Kerio Tech Firewall6 - Manual (Page 136)

Chapter 9 Bandwidth Limiter
136
Examples:
The detection of connections transferring large data volumes will be better understood
through the following examples. The default configuration of the detection is as follows:
at least 200 KB of data must be transferred while there is no interruption for 5 sec or more.
1. The connection at figure 9.6 is considered as a transmission of large data volume after
transfer of the third load of data. At this point, the connection has transferred 200 KB of
data while the longest idleness interval has been only 3 sec.
Figure 9.6 Connection example — short idleness intervals
2. Connection at figure 9.7 is not considered as a large data volume transfer, since after
150 KB of data have been transferred before an only 5 sec long idleness interval and then,
only other 150 KB of data have been transmitted within the connection.
Figure 9.7 Connection example — long idleness interval
3. The connection shown at figure 9.8 transfers 100 KB of data before a 6 sec idleness in-
terval. For this reason, the counter of transferred data is set to zero. Other three blocks
of data of 100 KB are then transmitted. When the third block of data is transferred, only
200 KB of transmitted data are recorded at the counter (since the last long idleness inter-
val). Since there is only a 3 sec idleness interval between transmission of the second and
the third block of data, the connection is considered as a large data volume transfer.
Figure 9.8 Connection example — long idleness interval at the beginning of the transfer