企业网内限制BT下载措施评析

企业网内限制BT下载措施评析 MagnificentWriting2007??2?e ?M?P???????sBT?r?????????? ???? (???????P???H?????????b?????2???]????430079) [????]?w???P????BT?r???????f?????2??????????BT?r?????M?P?????b???????O???????R?T???????7?????2???f???sBT?r ?????????????????????????????????7?????2???l?S?????n?????????.???7?b???2?2?A???T?b?????????????????g????. [???u??]BT;P2P;????;ACL;NAT;NBDR;PDLM [?l???f????]C93[???u?c???M]A[?????[??]1009-5489(2007)02-0140-01 ??,MBT?r?????????????7?????p: BT?r?????????0BitTorrent(????????)?H????p2p(peer-to-peer)?? ??,aBT?H???????????????P??????????????,a???F???????????0??Bram Cohen(?g?????????)???r????????,aBT??????????:?m?r??download?? ?2???2???m?b?????m?y?????W?Rupload?2?????0?P?????m?y?????????2?? ???r???D??,a?7???P??HTTP,FTP???r?????B?0?2?2?m?r???i?r?????2 ???2?????m?W?R(?d?????????E?(?W???????????????????f)?2?2?0?H???x ?7HTTP,FTP?????????r???0?????????2?F???t?????r???0?????y???2?? ????????HTTP,FTP?r???0??,a???????m???????r???????????r???0?? ???2???2?r???i???m?1?u,a???.???????????F?H:?r?????????P?2?D???????2 ?r????????????,a???????m?????2???a?e?????g???????r??,a??BT?r?? ?t?P?????????8?p?????2?????H?8???????b?????2?????H?o???????????? ?m????,a?w?????0????,a???????b???H???m???p?????o???2?:?????????? ???O?0???m??,a?????b???2?F?????????P?M?P???????f?i??????????,a?? ?d?H?m?????M?P?l?2?????t?????B?h?m?????M?P?????????r???????7???? ???????C???2???????????????????M?P?????????b?????????O????,a???? ???b?M?P?????b?????????2BT???m?S???????H?W???p???h??,a?????m?? ?(???????M?P?????b???????sBT???m?o?????D?????????O?m?????7???? ?????f??,a ??,M???s?????mBT?r?????????????? 1,M?M?MBT??????????????????: ???????????b?????f???T?b?H?????b?????????P???????????2?2???? ?(?????????????b?????c???H????TCP/IP?????c?P??????????,a?mTCP/ IP?????c?l?b?????f????32Bit???????????b?0?2???????????m?r???P?? ?0??,a???l16Bit???b???b???M???????????2???[16Bit?m?7???b?????? ????????,a?????????????b???????????b216(65536)???2???????g???b0 -65535,a?t?????????f?????f?b3??:(1)????????:0-1023?2?????m?m?? ?p???????P???????7?7?????b?P???0??????,a??:FTP21,TELNET23, HTTP80??,a(2)????????:1024-49151?2?????????,???????????P???0??,a ?b?P???????P???????????P???r?????????m?P??????,a(3)???M??/?[???t ????:49152-65535?2???w?????[?0?b?r???0???????????2???t?(?????[,a BT???????m???O?m???????b:6881-6890????,a?r?????????m???????? ????????????: ????(1):?P?????F??ACL???????s?]??(AccessControlList)?M??BT ????,a???g???F???g?????????r(??Cisco?b??): access-list101denytcpanyanyrange68816890 access-list??1 access-list101 denytcpanyrange68816890any permitipanyany ?????????????b???3?2?????????2???t???M?M????BT?r??????,a???? ??BT?????r???????B???k???????2?????f?i???????,???????????0???? ?????????????s?????2?2?????P???????F???????D??,a ????((2):???m?????/?????M?MBT????,a?0?2?????/?????????????0 ?2?2???????????7???????r?????p?B???2?P?????????????m?