It was based on outbound connections per local IP address, but I don't remember exactly how I achieved it. It might have been port 22 SYN, or it might have bee

It was based on outbound connections per local IP address, but I don't remember exactly how I achieved it. It might have been port 22 SYN, or it might have been using the conntrack module. IIRC it used the rate limiting module to set the rate, and then just the log module to log a message which the monitoring system would pick up. My routers were Linux boxes running in an HA configuration (heartbeat), with quagga for BGP to the upstreams. I had more cores than interfaces so the system would never livelock due to interrupt storm if a burst of packets came through (interrupt mitigation wouldn't happen if all cores are saturated handling interrupts). Firewalling was kept pretty simple, to reduce load and end boxes all had their normal firewalls, but I did block users sending IP source addresses that they weren't assigned. I also had a custom kernel module that would account traffic on the transit interfaces, so customers were only charged for traffic outside our network, anything internal (backups, apt/yum updates to our local mirror, etc) were all free. I loved having a router that had more than enough memory to hold full BGP tables no problem (while others were worried about the growth of the tables blowing out their RAM), and I liked that my slow path and fast path were the same speed. :-)