Bienvenido! - Willkommen! - Welcome!

Bitácora Técnica de Tux&Cía., Santa Cruz de la Sierra, BO
Bitácora Central: Tux&Cía.
Bitácora de Información Avanzada: Tux&Cía.-Información
May the source be with you!

Saturday, July 3, 2010

Limit p2p trafic

I have been playing with limiting traffic to P2P clients after hours because we find that as soon as the firewall switches to "free-time mode" (i set this all up) suddenly everyone is downloading etc and it saturates the network.

I decided that I wanted to limit the traffic using iptables "limit" function. I have written the rule (find below) but still need to confirm a few things.

###############################
#    Limiting P2P Traffic     #
###############################

$IPTABLES -A INPUT -i $INSIDE -s 192.168.1.27 -p tcp --dport 1000:10000 -m limit --limit 5/second -j ACCEPT
$IPTABLES -A INPUT -i $INSIDE -s 192.168.1.27 -p tcp --sport 1000:10000 -m limit --limit 5/second -j ACCEPT

at the moment I am only restricting myself cause if something goes bad its my own prob ahhaha

so how to test if it is limiting the traffic...

let me try to write out my understanding of the rule and then id love ANYONE to correct me cause i think im wrong

-m limit --limit 5/second -j ACCEPT

5/second will only allow 5 packets(or Kb's???) through each second and the rest will be dropped? correct?

what does the limit-burst command actually do? does it allow 5 packets (or Kb's?) per second until it reaches the packet burst.. then resets?

the man page isnt that helpful with this.. at least I dont really understand..

So things i would LOVE answers too
1. is the number relevant to KB's or Packets?
2. If its packets how do I translate THAT into KB's so I know how many to allow per second. We have a 256KB connection.. so I would like to restrict the P2P to say 56Kb/Second (spread over everyone) which will piss people off but at least our normal traffic can run without coming to a slow stop

No comments: