I know iptables has an option to limit the amount of connections to a certain port per [second/hour/day]. But I'm really looking for something that would control the amount of connections going to his computer/that port on his computer...perhaps I'll try bering and see what happens tho.
I'm not sure what application he's using, but I'm sure it's not for legitimate purposes (Well what P2P app is really used by most people for those anyway?), but I did verify that he has his connection limit set to 500. We just share the bandwidth, I don't really touch any of his stuff. I checked my seawall configuration, and it appeared to have nothing set for the MASQ timeouts - I set it to 1800 10 120 (I know it's low, but I'd rather start low and work my way up. Immediately 400 connections were closed, so I'll see how that works.
Part of the problem may be that I'm running a 486 DX/33, but if I run top on it, I'm usually 70-90% idle. So I don't think that should be a problem, of course I could be wrong. I do have one VPN tunnel set up, but almost nothing travels over it (some DNS/Wins stuff, and occasionally a SSH session) as it is used for testing.
The 25% is pretty close to being correct, I also have MRTG setup so I can see how much bandwidth is being used - while it does fluctuate, it rarely hits 50% of my available bandwidth (real bandwidth, not the ISP's advertised bandwidth).
For now I'll mess around with the MASQ timeout setting and see where that gets me.
Thanx again
Simon Bolduc
----Original Message Follows---- From: Ray Olszewski <[EMAIL PROTECTED]> To: "Simon Bolduc" <[EMAIL PROTECTED]>,[EMAIL PROTECTED] Subject: Re: [leaf-user] Limit Number of Connections Date: Wed, 02 Apr 2003 10:33:18 -0800
At 11:23 AM 4/2/2003 -0500, Simon Bolduc wrote:
Hey all,
I'm running a few Dachstein boxes (with Seawall), and I'm having some issues with one of them. My roommate runs a P2P application that opens a huge number of connections. The application can be setup to only allow a certain number of connections, but as his PC is behind the router that limitation occurs behind the router. So what happens is if he limits the open connections to 500 or so, his box will will only ever have 500 connections (verified by running netstat), but when I run netstat -Mn | grep -c 192.168.2.201 (his IP) on the router there are 2200-3000 connections.
Having this many connections makes everything really slow (browsing times out, etc). He only seems to be using about 25% of the available bandwidth.
Stopping the P2P app fixes the problem.
So I was wondering if there is any way to limit the amount of connections that a particular box can use? Any suggestions would be appreciated.
I'm reasonably (though not completely ... one never is with a negative) sure that there is no way to do this with Dachstein (that is, with 2.2.x kernels). I'm less certain about 2.4.x ... I still don't really know iptables as well as I'd like to ... so I'll leave it to someone else to indicate if moving to Bering might help.
The one thought I do have ... if you have limited the P2P app's open connections to 500 "or so", where are the other 1700-2500 (or so) that the Dach box reports coming from? My *guess* is that they are "stale" connections ... that your (carefully, it seems) unnamed "P2P application" may open only 500 at a time, but it closes old ones and opens new ones often. If this is so, you might fiddle with the MASQ timeout setting in ipchains ("ipchains -M -S ...") to cause the stale connections to close more quickly.
But, honestly, I'd also look further for the source of the problem (the "makes everything really slow" symptom, I mean). IP MASQ under ipchains allows for about 5000 connections, so you shouldn't actually be running short unless the rest of the LAN is extraordinarily active ... and routing is so little work for modern CPUs that I'd be surprised if system load on the Dach router were a factor (unless you're also doing a lot of VPN'ing or something else with encryption). So I'd be inclined to look at that "about 25% of the available bandwidth" measure you report a bit more carefully and skeptically, better to understand what is really going on.
_________________________________________________________________
STOP MORE SPAM with the new MSN 8 and get 2 months FREE* http://join.msn.com/?page=features/junkmail
-------------------------------------------------------
This SF.net email is sponsored by: ValueWeb: Dedicated Hosting for just $79/mo with 500 GB of bandwidth! No other company gives more support or power for your dedicated server
http://click.atdmt.com/AFF/go/sdnxxaff00300020aff/direct/01/
------------------------------------------------------------------------
leaf-user mailing list: [EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/leaf-user
SR FAQ: http://leaf-project.org/pub/doc/docmanager/docid_1891.html
