Could someone shed some light on measures I could take to ensure a few clients (ports) doesn't flood traffic (perhaps UDP?) and congest the switch for everyone? I've always been a little behind on Ethernet flow control outside of TCP scaling, which in the end of things, could be ignored by a malicious client.
There are a few ways of setting a limit on single user bandwidth consumption. It isn’t very common for an individual to seriously affect your entire network unless they genuinely have malicious intent. Along with technical suggestions, it is also worth adding in administrative ones, too.
Access Control: Limit who has access to your machines and what gets done on them. This isn’t a technical step, and not even viable in every scenario (like a downstream customer), but your initial question leads me to believe you’re concerned with nefarious users on your network. A good step would be to not let them on to begin with or stopping them from getting toolsets that allow them to do what your trying to prevent.
You’ll almost always find that once a lower layer is penetrated, the higher ones start to follow. It isn’t always common to find a machine vulnerable to some 0-day you found off exploitdb, but it is common (and easy) to find an open port, send out bogus ARP replies, and then spoof websites. 802.1X is getting heavy push in most organizations for a reason: port-security just isn’t cutting it anymore.
Solid Device Baseline: Get a good, secure baseline that all of your devices are working off of. Even if you restrict someone to a 128k connection, that won’t stop any amplification attack and will render the entire initiative useless. Good device baselines can be found on the NSA's site, along with solid explinations.
Policing: This is effectively setting a hard cap on any port you choose. Anything beyond the pre allocated bandwidth is just chopped off and sent to the bit bucket. If you’re looking to limit a single port to a specific amount of bandwidth, this is the easiest way of achieving it.
This does have a critical drawback, it isn’t intelligent in any way; once an interface reaches that threshold, it’s gone. What does this mean when no one’s using the network? Well, those policed aren’t going to, either. You can look at that as wasting usable bandwidth.
Shaping: There isn’t a good way of performing this within the boundary of your LAN, but it does an excellent job of sharing bandwidth at the edge (probably your POP or your customers POP). If you police a port, that port can never exceed the amount you’ve provisioned. When you shape, you can set group bandwidth percentages and different drop characteristics that allow priority ports all the bandwidth they can eat, when they actually need it.
This, too, has a pretty big drawback; it’s kind of difficult to get going. You will need to figure out a marking/queuing discipline that gives you exactly what you want. Plus, you’ll need to get all of the devices on your network talking the same language (configuration-wise) before you get real benefit from it.
There are many ways of addressing this and which one you choose can be dependent on the situation. Let me go over some of the more common ones.
- Quality of Service (aka QoS) - this could include rate limits, policing, marking traffic, etc. Depending on the capabilities of the device in use, this can take on a number of forms.
- Storm Control - depending on you device, this can provide hard limits and/or scaled limits on the amount of traffic that is received from a host. This will typically at least include broadcast traffic, but may also include multicast and/or unicast traffic as well.
- 802.1X/RADIUS - not only does this provide limitations requiring devices to authenticate to the network, you can configure policies that the host will be limited by, such as the amount of traffic allowed over a given period of time.
- IDS/IPS/SEIM - this would be a security based solution that would be looking for various types of events or abnormal behaviors. It can generally be configured to alert and/or take action when certain types of events occur.