/?????????[ ?i?/?????????t?????t?????????U??????,a???????????????2?M???M???2 ???H?????mBT???????[?o????????,a 2,M?P???M?MBT?0????IP???,???sBT?r????????????????: ???????B?S???H?P???M?MBT?r???0????IP?,???????,???s?M?P?? ?????????b???mBT?r????????,a?????????f???U?????P???????,BT?0 ??????IP?,???2?s?7???????????U,a???F???W?2?y???????mACL?????? ?M?M,a?????b(??CiscoIOs?b??): access-list102denytcpany(?????????U??BT?0????IP) ???????P???????/??????????BT?0??????IP?,???2?7?M??BT???? ???????x?2?0?2?/?????????????????n?t???0?2?2???p?P???0?0??,a???m ?M?MBT?0????IP?????????t?????M?M?p??????BT?0????IP?,???2???7 ????IP?,????BT?r???0???????b?t??,a??Internet?WBT?0?????????? ?p?2???????M?M???tBT?0????IP?,???????H?0???????T??????,a????IP ?,???????k??BT?0???????????????????????????p,a 3,M???mNAT???s?m?y?????????,???sBT?r????????????: NAT?????,??????(NetworkAddressTranslation)?2?H?P???f?3?m???? ???,???[???????tIP?,??(?M?P??????intranet)?????b??????Internet?? ?m?????d?,??,a???mNAT???sBT?r???S???H?????,????????????IP?? ?s??NAT?????????2???bp2p????????BT?????p?????F?H?2???P?t???P ?????????2???2???m???p????NAT?????2???????m?????????t?????sbt?? ???m,a???B:???????????????????M?P???????mNAT???????B????Internt, ?2???M?P???F??IOS?????bCiscoIOS12.3(4)T???w???W?2?8?????b???0 ??,a ???????W?????7???m: ipnattranslationmax-entrieshost220.121.122.1100 ipnattranslationmax-entriesall-host100 ?c?????m?y???????s(???l100???bNAT???B?r?m?y???p????IP?b 220.121.122.1?????b100?2???????x?F?n????????????????),a???l?????? ???????2???f?i???????B?2???0??????BT?r???2???H?mNAT?????????W?? ???s?2???????,???s?M?P??????BT?r???????m,a 4,M?mCisc,a???F??NBAR?l????PDLM?1???M?MBT?r??????????: NBAR???????m???d(Network-BasedApplicationRecognition)?????? ?m???d,aNBAR?H???????M???m???,?g???????????????H?2???0???????, ???PACL?????,???y???s???M??,M?????????????m????TCP/UDP?????? ??,aPDLM?????i?????????1??(PacketDescriptionLanguageModule)?H ?????????????????m???????????????2?????????????2?0??????????,a?? ???.???H??NBAR?a?????P???t?????????m?2??HTTPURL,DNS,FTP, VOIP???2?2???????????P???????2????NBAR?H?M???P?????????????m,a ?S?????????????r: (1)?mCisco?????W?r???0?b:bittorrent.pdlm???????W?R?,???F???W(?P ??TFTP,FTP); (2)????bt?????????2?c???b:ipnbarpdlmbittorrent.pdlm; (3)????Class-map??policy??map(???d???7??????)?c??: class-mapmathc-allbittorent matchprotocolbittorrent policy-mapbittorrent-policy classbittorrent drop (4)???m?,?????W interfacefastethemet0/0 service-policyinputbittorrent-policy service-policyoutputbittorrent-policy ?????????????t???????M?P????????BT?r?????????2?H?????????? ?????????2?????????????0???2???m???F???????bCisc,a?????H?M?????1?? ?????2?2???????????????7?P???m?????????F???????????2?t???????????? ?????O?????i???R?4?D??,a ?s?v???D:2007-01-18 ???i????:?????2???????P???H?????????b?????2?9???(:?????b????,a