Tag Info

Hot answers tagged

15

This can be done using the LimitReqModule with Nginx. However if this is for a reverse proxy you might want to try out the new rate limiting supported by HAProxy. I found the nginx rate limiting to be a little bit confusing to get the exact rate you want. But you basically have something like: limit_req_zone $binary_remote_addr zone=default:10m ...


7

UFW is designed to be "uncomplicated," which in this case means you don't have control over the particulars of the rate to which connections are limited. If you want to dig into the Python source of UFW, you could find out how to tweak it. The appropriate information is (on my Ubuntu 10.04 system) in /usr/share/pyshared/ufw/backend_iptables.py Setting the ...


5

I user Netlimiter 2 for my personal stuff. http://www.netlimiter.com/ I know they've moved to 3, but I haven't. Its absolutely fantastic for my purposes. You can block/limit inbound and outbound seperately, by application, by port (although I don't think you can just do port filtering...) Its USD29.99 so will definitely break the bank (If Sam's answer is ...


5

try to use http://opensource.adnovum.ch/mod_qos/ mod_qos now taking care of anything :)


4

From my experiments it seems that per minutes is just a way to write rates that are on sub-second intervals. So 60r/m == 1r/s. This can be demonstrated by setting it to 60 requests per minute and then launching say 2 requests per second. It will be limited from the start, not only after 60 requests have been made. That being said, I still don't fully ...


4

You can use ratepipe. I downloaded and tried it out and it seems to DTRT. It should work for you: tar --remove-files -cvif - 2011-08-02_14-05-09 | ratepipe -r 20 > 2011-08-02_14-05-09.tar


4

Yes, don't load the server up. But seriously, if you have a CPU thermal issue, it's best to take care of it now, and not later. It's not very good for (sensitive) electronics to be continually overheated and put back to work. I'm not familiar with cpufreqd, does it throttle frequency based on current load? If so, it may be scaling frequency back up when ...


4

A rate limit is not a prevention but rather an invitation to DoS - especially in the flavor presented above where packets are going to be dropped if a certain rate of unauthenticated packets without state information has been exceeded. Since everybody can forge packets (including source IP addresses) at this connection state without greater effort, a new DoS ...


4

The 5400zl series supports a very full feature list to provide quality of service (QoS) and traffic management. And for your specific requirement it also supports rate-limiting. Your best bet will be to upgrade to the latest version (K.15.8 at this point in time). The reference is the Advanced Traffic Management guide (current version) What you need to do ...


4

Yes, typical rate-limiting configuration definition string looks like: limit_req_zone $binary_remote_addr zone=zone:16m rate=1r/s; where $binary_remote_addr is the unique key for limiter. You should try changing it to $http_x_forwarded_for variable which gets the value of X-Forwarded-For header. Although this will increase memory consumption because ...


4

In short, Yes traffic control software can indeed drop packets when shaping traffic. That's ok for TCP protocols as TCP will take care of ensuring that lost packets get resent. The Traffic Shaping Wiki describes some of the methods used to shape the traffic. There are many algorithms available such as RED, tail drop and others. Will the traffic control ...


3

MAC addresses are purely an OSI Layer 2 phenomena. Once a packet passes through a router, MAC address information from the source machine is no longer available. So as the above person commented, if you're only offering this service to internal users, and those users as well as the service itself are all on the same Layer 2 network, then this might be ...


3

I think the confusion stems from your comprehension of the man page. ncftp is the name of the process being limited, so to limit firefox you would do: trickle -u 10 -d 20 firefox


3

If it's a true DoS, this isn't going to help much. The requests are still going to clog your pipe whether your server answers or not. By dropping that traffic, you're just delaying the inevitable exhaustion of resources. To truly combat a real DoS, you should contact your ISP and ask then to drop the offending traffic while it's still on their backbone ...


3

One thing is for sure - if you use security groups, the filtered traffic never reaches your server, so it reduces the load the server needs to take to process firewall rules. This is important if you talk about DDoS. The security groups seems to have just simple filtering rules, while with iptables you can do really fancy things. But do you need them? ...


