Slashdot Mirror
Limiting Bandiwidth in a Shared DSL Environment?
stylee asks: "We have a DSL connection that runs from a Cisco 675 DSL modem to a 24 port hub. Cat 5 cable has been run to the utility closet of each unit. The condo assoc. pays for the DSL from the monthly condo fees collected. The internet connection has been terribly slow the last few days, so I did a little snooping with ethereal and found that there is an individual who is using eDonkey 2000 to download and share movies. This user is eating up all the bandwidth. I want to set up a good router that can do load balancing so that an individual can't take up all the bandwidth and I was wondering what Slashdot would recommend. I would have to do it on the condo assoc. dime so it would have to be done on the cheap. Any suggestions?"
So a 2.4 (or a 2.6) kernel + iptables + some of the traffic shaping stuff (tc) sitting on a 486 that you can buy from the local second hand computer place for nothing, and things should be sweet.
What my university always did was, if a single user was using a lot of bandwidth on a constant basis, simply turn off their connectivity. When people learn to police themselves, stuff works better.
Karma: Bad (mostly due to all those "In Soviet Russia" jokes)
FreeBSD + ipfw should be able to handle this for you rather nicely. Find yourself an old P-200 or similar and put a couple NICs in it. That should be enough hardware to accomplish your goal.
You can run traffic shaping using a linux box. It may be the reason that the eDonkey eat up most of the upload traffic so ack cannot be sent back and slow down the download too.
it sounds like your condo associaton needs an internet usage policy- considering this guy's actions could get everyone in trouble.
I always look on freshmeat.net for these solutions...here's a tip...
Linux Bandwidth Arbitrator looks like it was designed for this sort of thing...
I'd might be able to tell you how to limit it.
What you need is a managed switch. They will allow you to limit bandwidth or completely disconnect a specific port. HP's switches are supposed to be particularly good
Be warned... a managed switch WILL cost several times more than a normal switch.
But apart from that, your only other choice is to use some sort of arbitrary setup to limit bandwidth to certain IP addresses and force each user to have one static IP (virtually impossible to enforce with your setup)
-- If you try to fail and succeed, which have you done? - Uli's moose
If he's illegally sharing files, he won't squawk too loudly.
OpenBSD has support for limiting classes of bandwidth for quality of service as a part of the pf(4) firewall. See the part of the pf user's guide that covers how to do it.
FreeBSD also has built-in support via the altq facility that is a part of the ipfw firewall.
My druthers would be to use OpenBSD for this as it's not a CPU-bound problem and security on your router should be very high on your list of priorities.
--Paul
At my house we have four guys and we all download pretty heavily (bittorrent, edonkey, gnutella, etc.) Unlimited this just chokes up the whole connection (a fragile cable modem that gets confused if it gets too many packets)
So I just run "tc qdisc add dev eth1 root tbf rate 250kbit latency 20ms burst 2kb". This keeps the network running at full speed with all the downloads going.
Checkout the Bandwidth Limiting HOWTO on tldp.org
Would it be too hard to change his hosts file so he thinks the internet's broken? Heh.
"Derp de derp."
The title of this post raises an interesting idea:
I think we should change the word "bandwidth" to "bandiwidth." It just sounds better!
I set up a DSL traffic shaper on Linux a bit ago. It's a bit of a pain in the ass to figure out the right things to do, and I don't have the script handy, but here are some pointers (given that this is from memory, some of this will probably be wrong).
Get a Linux box. Get two NICs (c'mon, NICs are cheap these days, and the DSL modem only needs a 10Mbit one).
Set up bridging on the Linux box.
ifconfig eth0 0.0.0.0
ifconfig eth1 0.0.0.0
brctl addbr br0
brctl addif br0 eth0
brctl addif br0 eth1
If your boxes use DHCP, you might want to give your shaper an outside IP address (so that it can run ntp and the like, if nothing else). Use br0 as the interface -- this tripped me up at first.
dhclient br0
Add per-host rate limiting. There are two *excellent* solutions to do this automatically under Linux -- esfq and wrr. Both automatically detect IP addresses on one side and spread bandwidth out evenly. Neither is apparently actively maintained, unfortunately, so if you're using a 2.6 kernel, you're out of luck. Your best bet is probably HTB (which *is* included in 2.6 and I believe current 2.4 kernels). HTB requires you to manually create a child of the main HTB qdisc for each IP address, and filter based on source IP address (or source MAC address, which is probably more appropriate if you have a single Ethernet segment and dynamically assigned IP addresses) but lets you filter traffic differently for each host. For a small network, this may be feasible. I'd hang another qdisc off of the HTB that reduces the priority of P2P *within* each host's account, so that someone can use spare bandwidth for eDonkey or whatever, but still retains reasonably snappy SSH, even on their own box.
