Thank you for your reply.

The idea of placing an inexpensive device in between is not bad, but doesn't resolve my issue.

Which is what follows:

-> a suspect end host activity (e.g. big files downloading) causes abnormal bandwidth usage on the switch port, on which it is physically connected

-> an alert is given by nms (LMS or others)

-> immediate reaction is to remotely and quickly limit bandwidth on that switch port, in order to:

1. limit consequences on the whole network

2. take time to perform further investigations, to understand if the host traffic is legitimate or not.

Then, if traffic is not legitimate, further dispositions could be taken (e.g. an administrative shutdown on the switch port, eventually informing the end user and forbidding some kind of software, and so on).

If traffic is legitimate, then finer traffic filtering and control measures could be put in place (eventually by QoS implementation).

Ah, so the issue is really you want to be able to control any port. For that, you're correct, an inline device won't be a cure. I was thinking more about "known" problem ports and/or uplinks.

Without doing a complete hardware upgrade, on a LAN, due to QoS limitations of most LAN devices, an alternative solution might be better bandwidth ratio management. If a single host can disrupt your network by its bandwidth demand, perhaps you need to be proactive rather than reactive. Change the oversubscription ratios. Normally we think of increasing uplink bandwidths, but decreasing host bandwidth might work too. For instance, if hosts are allowed 100 or gig, drop them back a notch.