Tag Info

Hot answers tagged

19

IFB is an alternative to tc filters for handling ingress traffic, by redirecting it to a virtual interface and treat is as egress traffic there.You need one ifb interface per physical interface, to redirect ingress traffic from eth0 to ifb0, eth1 to ifb1 and so on. When inserting the ifb module, tell it the number of virtual interfaces you need. The default ...


13

First, this question means that you are not following security/firewall best practices by allowing everything, except what is denied. The proper way to configure a firewall is to block everything, except what you allow. If you did that, Limewire would already by blocked. Now, to your answer, the easiest way is to block ports from the 6300 to 6400 range ...


10

What you're looking for is called Traffic Shaping. The best source of information for it (that I know of) is Linux Advanced Routing and Traffic Control. It's a little bit dated, but still has a ton of good information. If you google for Linux Traffic Shaping, you can find some scripts and tools to make the traffic shaping configuration a little bit ...


10

The download managers most likely work as explained in the the trickle paper. A process utilizing BSD sockets may perform its own rate limiting. For upstream limiting, the application can do this by simply limiting the rate of data that is written to a socket. Similarly, for downstream limiting, an application may limit the rate of data it ...


10

I think most approaches that ask "How do I lock down X" are just plain wrong. It's badness enumeration. Now go downvote me but I think that you should (as you do with "normal" firewalls) just allow the traffic that matches known good traffic. But now you have a problem, SSL encrypted HTTP traffic isn't as easy to allow. There are solutions to it that are ...


8

The traffic shaping layer of the kernel is, basically, a packet scheduler attached to your network card. So one traffic shaping policy applies to one network card. What you can do, in your case, is to create a list of IP and bandwidth attached, and then, for each IP, you create: One traffic shaping rule identified by a classid One netfilter rule that will ...


8

Been there, tried that. Just won't work. In a SOHO environment, such as where I work, there is no way to tell what is P2P and what is "legitimate" traffic, as the gear we have just isn't that sophisticated. The only way I have found that's worth anything at all is a more "manual" way. My monitoring system (Nagios) alerts me when the traffic on the external ...


7

us trickle. sample cmdline: trickle -d 10 wget http://noc.gts.pl/50mb.gts you can repalce wget with any other command. and btw - wget has built in bandwidth limiting option: --limit-rate=amount - so it does not require any external tools to slow it down.


7

This could very well be a switch/cabling issue, or a configuration problem on the desktop themselves. Anyway, a quick and easy test: take a laptop, plug it in socket A, download something big from a well-known high-bandwidth site (like Microsoft download center), measure time, move laptop to socket B, repeat, compare speeds. Also, while you're at it, you ...


6

You could define the curves with different names: rt, real-time curve, bandwidth/delay guarantee. ls, link-share curve, bandwidth/delay sharing (based on the configuration of neighbour leaves) ul, upper limit curve, maximum bandwidth/delay it may attain. What for do I need a real-time curve at all? Assuming A1, A2, B1, B2 are all 128 kbit/s ...


6

I have actually had to solve such a problem recently. We have 8Mbit/s for 150 PCs. The problem was not so much regular bandwidth use but people who would download big ISO files and kill the bandwidth for everyone else. We handled this by inserting a caching web proxy (Squid on Pfsense) that allows for 2 bandwith limiting parameters. First one is max global ...


6

If traffic shaping does not shape traffic properly for both shell and active uploads (I think it can, but not sure) then you could: a) run ssh on two ports - you could prioritize one for file transfers and one for interactive work. b) limit the total ssh rates - the only problem is if you fill up upload capacity of the link and ssh will work nicely ...


6

If you want to apply limitation to all outbound traffic, you don't need filters at all. Just add your qdisc to the interface root handle like so: tc qdisc add dev eth0 root handle 1: tbf rate 256mbit latency 1ms burst 1540 If you want to shape/police inbound traffic, it's a little more complicated. You'll need to use e.g. an IFB interface: modprobe ifb ...


5

It would seem that the ports are 6346-6347, TCP. http://www.ehow.com/how_2102913_block-limewire.html


5

Standard answer: Don't let your users install unauthorized software on their computers :) But another way to handle this is to be more general in your control methods. We use a proxy server like a Bluecoat which can also throttle bandwidth. Then you force all Internet access through the proxy and block everything going out at your firewall. Most programs ...


