Trying to segment host-based traffic is difficult in my experience. Instead, if you give each tenant their own IP addresses for applications, you can find programs that will control IP-based bandwidth.
APPENDIX Is your IIS structure one website to manage them all for all tenants and when you log in to the plug in the appropriate database? If this is the case, this can create version problems in that all tenant sites must have exactly the same scheme, and all of them must be updated at the same time when updating the application, so changing the scheme is required.
Another structure that sounds like what you might have is that each tenant has their own website:
tenant1_site/appvirtualdir tenant2_site/appvirtualdir ...
Where appvirtualdir points to the same physical path for all tenant sites. When all clients have the same version of the application, they all use literally the same code. If you have this scenario and some kind of authentication, then you will need one IP address for each tenant due to SSL. SSL will only be bound to IP and port, unlike non-SSL, which will be bound to IP, port and host. If so, then IP-based traffic monitoring will continue to be simpler and more accurate, as can be done on a router or through a network monitor.
Thomas
source share