New answers tagged cgroups
You recompile your kernel with CONFIG_CFS_BANDWIDTH=y. There is a feature request about this already.
You can filter with iptables based on classid. There is an example in the net_cls module link you provided. echo 0x100001 > /sys/fs/cgroup/net_cls/0/net_cls.classid iptables -A OUTPUT -m cgroup ! --cgroup 0x100001 -j DROP You can of course, change the example make iptables jump to another chain with more complex rules. Maybe: echo 0x100001 > ...
Something more basic: start sshd on a specific port with a very low nice level, which might help. # nice -20 /usr/sbin/sshd -p 2222 IF the problem is due to DOS throttling the network, then you have to use network-shaping rules outside the box (ie, on the switch).
Top 50 recent answers are included