Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a campus with 16 buildings and older 850nm 1Gbps fiber links between the buildings, that all come to a core switch for our servers that also uses 1Gbps ports. We're finally starting to replace our aging 10/100 end-user switches, and much of what we're looking at are 1 Gbps units.

My question is, since the trunk/uplink lines are still 1Gbps, if I were to install 1 Gbps switches for end users, should I limit the ports to 100Mbps until I can also upgrade the trunks to avoid allowing a bad-behaving host to saturate a trunk line (since we're a college, we have plenty of mis-behaving hosts) and thereby create a DoS situation for a building, or will TCP congestion control typically take care of that for me? What if we have a lot of UDP traffic (games, video chats, even a small amount of bittorrent)?

share|improve this question

Instead of capping all your users at 100mbps I would personally go with some kind of qos on the switches, either filtering out the offending traffic or - my preference - severely rate limiting it. That does assume installing managed switches however. A new install is a great time to get some basic qos in place.

share|improve this answer

TCP congestion control will not help you here. A mis-behaving host can set up multiple tcp connections from the same host, saturating the entire link.

You might use one of the tools described here to see how much a single host can get out of your bandwith:

And this is not even considering UDP streams.

Edit: I noticed you're not worried about filling up your uplink to the internet, but the links to the core switch. Limiting the end user ports, but not the link between the core and the local switches would mean you're actually building a fat tree:

So ensuring every client can have a fast connection to any other client. This will rule out mis behaving hosts, but will also give you practically zero benefit from your upgrade in practice.

You might not limit the ports at first, and see how it goes (how good the end users can behave)

How fast is your uplink to the internet? Or is this a completely separate network? If you have 100Mbps to the internet it doesn't mater what you limit or not, nothing will change here.

share|improve this answer
So you're saying I should limit the ports, then? – Joel Coel Sep 4 '12 at 13:31
Yes, but only between the local switch and the core switch. If you're not already experiencing users taking control off the full link now, you don't need to change it. On the other hand, if you're specially worried about one user using this as a DOS on a full building you can do the exact opposite and limit the local ports, and not the link to the core switch. Basically building a fat tree. – Jens Timmerman Sep 4 '12 at 13:44
I don't really have enough to post this as an answer but I wouldn't restrict the majority because of a few bad hosts. Most clients on the network are going to struggle to fill a gigabit pipe, especially if they're sending legitimate traffic. Even if there is some bit torrent (and this is over the LAN, rather than from the Internet), by giving the clients gigabit you ensure it won't tie up your network for as long. If you really want to prevent this traffic from causing you problems, filter it out at the switch. – James Yale Sep 4 '12 at 13:49
There's not really a lot of host<->host traffic within a particular switch. I think this is true of most networks these days. It's all about how fast you can connect to the data center, and often from there out to the web. – Joel Coel Sep 4 '12 at 14:12

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.