Filter based on traffic levels

Some webhosting companies bill based on the number of bytes sent each month
IPQueue can be used to record accounting information
Service can be suspended if a monthly quota is reached

    my $src = $ip->{src_ip};

    if ($customer->{$src}) {
        $customer->{$src}->{sent} += $msg->data_len;

        if ($customer->{$src}->{sent} >
            $customer->{$src}->{quota})
        {
            $customer->{$src}->{dropped} += $msg->data_len;
            $ipq->set_verdict($msg->packet_id, NF_DROP);
        } else {
            $ipq->set_verdict($msg->packet_id, NF_ACCEPT);
        }
    }

A real implementation would probably use a database to keep state
A similar example would be only permitting a user to connect to N different remote SMTP servers an hour, to prevent open-relay probing.

Next	© 2003 Michael C. Toren