How to keep one user from dominating the connection?

[nmessick]

Is there a way to setup some level of QOS to keep one user (or machine) from sucking down the entire internet connection. We have a 3.0/3.0 and when one person is downloading a large file its nearly impossible for anyone else to load webpages without refreshing multiple times.

 

[North323]

make sure your router/switch is capable of doing QoS. You could create a access-list for that user and limit bandwidth that way. see:

http://www.cisco.com/en/US/docs/ios/12_0/qos/command/reference/qrcmdr.html#wp1020005

 

[nmessick]

I don't know if I can point the finger at one user. Anyway to do it network wide? Say two people go at the connection... anyway to make sure they both get half?

 

[North323]

sure, create two access-lists. you can find out who it is, turn on IP accounting, see what IP is hogging.

 

[burtsbees]

CAR. Google it.

/

 

[burtsbees]

Cisco CAR, that is...

/

 

[nmessick]

If I do a CAR.. I end up with a hard limit on that entire ACL. Don't I still have the same problem of one user squashing out the others?

 

[lerdalt]

I'd look more at CBWFQ if possible. Set it so that your trouble users are in one queue, specify only a fraction of the bandwidth, then give everyone else into another queue and allow more bandwidth to it.

I tried putting together an example, but some reason it wasn't working right in my head. I'll see what damage I can cause later.

 

[Minue]

Hello
I would first turn on NBAR to see if it's P2P traffic (Emule,Kazaa,etc.)If your users are using these programs,you can drop this dangerous traffic from coming into your network.This would solve the problem without any other form of QOS.
Below are the configuration and show commands.
Note:To best catch the traffic apply the command to the WAN and LAN interface.

Router(config-if)#ip nbar protocol-discovery
Router# show ip nbar protocol-discovery top-n <1-50>

Regards

 

[nmessick]

I could make a go at that, there is still one stumbling block here for me. I've got 3mbit available, and two users going at it. To ensure that each user gets 1/2 the pipe I have to setup a seperate class for each user. Thats insane! There has to be an easier way. I can't imagine this is that uncommon of a request.

 

[lerdalt]

Take a look at this thread, I had posted something similar to what you are wanting to do. Hopefully it will point you in the right direction:

http://www.tek-tips.com/viewthread.cfm?qid=1507353&page=5

I'm assuming you have a fastethernet connection going to your Internet connection, so shaping is going to be out of the question

 

[unclerico]

The tough part is that the OP has to police bandwidth for just one or two people and leave the rest as is (at least that is my understanding of the problem). Lerdalt posted the best solution, IMHO, but what you'll need to do there is either assign the dominating users static IP's so that you can create your ACL to target only those IP's or move them to their own VLAN and create your ACL to target that whole VLAN. Oh and BTW, long live NBAR!!!!

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)

 

[maheick]

The easiest way to go about this is to use a flow based queueing mechanism. It can be as simple as enabling WRED, and can be done easily by going into the interface command level and issue the following command:

random-detect.

What this will ensure is that all flows in a common traffic class will be given equal time on the wire.

So in your example, say that one of your users intiate a download. Then the other user comes along and he too intiates a download, or simply starts to browse the internet, both flows will be given equal access. What ends up happening is that the intial flow from the first user, is throttled back by the router by dropping packets. Obvisouly for TCP this is effective. This also works for UDP just in a slightly different manner.

Does this make sense?

Mark