Low-Bandwidth Optimisation

# Check traffic control availability
tc -V
# Expected: tc utility, iproute2-ss200127 or later

# Check Squid version
squid -v | head -1
# Expected: Squid Cache: Version 4.0 or later

# Install monitoring tools if missing
sudo apt install iftop vnstat nethogs

# Start vnstat monitoring on primary interface
sudo vnstat -u -i eth0

# Capture 7-day baseline
# After 7 days, export summary
vnstat -d -i eth0

   # Real-time traffic by connection
   sudo iftop -i eth0 -t -s 300 > traffic_baseline.txt

   # Capture by process (requires nethogs)
   sudo nethogs -t -d 5 eth0 > process_bandwidth.txt &
   sleep 300
   kill %1

   # Parse iftop output for top destinations
   cat traffic_baseline.txt | grep -E "^[0-9]" | \
     sort -t',' -k3 -rn | head -20

   # Isolate single application traffic (example: Teams)
   sudo tcpdump -i eth0 -w teams_capture.pcap \
     'host 52.112.0.0/14 or host 52.120.0.0/14' &
   # Use Teams normally for 30 minutes
   kill %1

   # Analyse capture
   capinfos teams_capture.pcap

   # Test without compression
   curl -so /dev/null -w "%{size_download}" http://example.org/test-page

   # Test with compression
   curl -so /dev/null -w "%{size_download}" --compressed http://example.org/test-page

   # Calculate ratio
   # Typical HTML: 70-85% reduction
   # Typical JSON: 80-90% reduction
   # Already compressed (images, video): 0-5% reduction

   # Calculate cache size
   # 15 users × 75 MB = 1,125 MB, round to 2 GB minimum

   # Create cache directory
   sudo mkdir -p /var/spool/squid
   sudo chown proxy:proxy /var/spool/squid

   # Initialise cache (in squid.conf, already configured above)
   # cache_dir ufs /var/spool/squid 10000 16 256
   # This creates 10 GB cache with 16 L1 and 256 L2 directories

   # Initialise
   sudo squid -z

   # Start service
   sudo systemctl enable squid
   sudo systemctl start squid

   # Configure via Group Policy or direct registry
   # HKLM\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization

   # Enable LAN-only download mode (mode 1)
   Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization" `
     -Name "DODownloadMode" -Value 1 -Type DWord

   # Set maximum background bandwidth (percentage)
   Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization" `
     -Name "DOPercentageMaxBackgroundBandwidth" -Value 10 -Type DWord

   # Set maximum foreground bandwidth
   Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization" `
     -Name "DOPercentageMaxForegroundBandwidth" -Value 25 -Type DWord

   # Squid cache statistics
   squidclient -h localhost mgr:info | grep -E "(Request|Hit|Memory)"

   # Expected output for healthy cache:
   #   Request Hit Ratios:  5min: 35.2%, 60min: 42.1%
   #   Byte Hit Ratios:     5min: 28.4%, 60min: 38.7%
   #   Memory accesses per second: 45.2/sec

   # Download headers only for poor connections
   $regPath = "HKCU:\Software\Microsoft\Office\16.0\Outlook\Cached Mode"
   Set-ItemProperty -Path $regPath -Name "Download" -Value 1 -Type DWord

   # Sync only 1 month
   Set-ItemProperty -Path $regPath -Name "SyncWindowSetting" -Value 1 -Type DWord

   # Warn on attachments over 5 MB
   Set-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Outlook\Preferences" `
     -Name "MaximumAttachmentSize" -Value 5120 -Type DWord

   # Limit upload bandwidth to 128 KB/s
   Set-ItemProperty -Path "HKCU:\Software\Microsoft\OneDrive" `
     -Name "UploadBandwidthLimit" -Value 128 -Type DWord

   # Limit download bandwidth to 256 KB/s
   Set-ItemProperty -Path "HKCU:\Software\Microsoft\OneDrive" `
     -Name "DownloadBandwidthLimit" -Value 256 -Type DWord

   # Enable Files On-Demand (download only when accessed)
   Set-ItemProperty -Path "HKCU:\Software\Microsoft\OneDrive" `
     -Name "FilesOnDemandEnabled" -Value 1 -Type DWord

