Grouping Users Of A Pipe - D-Link DFL-1600 User Manual

252
For any traffic shaper to work, it needs to know the bandwidth
passing through the choke point that it is trying to "protect". If the
connection is shared with other users or servers that are not under
the control of the firewall, it is nearly impossible to guarantee
bandwidth, simply because the firewall will not know how much
bandwidth is available for the connection. Simple limits will of course
work, but guarantees, priorities and dynamic balancing will not.
4. Watch for leaks
Make sure that all traffic that is desired for bandwidth control passes
through the pipes.
23.2.2

Grouping Users of a Pipe

If pipes were restricted to the functionality described so far, traffic would
be limited without respect to source or destination. This mode of operation
is likely sufficient for managing simple traffic limits and guarantees.
However, D-Link firewalls have the ability to group traffic within each pipe.
This means that traffic will be classified and grouped with respect to the
source or destination of each packet passing through the pipe.
Grouping may be performed on source/destination network, IP
address, port, or interface. In the network grouping cases, the network
size may be specified. The port grouping cases include the IP address,
meaning that port 1024 of computer A is not the same "group" as port
1024 of computer B.
The benefit of using grouping is that additional bandwidth controls may be
applied to each group. This means that if grouping is performed on, for
example, IP address grouping, the firewall can limit and guarantee
bandwidth per IP address communicating through the pipe.
Limits can be set either by specifying the maximum bandwidth per group
manually or using the Dynamic Banlancing. The control first occurs per
user group and then continues with the pipe as a whole.
D-Link Firewalls User's Guide
Chapter 23. Traffic Shaping