Tag Info

Hot answers tagged

21

IFB is an alternative to tc filters for handling ingress traffic, by redirecting it to a virtual interface and treat is as egress traffic there.You need one ifb interface per physical interface, to redirect ingress traffic from eth0 to ifb0, eth1 to ifb1 and so on. When inserting the ifb module, tell it the number of virtual interfaces you need. The default ...


13

First, this question means that you are not following security/firewall best practices by allowing everything, except what is denied. The proper way to configure a firewall is to block everything, except what you allow. If you did that, Limewire would already by blocked. Now, to your answer, the easiest way is to block ports from the 6300 to 6400 range ...


11

What you're looking for is called Traffic Shaping. The best source of information for it (that I know of) is Linux Advanced Routing and Traffic Control. It's a little bit dated, but still has a ton of good information. If you google for Linux Traffic Shaping, you can find some scripts and tools to make the traffic shaping configuration a little bit ...


10

The download managers most likely work as explained in the the trickle paper. A process utilizing BSD sockets may perform its own rate limiting. For upstream limiting, the application can do this by simply limiting the rate of data that is written to a socket. Similarly, for downstream limiting, an application may limit the rate of data it ...


10

I think most approaches that ask "How do I lock down X" are just plain wrong. It's badness enumeration. Now go downvote me but I think that you should (as you do with "normal" firewalls) just allow the traffic that matches known good traffic. But now you have a problem, SSL encrypted HTTP traffic isn't as easy to allow. There are solutions to it that are ...


9

Been there, tried that. Just won't work. In a SOHO environment, such as where I work, there is no way to tell what is P2P and what is "legitimate" traffic, as the gear we have just isn't that sophisticated. The only way I have found that's worth anything at all is a more "manual" way. My monitoring system (Nagios) alerts me when the traffic on the external ...


8

The traffic shaping layer of the kernel is, basically, a packet scheduler attached to your network card. So one traffic shaping policy applies to one network card. What you can do, in your case, is to create a list of IP and bandwidth attached, and then, for each IP, you create: One traffic shaping rule identified by a classid One netfilter rule that will ...


8

Reading the papers on HFSC and its cousins is not a good way of understanding it. The primary goal of the HFSC paper is to provide a rigorous mathematical proof of its claims, not explaining how it works. Indeed you can't understand how it works from the HFSC paper alone, you have to read the papers it references as well. If you have some problem with the ...


7

us trickle. sample cmdline: trickle -d 10 wget http://noc.gts.pl/50mb.gts you can repalce wget with any other command. and btw - wget has built in bandwidth limiting option: --limit-rate=amount - so it does not require any external tools to slow it down.


7

This could very well be a switch/cabling issue, or a configuration problem on the desktop themselves. Anyway, a quick and easy test: take a laptop, plug it in socket A, download something big from a well-known high-bandwidth site (like Microsoft download center), measure time, move laptop to socket B, repeat, compare speeds. Also, while you're at it, you ...


6

If you want to apply limitation to all outbound traffic, you don't need filters at all. Just add your qdisc to the interface root handle like so: tc qdisc add dev eth0 root handle 1: tbf rate 256mbit latency 1ms burst 1540 If you want to shape/police inbound traffic, it's a little more complicated. You'll need to use e.g. an IFB interface: modprobe ifb ...


6

I have actually had to solve such a problem recently. We have 8Mbit/s for 150 PCs. The problem was not so much regular bandwidth use but people who would download big ISO files and kill the bandwidth for everyone else. We handled this by inserting a caching web proxy (Squid on Pfsense) that allows for 2 bandwith limiting parameters. First one is max global ...


6

If traffic shaping does not shape traffic properly for both shell and active uploads (I think it can, but not sure) then you could: a) run ssh on two ports - you could prioritize one for file transfers and one for interactive work. b) limit the total ssh rates - the only problem is if you fill up upload capacity of the link and ssh will work nicely ...


6

You could define the curves with different names: rt, real-time curve, bandwidth/delay guarantee. ls, link-share curve, bandwidth/delay sharing (based on the configuration of neighbour leaves) ul, upper limit curve, maximum bandwidth/delay it may attain. What for do I need a real-time curve at all? Assuming A1, A2, B1, B2 are all 128 kbit/s ...