   # Teams bandwidth policies (via Teams Admin Center or PowerShell)
   # Set via CsTeamsMeetingPolicy

   Set-CsTeamsMeetingPolicy -Identity "LowBandwidthPolicy" `
     -VideoBitRateKb 400 `
     -MediaBitRateKb 1000

   # Assign to users in low-bandwidth locations
   Grant-CsTeamsMeetingPolicy -Identity "user@org.example" `
     -PolicyName "LowBandwidthPolicy"

   # Windows telemetry reduction
   Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection" `
     -Name "AllowTelemetry" -Value 0 -Type DWord

   # Disable Customer Experience Improvement Program
   Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\SQMClient\Windows" `
     -Name "CEIPEnable" -Value 0 -Type DWord

   # Disable Windows Spotlight (downloads images)
   Set-ItemProperty -Path "HKCU:\SOFTWARE\Policies\Microsoft\Windows\CloudContent" `
     -Name "DisableWindowsSpotlightFeatures" -Value 1 -Type DWord

   # Install image processing tools
   sudo apt install imagemagick webp optipng jpegoptim

   # Create optimisation script
   cat > /usr/local/bin/optimize-image.sh << 'EOF'
   #!/bin/bash
   INPUT="$1"
   OUTPUT="$2"
   MIME=$(file -b --mime-type "$INPUT")

   case "$MIME" in
     image/jpeg)
       jpegoptim --strip-all --max=70 -o "$OUTPUT" "$INPUT"
       ;;
     image/png)
       optipng -o2 -out "$OUTPUT" "$INPUT"
       ;;
     image/webp)
       cwebp -q 70 "$INPUT" -o "$OUTPUT"
       ;;
     *)
       cp "$INPUT" "$OUTPUT"
       ;;
   esac
   EOF
   chmod +x /usr/local/bin/optimize-image.sh

   # Reserve bandwidth for update traffic to Microsoft/Canonical servers
   # See Phase 7 for complete tc configuration

   # Identify interface
   ip route | grep default
   # Example output: default via 192.168.1.1 dev eth0

   # Set bandwidth variable (in kbit)
   INTERFACE="eth0"
   BANDWIDTH="1024"  # 1 Mbps in kbit

   # Clear existing qdiscs
   sudo tc qdisc del dev $INTERFACE root 2>/dev/null

   # Create HTB root qdisc
   sudo tc qdisc add dev $INTERFACE root handle 1: htb default 50

   # Create root class at full bandwidth
   sudo tc class add dev $INTERFACE parent 1: classid 1:1 htb \
     rate ${BANDWIDTH}kbit ceil ${BANDWIDTH}kbit

   # Priority 1: Voice/Video - 20% guaranteed, can burst to 40%
   sudo tc class add dev $INTERFACE parent 1:1 classid 1:10 htb \
     rate $((BANDWIDTH * 20 / 100))kbit \
     ceil $((BANDWIDTH * 40 / 100))kbit \
     prio 1

   # Priority 2: Interactive - 30% guaranteed, can burst to 50%
   sudo tc class add dev $INTERFACE parent 1:1 classid 1:20 htb \
     rate $((BANDWIDTH * 30 / 100))kbit \
     ceil $((BANDWIDTH * 50 / 100))kbit \
     prio 2

   # Priority 3: Business - 30% guaranteed, can burst to 60%
   sudo tc class add dev $INTERFACE parent 1:1 classid 1:30 htb \
     rate $((BANDWIDTH * 30 / 100))kbit \
     ceil $((BANDWIDTH * 60 / 100))kbit \
     prio 3

   # Priority 4: Background - 15% guaranteed, can burst to 40%
   sudo tc class add dev $INTERFACE parent 1:1 classid 1:40 htb \
     rate $((BANDWIDTH * 15 / 100))kbit \
     ceil $((BANDWIDTH * 40 / 100))kbit \
     prio 4

   # Priority 5: Scavenger (default) - 5% guaranteed, can burst to 30%
   sudo tc class add dev $INTERFACE parent 1:1 classid 1:50 htb \
     rate $((BANDWIDTH * 5 / 100))kbit \
     ceil $((BANDWIDTH * 30 / 100))kbit \
     prio 5

