Tag Info

Hot answers tagged

16

4 GB is possible, but very unlikely considering the attack rate. I suggest installing OSSEC, it detects break in attempts and blocks the IP automatically for a certain time out.


14

If these are the cause of the bandwidth usage then the bandwidth is already consumed by the time you deal with them on your system. You can use a tool like iptraf to give you a breakdown of what's happening on each interface/port and then you can take appropriate action based on facts.


10

What you're looking for is called Traffic Shaping. The best source of information for it (that I know of) is Linux Advanced Routing and Traffic Control. It's a little bit dated, but still has a ton of good information. If you google for Linux Traffic Shaping, you can find some scripts and tools to make the traffic shaping configuration a little bit ...


7

No matter what you do you will be "wasting" CPU cycles (to determine if the referrer site (the one doing the linking) is authorized or not you must do some processing of the request data). The only thing you can do is save bandwidth while wasting a minimum of CPU cycles. There are some examples in the Apache Docs that do exactly what you want. This one: ...


7

You have created a duplex mismatch. Your port is set to 10/Full and your ISP's port is set to 10/Half. Either set your port to half-duplex (highly undesirable) or contact your ISP and ask them to set their port to 10/Full. According to Cisco's official training material for their most basic networking certification: When one device has disabled ...


6

Whenever we get these problems, we increase the broadband by 5mbps, which makes things better for a few months, and then we get some more staff, and then it starts again. My theory is that these inevitable peaks, which you generally won't get on a residential connection, are impacting on Skype audio and video, and while the company IT profile ...


6

tc, iptables etc can all do this, but just to be different: You can use Linux kernel feature cgroups and its net_cls module for limiting xapian-replicate-server. Something like this should do: mount -t cgroup -onet net /sys/fs/cgroup cd /sys/fs/cgroup mkdir xapian-replicate-server /bin/echo $$ > xapian-replicate-server/tasks /bin/echo 2048 > ...


6

There is a difference between running nmap as root, and as a regular user. Basically, when you run it as a regular user and the target machine blocks ICMP, nmap will do a complete three-way handshake and set up a complete TCP connection. This is more demanding than the "TCP ping" method that is used when you run it as root. For more info, read part 5 of ...


5

NetLimiter can probably do the job.


5

I user Netlimiter 2 for my personal stuff. http://www.netlimiter.com/ I know they've moved to 3, but I haven't. Its absolutely fantastic for my purposes. You can block/limit inbound and outbound seperately, by application, by port (although I don't think you can just do port filtering...) Its USD29.99 so will definitely break the bank (If Sam's answer is ...


5

Yes, quite possible, though something of a learning-curve. Basically you'll be using the police and/or bandwidth commands, without knowing a lot more I can't help you with the specific command but HERE's a link to Cisco's own, pretty great, command line reference for this topic.


5

I recommend using libvirt for managing your KVM virtual machines. It makes the whole thing much easier than with just plain QEMU/KVM and provides also nice CPU, IO and network statistics. You will like tools such as virt-top and virt-manager which work on top of the libvirt framework. To collect the virtual machine interface statistics from a script, you ...


5

If you want to limit the users based on IP addresses only, you don't need to implementation any authentication. You can use delay pools. This will limit the download speed of each IP/subnet according to the configured value(s).


4

No, these once-per second connection attempts themselves are not going to add up to 4GB in ten hours. Do you think you could download a 4GB file in 10 hours by getting getting a tiny packet once a second? There are 3600 seconds in an hour, so if you get a kilobyte a second for ten hours, that would be 36000 Kb, or 36 megabytes. Your bandwidth is measured ...


4

Sadly, I think you're going to be chasing your own tail. The socket is owned by root... because sshd is running as root. The user is not established until AFTER the user has authenticated... but since the connection is never closed, the socket is still owned by root. Short of trying to do some sort of reverse-matching between the socket ID and the current ...


4

This would be entirely dependent on what everyone was doing at any given moment. The minimum bandwidth everyone could get would be 1/75th of the 4Mb (everyone streaming videos for example). The maximum could be 4Mb, with only one person using the line.


