There is nothing illegal about ptp technology. If you are an ISP selling connections to the general public, your clients will expect ptp to be available, unless of course you mention in the sales blurb that its a restricted service. Blocking will just annoy clients and send them somewhere else. If you are operating a cabled / wired network there is no reason to block it anyway. limiting the number of sessions your clients are allowed along with bandwidth control is all you need to keep your network healthy, if your CPU’s are smokin then its time to upgrade. If your clients choose to partake in illegal activities your covered as your contract with them should state that this is at their own risk and you take no responsibility.
However, if you operate a 80211 wireless network then you will need to control its use a lot more to protect your network , (TDMA protocols can operate safely with simple session and bandwidth controls like cabled networks)
Lets get one thing clear, You will never block ptp completely. as you perfect your filters they may work for a while until new methods are invented. Its an ongoing battle you will never win and will consume far to much of your valuable time trying to do so.
In fact I know from experience that Blocking ptp can actually makes things worse on a 80211 network as the clients software will fire up many many sessions trying to get an initial connection and then switch to things like encrypted mode, port 80 http mode , users will even invest in VPN’s etc etc. Make no mistake the determined user will find a way past your filters and not care what damage it does to your network. Your only option left, as these methods are very hard to detect and control, is to throttle the users bandwidth. Not a good option as it will soon send the client elsewhere.
By shaping the traffic intead of blocking it you generally remain in control as the client software will usually first try to connect to peers using bog standard methods, if successful it will not bother looking for more covert methods These standard methods are easy to detect with layer 7 and mangle rules. even the built in MT ptp filter catches a lot of standard ptp traffic. So by using Layer7 matchers ( not to many they are CPU hungry) and the built in MT ptp filter you can mark the packets with mangle rules and apply some extra shaping rules that keep the client happy and your AP healthy
In my experience its the upload to your AP’S that will cause most damage.
Downloads can be much higher up to 2MB as long as sessions are controlled.
I use layer7 filters and the built in filter to mark all ptp traffic.
i then use PCQ´s to limit the upload/download to 128k/1mb of ptp traffic. I have a 100 session limit on all clients (the latest Mt software can also limit UDP sessions) these limits seem to satisfy most ptp client software that they have a decent enough connection and dont bother finding encrypted peers etc. Of course the odd client will be forcing encryption, if these guys are damaging your network you will just have to throttle their entire connection untill you can get them to agree to use standard methods, they usually comply.
note: to low an upload speed will also cause ptp client software to seek other methods to connect.