{"id":1725,"date":"2010-04-12T01:22:00","date_gmt":"2010-04-12T07:22:00","guid":{"rendered":"http:\/\/gregsowell.com\/?p=1725"},"modified":"2010-04-09T11:25:37","modified_gmt":"2010-04-09T17:25:37","slug":"how-i-control-my-videos-with-pcq-and-connection-limiting","status":"publish","type":"post","link":"https:\/\/gregsowell.com\/?p=1725","title":{"rendered":"Mikrotik &#8211; How I Control My Videos With PCQ And Connection Limiting"},"content":{"rendered":"<p>I initially had no QoS on my servers, which I quickly found was a BAD idea!  I had tons of users opening tons of connections, which means my server kept becoming unresponsive.  Each time a new connection comes in apache spawns a new process and it would eat somehwere around 25MB of ram; so after users would connect with multi threadded downloaders, my site would tank every day or so.  To prevent this, I put connection limiting in place.  I then noticed that users with higher connection speeds were pulling the videos quick, which could max out my internet connection, so I put in some controls for that in the form of an <a href=\"http:\/\/wiki.mikrotik.com\/wiki\/Manual:PCQ_Examples\">PCQ(Per Connection Queue)<\/a>.  An PCQ allowed me to offer my videos at a fixed rate to each user that connects, thus no one user can max out the connection.<\/p>\n<p>We start by matching HTTP get requests.  I created an L7 rule to match my video files:<\/p>\n<pre class=\"gs-code\"><code class=\"language-plaintext\">\/ip firewall layer7-protocol\r\nadd comment=&quot;&quot; name=&quot;Download - MP4&quot; regexp=&quot;^.*get.+\\\\.mp4.*\\$&quot;<\/code><\/pre>\n<p>Next I create a mangle rule to mark the connections heading to my server on port 80 matching my L7 rule.<br \/>\nThen a mangle rule marks packets based on packets that have the connection mark.<\/p>\n<pre class=\"gs-code\"><code class=\"language-plaintext\">\/ip firewall mangle\r\nadd action=mark-connection chain=prerouting comment=&quot;Mark Connection MP4 Downloads on Greg&#039;s site&quot; \\\r\n    disabled=no dst-address=209.189.228.152 dst-port=80 layer7-protocol=&quot;Download - MP4&quot; \\\r\n    new-connection-mark=MP4Connection passthrough=yes protocol=tcp src-address=0.0.0.0\/0\r\nadd action=mark-packet chain=prerouting comment=&quot;&quot; connection-mark=MP4Connection disabled=no \\\r\n    new-packet-mark=MP4Connection passthrough=no<\/code><\/pre>\n<p>This firewall rule limits the number of connections per user to 3 based on the connection mark.<\/p>\n<pre class=\"gs-code\"><code class=\"language-plaintext\">\/ip firewall filter\r\nadd action=tarpit chain=forward comment=&quot;Drop High Greg MP4&quot; \\\r\n    connection-limit=3,32 connection-mark=MP4Connection disabled=no \\\r\n    in-interface=ether1 protocol=tcp<\/code><\/pre>\n<p>I then created a PCQ that gives 200K to each user pulling my video based on destination.  I did destination because I&#8217;m limiting traffic going out to the user, so this will classify each individual IP.<\/p>\n<pre class=\"gs-code\"><code class=\"language-plaintext\">\/queue type\r\nadd kind=pcq name=GregMP4 pcq-classifier=dst-address pcq-limit=50 pcq-rate=\\\r\n    200000 pcq-total-limit=6000000<\/code><\/pre>\n<p>Last I added the queue tree to my existing &#8220;OUT&#8221; queue.  I specify my new PCQ and gave them a max of 6Mb and a minimum of 3Mb.<\/p>\n<pre class=\"gs-code\"><code class=\"language-plaintext\">\/queue tree\r\nadd burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \\\r\n    max-limit=10M name=OUT parent=ether1 priority=8\r\nadd burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=3M \\\r\n    max-limit=6M name=GregMP4 packet-mark=MP4Connection parent=OUT priority=7 \\\r\n    queue=GregMP4<\/code><\/pre>\n<p>So, if you guys have a specific resource you need to control a little more closely, give this a try.  Let me know what you guys think \ud83d\ude42<\/p>\n","protected":false},"excerpt":{"rendered":"<p>I initially had no QoS on my servers, which I quickly found was a BAD idea! I had tons of users opening tons of\u2026<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20,6,8],"tags":[],"class_list":["post-1725","post","type-post","status-publish","format-standard","hentry","category-hardware","category-mikrotik","category-networking"],"_links":{"self":[{"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/posts\/1725","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/gregsowell.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1725"}],"version-history":[{"count":7,"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/posts\/1725\/revisions"}],"predecessor-version":[{"id":1733,"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/posts\/1725\/revisions\/1733"}],"wp:attachment":[{"href":"https:\/\/gregsowell.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1725"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/gregsowell.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1725"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/gregsowell.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1725"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}