4

Will the 4MB be divided among all 75 users or will all users receive the same speed throughout the day You buy one pizza. YOu have 4 guests. Will every guest get a complete pizza? Com on, that is common sense. NATURALLY the limited resource (4Mbit bandwidth) will be distributed among the users that actually use it (which is less than 50-75 - not ...


4

I've never used this module but the documentation seems fairly straight forward. The directives are valid inside a <VirtualHost> block and will only apply to that virtual host if so. It also looks like they don't inherit from higher parts of the config so you should put every relevant directive in the virtual host. Your current config sets the ...


4

What kind of routers are you using? It sounds like you're just using SOHO type routers? You might want to look at getting better routers and switches with management built in and monitorable through SNMP. That said I'd also put in a proxy server that can log activity and block certain traffic. Proxying can help some of your speed woes, blocking can limit ...


3

You can do this using ALTQ, to some extent. What you can do using ALTQ is lower the bandwidth of a specific pipe after a specific time, when using HFSC. Whether this actually accomplishes what you need depends largely on the protocol. In depth information on PF and HFSC is available here and you'll be looking at option 7 for your implementation. It does not ...


3

I wrote a script to set up HFSC + SFQ for Linux (using tc); HFSC should do what you want, and SFQ on top enforces fairness between bulk streams. The result works very well for me, allowing for low latency even in the face of multiple bulk uploads or downloads. Here's the script: https://gist.github.com/939373


3

How about writing a rule that, if referer is unknown (of forbidden), just call a Php file where you pass the image as a param, and in the Php file, just put in big red: "this file comes from MYWEBSITE.COM and has no official authorization to be shown here". As for your question, make your rule global. Correct me if I'm wrong, but if the rule is declared ...


3

When you say ntop is no use -is that because you had problems using ntop, or that it didn't give you sufficient info? You could install the pfflowd package which is a netflow emitter - I only played around with it a little and found some netflow collectors didn't seem to like it as it didn't totally conform to standards. This thread ...


3

This would be the ultimate HowTo: http://lartc.org/howto/index.html


3

You could set up shaping with rules something like this: tc qdisc del dev eth0 root tc qdisc add dev eth0 root handle 1: htb default 1 r2q 160 tc class add dev eth0 parent 1: classid 1:1 htb rate 2000kbit burst 1k tc class add dev eth0 parent 1:1 classid 1:2 htb rate 2000kbit ceil 2000kbit burst 1k tc class add dev eth0 parent 1:1 classid 1:3 htb rate ...


3

If you use a poor quality router this might die when you do this kind of scan.


3

A quick search gave me MasterShaper, but when I worked at a wireless ISP I used htb.init to shape my traffic. I know that DD-WRT (custom firmware for broadcom wireless routers) has a very good QOS interface (I use it to keep the torrents from slowing everything else). Take a look at both projects, I know that htb.init config is made via text files and not ...


3

I'm not sure about apache module, but you could use iptables for it. Here is the howto about connlimit module: http://www.cyberciti.biz/faq/iptables-connection-limits-howto/ In your situation something like following would work: /sbin/iptables -A INPUT -p tcp --syn --dport 80 -m connlimit --connlimit-above 20 -j REJECT --reject-with tcp-reset However, as ...


3

Unfortunately there is no such a solution for FreeBSD. There are many solutions like dummynet/ipfw or altq/pf which are used to limit network usage based on different patterns but not on pids. On linux there is a way to limit network usage on a user basis: iptables -t mangle -A OUTPUT -p tcp -m owner --uid-owner test -j MARK --set-mark 1 I think there is ...


3

You can monitor network traffic using ntop tool in realtime. ntop clears its logs on restart, this is annoying a bit, but you still can run it for a period of time to classify your traffic. As I recall it can classify the traffic by client IPs, ports and protocols. If you know a port you will be able to find a related service using fuser command line tool.



Only top voted, non community-wiki answers of a minimum length are eligible