Slashdot Mirror
Working With The Bandwidth Problem?
macdaddy asks: "Being a Network Admin in a small university, I have to fight the Napster issue every day. I don't want to ban it but we only have 1 T1 and it maxes out around 10AM when the dormites wake up, and finally teeters off around 4AM when they go to bed. That really hinders legitimate use. My question, how does a Netadmin work with Napster and its users to keep from blocking it while still being able to use out lowly T1 for other purposes? What options are there? Proxies? Firewalls? Traffic shapers?" This problem is not just about Napster. There will be other services that, due to their popularity, will stress your network's bandwidth to the limit. It seems to me that establishing network controls would be more fair than completely filtering out the entire service, so what's the best way to implement them?
The Gnutella idea, at first, seems like a good one, unfortunately, there's one catch to it:
as soon as one person connects to a host/client outside of your LAN (remember, the gnutella network does NOT have a central authority), your precious internalization goes down the drain. Firewalling Gnutella ports, would in essence, be just as bad as what you're trying to avoid (firewalling napster).
Perhaps the simplest way around this would be to write some custom 'internal use only' gnutella-ish program. The simplest solution might just be to use a slightly modified gnutella client that uses a dif. range of ports, and filters out IPs not on your subnet.
Hrmm... I have been looking for a project to do for my Software Engineering class, and this would be a great project... if yr. interested, email me (by Sunday night) maybe we can work something out... =)
my sig's at the bottom of the page.
There are a number of possible solutions, and I'll mention some possible solutions.
- Firewalling napster ports. This is just the start of an arms race. You block one port, clients move to another port, repeat until bored.
- Using proxies and nothing can be done without using such a proxy. Not an ideal situation and you make any server a student wants to run inaccessible where such a server could be very usefull and nice (hey, slashdot started on a student account
:)
- Traffic measurements per IP. Using IP accounting you can find out quite fast who abuses the network. Set a policy in advance (no 'fair use' blabla, a 'more then 768 megabytes Internet traffic in one week and your connection is dead' or whatever number works best). Have that policy be accepted as school policy by the people in charge. It's not your rule (those pesky network admins at it again), it's the school rule for using the school's resources.
- Traffic shaping. Allocate an amount of bandwidth to the dorms, maybe allocate a larger amount after hours. Maybe allocate bandwidth per IP. (Can perfectly be combined with the previous one).
Remember one thing and don't be afraid to repeat it : The school is not an ISP and is therefore not obliged to give its student Internet access. Internet access is an aide to your studies. If you need more Internet access then that, get your own access and be prepared to pay for it.Succes, and good luck, and I hope you find a way to keep your student network users as friends so you can do your work a lot easier.
The Virtual Bookcase: book reviews
Have you tried actually talking to the "Dormites?" Quite honestly, they may not be aware of their detrimental affect their MP3 hayday is having on the net connection. Use a dorm mailing list or your school newspaper or something to communicate the problem to students and then hold a 1 or 2 series open forum in a public place like library or something. Invite all Napster/ users and any other interested party to come and talk about *friendly* ways to remedy the problem. I can vow to you this, those "Dormites" would much rather coexist than have *zero* Napster access, even if it meant self-control, et cetera. You mention that if nothing is done you will have no option but to disallow it and you'll have a good number of people show up. I've often found that when people are shown that 1. They are causing a problem nd 2. You want to work *with* them to solve the problem, you will get 100x better results than pulling some staff management type thing. I hope this helps and if you don't mind keep me updated by email how it goes.
Regards
Trying to put a cap on useage... i.e. X megabytes per week and you will cut access is a losing proposition from a game theory point of view.
There will always be the student who desides that the response to this is to download as much as possible before you cut access.
Or the student who thinks it would be realy cool to push the useage over the limit so you cut everyones access off.
Your best answer by far is to use a QoS aware firewall which can control the bandwidth used based on a policy you set.
There are a number of companies who make them, and one of them, Packeteer, even has a page devoted to exactly your problem.
You might want to check it out at http://www.packeteer.com/wintherace/
-jon
I've heard reports of some tiny schools setting up a few napster terminals in public places. The students who absolutely *must* have the newest Madonna album can go to that terminal, download it, then move it to their PCs over the LAN. Block Napster access for all other nodes on the network.
Obviously, this is far from ideal for the vast majority of colleges. But if you're not that large, it might work better than it would seem at first glance. I wish you well.
We are currently evaluating bandwidth devices for our WAN. I am trying to purchase Packeteer Packetshapers (www.packeteer.com). They are the only device that can manage bandwidth at layer 7. In other words, it doesn't matter how Napster port hops, the Packetshaper is able to recognize Napster activity by matching it to a signature database (like IDS or anti-virus), and then throttle the connection per a pre-set rule. This is the same for Real Audio, IRC, etc. Other tools are really only able to handle up to the IP and port, which is useless if the app port hops.....
This is what I would try and do....
Shut off the Napster ports during business hours. Simple as that. from about 8am-6pm. Send out a blanket e-mail to the student body that the network *has* to be open for legitimate use during those hours. Also make it clear that after 6pm that Napster and other traffic will flow freely, you're not attempting to censor anyone's rights or anything, and you have a real problem that you have to solve.
You're probably in the position where you have to do *something* right?
Blech. Signatures.
