:分析了Linux netfilter/iptables架构下L7-filter的功能、工作原理和实现机制,利用iptables的独立模块L7-

fiter实现了具有封锁MSN、QQ等P2P封包过滤功能,并进行相关测试。测试结果表明,该layer7的封包过滤可以在具

有网络地址转换(NAT)功能的防火墙体系上实现,限制对P2P等大流量数据对网络带宽的占用,使得网络运行更加

高效稳定。

-This paper analyzed the function,working principles andmechanism ofL7-filterunder the framework ofLinux

netfilter/iptables, realized filtering of the P2P packetswhich could blockadeMSN andQQ by use of independentmodulesL7-

fiter of iptables, and did related tests. The results of tests show that this packet filter could be realized in the firework systems

which could translate network address, and restrict the occupation ofnetwork bandwidth from large flow ofdata such asP2P in

order tomake the networkworkmore efficient and stable