From rune.kock at gmail.com  Sat Jul  1 15:26:10 2006
From: rune.kock at gmail.com (Rune Kock)
Date: Sat Jul  1 15:26:02 2006
Subject: [LARTC] why can not turn the bandwidth knob up to 100Mbit
In-Reply-To: <20060628135906.82204.qmail@web15805.mail.cnb.yahoo.com>
References: <20060628135906.82204.qmail@web15805.mail.cnb.yahoo.com>
Message-ID: <fa8654f10607010626g657e18eau4e02ab37263b44f2@mail.gmail.com>

> (using "tc -s class show dev eth1" to list result,if the rate of class 1:21
> is 100Mbit,the result is between 99M and 100M;
> if the rate of class 1:21 is 150Mbit ,the result is between 45M and 50M;)

I wonder if this has something to do with what devik writes on the htb homepage:

<qoute>
Limitation: when you operate with high rates on computer with low
resolution timer you need some minimal burst and cburst to be set for
all classes. Timer resolution on i386 systems is 10ms and 1ms on
Alphas. The minimal burst can be computed as
max_rate*timer_resolution. So that for 10Mbit on plain i386 you needs
burst 12kb.

If you set too small burst you will encounter smaller rate than you
set. Latest tc tool will compute and set the smallest possible burst
when it is not specified.
</quote>
From hijacker at oldum.net  Sat Jul  1 15:53:49 2006
From: hijacker at oldum.net (Nikolay Kichukov)
Date: Sat Jul  1 15:53:43 2006
Subject: [LARTC] Simple Rule to Cap P2P Uploads
In-Reply-To: <20060628165057.19977.qmail@web55701.mail.re3.yahoo.com>
References: <20060628165057.19977.qmail@web55701.mail.re3.yahoo.com>
Message-ID: <1151762030.6342.4.camel@ccja.localhost>

Hi Mathew,
your adsl uplink is 64000 bps, correct?

102400kbps > 64kbps
3kbps != 3KB/sec

Another point, tc syntax is 102400kbit, not 102400kbps(as far as I
tested that).

3KB = 3*8 kbit

Test that and let us know if this helps.

-Nik

On Wed, 2006-06-28 at 09:50 -0700, Mathew Brown wrote:
> Hi,
>   I'm new at traffic control and was reading up on HTB and using it to
> put an upper limit on traffic.  I have a 256k DSL with 64k upload
> (which translates to about 5/6KB uploads).  The machine running the
> P2P applications keeps filling up the 64K so my browsing from other
> machines in the network ends up being very slow.  Since there are
> several P2P applications, I wanted to set the entire upload cap to
> something like 3KB/s so it doesn't disrupt browsing.  However, I would
> also like to ssh and scp from this machine without having an upload
> cap.  The machine has a single interface to the network: eth0.  I
> tried the following tc lines but it appears to affect both the P2P
> traffic and my ssh traffic, resulting in a very slow ssh sessions:
>   
> tc qdisc add dev eth0 root handle 1: htb default 3
> tc class add dev eth0 parent 1: classid 1:1 htb rate 102400kbps ceil
> 102400kbps
> tc class add dev eth0 parent 1:1 classid 1:2 htb rate 102400kbps ceil
> 102400kbps
> tc class add dev eth0 parent 1:1 classid 1:3 htb rate 3kbps ceil 3kbps
> tc filter add dev eth0 protocol ip parent 1:0 prio 1 u32 match ip
> dport 22 0xffff flowid 1:2
> 
> Any ideas?  Thanks for your time.
> 
> 
> ______________________________________________________________________
> Do you Yahoo!?
> Next-gen email? Have it all with the all-new Yahoo! Mail Beta.
> _______________________________________________
> LARTC mailing list
> LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
-- 
?????? ??? ????????, ??? ?????.
?? ?????? ??? ?????, ?? ?????? ??? ????????...
-????? ?????

From hijacker at oldum.net  Sat Jul  1 16:38:38 2006
From: hijacker at oldum.net (Nikolay Kichukov)
Date: Sat Jul  1 16:38:32 2006
Subject: [LARTC] tc ingress policing with multiple subnets
In-Reply-To: <449FD426.7060804@andyfurniss.entadsl.com>
References: <002b01c69130$de91c270$0600a8c0@hpa>
	<449FD426.7060804@andyfurniss.entadsl.com>
Message-ID: <1151764718.6342.19.camel@ccja.localhost>

Hi Andy,
please, have a look at my answers in the text below.