You must set the maximum flow of the HTB just below the DSL modem's data transfer rate, or else the modem's buffer will fill up when outbound traffic fills up its (big) buffer, making interactive use impossible. Keep reducing the limit and then ping flooding (ping -f) the outside world from an inside box. Keep a regular ping running in another terminal, and monitor it. When your system is working right *ping times should not climb above 150 or 200ms or so on a box*. No 1000ms latency. You should simply start seeing packet loss.
I must say that setting something like this up was a huge pain in the ass, and that if I had the script handy at the moment, I'd post it. The Linux networking/filtering/routing system is not as well documented as it should be, and is *not* always the most intuitive thing in the world. It is, apparently, pretty powerful, based on what I've read from folks that have used other systems, though. [shrug]
Speaking of which, I can't figure out why sfq is in mainstream Linux but esfq is not. SFQ is, to my mind, almost useless for most people. Who on earth wants to balance all their TCP flows evenly? Even per-host bandwidth allocation is a *far* more common problem, and one that vanilla Linux (and any 2.6 kernel) cannot handle well.
I did not find it necessary to use ebtables or ipchains to produce an effective traffic shaper. YMMV.
May we never see th
IPCop v1.3 w/ Wondershaper or wait a couple more weeks for 1.4 which will have bandwidth shaping built in. It's a linux distro just for firewall/routers, runs on anything from a 486 up.
Several posters have already mentioned managed switches, linux routers with iptables, etc, but I've got a much simpler solution for you. It's a wonderful product manufactured by the Louisville Slugger corporation called a "baseball bat." With this fine product in hand, march over to the offending user's apartment, and smartly inform him that he is using too much bandwidth. If he refuses to self-throttle his bandwidth, offer to throttle him and his computer with the genuine wood Louisville Slugger baseball bat. Problem solved. Thank me later.
We don't have a state-run media we have a media-run state.
Monowall (www.m0n0.ch/wall) is a greaqt application for this. Can run from CDROM, CF or on a Soekris board - can do per IP bandwidth limiting/shaping, and totally free, based on BSD. It was trivial for me to set it up here.
I'd recommend politely approaching the guy and asking him to throttle it down a bit. If he agrees, problem solved. If he refuses, cut his connection. Why spend more money to solve the problem of one abuser?
"Derp de derp."
http://lartc.org
It's difficult to understand, much less set up, but essentially the stuff from this site can solve your problem by tightly controlling outbound traffic (since it is possible to have perfect control over what packets you release to the network) and by loosely attempting to control inbound traffic (since it isn't really possible to perfectly control what packets other people send you).
For example, my home setup has four priority classes:
Class 0:10 is for high priority traffic: ping replies, TCP ACK packets, and online gaming.
Class 0:20 is for everything not otherwise classified.
Class 0:30 is for BitTorrent traffic -- lower than normal, but higher than all the other p2p stuff. I do this because BitTorrent traffic is very likely to be directly related to a file I'm personally interested in.
Class 0:40 is for lowprio.mspencer.net and other misc filesharing programs. If the rest of the Internet connection is busy, class 0:40 ends up with around 24 kbit/sec out of my total 640 kbit/sec upstream.
I guarantee you can adapt this as needed, so each user has a fair slice of upstream available, but if someone's not using their slice then everybody else can split it. (So at 4 AM one user can still get the whole line speed, but at peak usage everybody gets the same bandwidth.)
The other side of the coin is ingress policing. I don't have a lot of experience with this, but you'll almost definitely need it. Basically the policing module tries to slow inbound packets by throttling the outbound acknowledgements. It's not perfect but it can help.
Some filesharing programs incorrectly state they are "firewalled" when you use a setup like this. Instruct the user to just tell his client to retest so it can confirm he's not firewalled.
My final paper for my 4000/8000 level networking class was regarding my traffic shaper. Maybe it'll help.
http://mspencer.net/traffic-shaper.doc in Word 2000 format.
http://mspencer.net/traffic-shaper.txt in plain text.
--Michael Spencer
As another followup, I looked on Freshmeat, and couldn't find anything that did what I wanted. It seems that it's all the rage to have traffic shapers also do NAT, which I *really* did not want.
I don't think Freshmeat is currently a good place to go when looking for a traffic shaping system to do this sort of thing.
May we never see th
As another aside, some distros bundle pump as the DHCP client, rather than dhclient.
