BiteSizedChunks.comLearn one small thing at a time.
Course contentsShow
← Linux
Lesson 1230 of 1,81910. Network Administration and Kernel StacksFree lesson

Managing Flow Limits per User/Process

Apply network resource quotas to prevent process-level bandwidth starvation.

In this lesson, you will learn how to enforce network resource quotas to ensure that a single rogue process or user does not consume all available bandwidth, preventing starvation for other services.

The Problem of Bandwidth Starvation

In a shared Linux environment, a process performing a high-volume data transfer—like a heavy backup or a misconfigured log exporter—can saturate the network interface. When this happens, other critical processes (like your web server or database) experience latency spikes or dropped packets because the kernel’s transmission buffers are exhausted by the "greedy" process. To maintain system stability, we must apply granular flow limits.

Implementing Limits with Cgroups and tc

The most effective way to manage these limits is by combining Control Groups (cgroups) with the Linux Traffic Control (tc) subsystem. Cgroups allow us to group processes by user or function, while tc provides the mechanism to classify that traffic and apply a rate limit.

By tagging the traffic of a specific cgroup using the net_cls (Network Classifier) controller, we can tell the kernel to treat packets from specific processes differently.

Here is a simplified conceptual workflow to limit a user’s bandwidth:

  1. Create a cgroup: 
    mkdir /sys/fs/cgroup/net_cls/restricted_user
echo 0x10001 > /sys/fs/cgroup/net_cls/restricted_user/net_cls.classid
  2. Assign a process to the group: 
    echo <pid> > /sys/fs/cgroup/net_cls/restricted_user/cgroup.procs
  3. Apply the limit via tc: We use a Token Bucket Filter (TBF) or Hierarchical Token Bucket (HTB) attached to the network interface, filtering by the classid we just defined. This forces the kernel to queue or drop packets once the user exceeds the assigned rate, ensuring the rest of the system remains responsive.

By applying these quotas, you move away from a "first-come, first-served" network model to a deterministic environment where bandwidth is treated as a limited system resource, much like CPU or RAM. This prevents individual processes from turning a localized network spike into a global system performance failure.

Key Takeaway: By binding process groups to specific traffic classes via cgroups and tc, you can enforce strict bandwidth ceilings that protect critical services from process-level network starvation.