One thing that I've wondered about these napster bandwidth issues -- is it possible to direct traffic within your network instead of through the internet ?
The napster users should be on your side for this, as it would be faster for them also. Of course, they may be able to saturate that network also.
Could you hold a dorm meeting and convince everyone to get a napster user name with the same prefix or suffix, and prefer those names when selecting who to download from. It would be kind of like a distributed web proxy cache for the music -- check first to see if someone already pulled it through the T1, and if not, get it from the internet but make it available from your machine so it doesn't have to come through again.
Would gnutella do this automatically ? Could you get some dorm techie in each dorm to set up his machine in the manner of www.gnute.com, so that those people without systems that have a gnutella client could connect to it ? The napster and gnutella clients I have used on linux don't seem to allow uploads from my machine; this was a while ago, but of course you would need clients that worked in both directions for everybody.
The visual networks device, I believe is a CSU/DSU, router, and this filtering logic all in one. It's got pretty good remote management features as well.
This is the mistake that is always made. You can take any OS or just about any network device and do some kind of QOS with ports and IP's. However, that is completely useless if the application can disguise itself as something else. If Napster can be configured to use port 80, you will give it just as much bandwidth as you do normal web browsing. My point was that Packeteer has a huge database of application signatures that can deal with this issue and, yes, they put effort into doing this so that they can make money. Even if you put enormous effort yourself into figuring out how to throttle Napster now, ehat are you going to do about Gnutella, or AIM, or whatever is the next bandwidth hog that comes out next year? Fb
The problem is that given ANY size pipe all users will very quickly eat up all you can give them scream for more. You need to have the ability to separate traffic and users into groups. ( I like doing VLAN Subnets personally) And then you can apply a Quality of Service system. Many users need good bandwidth other don't. And this is not a my computing is more important than yours thing. Video, audio, mainframe based TCP/IP, or (god forbid) if you are bridging 802.2 SNA traffic if you don't have a good repose time (big pipe), sessions just drop. Users are forced to start over, video becomes very painful if not useless and soon you have users who can not do any thing at all besides get very very angry. But things like Email, FTP, and Web are less sensitive about time issues. No one likes slow down loads but these users can often still work under very high trafic. QOS is a very useful tool with it you can have the students and the Administration fight it out for who should have more of the pipe and who should pay for it. You can force the issue of getting a bigger pipe. No one wants to pay for a bigger pipe and have it eaten up by the other side. With QOS you can insure them that they will get what they pay for and not have it eaten up by very one else. Every one gets the band with when it is open but the folks flipping the bill (and can be the students them selves not just the Administration) gets it when they need it. No I don't sell QOS systems just a Network Engineer that has been there. At an university and now at a corporation.
Just a thought....
Malk-a-mite
I'll second that post.
Packeteer is what you want if you don't have a big, expensive cisco router in place. Their bandwidth shaping technology is some of the best around, and they have tutorials on how to use their purple boxes to limit napster without killing it, very important with dorms full of screaming kids.
If you are lucky enough to have a big, expensive cisco router (not likely on just a T1), then you can play around with QoS, and set up different queues and filters to limit napster traffic. Cisco has a tutorial as well, you should poke around on their site for it.
the AC
Hemos is like...sci-fi fans;he thinks technology is cool, but he hasn't bothered to understand the science it's based on
...was back in 1991, when we didn't have such things as the WWW and Napster. What we did have was MUDs and IRC. And to be fair, the admins tried to block access by several means. Which we circunvented in a matter of minutes every time, of course.
In the end, we solved everything by reaching some middle ground peacefully. Students and admin can settle on an agreement, and 95% of the time the students will respect whatever they agree on.
Extremely offtopic: the quote at the bottom of this discussion's page, Lisp, Lisp, Lisp Machine, Lisp Machine is Fun. Lisp, Lisp, Lisp Machine, Fun for everyone, is supposed to be sung to the tune of "Row your boat"?
Tongue-tied and twisted, just an earth-bound misfit, I
Learning to fly, Pink Floyd.
Don't put the limit on the main router. Firewall off the dorms, and limit that traffic. OK, so the students can't run their own servers, but that's why the Uni offers shell accounts to everyone, right? Then, when they complain, tell them that if they can get all the Dormites to shell out the cash for another T-1, you'll devote it entirely to the dorms :).
You know, a friend of a friend just recently got a job at a small KS school where he ran into the same problem. I'll have to ask Dave if he knows how his friend solved it. :)
-Matthead
-Matthead
Next turn on the QOS features of your router. If you can, classify your traffic and drop it in a queue. Use WRR to prioritize what is important.
Utilize cache servers to help stretch your bandwidth and improve performance. Some people are able to get 30-50% hit rates on WWW, which means up to 30-50% more bandwidth depending upon what your original traffic patterns look like.
Educate your users about the impact their non-essential activities are having. Setup guidelines such as amount of traffic being used, hours of use, etc. Make sure you monitor it and enforce it. For example, try to block all napster traffic during the day and allow it only nights and weekends. Use RMON of flow accounting to see who your top talkers are and maybe send them an e-mail.
Most of these policies are going to need some nice pieces of hardware. Look at perhaps getting a traffic shaper, such as packeteer, or a nice switch router, such as Riverstone Networks. Make sure as your turn on features and implement policies you don't inadvertantly affect your router's performance.