   # Add stochastic fairness to each class
   sudo tc qdisc add dev $INTERFACE parent 1:10 handle 10: sfq perturb 10
   sudo tc qdisc add dev $INTERFACE parent 1:20 handle 20: sfq perturb 10
   sudo tc qdisc add dev $INTERFACE parent 1:30 handle 30: sfq perturb 10
   sudo tc qdisc add dev $INTERFACE parent 1:40 handle 40: sfq perturb 10
   sudo tc qdisc add dev $INTERFACE parent 1:50 handle 50: sfq perturb 10

   # Voice/Video: DSCP EF (46) and AF41 (34)
   sudo tc filter add dev $INTERFACE parent 1: protocol ip prio 1 \
     u32 match ip tos 0xb8 0xfc flowid 1:10
   sudo tc filter add dev $INTERFACE parent 1: protocol ip prio 1 \
     u32 match ip tos 0x88 0xfc flowid 1:10

   # Teams/Zoom ports (UDP high ports for media)
   sudo tc filter add dev $INTERFACE parent 1: protocol ip prio 1 \
     u32 match ip protocol 17 0xff \
     match ip dport 3478 0xffff flowid 1:10
   sudo tc filter add dev $INTERFACE parent 1: protocol ip prio 1 \
     u32 match ip protocol 17 0xff \
     match ip dport 50000 0xfff0 flowid 1:10

   # Interactive: SSH, RDP
   sudo tc filter add dev $INTERFACE parent 1: protocol ip prio 2 \
     u32 match ip dport 22 0xffff flowid 1:20
   sudo tc filter add dev $INTERFACE parent 1: protocol ip prio 2 \
     u32 match ip dport 3389 0xffff flowid 1:20

   # Interactive: HTTPS (general web)
   sudo tc filter add dev $INTERFACE parent 1: protocol ip prio 3 \
     u32 match ip dport 443 0xffff flowid 1:20

   # Background: Common update ports and large transfers
   # Microsoft Update
   sudo tc filter add dev $INTERFACE parent 1: protocol ip prio 4 \
     u32 match ip dst 13.107.4.50/32 flowid 1:40
   # Ubuntu archive
   sudo tc filter add dev $INTERFACE parent 1: protocol ip prio 4 \
     u32 match ip dst 91.189.88.0/24 flowid 1:40

   # Show class statistics
   tc -s class show dev eth0

   # Expected output shows packets in each class
   # class htb 1:10 rate 204Kbit ceil 409Kbit
   #  Sent 145234 bytes 892 pkt (dropped 0, overlimits 12...)

   # Ensure vnstat daemon runs
   sudo systemctl enable vnstat
   sudo systemctl start vnstat

   # Verify data collection
   vnstat -l -i eth0
   # Shows live traffic for verification

   # Add to monitoring
   tc -s class show dev eth0 | grep -E "(class|Sent)" > /var/log/qos-stats.log

# Measure current consumption (after optimisation)
vnstat -l -i eth0 -s 300

# Compare to baseline recorded before optimisation
# Target: 40-70% reduction in peak bandwidth consumption

squidclient -h localhost mgr:info | grep "Request Hit Ratios"
# Target: >30% hit rate after 1 week of operation
# Target: >40% hit rate after 1 month

# Generate test load
iperf3 -c speedtest.example -t 60 &

# During load, verify voice traffic still prioritised
tc -s class show dev eth0 | grep -A2 "1:10"
# Class 1:10 should show minimal drops

# Measure page load time
curl -o /dev/null -s -w "%{time_total}\n" https://mail.example.org

# Target: <10 seconds for primary applications
# Compare to baseline (often >30 seconds pre-optimisation)

# Export current policies after configuration
Backup-GPO -Name "Low Bandwidth Optimisation" -Path "\\server\share\gpo-backups"

# Import at new location
Import-GPO -BackupGpoName "Low Bandwidth Optimisation" `
  -Path "\\server\share\gpo-backups" `
  -TargetName "Low Bandwidth Optimisation" `
  -CreateIfNeeded