Tag Info

Hot answers tagged

20

You can fix this sort of thing via technology - basically firewall off the sources and/or ports - but I'm a big believer in not turning a HR problem into a game of cat'n'mouse with your users. Simply speak to HR, explain the problem and ask them to make a policy regarding this issue and have them communicate it to your users. Then simply agree with HR to do ...


10

There are two main approaches that you can take on this to get both objectives of inbound and outbound load balancing working in concert, which I'll summarize. With BGP Requirements: BGP capable router, AS number, IP ranges that you're authorized to announce When using BGP to balance load between multiple links, you're likely relying on it for all of ...


10

I watched this a while ago. It's 'A day in the life of Facebook operations'. They use cfengine2 (deployment), nagios (monitoring), ganglia (monitoring and trending) plus a lot of in-house tools. Funny to see some of the tools we use are used in such a massive scale (+60.000 servers)


8

I think most approaches that ask "How do I lock down X" are just plain wrong. It's badness enumeration. Now go downvote me but I think that you should (as you do with "normal" firewalls) just allow the traffic that matches known good traffic. But now you have a problem, SSL encrypted HTTP traffic isn't as easy to allow. There are solutions to it that are ...


7

Most (all? OpenSSH at least) SSH implementations set different IP TOS flags depending on if the session is interactive or bulk data. It sets the lowdelay TOS flag for interactive sessions. You can then match on the TOS flags in your ACL.


7

us trickle. sample cmdline: trickle -d 10 wget http://noc.gts.pl/50mb.gts you can repalce wget with any other command. and btw - wget has built in bandwidth limiting option: --limit-rate=amount - so it does not require any external tools to slow it down.


6

QoS is Quality of Service. It's meant to flag traffic that should receive special attention. VOIP, for instance, should be low latency and put at the front of the queue. The problem with that is that anyone could mark their traffic just to be treated nicely, even if were a bulk download that had no special requirements. So across the internet almost nobody ...


6

You could define the curves with different names: rt, real-time curve, bandwidth/delay guarantee. ls, link-share curve, bandwidth/delay sharing (based on the configuration of neighbour leaves) ul, upper limit curve, maximum bandwidth/delay it may attain. What for do I need a real-time curve at all? Assuming A1, A2, B1, B2 are all 128 kbit/s ...


6

Been there, tried that. Just won't work. In a SOHO environment, such as where I work, there is no way to tell what is P2P and what is "legitimate" traffic, as the gear we have just isn't that sophisticated. The only way I have found that's worth anything at all is a more "manual" way. My monitoring system (Nagios) alerts me when the traffic on the external ...


6

This is a very common issue when RDP is working with insufficient bandwidth or high latency. I'm not sure if it is a protocol bug or an implementation bug (eg. if packets are arriving out of order and not being reassembled correctly, or if they are being misinterpreted altogether), but the solution is either to increase available bandwidth, or adjust the ...


5

If you have a user that this happens to often in a day, give them a straight client/server VPN into the RDP server over their internet connection instead of the MPLS, bypassing QoS and the bandwidth congestion of the MPLS circuits themselves. If all is well for a few days, then you can set aside bugs/issues within the client or server and focus on the MPLS ...


5

You can install spotify yourself, sniff the traffic, and block outbound connections to their servers on your firewall. Or You can get a rate shaper that does packet inspection and shape the traffic for streaming audio to zero or close to it, then whitelist any legitimate audio streaming sites that you approve.


5

I think that you should use the POSTROUTING mangle table since you are marking the packets in the PREROUTING before the NAT engine. Have a look at the IPTABLE Chain :


5

You can use packet lengths to distinguish one from the other, but there's a risk that these will be chopped and mixed by the SSH transport. class-map match-all ssh-interactive match access-group name ssh match packet length max 600 class-map match-all ssh-files match access-group name ssh match packet length min 600 ip access-list extended ssh permit ...


5

It depends on the type of QoS you want to use. The world of QoS is vast and complex and there are many different techniques that can be combined in different ways to give a "guarantee" of service in each situation. Actually I'd say that reserving bandwidth for VoIP is a type of QoS policy. If you ask for a type of QoS policy in particular, you should ...


