9.3 Detection of connections with large data volume transferred
Prev | Chapter 9 Bandwidth Limiter | Next

## 9.3 Detection of connections with large data volume transferred

This chapter provides description of the method used by the Bandwidth Limiter module to detect connections where large data volumes are transmitted. This description is an extra information which is not necessary for usage of the Bandwidth Limiter module.

Network traffic is different for individual services. For example, web browsers usually access sites by opening one or more connections and using them to transfer certain amount of data (objects included at the page) and then closes the connections. Terminal services (e.g. Telnet, SSH, etc.) typically use an open connection to transfer small data volumes in longer intervals. Large data volume transfers typically uses the method where the data flow continuously with minimal intervals between the transfer impulses.

Two basic parameters are tested in each connection: volume of transferred data and duration of the longest idle interval. If the specified data volume is reached without the idleness interval having been thresholded, the connection is considered as a transfer of large data volume and corresponding limits are applied.

If the idle time exceeds the defined value, the transferred data counter is set to zero and the process starts anew. This implies that each connection that once reaches the defined values is considered as a large data volume transfer.

The value of the limit for the amount of data transmitted and the minimal idleness period are configuration parameters of the Bandwidth Limiter (see chapter 9.2 Bandwidth Limiter configuration).

### Examples:

The detection of connections transferring large data volumes will be better understood through the following examples. The default configuration of the detection is as follows: at least 200 KB of data must be transferred while there is no interruption for 5 sec or more.

1. The connection at figure 9.6 Connection example — short idleness intervals is considered as a transmission of large data volume after transfer of the third load of data. At this point, the connection has transferred 200 KB of data while the longest idleness interval has been only 3 sec.

   Figure 9.6. Connection example — short idleness intervals

2. Connection at figure 9.7 Connection example — long idleness interval is not considered as a large data volume transfer, since after 150 KB of data have been transferred before an only 5 sec long idleness interval and then, only other 150 KB of data have been transmitted within the connection.

   Figure 9.7. Connection example — long idleness interval

3. The connection shown at figure 9.8 Connection example — long idleness interval at the beginning of the transfer transfers 100 KB of data before a 6 sec idleness interval. For this reason, the counter of transferred data is set to zero. Other three blocks of data of 100 KB are then transmitted. When the third block of data is transferred, only 200 KB of transmitted data are recorded at the counter (since the last long idleness interval). Since there is only a 3 sec idleness interval between transmission of the second and the third block of data, the connection is considered as a large data volume transfer.

   Figure 9.8. Connection example — long idleness interval at the beginning of the transfer

Prev | Up | Next
9.2 Bandwidth Limiter configuration | Contents | Chapter 10 User Authentication