Slashdot Mirror
Vista's 'Next Gen' TCP/IP Stack
boyko.at.netqos writes "Microsoft's new Vista TCP/IP stack might be beneficial to businesses looking to increase use of their IT infrastructure... if they did it right. Ted Romer at Network Performance Daily writes: '[Vista] now allows us to throttle outbound traffic at a client or server. For example, you can throttle the bandwidth of a particular subnet to a particular server, giving some departments more access to the servers that they need. You can even restrict outgoing bandwidth for certain peer-to-peer applications like bit torrent. This shaping can also be handy when applied to servers, allowing less bandwidth for certain users/departments, and more for others. While consumers may debate whether Vista is a worthwhile upgrade, I believe it to be important for enterprise customers who will best be able to put Vista's capabilities to their fullest potential. Of course, I'm getting it for DirectX 10 games, but that's just me.'"
GRC | Security Now! Transcript of Episode #51 "Vista's Virgin Stack" http://www.grc.com/sn/SN-051.htm
"A gun is a tool, Marian. No better, no worse than any other tool. An axe, a shovel, or anything." Shane (1953)
Well, it's expensive. Are you going to waste a box that can run Vista on that? A box that can run shorewall and traffic shaping is a P100 with 64MB RAM, which can be found for free.
You have two options:
1. The Vista box shapes traffic for itself and nothing else. This isn't terribly effective as to have a good effect you need to shape all of the traffic, giving different hosts different priority.
2. You have the Vista box as a firewall for the network. In this case it's expensive, can be broken into, and if it is, you have a major mess because all your traffic will be going through it.
An old P100 with 64MB RAM running shorewall is practically invulnerable. No ports need to be open, excepting for SSH from the internal network, or not even that. You can run it from CompactFlash and have it with no moving parts at all. It'll quietly sit there for years shoveling packets back and forth with zero problems. It doesn't accept connections, it has no open ports of public services -- it's impossible to break into barring a kernel bug in the TCP stack.
It's obvious that no one has RTFA....
"(Granted, this QoS doesn't guarantee anything, it just marks the packet in Windows and it is up to your network infrastructure to honor those tags.) "
Vista supports Diffserv tagging based on the user/application/whatever, enforced via group policy. It's up to your network hardware to actually do the shaping.