4

Answer: DRR does not drop packets itself. To get the desired behavior, add child qdiscs to the DRR child classes like pfifo limit 50 to cause the child qdisc to drop packets instead of queueing them effectively indefinitely. The solution was found here: linux.org.ru thread Reference: man tc-drr NOTES This implementation does not drop packets from ...


4

Problem is with high contention, packets begin to queue up and VOIP packets cannot sit and wait. Are you sure you configured destination ports appropriately for traffic exiting your site? You can't packet shape ingress, only egress. Maybe you configured those destination ports for your LAN side which might include a lot of non-VOIP traffic as well ...


4

match protocol skype will only match Skype Protocol v1. v2 of the protocol is very good at finding ways around any blocks - for example it will simply use HTTPS if it has to. Here is a very good description of how to block it by forcing it to use HTTPS and then using DPI to inspect and block Skype HTTPS traffic ...


4

Seeing as how you have VOIP on the link, I'd probably go with something like this (I am assuming that your 10M WAN-facing port is nailed to 10 M, so won't use a hierarchical QoS policy to install a 10M shaper). class-map voice match dscp ef policy-map outbound class voice priority [ insert voice bandwidth allocation here ] class class-default ...


4

Reading the papers on HFSC and its cousins is not a good way of understanding it. The primary goal of the HFSC paper is to provide a rigorous mathematical proof of its claims, not explaining how it works. Indeed you can't understand how it works from the HFSC paper alone, you have to read the papers it references as well. If you have some problem with the ...


4

Enable QoS on your DD-WRT stuff as described here. Make all non-port-80/22/25/IMAP/POP traffic limited to some very small amount of bandwidth, and make even those ports limited to something reasonable like 2Mb/s or so. Then go read BOFH for ideas about what to do to the offending users.


4

You're right, it really is a social problem that needs to be addressed by management. If certain people are impacting the network to the point that it's causing problems for others, then they need to be dealt with and explained what the consequences will be if they keep it up. Reprogramming the MAC addresses on their NICs? If they have no legitimate need ...


4

While I am a big fan of the ASA platform, I will be the first to admit that QoS paradigms and capabilities are rather limited on ASA's. Standard IOS ISR's run circles around what the ASA is capable of in regard to QoS. If you have not read both the ASA QoS Configuration Guide and the IOS QoS Solutions Guide please read them. They are required reading for ...


4

The 5400zl series supports a very full feature list to provide quality of service (QoS) and traffic management. And for your specific requirement it also supports rate-limiting. Your best bet will be to upgrade to the latest version (K.15.8 at this point in time). The reference is the Advanced Traffic Management guide (current version) What you need to do ...


4

As long as the companies only share the internet connection and have no need to share other resources (like file servers), I clearly would favor option 1. If you have separate companies and have become the administrator by chance rather than an external, binding decision for every of the companies, one of the things you would want most would be a clean, ...


4

This strikes me as the wrong way to handle traffic shaping in your environment -- you are effectively limiting an unlimited resource (internal bandwidth - on your local switches) to try to prevent exhausting a limited resource (upstream bandwidth - on your DSL line). Your router (or barring that, a decent router/firewall appliance like pfSense) should ...


4

What kind of routers are you using? It sounds like you're just using SOHO type routers? You might want to look at getting better routers and switches with management built in and monitorable through SNMP. That said I'd also put in a proxy server that can log activity and block certain traffic. Proxying can help some of your speed woes, blocking can limit ...


3

There is not out of the box solution in Ubuntu. You have to recompile your kernel with the imq patch applied. There are a lot of tutorials on how to do that. Here is the first I have found: http://ubuntuforums.org/showthread.php?t=1404537


3

You should patch your kernel to add support for IMQ. Here you find the patches http://www.linuximq.net/patches.html and here you will find details instructions how to compile it: http://ubuntuforums.org/showthread.php?t=1404537 Regards


3

Give something like this a try for a catch-all tc filter add dev $IF_LAN parent 1: protocol ip prio 7 u32 match ip dst 0.0.0.0/0 flowid 1:190



Only top voted, non community-wiki answers of a minimum length are eligible