P2P Traffic Shaping For Home Use?

An anonymous reader writes "My housemate uses an aggressive P2P client, that when in use makes the Internet unusable for everyone else connected to the network. After hearing about various ISPs shaping traffic to reduce P2P traffic, I was wondering if there was a solution for managing P2P traffic on a home network. I have a Linksys WRT54G available for hacking. Can Slashdot recommend a way to reduce the impact of P2P on my network and make it usable again?"

Comments

It's simple with OpenWrt

[Anonymous Coward]

Install OpenWrt, then:

ipkg install qos-scripts
vi /etc/config/qos
[ enter your linespeed in the right place ]

qos-start

Re:It's simple with OpenWrt

[corsec67]

Or install Tomato and go to the QOS tab. It is pretty simple to get QOS going on Tomato

QoS

[llamalad]

Just set up QoS such that VOIP, SMTP, HTTP, HTTPS, and whatever else you care about gets prioritized.

get a PC with smoothwall linux

[kesuki]

you can put it between the router and the net if you're using the wireless capabilities.

a forum about traffic shaping with smoothwall

http://www.linux-noob.com/forums/index.php?s=dffc19493975498724b50564217f05e4&showtopic=3250&pid=11502&st=0&#entry11502

smoothwall linux
http://www.smoothwall.org/

1st off

[atarione]

a. 1st off and most importantly make sure the internet connection isn't in your name so you are not the one who gets sued by the RIAA b. go get DD-WRT (check your WRT54G version..later one's suck) then set up the traffic shaping QoS feature. http://www.dd-wrt.com/wiki/index.php/Quality_of_Service

Re:How about ask?

[kesuki]

as opposed to using traffic shaping, you can force the guy to switch clients to azureus http://azureus.sourceforge.net/

in advanced mode, you can set upload and download maximums, if you plan on allowing this, and using latency specific online gaming, you should set the limits to HALF of what azureus is capable of without anyone using the internet.

QoS is definitely recommended

[Lilkat]

I have the same issue at home, except I'm the one who is running bittorrent. As of right now, it is not perfect, but it has greatly improved since I started doing tweaks. The first thing I did was install DD-WRT on the router. After that, I maxed the connection limit to 4096 and set the timeout to a low setting, like 5 minutes. From there, I did some modifications to the QoS settings. If a wired connection is used, set his connection to the lowest priority, and the rest to the top priority. This is not perfect, so I'm still tweaking things to obtain a better outcome. The other suggestion is to tell him to use the scheduler feature found in the bittorrent client; a little bit of downtime at peak times goes a long way to keep harmony at home. -Lilkat

Re:How about ask?

[Vectronic]

That would be my suggestion aswell...

Besides, whatever client he is using, must have its own throttle, tell him/her to set it to like 75% of what the line can handle.

Some have timers too, so it can be 50/50 during multiple use, and 100% when he's the only one. Which is far easier than tweaking/hacking something you don't really use that often, and you may want to allow other software to use 100% (or as much as possible) on his machine (file sharing over the network, etc).

Easiest way: Raise QoS of OTHER traffic.

[Zarhan]

Raise priority for

    - Web (Http and https, maybe also 8080)
    - DNS (UDP:53)
    - Mail (SMTP, IMAP, POP3 (including SSL versions))
    - IRC (if you use)
    - FTP
    - SSH, Telnet
    - All TCP acknowledgement packets.
    - Maybe some gaming protocols (Directplay, WoW, etc - these unfortunately require checking docs for each game)

that way, you have whitelisted most of the "interactive" protocols that suffer from loaded link. No need to keep chasing after the latest encrypted, onion routed P2P application that happens to be flavor of the month. The biggest problem is the online gaming stuff.

Re:Easiest way: Raise QoS of OTHER traffic.

[dhoffman]

>d) start using TCP-vegas on the router: Add the following custom script for boot:

That won't do much good on the router. Your router is a layer 3 device and (except for packet classification) only looks at the IP header. TCP congestion control is layer 4 and operates at each end of your TCP connection. This is a good idea if your P2P client is running on a Linux box, however. But do the config on that box, not the router.

mmm, Tomato

[straponego]

I quite like Tomato firmware as well: http://www.polarcloud.com/tomato

It also has QoS features, and a nice AJAX interface.

Re:Buy another Linksys and link them.

