Forum Discussion
kykong_107132
Nimbostratus
NimbostratusDetect limewire P2P traffic.
Hi All,
Wondering anyone know using irules how can we detect limewire P2P traffic? I have a solution for eDonkey and bittorrent, but not sure how limewire traffic look like.
thank...
kykong_107132Nimbostratus
Nimbostratusthis are the irule that i used it to drop edonkey traffic.
when CLIENT_ACCEPTED {
TCP::collect 0 0
}
when CLIENT_DATA {
append payload [TCP::payload]
if {[string length $payload] < 6} {
TCP::release
TCP::collect
return
}
TCP::release
binary scan $payload cic ed_cli_protocol ed_cli_size ed_cli_type
set ed_cli_protocol [expr { $ed_cli_protocol & 0xff }]
if {($ed_cli_protocol == 0xE3) } { edonkey protocol in hexa is 0xE3
log "eMule signature $ed_cli_protocol , Emule traffic from [IP::remote_addr]"
discard
}
}
