Re: per user throttling

to add to this (a kinda fyi), cant u trace packets in iptables via 
user/group id and even process id?

quick google - from the man page for iptables

owner This module attempts to match various characteristics of the packet 
creator, for locally-generated packets. It is only valid in the OUTPUT 
chain, and even this some packets (such as ICMP ping responses) may have no 
owner, and hence never match. *--uid-owner **userid* Matches if the packet 
was created by a process with the given effective user id. *--gid-owner **
groupid* Matches if the packet was created by a process with the given 
effective group id. *--pid-owner **processid* Matches if the packet was 
created by a process with the given process id. *--sid-owner
**sessionid* Matches
if the packet was created by a process in the given session group.  perhaps 
u cud filter at the gateway with this?

just a suggestion. good luck

amran


On 4/20/05, Matt Buford <[email protected]> wrote:
> 
> The short answer is that this isn't for the faint of heart. It can be 
> done,
> but you'll need to do a good bit of coding and have a good understanding 
> of
> iptables, packet marking, NAT, and the order in which all these processes
> occur.
> 
> I managed to get this working, but it was basically a complete rewrite of
> the throttling part, and also involved changing almost every reference to
> packet marking in iptables. Here's an old message I sent explaining how I
> accomplished this. It should at least provide direction on one working 
> path
> to accomplish this:
> 
> http://freenetworks.org/pipermail/pebble-linux/2004-October/001019.html
> 
> ----- Original Message -----
> From: <[email protected]>
> To: <[email protected]>
> Sent: Tuesday, April 19, 2005 11:33 AM
> Subject: [NoCat] per user throttling
> 
> > Hi,
> >
> > in the archive of the mailing list I found two approaches dealing with 
> per
> > user throttling. One the "throttle-per-public-user-04.patch" limiting
> > based
> > upon iptable filters for the public user class and the posts from Derk 
> van
> > de Velde and Sameer Verma
> > "http://lists.nocat.net/pipermail/nocat/2004-March/004629.html".
> >
> > So far I could not make either of them working correctly. When applying
> > the
> > changes from Derk/Sameer redirection returns to the authentication page
> > rather than the originally requested page...
> >
> > anybody has any recent experience with throttling per user and can walk 
> me
> > through this?
> >
> > do the available patches effect each other? all patches (found a nice
> > summary at http://www.juneauwireless.net/NoCatAuth.html) claim to be run
> > against 0.82. do I have to worry about the order of applying patches or
> > comparing from hand rather than patch -px <...?
> >
> > thanks,
> > regards
> > jj
> >
> > _______________________________________________
> > NoCat mailing list
> > [email protected]
> > http://lists.nocat.net/mailman/listinfo/nocat
> >
> 
> _______________________________________________
> NoCat mailing list
> [email protected]
> http://lists.nocat.net/mailman/listinfo/nocat
>