On Mon, 2006-06-26 at 13:33 +0100, Andy Furniss wrote:
> Nikolay Kichukov wrote:
> > Hello everybody on the list,
> > 
> > I have the following situation where  I want to police the speed of 
> > incoming
> > packets from specific subnets to 1024kbps and then police all the rest to
> > 256kbps, which is the speed my ISP grants for the rest of the internet.
> 
> If you are shaping ingress you will need to set a rate below the link 
> speed, or you won't do anything.
> 
How about a rate that matches the link speed? Will 95% of the link be
alright for ingress?

> > 
> > So, eth1 is the one connected to the cable modem and then to the internet.
> > 
> > I do:
> > 
> > tc qdisc add dev eth1 ingress handle ffff:
> > 
> > 
> > then:
> > 
> > tc filter add dev eth1 parent ffff: protocol ip prio 1 u32 match ip src 
> > xx.yy.zz.0/24 police rate 1024kbit burst 10kb drop flowid ffff:
> > tc filter add dev eth1 parent ffff: protocol ip prio 1 u32 match ip src 
> > pp.dd.df.0/23 police rate 1024kbit burst 10kb drop flowid ffff:
> > ...
> > ...
> > and finally:
> > 
> > tc filter add dev eth1 parent ffff: protocol ip prio 2 u32 match ip src 
> > 0.0.0.0/0 police rate 256kbit burst 10kb drop flowid ffff:
> > 
> > 
> > My question is, is there a way I can limit the overall speed of incoming
> > packets from all of those defined subnets to 1024kbps, as it seems in the
> > above scenario that if packets from xx.yy.zz.0/24 subnet arrive at the 
> > speed
> > of 1024kbps, and at the same time packets are arriving from 
> > pp.dd.df.0/23 at
> > 1024kbps the overall would be 2048kbps, which I do not want.
> 
> You can use a shared meter.
> 
> ... police index 1 rate ......
> 
> 
I will read on about the index shared meter. Hope that will do what I
need to achieve.
> > 
> > Any comments or suggestions on this topic are welcomed.
> > 
> > Another question I have is, what is the difference of the burst/buffer 
> > being 10kb or 90kb for example? What difference would that make?
> 
> The detailed behaviour probably depends on rate estimators in kernel config.
> 
> Roughly the burst/buffer is a virtual buffer that when full will cause 
> further packets to be dropped until it has drained enough over time to 
> pass them again.
> 
So a buffer of 10kbytes will allow first 10kbytes to flow at the rate of
the line and the next packets be shaped at the filter rate?

example:
tc filter add dev eth1 parent ffff: protocol ip prio 2 u32 match ip src
0.0.0.0/0 police rate 256kbit burst 10kb drop flowid ffff:

if line speed is 512 kbit, the first downloaded 10kbytes will travel at
512kbit, and the packets afterwards will flow at the speed of 256kbit.

Is that kind of correct?

> If you are shaping ingress at near link speed I think smaller is better 
> - if you are shaping well below link speed like 1meg/100 then you can 
> use a bigger buffer.
> 
> Andy.
> 
I think I got that. 
Regards,
-nik

-- 
?????? ??? ????????, ??? ?????.
?? ?????? ??? ?????, ?? ?????? ??? ????????...
-????? ?????

From posuna at ehas.org  Sat Jul  1 17:42:40 2006
From: posuna at ehas.org (Pablo Osuna)
Date: Sat Jul  1 17:42:33 2006
Subject: [LARTC] How to priorize VoIP in a Wi-Fi scenario? Default qdisc in
	Linux, PRIO, HTB and HFSC ...
Message-ID: <1151768560.5095.75.camel@localhost.localdomain>

Hi all,

Long email but please be patient :)

I am part of EHAS [1], a non profit organization which main goal is to
improve the Healthcare assistance in isolated rural areas in developing
countries.
Recently we have developed a long distance Wi-Fi network in Cuzco
(Peru). This network provides connectivity to 12 nodes (they are in fact
Health Centers). As VoIP is a essential service in this scenario we have
setup a software PBX (Asterisk). Also nodes can browse through Internet
and we probably add video service (by WebCams) in the future. So we have
three services, in order of priority: VoIP, video and data.

As we want to priorize Voice and Video I have been studying in the last
month how to do that with Linux. After reading lot of documentation [2]
[3] [4], I have setup a testbed with a chain of 3 nodes in the
laboratory. Using iperf I inject TCP traffic and every 20s a different
flow of UDP traffic (to simulate VoIP, video and noise). I process the
logs and get graphs from them:

nodeA <--(channel1)--> nodeB <--(channel6)--> nodeC

- 0-80s: TCP
- 20-80s: TCP + UDP (voice)
- 40-80s: TCP + UDP (voice) + UDP (video)
- 60-80s: TCP + UDP (voice) + UDP (video) + UDP (noise)

Basically I wanted to test which is the best qdisc to do this. I have
setup two schemes:

1) One using PRIO as the main qdisc and some leaf classes as RED, SFQ
and short pfifo queues.
2) And the second scheme uses HTB as the main qdisc with the same kind
of leaf classes.

