You probably noticed that the majority of traffic shaping rules use ports and/or protocols as matching criteria. This is an imperfect solution, since many applications use random ports, or have the ability to select different ports, and the protocol alone usually isn't enough to identify the traffic.

Layer 7 traffic shaping, also known as deep packet Inspection (DPI), attempts to address this shortcoming by identifying traffic based on the contents of the packets. Prior to version 2.3, pfSense had Layer 7 traffic shaping available as an option. As of version 2.3, however, Layer 7 support has been removed from pfSense. According to the release notes for 2.3, Layer 7 traffic shaping had been broken for all of 2.2.x and had high CPU usage. Instead, the notes recommend that we use Snort filters instead. Snort is a third-party package which we will cover in Chapter 9, Extending pfSense with Packages.