5

It would seem that the ports are 6346-6347, TCP. http://www.ehow.com/how_2102913_block-limewire.html


5

Standard answer: Don't let your users install unauthorized software on their computers :) But another way to handle this is to be more general in your control methods. We use a proxy server like a Bluecoat which can also throttle bandwidth. Then you force all Internet access through the proxy and block everything going out at your firewall. Most programs ...


5

I user Netlimiter 2 for my personal stuff. http://www.netlimiter.com/ I know they've moved to 3, but I haven't. Its absolutely fantastic for my purposes. You can block/limit inbound and outbound seperately, by application, by port (although I don't think you can just do port filtering...) Its USD29.99 so will definitely break the bank (If Sam's answer is ...


4

In the case of a 56k modem versus a 4 Mbps DSl line, there's (usually) no shaping making the speed difference, it's just a difference in the speed of the link. The reason why it's hard to shape on incoming traffic is that there's no buffer in the transmission medium. You either accept the incoming bits or they're lost. For traffic taht is about to leave an ...


4

The capabilities of netfilter are almost boundless. On this one I'd use the limit module in iptables. Be aware: there is no way of limiting rates in TCP/IP without dropping packets. You can queue the packets up, but eventually when the queue is full packets get dropped. So we are going to drop SYN packages. I haven't tried this so far, probably because of ...


4

I would recommend MasterShaper http://www.mastershaper.org/index.php/Main_Page . It has shaping, a web interface, is open source and has other features. It doesn't have compression. In my former company (Internet Service Provider with a large base of users), we replaced a Packeteer PacketShaper with MasterShaper server and it works fine with traffic around ...


4

Block ports 6346,6347 TCP, UDP LimeWire will probably use different port. You should block all ports except the ones you are using. In case you have Windows, you can also set firewall on workstations to block "C:\Program Files\LimeWire\LimeWire.exe"


4

Wondershaper can do wonders, and it's quite easy to setup. Other than that, you can find some userland programs to do that. In Linux there's Trickle, there might be equivalents for Windows. But really, you want traffic shaping- people will forget to run the program, etc. Just limiting uploads to slightly less than your full capacity will probably do you a ...


4

In Fedora 17 they moved a lot of unused (in common usage I guess) modules for the kernel into the package kernel-modules-extra. Install that and your problem will go away.


4

Ok, I solved my own problem. It turns out that if you execute the first 3 lines above (the "tc qdisc" ones), it will delay all packets because there are no filters yet. The 4th line changes it to only delay packets from that single IP address. Additional filter lines can be added to add additional IP addresses to the "delayed" list. So: don't create a ...


4

I'm having trouble adding the script code for you here, it is available via this gist - https://gist.github.com/akrasic/7242498#file-limit-tc-sh The script is using TC and Hierarchical Token Bucket (HTB) to define the rules and lastly the filters that would act as a catch-all rule. You would need to modify the interface var if it's different than eth0Λ™and ...


4

RTNETLINK answers: No such file or directory is tc's way of saying that it can't find something - in this case: most probably the htb scheduler. To test and make sure try modprobe sch_htb You will probably get an error. And this probably means that your VPS provider is not using the default kernels from debian upstream. They usually provide you with a ...


3

bw is lower than expected I think you have to increase burst as well correspondingly. Is is possible to effectively limit incoming bandwidth? I'd say you surely can achieve similar effect dropping packets, instead of receving them. For protos like TCP, which have bandwidth self-tuning mechanisms, it would effectively work. Take a look at ...


3

VLAN tag is stripped from skb in recent kernels. Try something like this to do a meta match in skb: tc filter add dev internal protocol all parent 1:0 prio 100 basic match 'meta(vlan mask 0xfff eq 0x0ed8)' flowid 1:300


3

You booted your OVH server with the OVH-provided custom kernel, instead of the kernel provided by your Linux distribution. The kernel provided by OVH may not have all of the modules that you need. Reconfigure your dedicated server to boot from the hard disk, in your OVH account management pages.


3

Are you specifically avoiding "tc" (traffic control: http://tldp.org/HOWTO/Traffic-Control-HOWTO/index.html)? I think "tc" is the more appropriate tool for that job.



Only top voted, non community-wiki answers of a minimum length are eligible