Date: Tue, 16 Mar 2010 13:12:33 -0500 From: Erik Osterholm <freebsd-lists-erik@erikosterholm.org> To: FreeBSD <freebsd-questions@freebsd.org> Subject: Re: limit bandwidth on sftp Message-ID: <20100316181233.GA28264@barragry.com> In-Reply-To: <448w9s49ek.fsf@be-well.ilk.org> References: <f84c38581003131244p215e5dbci35705b0087c5f466@mail.gmail.com> <44634xpv38.fsf@be-well.ilk.org> <d36406631003160213s639b4942w84fbb1fab6bedbd3@mail.gmail.com> <448w9s49ek.fsf@be-well.ilk.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, Mar 16, 2010 at 10:40:35AM -0400, Lowell Gilbert wrote: > krad <kraduk@googlemail.com> writes: > > > On 15 March 2010 13:34, Lowell Gilbert < > > freebsd-questions-local@be-well.ilk.org> wrote: > > > >> Tsu-Fan Cheng <tfcheng@gmail.com> writes: > >> > >> > I need to limit my sftp session bandwidth to 20K, can someone show me > >> how > >> > to do it? thank you! > >> > >> There's no simple way to do that. > >> > >> scp has such a capability, though; maybe using that is your easiest option? > > > > You could limit port 22 with pf, ipfw etc. This would slow all you ssh > > traffic rather than just sftp which may or may not work for you. If you are > > clever with your rule sets you could guarantee bw for certain hosts so they > > dont loose a functional ssh session and/or you could bw limit it by source > > ip, rather than a global limit for port 22. > > Aside from having to configure it, the downside of this approach is that > it involves dropping some traffic and waiting for the retransmit, so it > will be less efficient than a bandwidth limit in the application > itself. TCP's dynamic window resizing (especially with Selective > ACKnowledgements) should keep the firewall from having to drop too many > packets, but changing conditions on the network can keep that from > working as well as you'd like. If using this technique, make sure the > other side supports SACK, preferably for multiple segments. For what it's worth, I think most implementations of sftp/scp do not set the PUSH flag when transmitting data. This, combined with ACK prioritization, could allow you to shape sftp without affecting interactive SSH sessions. Erik
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20100316181233.GA28264>