Reputation
Top tag
Next privilege 200 Rep.
See reduced ads
Badges
1 10
Impact
~10k people reached

Mar
21
revised What is the best solution for traffic control in a large system (ca. 2000 users)?
Described how the implementation was done.
Mar
20
asked Should I update the kernel on a Linux machine?
Mar
11
asked What is the easiest way to set up a PHP-enabled web server on Windows XP?
Feb
23
awarded  Supporter
Nov
12
awarded  Editor
Nov
12
revised How can I log all traffic with its exact length?
Added a description of the actual implementation.
May
23
comment How can I log all traffic with its exact length?
I need to account the traffic each of our users makes. I don't need the byte count to be 100% accurate, but the fault margin shouldn't be too high.
May
23
comment How can I log all traffic with its exact length?
I load-tested it today. When I create a chain with over 9000 rules (over 2000 users, each with a subnet and a VPN IP, two rules - one for Source, one for Destination IP checking - for each IP or IP range) ksoftirqd takes 100 % CPU and the kernel starts massively dropping packets. It looks as if the iptables approach is doomed. Even if I optimize the rules so that heavy users are at the top I won't be able to stop the dropping. The internet became totally unusable during the test.
May
5
awarded  Scholar
May
5
accepted How can I log all traffic with its exact length?
May
5
comment How can I log all traffic with its exact length?
In initial tests tcpdump causes the kernel to drop about 3-5 % of all packages. I initially thought of the iptables solution, the advantage I saw in tcpdump was the ability to process packets in real time. However, I guess it might be enough to use iptables chains and read the byte count every 60 seconds or similar. Thanks for your advice.
May
5
asked How can I log all traffic with its exact length?
Dec
19
awarded  Autobiographer
Dec
17
comment What is the best solution for traffic control in a large system (ca. 2000 users)?
Unfortunately, we can't afford to invest much money into this, neither for a dedicated packet shaper nor for more bandwidth. Our system is working at the moment, the question is how, instead of blocking users that have exceeded their allocated traffic, we can only reduce the bandwidth available to them.
Dec
16
awarded  Student
Dec
16
asked What is the best solution for traffic control in a large system (ca. 2000 users)?