Network › Module 8 › Lesson 3
Rate Limits and Capacity You Own
Write the budget for YOUR service before anyone “tests” it — loopback only.
Visual · rate_limits_owned_capacity
Rate limits are policy on YOUR capacity. Never hping3 others.
Opening
A rate limit is a numbered charity: this many requests, this window, then a cheap no.
Defenders who own a service get to decide how generous it is. A rate limit says how many requests a client may spend before the server answers 429 or drops. Timeouts, body-size caps, and concurrency caps are cousins. You write those numbers for code you run. You do not “rate-limit” a neighbor by flooding them until they fall over. Original Cyberlium.
1. Name the budget before you code it
Pick a window (for example 5 seconds) and a max hit count (for example 4) for the teaching helper. Those numbers are arbitrary on purpose: they exist so a few curls can show 200 then 429. They are not a claim about production CDNs.
Write client identity as “this loopback lab treats the world as one bucket.” Real apps might key on authenticated user. Do not pretend your toy is Cloudflare.
2. Cheap reject beats expensive work
A good limiter fails closed and cheap: count, compare, maybe 429, do not start the heavy handler. That is the opposite of “let everyone in, then hope.” It pairs with default-deny thinking from earlier Topic 11 modules without copying those lessons.
You still do not DoS-test a SaaS login form. Their capacity is not yours.
Command guide
Cheap reject beats expensive work
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ COMMANDS ═══
Command — copy this
python3 - << 'PY'
window, max_hits, hits = 5.0, 4, []
def allow(now):
keep = [t for t in hits if now - t < window]
hits[:] = keep
if len(hits) >= max_hits:
return False
hits.append(now)
return True
t = 0.0
for i in range(6):
print("req", i + 1, "allow" if allow(t) else "429", "count", len(hits))
t += 0.2
print("sixth request should show the cheap no — still YOUR math, not a flood")
PY3. Capacity you do not own
Shared NAT, campus Wi-Fi, and public APIs are other people's budgets. Measuring them with floods is an incident. Even “a few” hping3 packets at a stranger is the wrong culture for this academy.
If DEMO was a router, you already STOPPED. Do not “tune QoS” on that admin UI as this lesson.
4. What you ship: a written 429 budget for 127.0.0.1:8787
t11-m08-budget.txt with window, max hits, bind, 429. No flood tools. No production-CDN cosplay. DEMO GATE holds.
5. What you record before the next lesson
Budget file chmod 600. DEMO identified/STOP. Next lab implements it on loopback. NEVER hping3 others.
6. Wrong vs right: stranger networks vs literacy on systems you own
Worked failure — same network word, opposite target. Right never needs a café or campus LAN.
Wrong
Skip the file and “just flood until it dies.” Rate-limit a public API with a botnet joke script. Bind 0.0.0.0 so friends can help you 429.
Right
Write the budget. Keep bind loopback. Next: Lab — Rate-Limit YOUR Loopback Server.
Mission: write YOUR rate-limit budget
1) / STOP if router. 2) Create t11-m08-budget.txt (window, max hits, , 429). 3) Confirm you will not hping3 anyone. Never flood others.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor why 429 should be cheaper than the handler — not how to bypass someone else's WAF.
Knowledge Check
APPLY: Teaching budget says 4 hits / 5 seconds then 429. A fifth curl to YOUR loopback helper should:
Multiple choice
Knowledge Check
APPLY: True or False: You may load-test any website that has a login form because “rate limits are public.”
True or False
Knowledge Check
APPLY: Bind address for the limiter you will run is:
Multiple choice