BCrouter

Everything on this page is for informational purposes only and can be changed at any time. There are no guarantees this page contains the latest information.
Version: 200509261250
BCrouter:What is BCrouter?
Network:Overview of the KotNet network structure?
BCpolicer: 
  • Principle
  • :How does the userquota and bandwidth regulation work?
  • Settings
  • :What are your quotasettings?
  • Exceptions
  • :What sites don't account to your quota?
    Performance:What kind of hardware does it use?

    BCrouter:

    BCrouter is a high performance MAN network router and network access controller based on open source software. It is capable of managing and regulating network traffic of thousands of simultaneous users.
    Features:
    • User login system
      • "Unlimited" amount of users possible (1 Gig ram allows +50000 users.. more ram allows more)
      • Number of active logins or total number of users has no performance impact
      • KotNet users:
        • Potential KotNet users: 60000
        • Maximum simultaneous logged in users: 20000
    • Group based routing
      • "Unlimited" amount of usergroups possible (or more than you'll ever need anyway :-)
      • Every usergroup has its own independent routing tables and policy
      • Number of groups has no performance impact
      • KotNet usergroups:
        • K.U.Leuven users
        • K.U.Leuven Association users (GroepT, KHLeuven, W&K, ...)
    • Bandwidth regulation (BCpolicer)
      • Prevent that a minority of users take away all the bandwidth of the majority of users
      • Always allow traffic at normal speed to certain educational sites (e.g. toledo, webmail...)
      • Every user can have its own personal bandwidth settings with no performance impact
      • Distribute the individual bandwidth over the individual active network connections
      • Maximize responsiveness for interactive traffic
    • Volume quota (BCpolicer)
      • Every user is only allowed to use a certain fixed amount of traffic.
      • Slow down traffic to prevent a user from generating too much traffic
      • Every user/usergroup can have its own personal quota settings with no performance impact
      • A user is never blocked from the network (realtime-smallband).
      • If a user who is on 'smallband' stops downloading for a few minutes, the user immediately can use a limited amount of traffic again at normal speed.

    KotNet network setup:

    Currently there are 2 groups of users that can use KotNet:
    • K.U.Leuven students and personel
    • Students and personel of K.U.Leuven associated schools (GroepT,KHLeuven,W&K,EHSAL...)
    As can be seen on the figure above, both groups are treated differently by BCrouter:
    • K.U.Leuven group (blue lines)
      For students and personel of the K.U.Leuven it is possible to connect to internal K.U.Leuven servers and vica versa. Examples are library servers, pc rooms...
    • Association group (green lines)
      Users of this group don't nessessarily have a special relation to the K.U.Leuven itself. As a result of this, all traffic is sent to the Network Address Translator. Traffic from this usergroup to the K.U.Leuven is treated as coming from the Internet. It is not possible to make connections from the K.U.Leuven network to these KotNet pc's.
    There are also parts of the network where traffic of both groups is sent/received on the same network segment (blue-green lines).

    BCpolicer:

    Principle (simplified):
    The BCpolicer system can be compared to a leaky waterbucket (TokenBucket).

    Every user gets his/her own waterbucket that is constantly filled with water at the top while it is drained through a hole (at the same time) at the bottom.
    The size of this bucket is the amount of water a user is allowed save and use in 30 days.

    If there is no water flowing out of the bucket, the speed at which the water fills the bucket is set so that it completely fills the bucket in 30 days.
    This fillspeed is called the 'MeanFillRate' and is a constant value that never changes.
    If the bucket is already full, the water that overflows the bucket is lost.

    At the bottom of the waterbucket, there is a hole (CurrentRate)
    The maximum flow of water that can pass through the hole in a normal situation is called 'BurstRate'.

    For every data byte that has to be transferred on the computer network, the policer tries to get a waterdrop from the bucketsystem belonging to the owner of the byte. If the policer can get a waterdrop, the byte is allowed to pass on the network. If there is no waterdrop available (e.g. because the user wants to transfer more bytes than waterdrops leaving the users bucketsystem per second), the byte is not allowed until there are waterdrops available again.

    Some examples:
    If a user doesn't do anything on the computernetwork, there are no bytes for him/her that need to be transferred on the network. So there is no water leaving the bucket. The bucket is still being filled with the MeanFillRate flow and the water level is increasing.