/etc/sysconfig/network-scripts/ifup, and search for a line that looks like the following:
/var/lib/dhcp/dhclient-${DEVICE}.lea /var/run/dhclient-${DEVICE}.pid -cf /etc/dhclient-${DEVICE}.conf"
Oh, speaking of DHCP, big tip for Red Hat/Fedora users. Absolutely do not use the vanilla ifup scripts that Red Hat provides. They *suck*. If you are on any kind of a consumer DSL connection, every now and then (perhaps rare, perhaps common) you will lose your connection, for whatever reason. For some reason, Red Hat sets up their copy of dhclient to *give up* if it fails to get a dhcp lease, which means I frequently endured having a power outage at my house when I was away (killing the line) and then being unable to reach my computer remotely because it never acquired a DHCP lease.
Look in
DHCLIENTARGS="${DHCLIENTARGS} -1 -q -lf
ses -pf
Change the -1 (telling dhclient to die if it can't get a lease immediately) to a -w (telling it to keep trying) in that line, and you won't have to endure your Linux box randomly becoming unreachable and losing the IP address on its interface.
May we never see th
I used to use CarraFix, but Throttled whips the shit out of it.
I had to play around with the startup file for a few hours to get it working right. Here's my relevant modifications, if anyone's interested:
Don't forget to add a default class to the HTB to match any MAC that all your previous matching work didn't match. That way, anyone that you *haven't* added a MAC entry for (adding a child to the HTB tree) will at least go into a general class and get connectivity...they just have to share it with all the other people in the "general" class.
You may want to toy with the idea of having a perl script or something look at unmatched packets or maybe scrape the ARP cache (arp -a) to automatically add new entries to the HTB tree.
You will want to be sure that this box is set to autorestart on power failure.
You will want to include instructions (probably on the face of the box, as well as on file with whoever owns the property) on how to remove the box from the loop. That hard drive will fail someday.
For some reason, when I insert my shaper in between my DSL modem and the local network and start using it, I seem to see a delay of a minute or two before requests from clients on the inside start hitting the ouside). This confuses me immensely, since a major benefit of using a bridge over a pseudo-bridge is that the ARP entries, the MAC-IP mappings, stay the same. No idea what the cause is.
May we never see th
Cisco has declared the 675 router dead, and stopped supporting it. Before they declared it dead, there were frequent security upgrades, giving the impression that it might not be secure now. Cisco had bought the 675 technology from another company; it was not designed as a Cisco product.
So, maybe it would be sensible to buy a new router, and maybe that router would have load balancing. SMC seems to be a reputable company, but I don't see any SMC routers with balancing.
but it's less than 24. Evev if it's only 12 units, that's still a lot for 1 DSL line. Get your own line and call it a day.
Or get one of these.
Alex
If it's one Windows user and you don't have the time/resources to set up a free-Unix bandwidth shaper, you can ask the offender to run NetLimiter ... it costs money, but works great, and even improves transfer performance (If you cap your upload and download a few percent below the actual maximum capacity on the line, it doesn't back off and have to retransmit dropped packets from bandwidth overage). Google for it, I think it's at http://netlimiter.com
o/~ Join us now and share the software
I have done traffic shaping with FreeBSD/ipfw2 and found out the hard way that some viruses that initiate a lot of connections can take up unproportional share of bandwith. For instance on of the users has had a virus that was making roughly about 700 thousand outbound connections daily, but not causing much traffic, since all connections were single UDP packets. After we have disconnected it from the hub the overall response time and transfer speeds for other computers have increased.
Apart from such queer incidents, which I think are inherent to all bandwith controlling schemes, including HW firewalls, I would definitely go for a Linux/FreeBSD/OpenBSD solution. The HW requirements are not high - we are running 100 MBps connection for about 500 users with a "legacy" double pentium II 400 computer.
You can defy gravity... for a short time
Dummynet
Quote from the above linked page:
Unlike other traffic shaping packages which run in userland, dummynet has a very little overhead, as all processing is done within the kernel. There is no data copying involved to move packets through pipes, just a bit of pointer shuffling, and the implementation is able to handle thousands of pipes with O(log N) cost, where N is the number of active pipes.
All you need is an old PC, two NICs. You can boot Dummynet (running on PicoBSD) from a floppy..
Remember how it is based on linux? there are several wonderful replacement firmwares for it that give you some filtering options, you probably don't need the wireless part, but its what I've been deploying lately. check out the simandhi firmware and look at sveasoft.com. WRT54G as I recall, very wonderful little box and now you can make a hotspot and sell access to it also. the router isn't expensive, $80US I think. If you know enough, you might can do the filtering in straight iptables instead of the web interface, but that is a bit beyond me. good luck!
get a 486/66, slap in 2 Nics, d/l freesco and install it. Search the forums for bandwidth limiting.
