eudemon series firewall p2p traffic policing technology white paper

Eudemon Series Firewall P2P Traffic Policing Technology White PaperHuawei Technologies Co., Ltd.Table of Contents1P2P Service Overview (1)1.1Introduction (1)1.2Changes (2)1.3Popular P2P Software (3)2Eudemon Series Firewall Solution (3)2.1Depth Detection Technology (3)2.2Control Based on Different Time Sections (3)2.3Excellent Service Handling Performance (4)2.4User-based Bandwidth Management (4)2.5User-based Connection Number Management (4)2.6Flexible Networking Mode (4)2.7Technological Advantages of the Eudemon Firewall (4)3Networking Model (5)3.1Obstruction of Access Users’ P2P Traffic (5)3.2Use of the MAN Egress (6)3.3Time-based P2P Traffic Control (6)Appendix A Abbreviations (7)Eudemon Series Firewall P2P Traffic PolicingTechnology White PaperKeywords: P2P, BT, eDonkey, eMule, Eudemon series firewallAbstract: This article introduces the P2P traffic policing technology supported by the Eudemon series firewall.1 P2P Service Overview1.1 IntroductionTo put it simply, the P2P technology is used to directly exchange data or servicesbetween different PC users without involving any relay devices. It breaks through thetraditional Client/Server mode. In a symmetric network, the position of each node isthe same, with the dual characteristic of being the customer end and server end andcan be used as service provider and user at the same time. Thanks to the rapiddevelopment of the P2P technology, the storage mode of Internet will be transformedfrom the current “content as the center” mode to the “content distributed storage”mode, thus changing the current Internet traffic state of relying on large website as itscenter.The oft-used P2P software on the Internet mainly contains BT, eDonkey and eMule.The difference between traditional Internet traffic model and the P2P traffic model is asshown in Figure 1 below.Individual usersIndividual usersIndividual usersIndividual usersIndividual users Individual users Individual usersIndividual usersResource serverResource serverTraditional traffic model P2P traffic model Figure 1 Difference between traditional Internet traffic modeland the P2P traffic model1.2 ChangesThe P2P technology mainly provides the distributed data exchange capability. Sincethe processing ability and hard disk space of the individual user PC gradually increase,resource distributed storage has become possible.The P2P technology’s biggest role for the time being is providing data documentsexchange between individual users. Resource storage through the centralizedresource server is not the only means available now.The P2P technology leads to the following main changes:2) Changes on the Internet traffic model. Now 70% traffic on the Internet is the P2Ptraffic while the traditional HTTP traffic has stopped being the main traffic on theInternet.3) Changes on individual users’ traffic model. Previously the downlink traffic ofindividual users (from the Internet to the individual user) is far larger than theuplink traffic. But since the P2P technology needs to be uploaded whiledownloaded, both the downlink traffic and the uplink traffic of individual users aregreat.4) P2P traffic causes extreme congestion of the network.1.3 Popular P2P SoftwareCurrently the oft-used network P2P software contains the following:5) BTIts full name is “BitTorrent”. BitTorrent is multi-point downloading P2P software, whichis very user-friendly, just like a browser plug-in unit. It is called in China as “BianTaidownloading” and the most widely-used P2P downloading software.6) eDonkeyIt is jokingly called as “Dianlv” in China and also an oft-used P2P downloadingsoftware.7) eMuleIt is jokingly called as “Dianluo” in China and also an oft-used P2P downloadingsoftware.Currently among all the traffic on Internet, 50% is the BT traffic and 20% is theeDonkey and eMule traffic.2 Eudemon Series Firewall Solution2.1 Depth Detection TechnologyThe Eudemon series firewall adopts the depth detection method for the P2P softwareso as to identify P2P traffic accurately and control the P2P traffic. The Eudemon seriesfirewall can accurately discover P2P connection and control the P2P traffic.2.2 Control Based on Different Time SectionsThe Eudemon series firewall can zoom in the bandwidth of the P2P flow at night timeand zoom it out during day time according to different traffic ranges set within the timerange.The Eudemon series firewall can support restrictions on different oft-used P2Psoftware such as BT, eDonkey and eMule and extensive ranges.2.3 Excellent Service Handling PerformanceSince the forward process handling of the firewall is complicated and it is necessary tosupport abundant services, it is easy to cause bottleneck in the system. To improve thesystem forward