Tag Info

Hot answers tagged

16

You can fix this sort of thing via technology - basically firewall off the sources and/or ports - but I'm a big believer in not turning a HR problem into a game of cat'n'mouse with your users. Simply speak to HR, explain the problem and ask them to make a policy regarding this issue and have them communicate it to your users. Then simply agree with HR to do ...


10

There are two main approaches that you can take on this to get both objectives of inbound and outbound load balancing working in concert, which I'll summarize. With BGP Requirements: BGP capable router, AS number, IP ranges that you're authorized to announce When using BGP to balance load between multiple links, you're likely relying on it for all of ...


10

I watched this a while ago. It's 'A day in the life of Facebook operations'. They use cfengine2 (deployment), nagios (monitoring), ganglia (monitoring and trending) plus a lot of in-house tools. Funny to see some of the tools we use are used in such a massive scale (+60.000 servers)


8

I think most approaches that ask "How do I lock down X" are just plain wrong. It's badness enumeration. Now go downvote me but I think that you should (as you do with "normal" firewalls) just allow the traffic that matches known good traffic. But now you have a problem, SSL encrypted HTTP traffic isn't as easy to allow. There are solutions to it that are ...


7

us trickle. sample cmdline: trickle -d 10 wget http://noc.gts.pl/50mb.gts you can repalce wget with any other command. and btw - wget has built in bandwidth limiting option: --limit-rate=amount - so it does not require any external tools to slow it down.


6

QoS is Quality of Service. It's meant to flag traffic that should receive special attention. VOIP, for instance, should be low latency and put at the front of the queue. The problem with that is that anyone could mark their traffic just to be treated nicely, even if were a bulk download that had no special requirements. So across the internet almost nobody ...


6

Been there, tried that. Just won't work. In a SOHO environment, such as where I work, there is no way to tell what is P2P and what is "legitimate" traffic, as the gear we have just isn't that sophisticated. The only way I have found that's worth anything at all is a more "manual" way. My monitoring system (Nagios) alerts me when the traffic on the external ...


6

This is a very common issue when RDP is working with insufficient bandwidth or high latency. I'm not sure if it is a protocol bug or an implementation bug (eg. if packets are arriving out of order and not being reassembled correctly, or if they are being misinterpreted altogether), but the solution is either to increase available bandwidth, or adjust the ...


5

If you have a user that this happens to often in a day, give them a straight client/server VPN into the RDP server over their internet connection instead of the MPLS, bypassing QoS and the bandwidth congestion of the MPLS circuits themselves. If all is well for a few days, then you can set aside bugs/issues within the client or server and focus on the MPLS ...


5

You can install spotify yourself, sniff the traffic, and block outbound connections to their servers on your firewall. Or You can get a rate shaper that does packet inspection and shape the traffic for streaming audio to zero or close to it, then whitelist any legitimate audio streaming sites that you approve.


5

It depends on the type of QoS you want to use. The world of QoS is vast and complex and there are many different techniques that can be combined in different ways to give a "guarantee" of service in each situation. Actually I'd say that reserving bandwidth for VoIP is a type of QoS policy. If you ask for a type of QoS policy in particular, you should ...


5

You can use packet lengths to distinguish one from the other, but there's a risk that these will be chopped and mixed by the SSH transport. class-map match-all ssh-interactive match access-group name ssh match packet length max 600 class-map match-all ssh-files match access-group name ssh match packet length min 600 ip access-list extended ssh permit ...


4

match protocol skype will only match Skype Protocol v1. v2 of the protocol is very good at finding ways around any blocks - for example it will simply use HTTPS if it has to. Here is a very good description of how to block it by forcing it to use HTTPS and then using DPI to inspect and block Skype HTTPS traffic ...


4

Seeing as how you have VOIP on the link, I'd probably go with something like this (I am assuming that your 10M WAN-facing port is nailed to 10 M, so won't use a hierarchical QoS policy to install a 10M shaper). class-map voice match dscp ef policy-map outbound class voice priority [ insert voice bandwidth allocation here ] class class-default ...


4

This strikes me as the wrong way to handle traffic shaping in your environment -- you are effectively limiting an unlimited resource (internal bandwidth - on your local switches) to try to prevent exhausting a limited resource (upstream bandwidth - on your DSL line). Your router (or barring that, a decent router/firewall appliance like pfSense) should ...