    If a user only wants to transfer some bytes, the router will have no problem getting waterdrops and the bytes will be allowed to pass onto the network. If there is more water leaving than entering the bucket, the water level of the bucket wil decrease.

    If the user has already transferred a large amount of data causing the bucket to be empty, the downloadspeed of the user will decrease until it equals the flow of water entering his/her bucket (MeanFillRate). If the user stops downloading, the bucket will start to fill itself immediately since there is always water entering the bucket (MeanFillRate). After, for example, a few minutes, there will be enough water in the bucket again to allow low volume network traffic at normal speeds.

    Note
    • Since electronics and water are not best friends, the water is replaced by virtual tokens in the real router :-)
    • There are different buckets with different settings for traffic 'to' (download) and 'from' (upload) a KotNet pc. The configured download quota/speeds are independent in regard to the configured upload quota/speeds.
    • This is only a very simplified explanation. In the actual implementation, there are more advanced algorithms used for policing that allow regulation of individual network connections per user.
    • It is important to understand that the data bytes of a user are NOT flowing 'through' the bucket. If a data byte arrives at the router, the router 'asks' the waterbucket system if it is allowed to pass the byte. The permission to pass is 'bought' with a waterdrop from the correct userbucket.

    Current user settings:
    ParameterDescriptionDownload (=to KotNet pc)Upload (=from KotNet pc)
    TBMSMaximum size of the TokenBucket 4 294 967 296 Tokens
    (equivalent to 4 Gigabyte)
    1 073 741 824 Tokens
    (equivalent to 1 Gigabyte)
    BurstRateMaximum allowed number of tokens per second leaving the TokenBucket (=maximum network speed in bytes/sec if the TokenBucket is not empty) Residences: 250 000 tokens/sec
    UPC: To be determined
    Telenet: To be determined
    Residences: 250 000 tokens/sec
    UPC: To be determined
    Telenet: To be determined
    MeanFillRateNumber of tokens/sec that is constantly being added to the Tokenbucket (=maximum network speed when the TokenBucket is empty) 1543 Tokens/sec
    (equivalent to 4 Gigabyte/month)
    2314 Tokens/sec
    (equivalent to 200 Megabyte/day)