capability, the Eudemon series firewall adopts the NP-based (networkprocessor) hardware accelerating architecture to provide excellent forwardperformance through perfect combination of NP and CPU.In the software design system, the Eudemon firewall separates the services at thecontrol from that at the forward layer and makes CPU process the content at thecontrol layer (such as configuration, routing calculation and link state detection) andleaves all data services all to NP for handling. In this way, the system design enablesthe Eudemon firewall to bring NP’s processing capability into full play and endows theEudemon firewall with very excellent processing capability.This design system of the Eudemon firewall is the most advanced among the firewallstructural systems in the industry, for it avoids the too-solidified defect of the ASICchip-based hardware design and provides more diverse services through the softwareupgrading system. Meanwhile it can provide very excellent forward performance,thanks to the advancedness of the accelerating system, the performance indices ofthe Eudemon series firewall take a sharp lead among those of the similar products inthe industry.The Eudemon1000 firewall can provide the handling capability for a 3G throughput;besides the hardware is adopted to handle various characteristics such as P2P trafficpolicing, address conversion and ACL filtering. The increase of services will not affectthe handling performance of the firewall. Similarly, the use of the Eudemon firewall forP2P traffic policing will not affect the practical performance of the firewall either.2.4 User-based Bandwidth ManagementThe Eudemon series firewall supports user-based traffic management and can limitthe bandwidth of a certain IP so as to prevent one user from overusing the bandwidth.User-based bandwidth management can effectively prevent single users fromoverusing traffic bandwidth.2.5 User-based Connection Number ManagementThe Eudemon series firewall can not only limit the bandwidth but also limit the numberof connections for each IP address, prevent generation of large amounts ofconnections due to the user reason or the virus reason and prevent Dos attacks andthe spread of worm viruses.2.6 Flexible Networking ModeThe P2P control function of the Eudemon series firewall can adapt to differentoccasions and support the transparent mode, routing mode and NAT node. Besides, itsupports reconstruction of the existing network without changing the topology of theexisting network.Meanwhile, the Eudemon firewall can support networking in the dual-system backupmode so as to enhance the reliability of the system.2.7 Technological Advantages of the Eudemon FirewallThe Eudemon series firewall has the following advantages in limiting the P2P traffic:8) It can accurately identify the P2P traffic.9) It can restrict the P2P traffic within a certain range and designate its range asbetween 100K~1Gbps; in this way, it enables users to freely use the P2Psoftware without causing great impact on the network due to the P2P traffic.10) The total P2P traffic can be designated through ACL. But the hosts that are out ofthe range designated by ACL do not accept traffic policing by the firewall and theP2P traffic is not policed by the total traffic.11) It supports different traffic ranges to be set according to the time range.12) It has very performance, for the Eudemon series firewall adopts the networkprocessor structure and can support the 3G throughput. The use of limit on P2Pwill not affect the network performance.13) It can adapt to many networking modes and support the routing mode andtransparent mode.14) Different traffic bandwidth ratios can be set for different IPs, for example, thebandwidth of each IP can be set no more than 1M.15) The limit on the connection number for each IP can be set, for example, thenumber of UDP connections for each IP should not be more than 200.3 Networking Model3.1 Obstruction of Access Users’ P2P TrafficThe total P2P traffic of the net bar in daylight is no more than 1M; and thatbetween 00.00~6:00 is no more than 5MBroadband usersBroadband users Broadband usersBroadband usersNet barsEudemon can adopt the transparent mode to access the network without affecting thenetwork topologyFigure 2 Application of the eudemon firewall in the access network to limit the P2P traffic3.2 Use of the MAN EgressRestrict BPS' P2P totaltraffic below 40GMBPSLog serverMAN backboneGEGEBAS Eudemon 1000Figure 3 Use of the MAN egress3.3 Time-based P2P Traffic ControlMAN backboneGEGEEudemon 1000Day time 8:00~24:00, the P2P traffic is no more than 100MBPS;Night time 0:00~8:00, the P2P traffic is no more than 400MBPSFigure 4 Time-based P2P traffic controlAppendix A AbbreviationsAbbreviations Full spelling P2P peer to peer。