And now some conclusions and questions:

--- PRIO ---

My concern is that I am getting very similar results when I setup PRIO
and when I setup default qdisc (actually without doing nothing). PRIO
setup is:

tc qdisc add dev wlan0 root handle 1: prio

tc filter add dev wlan0 parent 1:0 prio 1 protocol ip u32 match ip tos
0xa0 0xff flowid 1:1
tc filter add dev wlan0 parent 1:0 prio 2 protocol ip u32 match ip tos
0x60 0xff flowid 1:2
tc filter add dev wlan0 parent 1:0 prio 3 protocol ip u32 match ip tos
0x00 0xff flowid 1:3

tc qdisc add dev wlan0 parent 1:1 sfq perturb 10
tc qdisc add dev wlan0 parent 1:2 sfq perturb 10
tc qdisc add dev wlan0 parent 1:3 sfq perturb 10

VoIP traffic is marked with 0x0a and Video traffic with 0x60. The thing
is that voice and video get the same throughput as UDP noise (TCP get
nothing as it was expected). I expected to see VoIP beating video, and
video beating noise but I saw these 3 flows getting the same throughput,
as default behaviour. Can someone tell me what is the default qdisc
running in Linux? I have read somewhere that the default qdisc was pfifo
with 3 children. Maybe the default qdisc is in fact very similar to PRIO
qdisc???

--- HTB ---

With HTB I am getting much nicer results and I can see the difference
among that and doing nothing. But there is a problem with this qdisc as
it has been said in this list before: 
Lets presume we have 1Mbps of total throughput in the wireless links.
When I reduce the speed of the wireless links to 0.5Mbps (that can be
very normal in a real wireless scenario) and keep the HTB with same
parameters from 1Mbps test, the results get much worse. I read that HTB
root has to be the bottleneck but never understood well why ... can
someone explain me that?

--- HFSC ---

I have read the English translation [4] (thanks Martin Brown!) but still
do not get the whole idea behind this qdisc. Could it be a solution for
unstable networks (in terms of variable bandwidth) as WiFi networks are?
After reading [5] I have changed our HTB setup to a HFSC setup:

First my HTB setup:

tc qdisc add dev wlan0 root handle 1:0 htb
tc class add dev wlan0 parent 1:0 classid 1:1 htb rate 0.95Mbit

tc class add dev wlan0 parent 1:1 classid 1:2 htb rate 0.7Mbit ceil
0.95Mbit prio 0
tc class add dev wlan0 parent 1:1 classid 1:3 htb rate 0.29Mbit ceil
0.95Mbit prio 1
tc class add dev wlan0 parent 1:1 classid 1:4 htb rate 0.01Mbit ceil
0.95Mbit prio 2

tc qdisc add dev wlan0 parent 1:2 sfq perturb 10
tc qdisc add dev wlan0 parent 1:3 sfq perturb 10
tc qdisc add dev wlan0 parent 1:4 sfq perturb 10

tc filter add dev wlan0 parent 1:0 prio 1 protocol ip u32 match ip tos
0xa0 0xff flowid 1:2
tc filter add dev wlan0 parent 1:0 prio 2 protocol ip u32 match ip tos
0x60 0xff flowid 1:3
tc filter add dev wlan0 parent 1:0 prio 3 protocol ip u32 match ip tos
0x00 0xff flowid 1:4

And now my HFSC setup:

tc qdisc add dev $INTWIRELESS root handle 1:0 hfsc

tc class add dev $INTWIRELESS parent 1:0 classid 1:1 hfsc sc rate
0.95Mbit ul rate 0.95Mbit

tc class add dev $INTWIRELESS parent 1:1 classid 1:2 hfsc sc rate
0.7Mbit ul rate 0.95Mbit

tc class add dev $INTWIRELESS parent 1:1 classid 1:3 hfsc sc rate
0.29Mbit ul rate 0.95Mbit

tc class add dev wlan0 parent 1:1 classid 1:4 hfsc sc rate 0.01Mbit ul
rate 0.95Mbit

tc qdisc add dev wlan0 parent 1:2 sfq perturb 10
tc qdisc add dev wlan0 parent 1:3 sfq perturb 10
tc qdisc add dev wlan0 parent 1:4 sfq perturb 10

tc filter add dev wlan0 parent 1:0 prio 1 protocol ip u32 match ip tos
0xa0 0xff flowid 1:2
tc filter add dev wlan0 parent 1:0 prio 2 protocol ip u32 match ip tos
0x60 0xff flowid 1:3
tc filter add dev wlan0 parent 1:0 prio 3 protocol ip u32 match ip tos
0x00 0xff flowid 1:4

