The Research On P2P Traffic Measurement System Based On Netfilter

In recent years, P2P network applications developed rapidly, and P2P application such as file sharing is crazily devouring the bandwidth,which has caused serious impact on more urgent critical business. Therefore, the measurement and control of P2P traffic has now become imperative measures of network management. However, we can't give a quantitative assessment of the impact on bandwidth by P2P applications so far. All the challenges of P2P identification and measurement are caused by the P2P protocol features. Traditional port-based traffic classification and measurement method has failed.A series of studies should be done for finding out the characteristics of P2P flow. Based on the study, this paper proposes a method through deep scanning in the application layer to identify and measure the traffic of P2P, and then designs and implements a Linux firewall Netfilter-based P2P traffic measurement system P2P_M.Netfilter is a framework of Linux firewall, and it uses Connection Tracking to filter packets, it can be expended by Linux loadable kernel module technique. Based on the analysis of application layer identification, which can identify P2P traffic through searching the application layer data by suitable patterns , a P2P traffic measurement system based on Netfilter is proposed. Based on extracting various popular P2P application-layer characteristics, the system can identify P2P traffic through high-speed application-layer feature string matching in Linux kernel, then does traffic statistics by Connection Tracking technology. The Connection Tracking need to hash tuple information composed by source IP, destination IP, source port, destination port and protocol, and creates a hash table using the hash value as its index. The information of connection between peers storages in the hash table, and the traffic statistics can be done based on connection to achieve the real-time traffic measurement with high performance.The detailed design of P2P_M including an efficient Connection Tracking P2P measurement, the kernel P2P identification and statistical module, the kernel and user space communications module and the application layer flow analysis module. The system is tested in LAN environment for its function and performance. According to the result, P2P traffic (mainly composed by PPLive and BitTorrent) through the LAN can be effectively measured by the system. By surveying data, further flow characteristics of P2P can be studied.