4

Enable QoS on your DD-WRT stuff as described here. Make all non-port-80/22/25/IMAP/POP traffic limited to some very small amount of bandwidth, and make even those ports limited to something reasonable like 2Mb/s or so. Then go read BOFH for ideas about what to do to the offending users.


4

You're right, it really is a social problem that needs to be addressed by management. If certain people are impacting the network to the point that it's causing problems for others, then they need to be dealt with and explained what the consequences will be if they keep it up. Reprogramming the MAC addresses on their NICs? If they have no legitimate need ...


4

I think that you should use the POSTROUTING mangle table since you are marking the packets in the PREROUTING before the NAT engine. Have a look at the IPTABLE Chain :


4

You could define the curves with different names: rt, real-time curve, bandwidth/delay guarantee. ls, link-share curve, bandwidth/delay sharing (based on the configuration of neighbour leaves) ul, upper limit curve, maximum bandwidth/delay it may attain. What for do I need a real-time curve at all? Assuming A1, A2, B1, B2 are all 128 kbit/s ...


4

As long as the companies only share the internet connection and have no need to share other resources (like file servers), I clearly would favor option 1. If you have separate companies and have become the administrator by chance rather than an external, binding decision for every of the companies, one of the things you would want most would be a clean, ...


4

Answer: DRR does not drop packets itself. To get the desired behavior, add child qdiscs to the DRR child classes like pfifo limit 50 to cause the child qdisc to drop packets instead of queueing them effectively indefinitely. The solution was found here: linux.org.ru thread Reference: man tc-drr NOTES This implementation does not drop packets from ...


4

While I am a big fan of the ASA platform, I will be the first to admit that QoS paradigms and capabilities are rather limited on ASA's. Standard IOS ISR's run circles around what the ASA is capable of in regard to QoS. If you have not read both the ASA QoS Configuration Guide and the IOS QoS Solutions Guide please read them. They are required reading for ...


4

What kind of routers are you using? It sounds like you're just using SOHO type routers? You might want to look at getting better routers and switches with management built in and monitorable through SNMP. That said I'd also put in a proxy server that can log activity and block certain traffic. Proxying can help some of your speed woes, blocking can limit ...


4

The 5400zl series supports a very full feature list to provide quality of service (QoS) and traffic management. And for your specific requirement it also supports rate-limiting. Your best bet will be to upgrade to the latest version (K.15.8 at this point in time). The reference is the Advanced Traffic Management guide (current version) What you need to do ...


3

You can monitor the statistics of every single port on the switch using SNMP. This will give you your individual throughput on each port, tally them all up at any given time and that gives you your total traffic. If that traffic is higher than your switches backplane, then your switch is the bottleneck. You should also monitor your uplink ports. If they ...


3

My preferred method is to configure the client to throttle itself. This seems to be the most simple and effective method. Almost every client supports it; I use the ancient ctorrent client and even it support dynamically configurable throttling via the CTCS extension. If the client or managing user refuses to do so, and social engineering fails, I run ...


3

Option 2 - will give you the opportunity to buy a L3 switch with more capability, capacity, flexibility and resilience than option 1. Overall performance will is likely to be higher, you'll have the option to use PoE ports for the phones if you wish and you'll have the option to run some form of network management tool tool so you know what's going on and ...


3

drr is a scheduler, you still have to allocate different bandwidth to classes with htb. I guess you though specifying quantum as 600 and 1400 will give close to 1:2 ratio. In fact it will not. You may get close to that ratio on your config only in case of congestion, e.g. create multiple UDP streams, and then measure two in question, but it's still not the ...


3

I would favor Option 3 personally: Install a proper "Big Managed Switch" like you have in Option 2 Put each company in their own VLAN. For the uplinks you have a few choices: Give each company their own uplink (modem, etc.) inside their vLAN like you have in Option 1. Install a decent firewall like PFSense with an interface in each vLAN and funnel all ...


3

A quick back-of-my hand calculation gives the following data: 100 mbit bit rate is 100 000 000 bits/second (network, so not 1024) A full length ethernet frame is 1518 bytes, 12 144 bits. Transfer of a full packet takes 12144/100000000 seconds, around 0.12 ms. A minimum length ethernet frame is 64 byes, 512 bits. Transfer of a minimal packet takes ...



Only top voted, non community-wiki answers of a minimum length are eligible