[Angry Rooster]

When I bought a WRT54G I had the same problem... mine is v6. Apparently after v4 Linksys(or more accurately Cisco, who owns them) lowered the internal memory to lessen the effectiveness of third party flashing. Unfortunately in doing so, they made their routers horrible. There isn't enough memory to hold larger IP tables, so bittorrent traffic and the like bogs it down until it needs a restart. DDWRT helps a little, in that you can schedule restarts to go every hour or so, but the sporatic connection is less than ideal. My solution was similar to the above. I just used my older model wired Linksys router to handle all the IP routing and set the WRT54G(with DDWRT) as a pass-through device. It's unfortunate that they felt like crippling a perfectly useful router just because free firmware made it competitive with their high end products.

I use a DLink DLG-4300

[QX-Mat]

http://games.dlink.com/products/?pid=370

Works well, but is rather expensive. Has an oversized NAT table to help with UDP server pings, so this will remedy and torrent problems you might have with your current setup.

QoS system is fairly flexible with an intuitive GUI and many preconfigured service options.

Has an option to pack the output frames completely (harms XBox Live possibly) as well as delay non-prio packets in favour of VOIP/gaming/as you configure.

Matt

Re:I use a DLink DLG-4300

[chrysrobyn]

I've got to echo the DLink recommendation -- but I've had the 4100 for about a year. They call their QOS stuff "Game Fuel" (there were a few slashdot stories about it when they started hyping it up).

I've been very happy with mine, including being able to torrent like a freak and still use the Vonage box to make VOIP calls. I know the torrents are being throttled by my little box, but I can't see a big impact on transfer speeds. As a bonus, the DLink is much faster than the NAT firewall it replaced-- my maximum throughputs are higher.

Setup is as easy as configuring a normal NAT device. Of course, if you want to play with port forwarding, that's there too, and if you want your QOS to be a little more sophisticated than the default (which you should really try and see if you're happy with it), there are a plethora of configuration options.

OpenBSD Packet Filter

[Piranhaa]

http://www.openbsd.org/cgi-bin/man.cgi?query=pf.conf 'nuf said

Re:Talk to your housemate

[eli2k]

If you are both roommates, and share the Internet, it is unfair for one person to disrupt things such that no one else can access the Internet. Otherwise make him pay for his own line and he can do whatever he wants. You don't all want to get in trouble, right?

And after you install DD-WRT...

[Tau Neutrino]

In the Administration section, on the Management page, make some changes to the IP Filter Settings. Set the Maximum Ports to 4096 (the maximum), and the Timeout values for both TCP and UDP to 120 seconds.

Running Azureus used to kill all the other network activity on my LAN. These changes made all the difference in the world.

Re:And after you install DD-WRT...

[Tau Neutrino]

You're right, I neglected to say which direction the timeout should go. It's definitely reduce the TCP and UDP timeout values to 120 seconds. One of the problems with P2P is establishing many connections to flaky systems or networks. Your client (and router hold the connection open, waiting for response that never comes. That fills up the connection table and makes it hard to establish other, more productive ones.

You want to reduce the time your router waits from 1 hour, as it's currently set, to two minutes.

Re:DDWRT gives you a GUI then you can....

[schnikies79]

Yea, I finally gave up on DD-WRT. It was unstable and a resource hog. Tomato is a MUCH better option if you want a web gui.

My pings dropped 10ms and the QOS actually works.

Re:Need more input!

[UncleTogie]

Can you expand on this? Something like "if the version happens to be xxx then you could do foo, if the version happens to be yyy then you could do bar..."

Good point. How 'bout a wikipedia link for the WRT54G, with entries on available firmware?

Re:Need more input!

[mrsteveman1]

Any WRT54G model before v5 can be modified easily, v5+ can sometimes be modified with DD-WRT. And of course they still sell the GL, which is quite worth the price ($60 on amazon) because of how useful it becomes with this alternate firmware. The GL can also be modified and has the advantage of still being sold under a clear model number, so you know you can mod it, unlike others.

On the other hand, there is awesome shaping available in tomato firmware, it can classify traffic and show you what percentage of your traffic was in each class.

http://www.polarcloud.com/img/ssqosc108.png
http://www.polarcloud.com/img/ssqosg108.png
http://www.polarcloud.com/tomato

Re:Need more input!

[garbletext]

To hack a wrt54g, you either need an old one (v1-3, I believe) or the hacker friendly WRT54GL. The newer versions don't run linux.