3

The documentation here has an explanation that sounds like what you want to know: The directive specifies the zone (zone) and the maximum possible bursts of requests (burst). If the rate exceeds the demands outlined in the zone, the request is delayed, so that queries are processed at a given speed From what I understand, requests over the ...


3

Not an apache module, but you can try using the "Crawl delay" directive in robots.txt to slow down well behaved spiders. http://en.wikipedia.org/wiki/Robots%5Fexclusion%5Fstandard#Crawl-delay%5Fdirective


3

Use a status code other than 503 for your "maintenance mode." As we can clearly see, users don't actually get served a 503 when you are using "maintenance mode" anyway, so there's no benefit to using that status code internally in your configuration. Make up another code (593?) and use that. Or better yet, skip the extra location and just send the ...


2

No shipping version of Windows Server has any built-in functionality to do rate-limiting like you're looking for, either in the IP stack or in the DNS server. You're stuck putting a firewall that can rate-limit in front of the Windows machine if you want this type of functionality.


2

To directly answer your question, take a look at ModEvasive and Traffic Shaping from Lighttpd. As an alternative/in addition to what you mentioned, you should be able to throttle connections per second using iptables rules. And finally, consider using some sort of application (message) queue mechanism. That way no matter how many requests you get to your ...


2

Changing the rsync command or wrapping it in a shell script to include the ionice command/parameters is an option. Also, You can leverage the --rsync-path option, which tells rsync which command to execute on the remote server. Something like --rsync-path="ionice -c2 -n7 rsync" will ensure that ionice runs on the destination. I'll add that ionice is not ...


2

Well, first off, is there a way that you can re-work the XMLRPC server to be able to handle multiple simultaneous requests? Having multiple web sessions depend on a service that can only do one request at a time is probably NOT going to cut it for use in the real world. An internal corporate site with low traffic might get away with it, but in the real ...


2

There is a wput utility which works the other way from the more known wget. It can be used to upload your files at a controlled rate. −−limit−rate=RATE If you don’t want Wput to eat up all available bandwidth, specify this flag. RATE is a numeric value. The units ’K’ (for KiB) and ’M’ (for MiB) are understood. The upload rate is limited on average, ...


2

If possible, use rsync. Most NAS provide rsync service nowadays, it's more secure than an smb share and it allows you to throttle bandwith precisely. Moreover, it will only transfer the differences betweeen your files, rather that transfer everything every time.


2

You can safely use named locations, such as "@location" in an if() block. See: http://wiki.nginx.org/IfIsEvil Something like this should work: http { limit_req_zone $binary_remote_addr zone=delay:10m rate=1r/m; server { ... error_page 410 = @slowdown; if( $remote_addr != "1.2.3.4" ) { return 410; } ...


2

Unless I am misunderstanding your goals, you cannot really restrict the rate at which packets come in to your network from your ISP unless you coordinate some form of QoS with your ISP to shape traffic at their routers. This typically requires a business-class connection and money. You are seeing packet drops because that is the only way to shape traffic - ...


2

As I have said on another thread, this requires addition of a very simple ACL to report the number of entries used in a table. It's at most 10 lines of code including function declaration I think, but we need to add it. I don't have the time right now, so I'm adding that to the TODO list and will accept a contrib if someone finds the time to do it.


2

On Amazon EC2, you are not charged for incoming traffic. You are only charged for outgoing traffic. src: http://aws.amazon.com/ec2/pricing/#DataTransfer One thing to know is that you cannot add or remove a security group to a running instance. You can however change the rules in the security group you used for that instance.


2

I don't think it exists a module to limit connections per time per IP. But you should play a little bit with limitipconn and mod_cband ... probably together can do that. Or you can use limitipconn with iptables. To do that probably you should use iptables: iptables -A INPUT -p tcp --dport 80 -m state --state NEW -m limit --limit 1/minute -j ACCEPT I ...


2

iptables has rate- and connection-limiting modules available: iptables -I INPUT -m limit --limit X/second -p tcp --dport 80 --syn -j ACCEPT Note that this won't actually limit the number of HTTP requests; it'll limit the number of TCP connections, which might not correspond to the number of HTTP requests if the browser is using keepalive. Also note that ...



Only top voted, non community-wiki answers of a minimum length are eligible