Klaus,

depending of what you want to test - (1) small bursts (many requests in a small timewindow) or (2) constant large traffic.

for (1), you can use the cfg I sent you, but, as you said, you may have the problem with "on purpose" bursts of requests.

for (2), try a large sampling unit with a larger number of messages: modparam("pike", "sampling_time_unit", 10) modparam("pike", "reqs_density_per_unit", 100)

regards, bogdan

Klaus Darilion wrote:

Bogdan-Andrei Iancu wrote:

...

Hi Klaus,

in my opinion the pike is still the answer - it works at IP level (gets only source ip of the package). if you want to get the 20 requests/second, try modparam("pike", "sampling_time_unit", 2) modparam("pike", "reqs_density_per_unit", 10)

and try to decrease the last value if still not reacting..

Certainly I have to give pike a try, again.

But I think the threshold is too low. E.g. think of an eyebeam client starting up and sending SUBSCRIBEs to all the buddies.

regards klaus

...

regards, bogdan

Klaus Darilion wrote:

...

Hi!

I once again bother about a stupid SIP client which is misconfigured and sending REGISTER messages like crazy to my SIP proxy (~20 requests/second). How do you deal with that stupid clients.

Manual blocking does not work as the client has dynamic IP addresses.

I once also tried the pike module but had problems to find out a proper configuration (threshold value and sampling interval).

Further, I think blocking at IP level (e.g. openser injects iptable rules) would be more useful.

I would be happy to hear how you handle such situations.

---

Users mailing list Users@openser.org http://openser.org/cgi-bin/mailman/listinfo/users