Bandwidth throttling in OS X

[bwana]

Found this at my favourite hints site (macosxhints.com) -

Advanced OS X users know that Darwin comes with ipfw, which can be used to set up a custom firewall. This same service however can be used to also limit bandwidth on specific ports.

Example:

sudo ipfw pipe 1 config bw 15KByte/s

creates a pipe that only allows up to 15KB/s to go through.

Then:

sudo ipfw add 1 pipe 1 src-port 80

will attach that pipe to the outgoing traffic on port 80, effectively limiting the outgoing traffic of the web server.

sudo ipfw delete 1

will remove the pipe from the port.

 

[koffiejunkie]

Nice! I'm a little confused about the Leopard firewall though. I have it enabled, and I bought Little Snitch and have many rules, yet:

$ sudo ipfw list
Password:
65535 allow ip from any to any

OK, I assume the Little Snitch rules are not real firewall rules - but some sort of policy editor rather. A firewall cannot know what program is connecting, after all. But I expect the Leopard firewall to show, at least.

 

[bwana]

OK, I assume the Little Snitch rules are not real firewall rules - but some sort of policy editor rather. A firewall cannot know what program is connecting, after all. But I expect the Leopard firewall to show, at least.

Why cant a software firewall know what application is connecting?

EDIT - I had a look and my firewall settings and it seems to know what application is connecting because there is a whole slew of applications I have, upon request by the firewall, granted permission to access the internet.

 

[koffiejunkie]

Why cant a software firewall know what application is connecting?

I'm not a programmer or network guru, so my explanation might be slightly off, but:

A firewall is just a packet filter, a network device. Even if you manage to build a firewall that covers all seven network layers, you'd be able to distinguish types of traffic by what the packets look like, i.e. the firewall wouldn't be fooled if you make azureus listen on port 80, because it will inspect the content and recognise it as torrent traffic. But even then it has no way of knowing from which program the traffic originates.

Desktop software firewalls are really more than firewalls. They intercept system calls from programs. A good example is running say, telnet or ssh from within iTerm. Little Snitch would pop up and say telnet/ssh via iTerm is trying to make an outbound connection. This means it's operating somewhere between user space and kernel space. If we were still using DOS (let's imagine DOS had a network stack) a software firewall might have been able to know which program is connecting, because software talked to the hardware (i.e. network card in this case) directly. But under proper network capable operating systems the network stack sits in the kernel, software talks to the kernel, not to the network stack.

Does that make any sense?

 

[StbA]

Nice! I'm a little confused about the Leopard firewall though. I have it enabled, and I bought Little Snitch and have many rules, yet:

$ sudo ipfw list
Password:
65535 allow ip from any to any

OK, I assume the Little Snitch rules are not real firewall rules - but some sort of policy editor rather. A firewall cannot know what program is connecting, after all. But I expect the Leopard firewall to show, at least.

I think it's a port used by auto time update in System Preferences.

 

[gunslinger]

Nice tip, Thanks