0

I have about 30 servers connecting into a Cisco 3500 series switch, with 100M upstream bandwidth. Periodically, one or more of my servers will do a large file transfer which will completely saturate the network and cause 10-15% packet loss to other devices. I need a good solution to 1) monitor my bandwidth on a per-IP Address basis across all the servers 2) Prevent any given IP from consuming more than 50% of the available bandwidth 3) Give priority to certain protocols (streaming traffic, SSH) and lower priority to other traffic (BitTorrent, SMTP, FTP). I can monitor traffic on a per-port basis with that switch, but that does not give me any IP level visibility and no bandwidth control besides setting the port speed.

I have a spare Dell R200 with dual 1G NICs that I can devote to the cause and I'm fairly comfortable around Linux. I know this can be done with IPTABLES, TC and HTB, but I would rather have a more packaged solution with decent documentation and a management interface. If the answer is buy Cisco XXX, I'm open to that also, but since I have a server sitting around, I though I'd try that first.

So the question is: What Linux/BSD Firewall/Router/QOS solution would be meet these requirements? I've seen the list at http://en.wikipedia.org/wiki/List_of_router_or_firewall_distributions, but I'm looking for real-world experience with any of them.

3 Answers 3

3

A pre-packaged solution for this type of scenario would be great, but I have yet to find the ideal one. MY particular setting is a smaller Wireless ISP, but it is a similar problem of presenting particular clients from flooding the network. Two solutions I've used:

  • cbq.init or htb.init. Both of these easy the administration of managing the various tc queues and filtering. If you already understand tc and shaping, this might be a nice way to help manage the various queues. This is the solution I use for most of our bandwidth management servers. Works farily well, but no integration into iptables for marking traffic. We use the tc filters, but they are less then ideal.
  • The shorewall firewall project is a Linux package for general firewall management. It includes support for bandwidth management, and appears to allow packages to be marked with iptables rules, which I find easier to deal with. Larger learning curve, but might be worth it in the long run.
1
  • I'm testing Shorewall out now. it looks like it will probably do everything I need it to. Thanks
    – John P
    Dec 15, 2010 at 15:55
1

You can use Mikrotik RouterOS for traffic engineering. You can see Traffic Engineering features in http://wiki.mikrotik.com/wiki/Category:Manual that might suit your need.

0

Why not use some of the rate-limiting and QoS features in IOS on your switch?

2
  • The only rate limiting in the switch is per-port -- not per IP address.
    – John P
    Dec 13, 2010 at 4:13
  • What would be the difference in this case? Dec 13, 2010 at 5:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .