What is the best way to implement a rate-limiting algorithm for web requests?

Question

Possible/partial duplicates:

• What’s a good rate limiting algorithm?
• Throttling method calls to M requests in N seconds
• Best way to implement request throttling in ASP.NET MVC?

I am looking for the best way to implement a moving time window rate limiting algorithm for a web application to reduce spam or brute force attacks.

Examples of use would be "Maximum number of failed login attempts from a given IP in the last 5 minutes", "Maximum number of (posts/votes/etc...) in the last N minutes".

I would prefer to use a moving time window algorithm, rather than a hard reset of statistics every X minutes (like twitter api).

This would be for a C#/ASP.Net app.

Answer 1

We found out Token Bucket is better algorithm for this kind of rate-limiting. It's widely used in routers/switches so our operation folks are more familiar with the concept.