12 Jul
2007
12 Jul
'07
3:46 p.m.
Klaus,
depending of what you want to test - (1) small bursts (many requests in
a small timewindow) or (2) constant large traffic.
for (1), you can use the cfg I sent you, but, as you said, you may have
the problem with "on purpose" bursts of requests.
for (2), try a large sampling unit with a larger number of messages:
modparam("pike", "sampling_time_unit", 10)
modparam("pike", "reqs_density_per_unit", 100)
regards,
bogdan
Klaus Darilion wrote:
Bogdan-Andrei Iancu wrote:
Hi Klaus,
in my opinion the pike is still the answer - it works at IP level
(gets only source ip of the package).
if you want to get the 20 requests/second, try
modparam("pike", "sampling_time_unit", 2)
modparam("pike", "reqs_density_per_unit", 10)
and try to decrease the last value if still not reacting..
Certainly I have to give pike a try, again.
But I think the threshold is too low. E.g. think of an eyebeam client
starting up and sending SUBSCRIBEs to all the buddies.
regards
klaus
regards,
bogdan
Klaus Darilion wrote:
Hi!
I once again bother about a stupid SIP client which is misconfigured
and sending REGISTER messages like crazy to my SIP proxy (~20
requests/second). How do you deal with that stupid clients.
Manual blocking does not work as the client has dynamic IP addresses.
I once also tried the pike module but had problems to find out a
proper configuration (threshold value and sampling interval).
Further, I think blocking at IP level (e.g. openser injects iptable
rules) would be more useful.
I would be happy to hear how you handle such situations.
_______________________________________________
Users mailing list
Users(a)openser.org
http://openser.org/cgi-bin/mailman/listinfo/users