Hardware appliances can limit the rate of requests on layer 4 or 5 of the OSI model.
Protocol servers using a request / response model, such as FTP servers or typically Web servers may use a central in-memory key-value database, like Redis or Aerospike, for session management. A rate limiting algorithm is used to check if the user session (or IP address) has to be limited based on the information in the session cache.
However, in some cases (i.e. web servers) the session management and rate limiting algorithm should be built into the application (used for dynamic content) running on the web server, rather than the web server itself.
When a protocol server or a network device notice that the configured request limit is reached, then it will offload new requests and not respond to them. Sometimes they may be added to a queue to be processed once the input rate reaches an acceptable level, but at peak times the request rate can even exceed the capacities of such queues and requests have to be thrown away.
Data centers widely use rate limiting to control the share of resources given to different tenants and applications according to their service level agreement. A variety of rate limiting techniques are applied in data centers using software and hardware. Virtualized data centers may also apply rate limiting at the hypervisor layer. Two important performance metrics of rate limiters in data centers are resource footprint (memory and CPU usage) which determines scalability, and precision. There usually exists a trade-off, that is, higher precision can be achieved by dedicating more resources to the rate limiters. A considerable body of research with focus on improving performance of rate limiting in data centers.
- Token bucket
- Leaky bucket
- Fixed window counter
- Sliding window log
- Sliding window counter
- ASP.NET Web API rate limiter
- ASP.NET Core rate limiting middleware
- Rate limiting for .NET (PCL Library)
- Rate limiting for Node.JS
- Richard A. Deal (September 22, 2004). "Cisco Router Firewall Security: DoS Protection". Retrieved April 16, 2017.
- Greenberg, Andy. "An Absurdly Basic Bug Let Anyone Grab All of Parler's Data". Wired. No. 12 January 2021. Retrieved 12 January 2021.
- Jinghe Jin, Nazarov Nodir, Chaetae Im, Seung Yeob Nam, "Mitigating HTTP GET Flooding Attacks through Modified NetFPGA Reference Router," 07 November 2014, pp. 1, Retrieved 19 December 2021.
- M. Noormohammadpour, C. S. Raghavendra, "Datacenter Traffic Control: Understanding Techniques and Trade-offs," IEEE Communications Surveys & Tutorials, vol. PP, no. 99, pp. 1-1.
- Nikrad Mahdi (April 12, 2017). "An Alternative Approach to Rate Limiting". Retrieved April 16, 2017.