The problem is that when I activate HFSC I lose the wireless connection
between the nodes so probably I am doing something wrong. I know I am
missing some HFSC parameters as dmax and umax but I do not know very
well how to setup them. 
In case of saturation I just want to have VoIP with 70% of the
resources, video with 29% and data with 1%. In case of no saturation I
would like borrowing among them. Please, can someone tell me a nice HSFC
setup to get this?

On the other hand iperf probably is not the best tool but it is the only
one I have tested. If someone has any other recommendation it is more
than welcome :)

Well, this was my first email to the list. Hope I am lucky and get some
answers to my questions. I will keep doing tests and will post more
results here.

Regards:

Pablo

[1] http://www.ehas.org/index_html?set_language=en&cl=en
[2] http://www.opalsoft.net/qos/DS.htm
[3] http://lartc.org/
[4] http://linux-ip.net/tc/hfsc.en/
[5] http://mailman.ds9a.nl/pipermail/lartc/2006q2/018865.html


From proclus at gnu-darwin.org  Sat Jul  1 20:04:09 2006
From: proclus at gnu-darwin.org (proclus@gnu-darwin.org)
Date: Sat Jul  1 20:04:22 2006
Subject: [LARTC] FOSS, Science, and Public activism
Message-ID: <20060701180409.6D3EB6B0FE8@gnu-darwin.org>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

(Sorry if you get more than one copy of this message, but I felt
that it was urgent to get this important info out.)

The values of freedom and openness are crucial to understanding 
itself, so that civilization and public welfare now depend on 
them, as I argue below.  These values may find their best 
expression in the free and open source software (FOSS) movement, 
and the foresightful example of FOSS developers should now be
beneficially applied to many other disciplines in the context of a
global and public Internet.

It is crucial that we occasionally take time to discuss the
reasons _why_ we release our source code, and this is one of 
those occasions.  There are good reasons for the freedom and
openness which are characteristics of FOSS development, reasons
which should receive wider attention now that they can be readily
communicated to other arenas.  The consequences of doing otherwise
are often catastrophic.

For example, it incomprehensible that Genentech could consider
withdrawing a cheap cure for blindness (ARMD) from the market.

http://lists.essential.org/pipermail/random-bits/2006-june/001374.html

The mechanism of this drug is public knowledge.

http://sourceforge.net/mailarchive/forum.php?thread_id=14183567&forum_id=6042

This abhorrent situation is a great example of the kind of thing
that will happen if people don't get behind the values of freedom
and openness that we are espousing.  Please let Genentech know
that you find what they are doing offensive.  Publicize the mechanism
so that new compounds can be obtained as replacements.  For the 
future, continued vociferous public activism is required to prevent
such outrages from occurring in the future.

It becomes clear that the compounds which come from common roots,
fruits, and vegetables are a shared human heritage and the free and
open source of the future.  Tannins are another interesting case in
point, because as molecules, and as anti-oxidents, they are similar to
resveratrol (resV), and that molecular mechanism has been anchored to
the public domain via a prior art declaration.  It is a so-called
CR-memetic, which may increase healthy human longevity by many
decades.  Here are some links about it.

Resveratrol mechanism posts from GNU-Darwin list
http://proclus.gnu-darwin.org/gdposts.html

CR protocol for human bodies
http://proclus.gnu-darwin.org/bootstrap.html

Here is some important recent news about it.

http://www.imminst.org/forum/index.php?s=&act=print&client=printer&f=237&t=10749

It is exciting to suppose that people can get off the pharmaceuticals
that they are taking with calorie restriction or CR-memetics.  I
personally am trying to get off the cholesterol drug Pravachol, a
statin compound, starting a few of weeks ago.  Write me, and I'll let
you know how it turns out.  From the article...

"Fontana says ...  evidence of "younger" hearts in people on calorie
restriction, suggest that humans on CR have the same adaptive
responses as did animals whose rates of aging were slowed by CR."

I think that it is time to look at the tannins in tobacco leaves.  
There may be other treasures lurking there too.  As you may be
aware there is ample public research into any possible beneficial
compounds that may be obtained from tobacco leaves.  The mechanisms
are there waiting to be discovered.  If you want to post them, just
reply to me and I'd be delighted to host them.

