Subject: limit connections

From: "Alex Gao" <[email-masked]>
Date: Sat, 3 Apr 1999 23:34:35 +0800

hello :

  Can anyone tell me how to limit connections per IP?

  I use BeroFTPD 1.3.4 and many people connect my FTP 30 connection per IP.How can do it?
  Alex Gao
personal E-mail: [email-masked]     business E-mail: [email-masked]
homepage: http://swatou.net         ICQ:3131764

---

From: Gregory A Lundberg <[email-masked]>
Date: Sat, 3 Apr 1999 11:38:09 -0500 (EST)

On Sat, 3 Apr 1999, Alex Gao wrote:

> I use BeroFTPD 1.3.4 and many people connect my FTP 30 connection per
> IP.  How can do it?

This is an FRF.

Unless Bernhard has added something I've not heard about, there is no way
to limit connections per-user or per-IP-address in a general way.

If it's a specific host or network block, you can define a class for those
uses and limit the class.

I have noticed that there are a few mirror-like packages out there for
Windows.  I tried a few for grins.  What I found was that some of them
offer a 'download in parallel' option which has no parallel-connection
limit.  When I told it to download from my ftp site, it tried to open
several hundred sessions at once and declared the site dead when it stared
failing due to user limits.

I have noticed also that most anonymous users like to use Netscape or IE.
There's a configurable limit for parallel connections from those browsers.
Typically the limit is a small number (5 or 6).

Web browsers, however, tend to do a dumb thing.  They hold the last
session open until the user closes the window or moves off to another
site.  If a user opens a few windows, you'll have several open sessions.

I've done some experimentation and found that a short timeout helps
immensely.  The default of two hours is **WAY** too long.  I played with
the timeouts and settled on 5 minutes.  That's long enough to scan a
document and start another download for command-line people.  And it's
short enough to push out the web browsers.

So my recommendation:

  Run the server with -t 300 -T 300 on the command line.  This sets a
  five-minute default idle timeout, and a five-minute limit on how high a
  user can set the idle timeout.

You'll still have a few users in parallel, but the number will probably be
quite reduced.

-- 

Gregory A Lundberg              Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195