OpenWRT requirements

[j1m 5n0w]

OpenWRT hardware requirements If it's version 4.0 or earlier (or the L model), it has enough RAM and flash (16MB, 4MB respectively) to run OpenWRT, or other wrt54g-friendly distributions. (OpenWRT is pretty cool; it has an olsrd package you can install from the web configurator, and with a little bit of effort you can make an ad-hoc mesh. Not useful for traffic shaping, but interesting nonetheless. I expect there are probably tools available to do traffic shaping with OpenWRT as well, I just never needed to mess with that.)

Re:OpenWRT requirements

[WanderingGhost]

OpenWRT comes with QoS scripts that will help you prioritize packets. I installed it and now P2P never interferes with HTTP, DNS and other traffic.

Tomato

[TheTyrannyOfForcedRe]

Grab the Tomato firmware for your Linksys. Tomato's QoS features are much easier to configure than others like DDWRT. With Tomato, you don't need to be a Linux networking guru to do what you want. Tomato also handles P2P very well. You can pound a WRT54 running Tomato with heavy P2P traffic 24/7 for months with no perfmrance problems. No resets required. Grab it here http://www.polarcloud.com/tomato/

Re:DD-WRT

[Anonymous Coward]

use "Tomato" - it lets you dynamicly change the priority of a connection depending on the upload/download size.

eg. you can say all HTTP downloads over 1MB get lower priority. It will also work for keep-alive connections so it will work if your flatmate is downloading "a whole website" (since the total size of the site is over 1MB)

Re:Need more input!

[srlapo]

I have a Linksys wrt54g v8 and it has some good QoS options with the native firmware. You can restrict usage and bandwith by mac address, by the ethernet port your roomie's computer is connected to, or even the classic, by the tcp port. You can also set or deny different services depending on the time of day, and computer using them too.

Linux, iptables and Traffic Control (tc)

[xororand]

As someone mentioned in a previous post, it's much easier to just whitelist priorized services such as ssh, telnet or gaming protocols than wasting too much CPU cycles on detecting obscure P2P protocols with layer 7 filters.

Personally, I use iptables & tc to setup a simple HTB (Hierarchical Token Bucket filter) system with 3 priority levels:

- Interactive: SSH (with Minimize-Delay TOS-Flag), Telnet, Jabber, ...
- Medium: HTTP, IMAP, SMTP, POP3, ...
- Low: All the rest

Shaping the upload speed is my only concern. All 3 classes may use the complete upload bandwidth. The interactive HTB class gets a guaranteed 90% of the bandwidth and a high burst value. The lowest HTB class has a burst of 0 and about 5% guaranteed upload speed.

While this is only primitive setup, it allows lag-free ssh with an unlimited upload in the background.

An in-depth how-to about the Linux Traffic Control system: http://www.tldp.org/HOWTO/Traffic-Control-HOWTO/index.html

A short pragmatic example using HTB & SFQ can be found here: http://gentoo-wiki.com/HOWTO_Packet_Shaping

Known problem with Linksys

[aussiedood]

From the uTorrent FAQ: "The default firmware for Linksys (and all replacement firmwares except for the latest DD-WRT and HyperWRT Thibor) have a severe problem where they track old connections for FIVE days, which causes the router to hang when using P2P apps, or any software that generates a lot of connections. DHT only aggravates the situation because of the number of connections it generates."

Does NOT apply to WRT54G/GS v5 and up.
HTH

Re:Need more input!

[morari]

DD-WRT can be flashed onto just about any WRT54G nowadays. You loose a few features with the newer version though, as the storage space isn't as large as it once was.

For the tiny bit of extra money however, the GL is definitely worth it in terms of hacking.

Re:Need more input!

[Shakrai]

but you want to tell everything you know about "P2P traffic shaping for home use" and be useful to more people.

This won't be directly helpful to the submitter (he's working with a WRT54G), but this is how I do it in Linux. Set up the shaping rules with tc. Classify traffic with iptables. Examples follow:

(in /etc/ppp/ip-up -- would likely be rc.local or similar file for a cable modem user who doesn't use ppp)

# ADSL connection is 832,000 bits/s on upload.
#
# We rate limit to 632,320 bits/s (76%) to account for ATM/PPPoE/IP protocol overhead.
#
# This is broken up as follows:
#
# 72,000 bits/s for TCP Acks (keep our downloads fast even if upload is pegged)
# 35,000 bits/s for interactive packets (icmp echo/reply, tcp syns, network time protocol, small ssh packets -- only small ones so we don't prioritize scp transfers)
# 236,500 bits/s for priority traffic (traffic to my work VPN)
# 236,500 bits/s for normal traffic (this is the default)
# 35,000 bits/s for low priority traffic (udp trackers in bittorrent)
# 35,000 bits/s for idle priority traffic (bittorrent uploads)

