A method based on the Netfilter framework of Linux system to capture or block the network traffic under rules is brought up in this paper.The system consists two parts:a loadable kernel module and a user-space application.Netlink socket is adopted to transmit orders between kernel-space and user-space
and memory mapping technology is used for the data exchange between both of them.This system can be used in network content-based filtering
DPI (deep packet inspection)
or IDS (intrusion detection system) use a specific pattern matching algorithm.Finally
blocking BitTorrent traffic as an example to test the system is shown