Limiting Bitrate and Network Throttling

We may limit incoming or outcoming data rates to/from our infrastructure to maintain the stability of our service for customers. Bitrate limitation is an action to limit the number of bits that can be passed through a transmission channel in a period of time. Network throttling is an intentional action to slow down transmission speed in a network channel. It is not only about limiting bitrate but also limiting the allowed number of requests in a period of time. There are several tools and techniques that can be used to apply bitrate limitation and network throttling.

Wondershaper

It is an easy-to-use tool for Linux and is already in the package repository. It can limit the bit rate that can be achieved by network interfaces in the system. We can install it by running the following command.

apt install wondershaper

We can choose an interface to have a limitation either or both on download and upload.

wondershaper <interface-name> <download-rate-in-bps> <upload-rate-in-bps>

For example, the following code will limit eth0 to 40k bits/s of download rate and 20k bits/s of upload rate.

wondershaper eth0 40000 20000

To clear the setting, we can run the following command.

wondershaper clear eth0

Trickle

Based on its manual page, Trickle is a tool to limit the download or upload rate of any applications that utilize the socket interface. We can read more information about this tool here. We need to remember that only programs with dynamic linking can work with Trickle. We can test whether a binary can work with Trickle by the following command.

ldd $(which [binary]) | grep libc.so

For example,

ldd $(which wget) | grep libc.so

If it shows the location of libc.so, it means the binary can work with Trickle. For instance, if we want to limit the download rate of the wget tool, we can use the following example.

trickle -d [rate in KB/s] wget [protocol://file-URL] 

Nginx

Nginx is actually a proxy server that provides plenty of features to help us serve our web-based services such as the request rate and bandwidth limiting capability. This feature is used to prevent DDoS attacks by preventing our server to handle too many requests. It needs a defined key to differentiate a client from another, a memory zone to keep states of all the keys, and a rate-setting that states the number of requests per second or minute. The examples are as follows.

http {
    #...
    limit_req_zone $binary_remote_addr zone=one:10m rate=1r/s;

    server {
        #...
        location /search/ {
            limit_req zone=one;
        }
        location /search2/ {
        	# if request rate > specified rate, 5 requests are queued
            limit_req zone=one burst=5; 
        }
        location /search3/ {
        	# 5 excessive requests are served immediately
            limit_req zone=one burst=5 nodelay; 
        }
        location /search4/ {
        	# 3 excessive requests are served immediately, 2 requests are delayed
            limit_req zone=one burst=5 delay=3; 
        }
    }
}

Bandwidth limiting is applied per connection while Nginx originally allows multiple connections. It means if we want the exact bitrate value to be provided for specific addresses, we can set Nginx to allow only one connection.

http {
    limit_conn_zone $binary_remote_address zone=addr:10m;
    
    # mapping for dynamic configuration
    map $ssl_protocol $response_rate {
      "TLSv1.1" 10k;
      "TLSv1.2" 100k;
      "TLSv1.3" 1000k;
    }

    server {
        root /www/data;
        limit_conn addr 5;

        location /download/ {
            limit_conn       addr 1;
            # rate limiting is applied after 1MB data is passed
            limit_rate_after 1m; 
            limit_rate       50k;
        }
        
        # dynamic configuration
        location /secure/ {
            limit_rate       $response_rate;
        }
    }
}

We can get more information from Nginx documentation.