid 2:11

Using HTB and these filters would put all packets marked with "1" into a class per device (eth0&eth1 here). 
Limiting the bandwidth of this class you could limit the bandwidth given to P2P connections.



TODO:
-----
-DOCUMENTATION 
-more P2P networks coming soon (OpenNap, S2S, etc.)
-more testing


Contact:
--------
Any suggestions or hints are more than welcome. Write a message to
 tady<at>gmx<dot>net
and please put the word IPP2P into the subject of the mail otherwise it will automatically
be treated as spam.

Find the official IPP2P homepage at:
http://rnvs.informatik.uni-leipzig.de/ipp2p/