Date: Sat, 25 Dec 2010 20:44:14 +0100 From: Ivan Voras <ivoras@freebsd.org> To: freebsd-net@freebsd.org Subject: Re: IPFW extension for traffic classification based on statistical properties Message-ID: <if5hib$dad$1@dough.gmane.org> In-Reply-To: <4D13E6CC.7080503@swin.edu.au> References: <4D13E6CC.7080503@swin.edu.au>
next in thread | previous in thread | raw e-mail | index | archive | help
On 24.12.2010 1:18, Sebastian Zander wrote: > With DIFFUSE v0.1, IPFW computes statistics (such as packet lengths > or inter-packet time intervals) for observed flows, and uses > ML (machine learning) techniques to assign flows into classes. > In addition to traditional packet inspection rules, IPFW rules > may now also be expressed in terms of traffic statistics > or classes identified by ML classification. This can be helpful > when direct packet inspection is problematic (perhaps for administrative > reasons, or because port numbers do not reliably identify classes of > applications). How successful (accurate) can something like this be? For example, if there is torrent traffic on a network, it will (probably) be a mixture of slow and fast connections which have different latencies due to, among others, geographical distribution. If you introduce e.g. web traffic on the one side and ssh sessions, IM sessions and similar "interactive" traffic, do you have any results showing you can correctly classify and prioritize the interactive traffic (meaning ssh and IM, not bittorrent and web)? (I'm not asking specifically for DIFFUSE but mostly about the general approach).
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?if5hib$dad$1>