/sbin/tc qdisc add dev $1 root handle 1: htb default 50
/sbin/tc class add dev $1 parent 1: classid 1:1 htb rate 632320bit ceil 632320bit
/sbin/tc class add dev $1 parent 1:1 classid 1:20 htb prio 1 rate 72000bit ceil 632320bit quantum 1454
/sbin/tc class add dev $1 parent 1:1 classid 1:30 htb prio 2 rate 35000bit ceil 632320bit quantum 1454
/sbin/tc class add dev $1 parent 1:1 classid 1:40 htb prio 3 rate 227660bit ceil 632320bit
/sbin/tc class add dev $1 parent 1:1 classid 1:50 htb prio 4 rate 227660bit ceil 632320bit
/sbin/tc class add dev $1 parent 1:1 classid 1:60 htb prio 5 rate 35000bit ceil 632320bit quantum 1454
/sbin/tc class add dev $1 parent 1:1 classid 1:70 htb prio 6 rate 35000bit ceil 632320bit quantum 1454

/sbin/tc qdisc add dev $1 parent 1:20 handle 20: sfq perturb 10
/sbin/tc qdisc add dev $1 parent 1:30 handle 30: sfq perturb 10
/sbin/tc qdisc add dev $1 parent 1:40 handle 40: sfq perturb 10
/sbin/tc qdisc add dev $1 parent 1:50 handle 50: sfq perturb 10
/sbin/tc qdisc add dev $1 parent 1:60 handle 60: sfq perturb 10
/sbin/tc qdisc add dev $1 parent 1:70 handle 70: sfq perturb 10

In order, those commands establish a htb scheduler with a celing of 632,320bit/s (you have to set this around 70-80% less than your actual upload to force the packets to queue at your box and not the dsl/cable modem), then establishs children underneth it for each class of traffic. The children will get AT LEAST the specified rate and when extra is available will borrow it according to their priority number. Prio 0 gets all extra bandwidth until satisifed or no more exists, then prio 1, prio 2, etc, etc.

The second set of commands attaches a fair queuing algorithm so individual connections within those classes will share the bandwidth (more) fairly.

From there it's just a matter of using iptables to classify the traffic. This example shoves all bittorrent traffic into the lowest queues. We assume that anything coming from 172.25.42.254 is bittorrent traffic because we add that as a second IP address on the client behind NAT and make Azureus bind to that IP (all other traffic goes out on the default IP).

iptables -t mangle -N LOW
iptables -t mangle -N IDLE
iptables -t mangle -A LOW -j CLASSIFY --set-class 1:60
iptables -t mangle -A LOW -j RETURN
iptables -t mangle -A IDLE -j CLASSIFY --set-class 1:70
iptables -t mangle -A IDLE -j RETURN
iptables -t mangle -A FORWARD -p udp -s 172.25.42.254 -j LOW
iptables -t mangle -A FORWARD -p udp -s 172.25.42.254 -j RETURN
iptables -t mangle -A FORWARD -p tcp -s 172.25.42.254 -j IDLE
iptables -t mangle -A FORWARD -p tcp -s 172.25.42.254 -j RETURN

Those commands

Re:Need more input!

[mrmeval]

I had a REV 8 linksys and it would be perfect as it LOCKS up on max bandwidth. The internal webserver also crashed and it won't take open source firmware. I got a good one when I bought a Buffalo that rocks, just before a texas judge stopped their product from being sold here.

DD-WRT would do that easily. It can do it to wireless as well. Look for a compatible router, preferably one that can take a full install and strangle their link. ;)

http://www.dd-wrt.com/

Re:Buy another Linksys and link them.

[ydrol]

> lowered the internal memory to lessen the effectiveness of third party flashing

My understanding is the motivation was primarily cost. VxWorks runs on less hardware, and presumable the amount saved my reduced flash is greater than the per seat license cost for VxWorks?