The public establishment of prior art is a time-honed method of
entering inventions into the public domain.  We now have other
methods at our disposal as well.   If you are planning to establish
prior art against future CR-memetic related patents, you might want
to have a look at www.creativecommons.org.  Perhaps it goes without
saying at this point that you should please choose a license that
provides for free and broad public access to your memetic.

In that way you will assure that the public health is served by 
anchoring them to the public common, where they cannot be exploited
by those who would withhold them for their own profit.  The DRM 
situation is precisely analogous to this.  Can you imagine doing
science in a world where your ability to read and write your data is
filtered through secret protocols that are hidden from you? I
recommend the Defective By Design campaign to fight the outrage of
DRM, which is incompatible with the scientific pursuit.

http://www.defectivebydesign.org/

It is clear that scientific tools must be demonstrably and
penetratingly understood, or else our claims will likely be skewed
and called into question.  Free and open source software is
a great example of how to make your science verifiable to the
public.  Establishing prior art against future patents is 
another good one, which is precisely analogous in method, 
making the result explicit to the public, free and open to all.
Thank goodness for the free and open software movement, which
gave us such a great example of how to serve the public in this
manner.

I am willing to grant that there are particular exceptions to
these rules of freedom and openness, and such exceptions may be
relatively harmless; however, let us posit the opposite, that
freedom and openness are _not_ crucial to understanding.  Think of
the implications.  When people are compelled to learn, they do not
receive the intended message.  It is not understood correctly
or completely.   When crucial facts are withheld from the people
you are trying to teach they become paranoid, possibly unteachable. 
Freedom and openness are obviously the best approach to understanding.

This is not a metaphor for the pursuit of science, but a fact. 
We are learning from nature, and it is ultimately required that
our tools be demonstrably and penetratingly understood, or else
we will receive incorrect lessons from nature.  Clearly this
requires public access to the source code and more.  This 
is why many of us are pressing for public access to scientific
publications.

Moreover FOSS tools are becoming ever more important to the
pursuit of the scientific endeavor itself.  In our biophysics
department we are obsolescing proprietary hardware and software
in favor of open standards and free software, which is a
widespread phenomenon in the science sector, and sure to continue.
We build most of the workstations ourselves with commodity hardware,
but we also have some clusters running Debian and FedoraCore.

Some of you will know that I am the lead developer for the
GNU-Darwin distribution.  GNU-Darwin has a FOSS operating system,
which is getting alot of press these days.  Here is an example

How Apple and Microsoft are advancing desktop Linux
http://www.desktopLinux.com/news/ns7294331817.html

I see the article as counter-productive against building a FOSS
coalition that includes democracy, freedom, and public access 
activists, Apple, GNU-Darwin, GNU, and GNU/Linux all linked
together in spectrum.

It is important to alert the whole FOSS community that Darwin
cannot be classified as a free or open source operation system
as of the Darwin-8 revision, because AppleACPIplatform-39 which
is required to boot the system is proprietary.  It is notable that
only the current version of Darwin from Apple is a non-free OS.
GNU-Darwin has a free version, an earlier revision that includes
the source code.  It is FOSS, and we call upon Apple to maintain
Darwin as such, as it has been in the past.  We hope that the
current situation with the kernel and ACPI driver will soon be
remedied so that Darwin will continue as a FOSS OS.

We are asking for free software developers to please write to the
*nix core of Darwin, which is the core OS for both Mac OS X and
GNU-Darwin OS.  Darwin OS, which underlies both systems, comprises
parts from GNU, the BSD's, mach, plus Apple's substantial
contributions to the free software community.  Be consistent with your
philosophy and avoid linkage to proprietary binaries, such as OpenGL
and CoreAudio, except when it is imperatively required in order to
lead users to the values of software freedom.  Under that principle,
another reason to maintain compatibility with the *nix core, is so
that your code will be readily portable to new platforms and usable
by free-software-only aficionados too.  

GNU-Darwin OS is not an obsolete implementation of Darwin OS, or to be
superseded by Mac OS X.  We are trying to lead users to freedom, not
away from it.  By maintaining Darwin core compatibility your code will
remain valuable as the marketplace and industry continues to evolve
(trust me here), particularly as DRM-related problems continue to come
forward. Of course, that means releasing your source code under a FOSS
license, such as APSL.  Darwin OS is a free and open source operating
system that is not going away, so try to focus your coding towards
supporting that standard instead of proprietary software.