    List of site exceptions:
    KULeuvenNet servers
    HostIp addressProtocolPortnumberException
    KULeuvenNet subnet134.58.126.0/23icmpanyNo login required, no user quota accounting, no speedlimit
    KULeuvenNet Web servers134.58.127.64/29tcphttpNo login required, no user quota accounting, no speedlimit
    ns1.kulnet.kuleuven.be134.58.126.3udpdnsNo login required, no user quota accounting, no speedlimit
    ns2.kulnet.kuleuven.be134.58.127.1udpdnsNo login required, no user quota accounting, no speedlimit
    netlogin.kuleuven.be134.58.127.65tcphttpsNo login required, no user quota accounting, no speedlimit
    Webmail servers
    HostnameIp addressProtocolPortnumberException
    webmail.cc.kuleuven.ac.be134.58.242.17tcphttpsNo login required, no user quota accounting
    webmail1.cc.kuleuven.ac.be134.58.242.3tcphttpsNo login required, no user quota accounting
    webmail2.cc.kuleuven.ac.be134.58.242.4tcphttpsNo login required, no user quota accounting
    Web servers
    HostnameIp addressProtocolPortnumberException
    cwisdb.cc.kuleuven.be134.58.126.143tcphttpsNo login required, No user quota accounting
    icts.kuleuven.be134.58.242.25tcphttpNo login required, No user quota accounting
    www.kuleuven.be134.58.10.40tcphttpNo login required, No user quota accounting
    www2-24.cc.kuleuven.ac.be134.58.242.24tcphttpNo login required, No user quota accounting
    Toledo
    HostnameIp addressProtocolPortnumberException
    cygnus.cc.kuleuven.be134.58.10.95tcphttpsNo login required, No user quota accounting
    Ftp servers
    HostnameIp addressProtocolPortnumberException
    ftp.kulnet.kuleuven.ac.be134.58.250.2tcpftp,httpNo login required, no user quota accounting
    pclabftp.cc.kuleuven.ac.be134.58.10.90tcpftp,httpNo login required, no user quota accounting
    ftp.belnet.be193.190.198.20tcpftp,httpLogin required, no user quota accounting
    ftp.ulyssis.org193.190.253.193tcpftp,httpLogin required, no user quota accounting
    Toledo servers
    HostnameIp addressProtocolPortnumberException
    cygnus.cc.kuleuven.be134.58.10.95tcphttpsNo login required, no user quota accounting
    GroepT
    HostnameIp addressProtocolPortnumberException
    idp.groept.be193.190.255.27tcphttpsNo login required, no user quota accounting
    mail.student.groept.be193.190.255.2tcphttpsNo login required, no user quota accounting
    mail.ace.groept.be193.190.255.5tcphttpsNo login required, no user quota accounting
    mail.groept.be193.190.255.6tcphttpsNo login required, no user quota accounting
    KHLeuven
    HostnameIp addressProtocolPortnumberException
    idp.khleuven.be193.190.138.31tcphttpsNo login required, no user quota accounting
    mail.student.khleuven.be193.190.138.20tcphttpsNo login required, no user quota accounting
    -none-193.190.138.81tcphttpsNo login required, no user quota accounting
    Lessius
    HostnameIp addressProtocolPortnumberException
    idp.lessius.eu193.190.124.7tcphttpsNo login required, no user quota accounting
    mail.lessius.eu193.190.124.5tcphttpNo login required, no user quota accounting
    Ehsal
    HostnameIp addressProtocolPortnumberException
    idp.ehsal.be193.190.224.216tcphttpsNo login required, no user quota accounting
    KHBO
    HostnameIp addressProtocolPortnumberException
    idp.khbo.be193.191.130.84tcphttpsNo login required, no user quota accounting
    webmail.khbo.be193.191.130.72tcphttpNo login required, no user quota accounting
    KHLim
    HostnameIp addressProtocolPortnumberException
    idp.khlim.be193.190.56.237tcphttpsNo login required, no user quota accounting
    webmail.khlim.be193.190.56.247tcphttpsNo login required, no user quota accounting
    193.190.56.244193.190.56.244tcphttpsNo login required, no user quota accounting
    KUBrussel
    HostnameIp addressProtocolPortnumberException
    idp.kubrussel.ac.be193.190.236.204tcphttpsNo login required, no user quota accounting
    SintLukas
    HostnameIp addressProtocolPortnumberException
    idp.sintlukas.be193.191.136.169tcphttpsNo login required, no user quota accounting
    webmail.sintlukas.be193.191.136.170tcphttpsNo login required, no user quota accounting
    WENK
    HostnameIp addressProtocolPortnumberException
    idp.wenk.be193.190.145.182tcphttpsNo login required, no user quota accounting
    webmail.wenk.be193.190.145.181tcphttpsNo login required, no user quota accounting
    webmail2.wenk.be193.190.145.165tcphttpsNo login required, no user quota accounting
    HostnameIp addressProtocolPortnumberException
    tcphttpsNo login required, no user quota accounting
    W&K
    HostnameIp addressProtocolPortnumberException
    webmail.wenk.be193.190.145.181tcphttpNo login required, no user quota accounting

    Performance:

    Hardware:
    • Dell Poweredge 2650
    • Dual Intel(R) Xeon(TM) CPU 3.20GHz with Hyperthreading
    • ServerWorks GC-LE chipset, 400MHz front side bus, 2:1 memory interleaving, 5 PCI buses (three of which are are PCI-X capable)
    • 1 Gig ECC ram
    • Dual (onboard) Broadcom Corporation NetXtreme BCM5703X Gigabit Ethernet
    Software:
    • Debian Sarge operating system
    • Vanilla Kernel 2.6.12.2 (with modified routing cache size)
    • ipt_bcpolicer netfilter kernel module
    Performance:
    • Up to 200 000 packets/sec throughput (> 1.5 Gigabit of 'normal' network traffic)
    • Worst case scenario: 100 000 packets/sec throughput (with no routing cache enabled)
    • >60000 user login/logout operations/sec
    • Load distribution when fully loaded:
      • 75% routing (kernel routing code)
      • 10% used by ipt_bcpolicer
      • 10% used for logging purposes
      • 5% other tasks