Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have been experiencing DDoS attacks on my web server, with some IPs using more than 50 Mbit/s.

Now if I would like to limit the max bandwidth usage for each unique IP to, lets say, 1 Mbit/s, what would be the best approach?

share|improve this question
    
It will be very hard to limit inbound bandwidth without discussing it with your ISP. You should be able to control the outbound bandwidth fully though. –  Slartibartfast Mar 29 '11 at 4:46

3 Answers 3

up vote 0 down vote accepted

You can do something better with iptables. http://www.zoominternet.net/~lazydog/iptables-tutorial.html#HASHLIMITMATCH

My suggestion would be to stop responding (for X time) to any source IP address that make more then X request in a X period of time. What you will need to set X to will depend on the DDOS attack. You want to block the attackers, but not normal traffic.

share|improve this answer

Try to see documentation about iptables there should be some config about caping bandwith.

But on the other end you should try to configure iptables to ban bad IPs so it will clear the problem and also you will be able to report IPs and time of the attack to authorities.

share|improve this answer
    
I have tried to ban bad IPs and also report them, without luck. –  user76231 Mar 29 '11 at 6:15

These links will help you to limit bandwidth consumption per domain in an apache server

http://help.directadmin.com/item.php?id=339

http://svn.apache.org/repos/asf/httpd/sandbox/mod_bw/mod_bw.txt

share|improve this answer
1  
Thanks but I need something that works without apache –  user76231 Mar 29 '11 at 6:12

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.