Videogames vs P2P

RouterOS General
1

In QoS mikrotik works well to discern well know services (http, pop, ftp…) from the other unknown. But now the real problem (for us) is recognize videogames traffics from the other unknown, and probability p2p, traffic.

Videogames, and all other light services, need low latency and low bandwidth, but if I cannot recognize them from the p2p traffic, I cannot say my network works well with videogames.
“Address list solution” not working: it is too difficult (address can change easy), it isn’t scalable, it does not prevent the problem, ecc… It isn’t the solution.

The question is: how can we discern all small service(videogames) from the other heavy traffic (p2p) in our network?

  • Videogames, like p2p, use both tcp and udp connections.
  • Videogames use a small rate, but sometimes a single p2p connection too.
  • Videogames sometimes use a full packet size (>1000 byte), often <350.
  • P2P uses sometimes small packet but often >1000 byte.

In most of case, the only real differentiation is the quantity of connections created by customer router: videogames needs few connection, p2p a lot.

The real solution for me is:
Marked (in the main border router) all costumer ip as “p2puser” when use a lot of connections and “normal user” when use few.
Play with packet size and rate in firewall mangle if it necessary.
So when we have few connections (and few rate), I’m sure that the unknown traffic isn’t p2p but a light service like a videogame.
Now the problem is: how can I find the customer addresses that use a lot of/few connections (both tcp and udp)? Connection-limit? Dst-limit? I don’t understand they well…


Thanks

2

I did some tests in this week end. They aren’t exhaustive, but I hope useful. I see:

UDP:
Videogames use small packet (<500bytes), I don’t know if there are some that use >500.
Torrent has a “vulnerability”: it don’t use udp packets <500bytes
Emule, I remember, uses udp only for service communications (today it is the same?)

TCP:
Videogames use small packet (<500), but sometimes use a full packet, this is the problem.
Torrent has another “vulnerability”: it don’t use tcp packets <500byte, emule I think too, but I’m not sure.

So, often is not difficult to identify p2p traffics form videogame, but the problem is the large tcp packets.
In this case we can help us with connection-rate, but not resolve the problem definitively (4-5 connections with low rate = a single connection with high rate) . Also, I think new versions of bittorrent could be use smallest packets.
I tried to use connection byte, connection limit, dst-limit…but I did not get the desired result.

So, I ask you if there is a method to identify videogame from p2p, without using an address list to insert the game server.

In my opinion, the solution is still create an address list of customers and insert their when are using a lot of connections (tcp + udp), maybe with a burst system (sometimes videogames create a lot of connection for few seconds). In this manner I can accept under “videogame traffics“ tcp large packet (I can also put connection rate control) when the ip costumer isn’t in the address list.
But how can I do this? Can someone help me please?


Thank you.