Multithreaded L7-filter for Linux and Multicore Schedulers

Danhua Guo and Laxmi Bhuyan
Department of Computer Science and Engineering
University of California Riverside
{dguo, bhuyan} @ cs dot ucr dot edu

Overview of the original L7-filter

L7-filter is a Deep Packet Inspection (DPI) classifier for Linux's Netfilter that identifies packets based on application layer data. It can classify packets as Kazaa, HTTP, Jabber, Citrix, Bittorrent, FTP, Gnucleus, eDonkey2000, etc., regardless of port. It complements existing classifiers that match on IP address, port numbers and so on.

The original intent is for L7-filter to be used in conjunction with Linux QoS to do bandwith arbitration ("packet shaping") or traffic accounting.

To download the original L7-filter, see Sourceforge project page

What to expect from this page

As convenient as the original L7-filter package is, it is still a single threaded network application. As multicore web servers become the mainstream backend platform, single threaded applications not only waste the available physical resources but also lack behind the performance requirements in terms of throughput and latency. Part of my PhD thesis focuses on how to parallelize network applications and run them efficiently on multicore web servers. Specifically for L7-filter, we have written a multithreaded version of L7-filter, and several multicore schedulers to improve its performance by a factor of 13 compared to the single threaded version and by 57% compared to our baseline multithreaded version. In summary, we developed the following functionalities for the L7-filter:

Source code

While for research convenience, we tested our proposals using a trace-driven model, we also developed the corresponding online version for all our schedulers.

Offline trace-driven model

The offline trace driven model decouples the L7-filter into two components: network processing and pattern matching. Without noises from the network, it is very convenient for DPI studies to focus on the performance bottleneck - pattern matching.

This model requires a libnids package to simulate the TCP stack in the userspace and a libpcap to read packets from the tcpdump trace file located on the disk.

Online L7-filter that ACTUALLY works in Linux

Instead of reading packet trace from the disk, the online L7-filter works with iptables in Linux, and processes packets received from the NIC. Please refer to the HOWTO page for system setup. A snapshot of the steps:

Feel free to contact me if you have any questions.


Absolutely essential reads

l7-filter related publications and development docs

Feature overview

More documentation

Contact us

Comments, suggestions, looking for collaboration or donations? Feel free to Email either me or Dr. Bhuyan.

Related software

Similar (open source/partially open source) projects


The original coders were Justin Levandoski, Ethan Sommer, and Matthew Strait, with support from Sebastian Celis, Andy Exley and Lillie Kittredge. The primary maintainers are now Ethan Sommer and Matthew Strait.

The multithreaded version L7-filter and all the multicore schedulers were created, coded, published and maintained by Danhua Guo. Logo Valid XHTML 1.0. Go back to Homepage

Last updated November 19th 2010 by Danhua Guo