5

Reading the papers on HFSC and its cousins is not a good way of understanding it. The primary goal of the HFSC paper is to provide a rigorous mathematical proof of its claims, not explaining how it works. Indeed you can't understand how it works from the HFSC paper alone, you have to read the papers it references as well. If you have some problem with the ...


5

I user Netlimiter 2 for my personal stuff. http://www.netlimiter.com/ I know they've moved to 3, but I haven't. Its absolutely fantastic for my purposes. You can block/limit inbound and outbound seperately, by application, by port (although I don't think you can just do port filtering...) Its USD29.99 so will definitely break the bank (If Sam's answer is ...


4

I would recommend MasterShaper http://www.mastershaper.org/index.php/Main_Page . It has shaping, a web interface, is open source and has other features. It doesn't have compression. In my former company (Internet Service Provider with a large base of users), we replaced a Packeteer PacketShaper with MasterShaper server and it works fine with traffic around ...


4

Block ports 6346,6347 TCP, UDP LimeWire will probably use different port. You should block all ports except the ones you are using. In case you have Windows, you can also set firewall on workstations to block "C:\Program Files\LimeWire\LimeWire.exe"


4

Wondershaper can do wonders, and it's quite easy to setup. Other than that, you can find some userland programs to do that. In Linux there's Trickle, there might be equivalents for Windows. But really, you want traffic shaping- people will forget to run the program, etc. Just limiting uploads to slightly less than your full capacity will probably do you a ...


4

The capabilities of netfilter are almost boundless. On this one I'd use the limit module in iptables. Be aware: there is no way of limiting rates in TCP/IP without dropping packets. You can queue the packets up, but eventually when the queue is full packets get dropped. So we are going to drop SYN packages. I haven't tried this so far, probably because of ...


4

In the case of a 56k modem versus a 4 Mbps DSl line, there's (usually) no shaping making the speed difference, it's just a difference in the speed of the link. The reason why it's hard to shape on incoming traffic is that there's no buffer in the transmission medium. You either accept the incoming bits or they're lost. For traffic taht is about to leave an ...


3

Assuming eth0 is a 100mbit Ethernet connection to the Cisco Router, it should be something like this (Isn’t it?): tc qdisc add dev eth0 root handle 1: htb default 2 # 100 mbps tc class add dev eth0 parent 1: classid 1:1 htb rate 100mbit # To LAN traffic tc class add dev eth0 parent 1:1 classid 1:2 htb rate 99000kbit ceil 100mbit # IN traffic tc class add ...


3

+1 for Karolis T. and Roy. As a side note, You should look into controlling who has rights to install software. Blocking limewire is the tip of the iceburg if people can control the software on the machines. Installing spyware, viruses, disabling anti virus etc. are all bigger issues IMO


3

Wget has built in bandwidth control with the --limit-rate option. Shorewall also offers a nicer interface to traffic shaping, as does wondershaper.


3

You could use acl aclname rep_mime_type mime-type to block certain mime-types from downloading (eg iso's) and reply_body_max_size to set a ceiling on the biggest files that can be downloaded you could also use free-sa to analyze your logs to see where the bandwidth is going http://free-sa.sourceforge.net/ EDIT: Actually squid delay pools will do ...


3

Sure, routers don't ordinarily change source/destination IP addresses; only NATting routers do that. So, just don't use NAT, and all will work fine.


3

You should be able to rate limit tcp connections, if the remote servers are obeying tcp packet transmit and receive rules then you should be able to rate limit to avoid a dos. I've had good success with HTB http://luxik.cdi.cz/~devik/qos/htb/manual/userg.htm if your more familiar with cisco, then you could implement a qos policy on your gateway rather ...


3

Simple script to limit ingress and egress http traffic: #!/bin/bash INT="eth1" case "$1" in start|restart) tc qdisc del dev $INT handle ffff: ingress 2>/dev/null tc qdisc add dev $INT handle ffff: ingress tc filter add dev $INT parent ffff: protocol ip prio 50 u32 match ip dport 80 0xffff police rate 50Mbit burst 10m drop flowid ...


3

A pre-packaged solution for this type of scenario would be great, but I have yet to find the ideal one. MY particular setting is a smaller Wireless ISP, but it is a similar problem of presenting particular clients from flooding the network. Two solutions I've used: cbq.init or htb.init. Both of these easy the administration of managing the various tc ...



Only top voted, non community-wiki answers of a minimum length are eligible