Here is the essence of the current problem with Darwin OS.  Apple
replaced working boot code with the following proprietary drivers, 
which are required for the system to boot.

Darwin-7:
AppleAPIC.kext/
Applei386genericplatform.kext/

Darwin-8:
AppleACPIplatform

In addition the kernel (xnu) has been taken proprietary in the
recent revisions.  We are not asking for Apple to give away such
things, but rather to continue maintaining Darwin OS as FOSS, which
it already was. 

After repeated attempts by many FOSS developers to get this
situation remedied, nothing has happened.  It is now time for us to
better use the measures at our disposal in order to assure that
Darwin OS remains free and open.  If you are unhappy that xnu and 
the boot drivers have not been released, I would encourage you to
spread your dissatisfaction to other forums, so that Apple will take
notice and commit to a workable free and open Darwin OS from now on.  

Moving on to coalition strategy now, some of you may not know that
GNU/Linux system administration is one of my day jobs.  I manage a
wide range of systems.  Here is a screen-shot of my work desktop, so
that you can see I use the same tools at work that I use at home at
night on GNU-Darwin.  (weekends too, so please read I am your friend)

http://proclus.gnu-darwin.org/debian.html

The only time that I ever use proprietary software is when I am trying
to help other users learn free and open source free software.  I'm a 
long time Apple and GNU/Linux user, and here is the old proof doc ;-}.

http://proclus.tripod.com/indulge.html

Now, it is embarrassing but, I want you to have a look at my cv.

http://biophysics.med.jhmi.edu/love/thesis/cv6.html

In all my years I have never used Microsoft Windows.  There are only
two exceptions to this statement, where I was helping Windows users to
access our servers at Hopkins.  Clearly, you can get a few things done
without it ;-}.

One of the primary reasons for founding GNU-Darwin was to help people
to put Microsoft behind them,  and it is definitely possible to do it
now.  You have many resources at your disposal to help you leave
Microsoft behind.  Look at the link below to see what you can do
with free software.  Apple, GNU-Darwin, GNU.org, and GNU/Linux will
all help, and we are largely all helping together, because we have a
shared foundation of free software.

http://www.gnu-darwin.org/gdc/

Microsoft is only one example.  That is why we are so insistent that
Apple keep true to free and open source software principles.  We
should ultimately try to leave all proprietary software behind us, so
that we can participate fully in the freedom and openness of the
internet culture and public domain.  What more do we need, when we
have such a rich store of information and so many capable people at
our sides?

Finally, as a scientist, it is obvious to me that this situation is
relevant current and ongoing discussion in the scientific community,
and as such, it is also clear that many members of the various lists
would be interested in the current state of Darwin with respect to
FOSS and with respect to science.  

Here is the crucial point.

The principles of FOSS and scientific inquiry converge.  In
practical terms, how else can you know is what happening in your
experiments?  Free and open source software, open standards, best
promote the scientific endeavor by mirroring its method, but also
they assure that the work is accessible to the public.

Freedom and openness are crucial to understanding, and foundational
to the scientific endeavor, and they should not be compromised. 
There are a few examples of exceptions, but clearly, this matter
will find further debate in the appropriate forums.  We should not
quell debate because a few people are offended or complaining.  
- From a scientific perspective that would be incorrect.

On that last point, I would suggest that Apple get on the right side
of the debate, and they will make tremendous headway.  Now is the
time.

Some people will find this message annoying and divisive, and the
delete button is ready at hand for them, but other people will find 
it interesting and engaging.  All as you like.  Let us not quell
discussion because a few people are annoyed.

Some will call this a troll, but I hope that folks will see through
such name-calling.  Trolls are mythological creatures, so don't
believe in them.  Everyone has a right to have their opinion
heard, even if those opinions are divisive or unpopular.  It is
clear that the idea of trolls is being used to attack freedom of
expression.  In fact, freedom of expression demands that we
listen to the so-called-trolls sometimes, and if you are civil, it
helps, so don't resort to name-calling. 

On cross-posting; when there are matters of urgent importance that
affect a broad range of subscriber lists, courtesy must sometimes
take a back seat, and cross-posting is an example of that. 
Cross-posting is to be encouraged when the subject of the post is on
topic.  Each of the various lists will respond in the way that seems
appropriate to the people in that forum, and the threads on the
various lists will diverge accordingly.  As the threads diverge, the
cross-posting addresses should be removed as needed.  Relevance to
all people is an unattainable goal, but messages of the broadest
applicability should have the broadest reach, and discussion should
not be stymied because some find it irrelevant.  I have given this
method due consideration; it is not trolling, not spam, not off-topic,
and cross-posting is an example of something that is sometimes
required according to the felt importance and relevance of a given
subject matter.  

