5

I am using Cisco 1921 routers. I would like to configure them so as to limit the rate at which outbound data can flow. The kicker is that I want this rate limit to be quite low, say 1000 bytes per day. Is there any way to do this? Or, if not, does anyone know of a stand-alone appliance I could insert that would achieve this effect?

To clarify what I am trying to accomplish here: The users in my shop do a lot of downloading of data, so I want no limits on incoming data. However, I want severe limits on outgoing data so as to prevent any significant leaks of the extremely valuable information residing on my servers.

To clarify further: the path through the router is used exclusively for downloading. There is no surfing going on, just cronned scripts using sftp and ftp (legacy code!). So the outbound traffic is just whatever it takes to support the file-transfer protocol. The 1000 bytes is not a hard limit - in fact, at this point, I'm not sure what the limit ought to be.

Improve this question
7
  • Are you attempting to limit protocol traffic or traffic from an source (Host or subnet)?
    – HAL
    Mar 10, 2014 at 15:22
  • 2
    it would help if we knew a few more details about what you're accomplishing by limiting traffic and other constraints on the problem
    – Mike Pennington
    Mar 10, 2014 at 16:19
  • I'd also like to know. There might be other solutions. I'm not completely familiar with being able to limit it by total up/down per day. I've submitted an answer to the best of my ability with the current information.
    – HAL
    Mar 10, 2014 at 16:27
  • 1
    Thank you for adding more detail. This raises another question in my mind. Even regular web-browsing nowadays uses a large amount of bandwidth in both directions. I just checked the graphing on our Guest connection at work (i.e. mainly web-browsing) and the Download:Upload ratio is 3:1 on average, sometimes as high as 2:1. Downloads do take up more of the bandwidth, but the upload needs on most any connection, in order to be usable at all, will far exceed the limit of 1000 bytes you're discussing.
    – Brett Lykins
    Mar 11, 2014 at 14:18
  • 3
    Is there a hard limit right at 1000 bytes, or is it acceptable to have a variable cutoff somewhat higher at perhaps 1236 bytes? Some solutions can't react instantly to the statistics changes on an interface. BTW, it sounds like you really need a proxy server to enforce policies, instead of trying to limit this on individual router interfaces.
    – Mike Pennington
    Mar 11, 2014 at 14:30

2 Answers 2

Reset to default
2

I don't think you want to hear this, but no, you don't want to do rate-limiting like you have specified in your question. It's not a good solution to prevent leaking information out. On this topic, see XY Problem.

First of all 1000 bytes per day cap will be used up very quickly just on ACKs sent for the legitimate transfers.

As @MikePennington mentions on the comments you'd be better off using proxies to enforce desired policies.

Therefore one suggestion to address your problems might be:

  1. Set up a DMZ with proxy server.
  2. Restrict the access from internal network only to proxy servers.
  3. Set up and enforce the desired policy on the proxy servers.

Proxy servers could easily be used to prevent files from being uploaded while it'd still allow downloads.

Depending on your environment it might make sense to move the whole server to DMZ and only leave the clients into protected network. Whether this is feasible and beneficial it highly depending on how the server is being accessed, what's running on it and how it is being used.

There are some further questions that might help you assess the situation:

  • Where do you have the assets that you want to protect? Are they on clients or on the server?
  • Do you consider the clients connected network to be 'trusted' or 'hostile'?
  • Do you consider the users using clients 'trusted' or 'hostile'?
  • Do you think the server can be compromised?

This list isn't exhaustive by any means.

It sounds like you should review your overall architecture rather than plug in bits and pieces to prevent information from leaking out. There are no drop-in solutions to address security issues.

Improve this answer
0

There are specific solutions (usually proxies) both commercial and open source that can address this and are specialized to fight with data leakage prevention. On the protocol level, limiting traffic to some artificial values (be it 1000 or 10000 bytes per day) doesn't make sense as it will break TCP or any other higher-level protocols.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.