The biggest issue I have had with freesco was a) bad floppies and b) finding supported nics. 3Com 3C509s and 3C905s both work great. On the ISA ones make sure you turn off PnP.
I've used this product for over 2 years without an issue. I'd reboot it once a month just because, but I can't think of a time I had to.
Good Luck
Vertical
72 CD D7 52 D0 7E D8 47 44 91 D5 84 D1 59 F1 A9-This is my 128bit integer. There are many like it, but this one is mine.
You can download a series of floppy disk images and turn just about any old PC with two NICs into a router with all sorts of limits, including P2P Filtering! www.mikrotik.com
A computer once beat me at chess, but it was no match for me at kick boxing -- Emo Phillips
Shorewall has traffic shaping built in, but what it sounds like you might prefer to do is put in a Quality of Service system. Just reduce the priority of the outbound traffic, or block it all together, depending on how strict you want to be.
I've successfully down this to allow bittorrent transfers to take a lower priority than my VoIP traffice from my phone. It seems so far to have worked quite well. I had some trouble getting the qos-htb and tc qdisc stuff to work. Possibly because of the versions, but didn't bother trying to figure it out. Shorewall worked quite well for my purposes.
Check out the LEAF project over at leaf.sourceforge.net, its a very active project with great user and developer support.
think before you write, it'll save me moderator points.
For those that don't want to migrate to OpenBSD FreeBSD 5.2.1 has support for OpenBSD's pf and altq via a port, although you need to patch your source tree by hand. FreeBSD 5-current has fully integrated support for pf and altq, although I would wait for FreeBSD 5.3-RELEASE, rather than trying to use current. I personally found ipfw and the queueing subsystem extremely hard to use. That said, FreeBSD 5.2.1 on my k6-233 works great for our LAN. I use it to prioritize dns/www/smtp/pop3/imap, put leechers into their own bandwith limited queue, and set aside ~4kb/s upload for priority stuff. It has had an amazing effect - lag is completely gone, and leechers don't affect the latency of the LAN's connection anymore.
All this is excellent for corporate scale infrastructure,
but it's a lot of work for the everyday DSL people who have a brother who runs eDonkey 24/7.
Really it would be nice is something was available to balance all ports equally so that:
-=WHEN THE BANDWIDTH IS FREE IT IS NOT LIMITED=-
I guess the "prio" chain may be help with this. It isn't as well documented as htb. If anyone can figure out how to balance everything in as little lines as possible using something like prio, please share it as that would save us all some time grappling with htb and cbq.
A blog I run for the wealth
Get a Linksys 802.11g Wireless router. Because the firmware is just a customized linux kernel, and Linksys finally GPLed out their code, there's a fairly active community that's into hacking the firmware code to add all sorts of functionality that Linksys never considered, including QoS and Packet Shaping.
Just lock the ports for all of the popular P2P apps that have fixed ports down to 50kbps up and down, and call it a day. If I was on a shared DSL, I'd completely understand this, and even appreciate that a way to stop stepping on my neighbors toes had been implemented FOR me. If this guy's a jack-ass and he starts playing games futzing with ports on the apps that allow it, kick his ass to the curb and tell him that he can get his own service if he needs that sort of bandwidth.
The hardware being your boot and the software being his ass. Not only is his downloading slowing you down but with all the RIAA crap going around it could be a legal liability. You have to think that if something happens legally, will this 15 year old behind a router going to get sued? Or the registered name/owner of the DSL service?
it sounds to me like your first concern should be that 24 households are on the same hub.... i for one wouldn't feel comfortable knowing that anyone else in the area could just open up ethereal and check me out. look into buying a 24 port switch for privacy's sake; i'm sure your neighbors will be more than willing to chip in for one if you explain how they differ from hubs.
as for the bandwidth issue, 24 households sharing a single DSL line is a bit of a stretch, especially if some houses have several computers in them. it seems strange to me that people don't want to pay for their very own DSL line but at the same time expect good bandwidth!
bottom line? you will probably not be able to do this cheaper (in the long run) than everyone getting their own DSL connection. of course, since you already have the closet with the hub and the cables run, you could set it up so that small groups of neighbors can agree to split a single DSL connection -- presumably those with low-bandwith habits. just buy a small hub/switch for each group (or a managed switch that does VLANs). that way, the bandwidth hogs can pay for their own line and the rest of the users can get a lower per-month cost by collaborating.
Somewhere on this page I have hidden my signature.
Someone should slap you for that comment.... The RIAA is a bunch of theives.... You are ignorant for helping them to rip off your favorite artists... Well and you as well.