In this chapter we saw two ways of filtering Layer 7 (Application) traffic in a network.
The most popular and most stable project is L7-filter, which has pretty good matching patterns for quite a large number of protocols.
Using Layer 7 filtering with Linux is a very nice feature, but it is CPU intensive, and might not be suitable for high-traffic conditions. Dedicated, specialized hardware solutions have existed for Layer 7 filtering for quite some time now, and some of them deliver good performance.
L7-filter is a smart and ambitious project aimed at small to medium networks that need bandwidth optimization. The advantage of L7-filter over the specialized hardware solutions is, of course, the cost.
To conclude this chapter, there are two important ideas to be drawn from it, and those are:
Use L7-filter if it doesn't affect the network performance and doesn't overload the router's CPU. The decision whether to use L7-filter must be based on the machine performance (mainly CPU speed...