Here at my university, in the dorms connections have a 24 hour rolling bandwidth quota (updated hourly) of 750mb off campus traffic, which is sufficient for the overwhelming majority of users. Connections are not speed limited up to 750mb of traffic. After the 750mb has been reached, the user is placed into a "Class B" tier of service where connections are limited to 128kbit per flow. If the traffic exceeds 1gb per 24 hour period, users are moved into "Class C" service, which is 512kbit pool for all users in that tier. This system worked very well for us, allowing normal usage but curbing the people that abuse the connection. http://www.lartc.org/ has excellent documentation on how to get a setup like this up and running