I have about 30 servers connecting into a Cisco 3500 series switch, with 100M upstream bandwidth. Periodically, one or more of my servers will do a large file transfer which will completely saturate the network and cause 10-15% packet loss to other devices. I need a good solution to 1) monitor my bandwidth on a per-IP Address basis across all the servers 2) Prevent any given IP from consuming more than 50% of the available bandwidth 3) Give priority to certain protocols (streaming traffic, SSH) and lower priority to other traffic (BitTorrent, SMTP, FTP). I can monitor traffic on a per-port basis with that switch, but that does not give me any IP level visibility and no bandwidth control besides setting the port speed.

I have a spare Dell R200 with dual 1G NICs that I can devote to the cause and I'm fairly comfortable around Linux. I know this can be done with IPTABLES, TC and HTB, but I would rather have a more packaged solution with decent documentation and a management interface. If the answer is buy Cisco XXX, I'm open to that also, but since I have a server sitting around, I though I'd try that first.

So the question is: What Linux/BSD Firewall/Router/QOS solution would be meet these requirements? I've seen the list at http://en.wikipedia.org/wiki/List_of_router_or_firewall_distributions, but I'm looking for real-world experience with any of them.


A pre-packaged solution for this type of scenario would be great, but I have yet to find the ideal one. MY particular setting is a smaller Wireless ISP, but it is a similar problem of presenting particular clients from flooding the network. Two solutions I've used:

  • cbq.init or htb.init. Both of these easy the administration of managing the various tc queues and filtering. If you already understand tc and shaping, this might be a nice way to help manage the various queues. This is the solution I use for most of our bandwidth management servers. Works farily well, but no integration into iptables for marking traffic. We use the tc filters, but they are less then ideal.
  • The shorewall firewall project is a Linux package for general firewall management. It includes support for bandwidth management, and appears to allow packages to be marked with iptables rules, which I find easier to deal with. Larger learning curve, but might be worth it in the long run.
  • I'm testing Shorewall out now. it looks like it will probably do everything I need it to. Thanks – John P Dec 15 '10 at 15:55

You can use Mikrotik RouterOS for traffic engineering. You can see Traffic Engineering features in http://wiki.mikrotik.com/wiki/Category:Manual that might suit your need.


Why not use some of the rate-limiting and QoS features in IOS on your switch?

  • The only rate limiting in the switch is per-port -- not per IP address. – John P Dec 13 '10 at 4:13
  • What would be the difference in this case? – Keith Stokes Dec 13 '10 at 5:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.