Re: Enforcing Bandwidth caps (quotas) in Wireless Service Providers http://www.dslreports.com/forum/r13465797 en Wed, 25 Nov 2009 09:24:12 EDT Wed, 25 Nov 2009 09:24:12 EDT Re: Enforcing Bandwidth caps (quotas) http://www.dslreports.com/forum/remark,13471731 totalaccess : again we do this at the base where the bandwidth hits the system, on a dual etherne unit instead of attached to any AP. Having your AP do bandwidth control is a bad idea.
--
Deploying Global Solutions: »www.wirelessworlds.com]]> http://www.dslreports.com/forum/remark,13471731 Mon, 23 May 2005 00:32:33 EDT Re: Enforcing Bandwidth caps (quotas) http://www.dslreports.com/forum/remark,13469704 joeyconcrete : For anybody who's interested I found two relevant RFCs.

RFC 3576 - Dynamic Authorization Extensions to Remote Authentication Dial In User Service (RADIUS)

RFC 2882 - Network Access Servers Requirements: Extended RADIUS Practices

These refer to "Disconnect Messages" and "Change-of-Authorization Messages (CoA)". To basically allows a RADIUS server to disconnect an active session by sending a specially formed packet to the Access server. Certain Cisco device support this (Cisco called it Ping of Disconnect, POD) and I 'think' other vendors do (Chillispot does for instance.

Using this its relatively easy to write a script which monitors the RADIUS accounting-database, when a quota is reached the message can be sent to the NAS. ]]> http://www.dslreports.com/forum/remark,13469704 Sun, 22 May 2005 19:09:08 EDT Re: Enforcing Bandwidth caps (quotas) http://www.dslreports.com/forum/remark,13466050 GuyS25 : It's a one vendor solution but Mikrotik can do this with a script. No PPPoE concentrator or radius server required.

HTH]]> http://www.dslreports.com/forum/remark,13466050 Sun, 22 May 2005 05:19:50 EDT Re: Enforcing Bandwidth caps (quotas) http://www.dslreports.com/forum/remark,13465797 totalaccess : We built our own BCU's and have had great success in traffic shapping and capping PTP traffic. We placed our BCU's at the base of each system where the bandwidth comes in and use the system a transparent bridge on the network.
--
Deploying Global Solutions: »www.wirelessworlds.com]]> http://www.dslreports.com/forum/remark,13465797 Sun, 22 May 2005 02:51:41 EDT Re: Enforcing Bandwidth caps (quotas) http://www.dslreports.com/forum/remark,13445478 joeyconcrete : Wired/Wireless, I guess ultimately it ends up at a concentrator. After scanning the web, it appears its only possible using "special" implementations or specialist software. For example, BT's broadband in the UK limits you to 10gb @ 512kb, then once you're quota is exceeded your speed is throttled to 64k. I'm guessing this is using some specialist kit as opposed to a simple concentrator/RADIUS pairing. Google seems to throw up companies like Allot and Packeteer - they have fancy things like policy managers etc - but all look very expensive!]]> http://www.dslreports.com/forum/remark,13445478 Thu, 19 May 2005 12:22:42 EDT Re: Enforcing Bandwidth caps (quotas) http://www.dslreports.com/forum/remark,13443130 sporkme :
said by joeyconcrete See Profile:

What I'm wondering is there a way whereby you can actively disconnect a session by sending a "message" of some sort from the RADIUS server. Almost like a "stop" message sent to the access-device. The less elegant solution of disconnecting their session very xxx hours would work - I'm presuming a session-timeout will drop the PPP connection entirely?
While I've seen Radius bent into some strange shapes, usually this is done when the session is started. That sounds crazy, but think of RAS gear... A user dials in, and the radius server OK's him. Along with that information, it may also specify the user has an idle-timeout of 10 minutes, a session-timeout of 8 hours, etc. So in that case, lots of the "counting" is really done on the radius client. Sometimes the radius server and the client may both be doing some neat stuff that in combination leads to something like "this user can have X bytes/month".

Now how radios implement this, I have no idea. My day job is totally wired. :)]]> http://www.dslreports.com/forum/remark,13443130 Thu, 19 May 2005 01:51:07 EDT Re: Enforcing Bandwidth caps (quotas) http://www.dslreports.com/forum/remark,13439851 joeyconcrete : Thanks for the reply. I understand what you're saying about the "stop" accounting messages, but as you pointed out - these are only available when a session has ended. There's the interim accounting which I understand. What I'm wondering is there a way whereby you can actively disconnect a session by sending a "message" of some sort from the RADIUS server. Almost like a "stop" message sent to the access-device. The less elegant solution of disconnecting their session very xxx hours would work - I'm presuming a session-timeout will drop the PPP connection entirely?]]> http://www.dslreports.com/forum/remark,13439851 Wed, 18 May 2005 18:03:57 EDT Re: Enforcing Bandwidth caps (quotas) http://www.dslreports.com/forum/remark,13430863 sporkme : What I'm describing would work with PPPoE and radius, but I have no idea how wireless gear that does authentication/accounting with radius would work. Do any of the devices provide account session byte counts? If so, then the below would apply...

I'm not going to say it's easy, but as long as you timeout your sessions after say, 24 hours or whatever granularity you need, you should have the info. Each time the access server sends the accounting "stop" packet, it should include a "bytes transferred" number that will get stashed in your radius sql backend (yeah, you really want to use a sql-backed radius server like gnu-radius, freeradius, radiator). Part of your "can they auth" sql query can total up the bytes transferred and deny access, or possibly send a custom reply to your access server device to throttle them.]]> http://www.dslreports.com/forum/remark,13430863 Tue, 17 May 2005 17:29:15 EDT Enforcing Bandwidth caps (quotas) http://www.dslreports.com/forum/remark,13430468 joeyconcrete : Whats the best way to go about enforcing bandwidth caps on a per user basis. If I have a user on RADIUS is there a way to enforce a set amount of data transfer per month (e.g 20gb). Once the user has reached their quota the PPPoE Concentrater/NAS disconnects them or reduces their speed to say 64k?

I'm guessing this would require some special features on the access-device/concentrator to allow this, and may require some fancy stuff on the RADIUS server to calculate the ongoing quotas? Or am I wishing for too much :D]]> http://www.dslreports.com/forum/remark,13430468 Tue, 17 May 2005 16:40:57 EDT