User Guide
APconnections, Inc. // 303.997.1300 // www.netequalizer.com
Page 20 of 96
All rights reserved
Copyright © 2014, 2015 APconnections, Inc.
rev. 20150309
Controlling P2P Traffic
Peer-to-Peer (P2P) Traffic attempts to create hundreds, or possibly thousands, of
simultaneous connections to absorb a lot of your available network bandwidth.
Setting
Connection Limits effectively blocks or reduces both encrypted and unencrypted P2P
by not
allowing users to create connections over the limits you specify.
NetEqualizer enables you to limit the amount of bandwidth a specific IP address or set of IP
addresses can use. There are two ways to configure this in the NetEqualizer, to best meet
your needs. We will go through each in detail below:
1.
Connection Limits
- Standard control of P2P traffic.
2.
Smart Connection Limits
- Dynamic, fairness-based control of P2P traffic
using the Dynamic Hogmin parameter. Also
know as Smarter P2P Blocking.
Setting Connection Limits
(
back
)
Connection Limits control the number of inbound and outbound data streams (IP
pairs or "connections") that each user on your network can create. Connection
Limits are bi-directional; any limit you set is divided in two and applied. For example, a
Connection Limit of sixty (60) would be turned into two connection limits: thirty (30)
inbound and thirty (30) outbound connections.
There are more reasons for system administrators to limit connections to a server than we
can possibly include in this discussion. The APconnections’ design team developed this
feature within NetEqualizer to lessen the effects of Peer-to-Peer traffic (P2P) and Denial of
Service (DoS) attacks, which we will discuss here.
Peer-to-Peer traffic attempts to create hundreds, or possibly thousands, of simultaneous
connections to absorb a lot of your network bandwidth. Setting Connection Limits effectively
blocks or reduces both encrypted and unencrypted P2P by not allowing connections over the
limit you specify.
In a DoS attack, storms of incoming connections are generated by hackers with the
intention of overwhelming a server or servers. An attacker will spoof requests, sending
storms of erroneously addressed connection requests to your server. These request storms
create overwhelming administrative overhead, crippling the server and requiring a reboot by
IT staff. While there are techniques that attempt to validate the incoming requests by
sending queries back to the sending IP address for verification, these approaches create
more traffic
on the network. Instead of this approach, we chose to address the issue by
setting DoS protection via Connection Limits.
NetEqualizer Connection Limits keep a total count of active connections (of any type) per IP
address. Additional connections cannot be created once the Connection Limit is reached for
that IP address.
Connection Limits can be set per individual IP or for an entire subnet at one time. If you set