>It's unfortunate that they felt like crippling a perfectly useful router just because free firmware made it competitive with their high end products.
Due to popular demand its back as the WRT54GL

Re:All major clients, but it still requires talkin

[kesuki]

"Tomato is the way to go, as half of the posters seem to be saying."

my original suggestion was to use smoothwall's QoS. but some people felt tomato would be better than a smoothwall setup, the only reason i like smoothwall is you don't need to flash a hardware router, and if you use an older PC it will use less power running smoothwall than it ever did running windows, for whatever reason any PC from the 486 on, always uses less power running free open source software than running windows, i think it's the 'system idle thread' i think it literally makes the cpu busy out rather than fall asleep...

never had a problem with a Linux or BSD system doing no CPU activity, just routing a few packets and letting the cpu idle and use any on chip power savings... when i first switched my 486 from 24/7 windows to 24/7 freebsd (in 1996) i saved $10 a month in electric bills. (i still have the bills but they're in storage) plus, i never had to reboot freeBSD windows would crash every week.

IPCop

[jcrousedotcom]

I use ipcop http://www.ipcop.org/ for my home network - it's all of about 40 megs (well it was, I see the new update is quite a bit bigger so I may be low on that figure) and can run on any old pc lying around.

It can do the traffic shaping you're wanting, plus, I found, especially when I am doing p2p downloading or some online gaming, my old netgear (very old) couldn't keep up and would drop packets. I saw my download speeds go up significantly and I have the opportunity to do traffic shaping if needed.

It's free (donation) and very simple to set up. You don't have to be a linux guru to set it up, it has a web based interface for configuration.

It works great for me.

Build a Better firewall...

[binaryspiral]

Even the most expensive residential router chokes on the shear number of connections your average P2P client tries to maintain.

I modified my WRT54G's setting to be just a wireless access point and switch by disabling the DHCP server - then built a cheap Smoothwall firewall using an old P3 800Mhz with a pair of pci nics.

DSL -> Smoothwall -> LAN Port 1 on WRT54

Leaving the WAN port unused, I still have three ports for wired PCs (nearly unlimited with the addition of more switches) and wireless works without a hitch. The WRT's job is just to be a switch and manage wireless authentication and encryption.

The Smoothwall easily handles the traffic without slowing down other clients and (bonus) has QoS built in.

It also provides web caching, email antivirus, DNS, NTP, Snort IDS, and so much more.

Oh, and it's totally open source and available for download from smoothwall.org

Re:Need more input!

[Anonymous Coward]

i used to have a wrt54gl and it's a great router. there is a good chance if you don't know the L is on the model name and the router was bought within the last year it's the crummy non-moddable version, but in case it is, i highly recommend tomato firmware, it pretty much sorted out my network sharing problems with a flatmate who streamed video constantly clogging up the unlimited 512kbps line i had set up. once i was running tomato and downgraded his QoS priority everyone else (me and the other flatmate) were able to consistently get fair access to the bandwidth.

btw i am posting this as an anonymous coward because for some reason i can't recover my account.

Re:Buy another Linksys and link them.

[FuegoFuerte]

It's unfortunate that they felt like crippling a perfectly useful router just because free firmware made it competitive with their high end products. Dude... If that were their reason, they wouldn't have come out with the WRT54GL to please all the people wanting to put better firmware on their routers. The reason for lessening the Flash and RAM is simple - They switched OSs. The first WRT54Gs ran Linux. They switched to a smaller, lighter embedded OS (VxWorks). Since it has a smaller footprint, they were able to halve the Flash and RAM, helping them compete in a market primarily made up of cheap bastards. For people who are slightly less cheap, they still make the version with more memory... the GL model is, from what I've read, identical to the v4.0 of the WRT54G. When people aren't willing to pony up the cash for a quality product, manufacturers drop the quality of the product. Consumers don't really care. If they did, you'd still be able to find quality merchandise made in the US at all retailers. Instead, we have disposable crap on the shelves in most of our stores, and people snatch it up. Just wait and see what happens when we go to war with China (and mark my words, we will).

Re:Need more input!

[Anonymous Coward]

I can attest to the firmware aspect, the attenas aren't the issue, it's the firmware's bugginess that kills it. Open Source Firmware fixed that problem for me.

Re:How about ask?

[Anonymous Coward]

Usually such issues come from the asymetric lines you get stuck with from ISPs.
Using full bandwidth up will congest your downstream. It can be solved with a very simple cap on upload, limiting it to 80-90% of max upload bandwidth. No need to go high-tech on his ass.
Symetric lines do not exhibit these issues, atleast not so noticably.