l7fsm-filter is Netfilter module to match and filter OSI Level7 protocols 
based on finite state machine.
Finite state machine filtering method is very fast compared with regexp and manual memory comparing methods.

l7fsm filter uses Ragel state machine compiler ( http://www.complang.org/ragel/ )

Currently l7fsm supports tcp and udp transport protocols.

It includes kernel patch, iptables and two new kernel modules:
nf_conntrack_l7fsm
xt_l7fsm

to build the project:
apply patch to linux kernel
copy files and directories from kernel folder to kernel tree
copy files and directories from iptables folder to iptables tree
install Ragel state machine compiler

enable items 'l7fsm protocols support' and 'level7 match support' in kernel configuration in section
Networking support -->
    Networking options --> 
    	Network packet filtering framework (Netfilter) -->
        	Core Netfilter Configuration -->


build kernel modules nf_conntrack, nf_conntrack_l7fsm, xt_l7fsm

build iptables in install

How to use l7fsm:

load kernel modules:
sudo modprobe nf_conntrack_l7fsm
sudo modprobe xt_l7fsm
sudo modprobe iptable_raw

Add iptables rules to track all connections by l7fsm filter:

sudo iptables -t raw -A OUTPUT -p tcp -j CT --helper l7fsm_tcp
sudo iptables -t raw -A PREROUTING -p tcp -j CT --helper l7fsm_tcp
sudo iptables -t raw -A OUTPUT -p udp -j CT --helper l7fsm_udp
sudo iptables -t raw -A PREROUTING -p udp -j CT --helper l7fsm_udp

To count packet by protocol add rules for l7fsm filter:

sudo iptables -A OUTPUT -p tcp -m l7fsm --filters "http" -j ACCEPT
sudo iptables -A INPUT -p tcp -m l7fsm --filters "http" -j ACCEPT
sudo iptables -A FORWARD -p tcp -m l7fsm --filters "http" -j ACCEPT

sudo iptables -A OUTPUT -p tcp -m l7fsm --filters "ftp" -j ACCEPT
sudo iptables -A INPUT -p tcp -m l7fsm --filters "ftp" -j ACCEPT
sudo iptables -A FORWARD -p tcp -m l7fsm --filters "ftp" -j ACCEPT

sudo iptables -A OUTPUT -p tcp -m l7fsm --filters "smtp" -j ACCEPT
sudo iptables -A INPUT -p tcp -m l7fsm --filters "smtp" -j ACCEPT
sudo iptables -A FORWARD -p tcp -m l7fsm --filters "smtp" -j ACCEPT

sudo iptables -A OUTPUT -p tcp -m l7fsm --filters "sip" -j ACCEPT
sudo iptables -A OUTPUT -p udp -m l7fsm --filters "sip" -j ACCEPT
sudo iptables -A INPUT -p tcp -m l7fsm --filters "sip" -j ACCEPT
sudo iptables -A INPUT -p udp -m l7fsm --filters "sip" -j ACCEPT
sudo iptables -A FORWARD -p tcp -m l7fsm --filters "sip" -j ACCEPT
sudo iptables -A FORWARD -p udp -m l7fsm --filters "sip" -j ACCEPT

To view packets and bytes matched for each rule:
sudo iptables -L -v