hey,

I have a question on how to best limit traffic with pf. The main
goal is not so much to limit bandwidth to a lower point all the
time but more to prevent a runaway process (or user) from
drowning the rest.

Since i do not have the means for extensive testing i hope to
get some pointers before going down a path that would only waste
time and resources. I have the following situation (simplified):

                         /-vlan1  <==1Gb==> desktops    
internet <==512Kb==>bge0 PF
                         \-vlan2  <==1Gb==> production

I want to make sure production has at least 256Kb both upload as
download on the internet connection.

1) I know it will not stop flooding of the line by 3rd parties. This is 
not the goal
of the rules. The goal is to prevent a download initiated by a server or 
user
from taking up all the download bandwidth

2) I was thinking of using a shared queue on vlan1 and vlan2 but I could 
not find
any documentation whether that is possible at all.
Would the following work and actually limit download traffic? If not 
then I guess
I will have to create separate download queues of max 400Kb so ensure at 
least
some bandwidth remains for the other side.

altq on bge0 cbq bandwidth 512Kb queue { ext-prod,  ext-desktop }
altq on vlan1 cbq bandwidth 1Gb queue { download, default-desktop }
altq on vlan2 cbq bandwidth 1Gb queue { download, default-prod }
queue download bandwidth 512Kb  { download_prod, download_desktop }
queue download_prod bandwidth 50% priority 3 cbq(borrow)
queue download_desktop bandwidth 50% priority 1 cbq(borrow)
pass in quick on bge0 from any to <production> keep state queue 
download_prod
pass out quick on vlan2 from any to <production> keep state queue ext-prod
pass in quick on vlan2 from <production> to any keep state queue ext-prod
pass out quick on vlan2 from <production> to any keep state queue 
download_prod
pass in quick on bge0 from any to <desktop> keep state queue 
download_desktop
pass out quick on vlan2 from any to <desktop> keep state queue ext-desktop
pass in quick on vlan2 from <desktop> to any keep state queue ext-desktop
pass out quick on vlan2 from <desktop> to any keep state queue 
download_desktop


Is this idea going in the right direction or is there a much better way 
to do this?

Thanks,
Stefan