In summary, Freedom and openness are now the bedrock of our
civilization and public welfare depends on these values, so that we 
should actively engage ourselves in preserving and making them happen.
In keeping with these principles it is crucial to note that there are
exceptions to etiquette, otherwise free expression will be overly
channeled, damped, and ultimately suppressed in our forums.  This
notion of courtesy will certainly receive additional consideration,
but meanwhile, let us together get to work on the activism now.  

Duly, I am amenable to valid criticism and able to respond, but please
reply with kindness.  Obviously, feel free to write back, copy, or
send these comments along to anyone else as you see fit.

Regards,
Michael L. Love Ph.D
Department of Biophysics and Biophysical Chemistry
School of Medicine
Johns Hopkins University
725 N. Wolfe Street
Room 608B WBSB
Baltimore MD 21205-2185

Interoffice Mail: 608B WBSB, SoM

office: 410-614-2267
lab:    410-614-3179
fax:    410-502-6910
cell:   443-824-3451
http://www.gnu-darwin.org/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (Darwin)

iD8DBQFEpIl6u0oI3iz5oZcRAtpQAJ9X7D6kq1vmWKXkG/3LBvx3gGrK1QCZAbgI
8Ww6QABLiZtmFmS9Ekea5nI=
=a0Oy
-----END PGP SIGNATURE-----
From wlagmay at yanbulink.net  Sun Jul  2 13:33:02 2006
From: wlagmay at yanbulink.net (Wennie V. Lagmay)
Date: Sun Jul  2 13:32:58 2006
Subject: [LARTC] private to public IP
Message-ID: <002c01c69dcb$475c96d0$7819a8c0@MYNOTEBOOK>

Hi all,
I want to create a log on Iptables wherein to store and to identify which 
private Ip is connected on public Ip on a certain date and time. Can you 
help me on this

Thanks,

Wennie 

From rajeshmahajan09 at gmail.com  Sun Jul  2 21:31:22 2006
From: rajeshmahajan09 at gmail.com (Rajesh Mahajan)
Date: Sun Jul  2 21:31:13 2006
Subject: [LARTC] IFB working
Message-ID: <c9961d450607021231x511d238brb5f3feffbaa580b6@mail.gmail.com>

How to use IFB as replacement of IMQ

There is not much documentation about it
Please explain with example

-- 
Failure seldom stops you. What stops you is the fear of failure.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060703/60c971fd/attachment.htm
From rune.kock at gmail.com  Sun Jul  2 22:53:46 2006
From: rune.kock at gmail.com (Rune Kock)
Date: Sun Jul  2 22:53:36 2006
Subject: [LARTC] IFB working
In-Reply-To: <c9961d450607021231x511d238brb5f3feffbaa580b6@mail.gmail.com>
References: <c9961d450607021231x511d238brb5f3feffbaa580b6@mail.gmail.com>
Message-ID: <fa8654f10607021353m6f2a4f6craca762781d528df8@mail.gmail.com>

> How to use IFB as replacement of IMQ
>
> There is not much documentation about it
> Please explain with example

This is the docs that I have been able to find.

http://linux-net.osdl.org/index.php/IFB
http://marc.theaimsgroup.com/?l=linux-netdev&m=110712327422706&w=2
http://www.mail-archive.com/netdev@vger.kernel.org/msg04846.html
http://www.mail-archive.com/netdev@vger.kernel.org/msg04847.html
http://www.mail-archive.com/netdev@vger.kernel.org/msg04900.html
http://www.mail-archive.com/netdev@vger.kernel.org/msg04901.html


Rune
From alex at samad.com.au  Mon Jul  3 00:35:14 2006
From: alex at samad.com.au (Alexander Samad)
Date: Mon Jul  3 00:35:07 2006
Subject: [LARTC] private to public IP
In-Reply-To: <002c01c69dcb$475c96d0$7819a8c0@MYNOTEBOOK>
References: <002c01c69dcb$475c96d0$7819a8c0@MYNOTEBOOK>
Message-ID: <20060702223514.GC1743@hufpuf.lan1.hme1.samad.com.au>

