I am setting up a scanning system for a Pentest company. The box has loads of bandwidth and I'm concerned that testers could inadvertently DoS the clients. Capping the outgoing bandwidth to 10mbps seems a reasonable balance between testing speed and avoiding a DoS. However, multiple testers will be working on separate clients, so I need the limit to be 10mbps EACH, not 10mbps total.

A reasonable approximation to this ideal is to limit traffic based on the destination /24 address. For example, traffic to and would both be capped in the same 10mbps "bucket" because they're both in But would be in a separate 10mbps bucket.

How can I implement this on Linux? I've read some introductory documents on tc, and it seems we need to mark packets to identify the buckets. I've seen some examples that have hardcoded IP address in the configuration. However, I'd like to do this generically, without having to reconfigure tc every time we start a new test.


In your case, tc won't work, because you would need to create the 2^24 = 16777216 buckets in advance.

Alternatives are a packet per second limit in iptables, or to implement the shaping in your software.

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.