ipfwthrottle man page on BSDOS

Man page or keyword search:  
man Server   6284 pages
apropos Keyword Search (all sections)
Output format
BSDOS logo
[printable version]

IPFWTHROTTLE(8)		  BSD System Manager's Manual	       IPFWTHROTTLE(8)

NAME
     ipfwthrottle - throttle IP packet flows

SYNOPSIS
     ipfwthrottle [-ASDnv] [-b buckets] [-m mask] [-s serial] [-t when] [-T
		  tag] [-x max] [packets/seconds]

DESCRIPTION
     The ipfwthrottle utility is used limit the number of packets per second
     for a given class of IP packets.  For instance, it may be used to limit
     the number of SMTP sessions between a pair of hosts to 25 each minute, or
     the number of DNS requests from a given host to 50 per second.  This is
     different from ipfwrate(8),  which limits the bit rate at which packets
     may depart the system.

     Each instance of a throttle filter, a cache of sessions is maintained.  A
     hash function is applied to choose a bucket and a linked list is used
     from there to find the correct entry.  A session is defined by one or
     more of the following: source IP address, destination IP address, source
     port, and destination port.  By default only the source and destination
     IP addresses are used.

     A throttle filter is always installed on the call filter point (see
     ipfw(8)).

     With no arguments (options only), statistics about the sessions being
     throttled are displayed.

     If the single packets/second argument is provided, it specifies how many
     packets may be sent in the given span of time.  Note that 5/1 and 50/10
     are different.  5/1 says up to 5 packets may be sent in a space of 1 sec-
     ond. 50/10 says up to 50 packets may be sent in the space of 10 seconds,
     and all 50 packets might be in the fraction of the first second, followed
     by nearly 10 seconds of no packets allowed.

     The following options are available:

     -A	     Ignore the addresses when determining the session.

     -b buckets
	     Set the number of hash buckets to be used to buckets. The default
	     setting of 997 is probably good for most situations.  If you are
	     expecting a large number of simultaneous sessions you may want to
	     increase this value.  The value should be reasonably prime.  To
	     support about 50,000 sessions a value of 9977 would probably work
	     fine.

     -D	     Only use the destination IP address for determining the session.

     -m mask
	     Use the bits specified by mask in the first 4 bytes of IP data to
	     further qualify this session (beyond the source and destination
	     addresses).  This is mainly used for TCP and UDP.	Use 0x0000ffff
	     for destination port only, 0xffff0000 for source port only and
	     0xffffffff for both destination and source ports.	The default is
	     0, i.e., the IP data is ignored.

     -n	     Do not sort output when displaying.

     -S	     Only use the source IP address for determining the session.

     -s serial

	     Display only the information for the specified serial number.

     -t when
	     Expire all sessions that are older than when seconds.  Times may
	     be modified with s, m, h, d, w, and y to specify seconds, min-
	     utes, hours, days, weeks and years.  For example: 1m30s is 1
	     minute and 30 seconds.  A year is always considered to have 365
	     days.

     -T tag  Specify the tag to be used.  If this is not specified then a tag
	     will be generated by the system.  It is almost always wrong to
	     not specify a tag as the tag is how other filters specify the
	     throttle filter.

     -v	     Provide additional information while running.

     -x max  Limit set the maximum number of entries to max. If more than max
	     entries are needed the oldest entries are removed to make room
	     for the new entries.

HOW TO USE
     Multiple throttle filters may be used and they may be called at different
     filtering points.	The most common filter points are input and forward
     (see ipfw(8)).  A single throttle filter may filter multiple types of
     connections, however, only a single rate can be applied and the protocol
     is not considered.	 In general you should have a new throttle filter for
     each IP protocol being examined.  This example will assume the site is
     throttling SMTP and DNS requests into the local machine.  It wants to
     limit the SMTP requests to 25 per minute and the DNS requests to 50 per
     second.  The following two commands would be issued:

	   ipfwthrottle -m 0xffffffff -T SMTP-throttle 25/60
	   ipfwthrottle -m 0xffffffff -T DNS-throttle 50/1

     An input filter is then constructed which contains the code fragment:

	   tcp && dstport(smtp/tcp) && !established && !call("SMTP-throttle") {
		   reject;
	   }
	   udp && dstport(domain/udp) && !call("DNS-throttle") {
		   reject;
	   }

     In each case, the standard IPFW language is used to determine if the
     packet should be subject to throttling.  Once it is determined that this
     packet type is subject to throttling the throttle filter is called.  If
     the filter does not return success we reject the packet (the throttle
     filter returns a true value if the packet should be allowed and a false
     value if it should not be allowed.)

SEE ALSO
     ipfw(8,)ipfwcmp 8

				  Dec 1, 1999				     2
[top]
                             _         _         _ 
                            | |       | |       | |     
                            | |       | |       | |     
                         __ | | __ __ | | __ __ | | __  
                         \ \| |/ / \ \| |/ / \ \| |/ /  
                          \ \ / /   \ \ / /   \ \ / /   
                           \   /     \   /     \   /    
                            \_/       \_/       \_/ 
More information is available in HTML format for server BSDOS

List of man pages available for BSDOS

Copyright (c) for man pages and the logo by the respective OS vendor.

For those who want to learn more, the polarhome community provides shell access and support.

[legal] [privacy] [GNU] [policy] [cookies] [netiquette] [sponsors] [FAQ]
Tweet
Polarhome, production since 1999.
Member of Polarhome portal.
Based on Fawad Halim's script.
....................................................................
Vote for polarhome
Free Shell Accounts :: the biggest list on the net