Filtering of Peer-to-peer traffic. Martin Gejke

Transcription

1 Filtering of Peer-to-peer traffic Martin Gejke

2 Table of Contents Filtering of Peer-to-peer traffic... 3 Peer-to-peer basics...3 Filtering...3 Position of the filter... 4 Methods of filtering... 4 Traffic analysis...4 Content filtering... 5

3 Filtering of Peer-to-peer traffic Peer-to-peer basics Peer-to-peer(P2P) technology can be used for lots of different applications. When using a P2Pnetwork communications are based on the fact that all the connected participants are treated as equals instead of relying on a relative small number of servers. This has the advantage that the computing power and bandwidth isn't limited by a server, each peer that connects brings it's own. Because of this P2P-networks are very suitable for file sharing and distribution of different kinds of data. There are two types of P2P-networks, Pure P2P and Hybrid P2P, the first requires no central server for managing the network, the second uses just that and the peers are responsible for keeping it up to date with their information. Of course this comes with some drawbacks, there's more overhead for keeping track of the topology of the network and data that is wanted could be many hops away. When using P2P to download files a connected peer(node) can download from and upload to lots of different nodes, when increasing the number of simultaneous nodes this gives the effect that the bandwidth can be maxed out. For a private home user this is for the most of the time a good thing but for an ISP or when the user is an employee at a company this is not a good thing. The effect could be that important applications could have their traffic reduced and important data might not get through. Other types of P2P protocols are for example Skype, MSN and ICQ. These kind of programs can open up a company network to viruses and other sorts of malicious code and even if they're used in a safe way they can lower the productivity of the employees. A video conference via MSN could also steal lots of valuable bandwidth. Even if you're not running a Skype conversation, Skype traffic could be passing through your network since Skype uses connected peers as relays. To solve these and some other problems there is a need for P2P-filtering. Filtering P2P-filtering is obviously an fast growing market, a search for p2p filtering on google gives millions of hits. Estimates are that the market might be as big as $2.4 billion in Examples of programs/devices used for this are: ipoque PRX P2P Edge XL IM Lock CopySense Appliance These differ quite a bit in how the try to solve the problem, I will try to mention a few of them.

4 Position of the filter For a company a filter can be placed in a couple of different places. 1 2 INTERNET Figure 1: Different positions of filters Position 1 in Figure 1 is when the filter is placed in the user computer, this is then in a form of a software. The easiest way would of course be to not allow the user to start any P2P-programs, but that is easier said than done. Other methods involve identifying and blocking network traffic that might be generated by P2P and making sure that it doesn't reach the network. Position 2 is where the Internet access point for the company is located. Here some kind of hardware filter is best used, this can either be built into a router or some hardware specially designed for filtering. Since P2P doesn't rely on Client/Server solutions the possible positioning is the same on either a sender or reciever. Methods of filtering Traffic analysis Every P2P application using a network sends different packets, these packets can be monitored, examined and categorized. These data can be summarized in signature, a unique description of what that particular programs network traffic looks like. If you consider the OSI-model this monitoring has to be done in layer 7, the application layer. Companies like Verso Technologies offer hardware solutions for tracking this, they keep a database of know P2P(and other malicious softwares) network signatures. With this their device can log the data, from where and to whom, or simply block the data. Of course there might be legit uses of P2P-programs so you could have to allow them by checking for example lower OSI-layers for IP or MAC-adresses.

5 Content filtering Some filtering applications like CopySense goes one step further. By first identifying the traffic as P2P-data and then reading the data and calculating a digital fingerprint of the music/video it can be compared to a database of known copyrighted material. If there's a match, it's probably illegal. This is useful for companies to stop employees from distributing copyrighted music. There's also easier methods for doing this and that it simply trying to extract meta-data(filenames etc) from the sent data and check against know copyrighted material.