On Sun, Jul 02, 2006 at 02:33:02PM +0300, Wennie V. Lagmay wrote:
> Hi all,
> I want to create a log on Iptables wherein to store and to identify which 
> private Ip is connected on public Ip on a certain date and time. Can you 
> help me on this

tcpdump
> 
> Thanks,
> 
> Wennie 
> 
> _______________________________________________
> LARTC mailing list
> LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
> 
From kajtek at biezanow.net  Mon Jul  3 00:46:21 2006
From: kajtek at biezanow.net (Kajetan Staszkiewicz)
Date: Mon Jul  3 00:46:19 2006
Subject: [LARTC] private to public IP
In-Reply-To: <002c01c69dcb$475c96d0$7819a8c0@MYNOTEBOOK>
References: <002c01c69dcb$475c96d0$7819a8c0@MYNOTEBOOK>
Message-ID: <200607030046.25194.kajtek@biezanow.net>

Dnia niedziela, 2 lipca 2006 13:33, Wennie V. Lagmay napisa?(a): 

> I want to create a log on Iptables wherein to store and to identify which
> private Ip is connected on public Ip on a certain date and time. Can you
> help me on this

Maybe ulog?

-- 
| pozdrawiam / greetings | powered by Trustix, Gentoo and FreeBSD   |
|  Kajetan Staszkiewicz  | jabber,email,www: vegeta()tuxpowered net |
|        Vegeta          | IMQ devnames: http://www.tuxpowered.net  |
`------------------------^------------------------------------------'
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url : http://mailman.ds9a.nl/pipermail/lartc/attachments/20060703/0d5ad3c5/attachment.pgp
From rajeshmahajan09 at gmail.com  Mon Jul  3 05:37:56 2006
From: rajeshmahajan09 at gmail.com (Rajesh Mahajan)
Date: Mon Jul  3 05:37:45 2006
Subject: [LARTC] IFB working
In-Reply-To: <fa8654f10607021353m6f2a4f6craca762781d528df8@mail.gmail.com>
References: <c9961d450607021231x511d238brb5f3feffbaa580b6@mail.gmail.com>
	<fa8654f10607021353m6f2a4f6craca762781d528df8@mail.gmail.com>
Message-ID: <c9961d450607022037x70bfd255s7c367ab14d610ce2@mail.gmail.com>

All these documents have one line

action mirred egress redirect dev dummy0

what I can understand out of this is that all packets in egress of device
are being redirected to dummy0, where as the need is to inject dummy 0 with
packets in ingress of the device so that shaping can be done for packets
storming in for our system and not the packets leaving our system.
Policing can be done but here the requirement is for Shaping (queueing).
With IMQ ingress shaping does work fine but the only question I have is how
to shape packets coming in ingress of the device

I am enclosing my sample script suggest any changes that I can make to
achieve the results.

IP ADDRESS on which shaping needs to be done 10.1.1.15 (host running the
script)
IP ADDRESS from which packets are coming in ingress of eth0 which needs to
be shaped: 10.1.1.100

Let me know the modifications required so that I am able to shape pakets
destined for my system (10.1.1.15).


kernel version: 2.6.16-2-686
iproute2 version: iproute2-ss060323
OS: Debian

#!/bin/bash
export TC="/sbin/tc"

$TC qdisc del dev ifb0 root
$TC qdisc add dev ifb0 root handle 1: htb default 2

$TC class add dev ifb0 parent 1: classid 1:2 htb rate 10Kbit ceil 12Kbit

$TC filter add dev ifb0 parent 1: protocol ip prio 2 u32 match ip src
10.1.1.100/32 flowid 1:2

ifconfig ifb0 up
$TC qdisc del dev eth0 root handle 1: htb default 2
$TC qdisc add dev eth0 root handle 1: htb default 2

$TC class add dev eth0 parent 1: classid 1:2 htb rate 10Kbit ceil 16Kbit

$TC filter add dev eth0 parent 1: protocol ip prio 1 u32 match ip src
10.1.1.100/32 flowid 1:2 action mirred egress redirect dev ifb0



Thanks in advance :)


On 7/3/06, Rune Kock <rune.kock@gmail.com> wrote:
>
> > How to use IFB as replacement of IMQ
> >
> > There is not much documentation about it
> > Please explain with example
>
> This is the docs that I have been able to find.
>
> http://linux-net.osdl.org/index.php/IFB
> http://marc.theaimsgroup.com/?l=linux-netdev&m=110712327422706&w=2
> http://www.mail-archive.com/netdev@vger.kernel.org/msg04846.html
> http://www.mail-archive.com/netdev@vger.kernel.org/msg04847.html
> http://www.mail-archive.com/netdev@vger.kernel.org/msg04900.html
> http://www.mail-archive.com/netdev@vger.kernel.org/msg04901.html
>
>
> Rune
>



-- 
Failure seldom stops you. What stops you is the fear of failure.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060703/4d2045cd/attachment.htm
From vvitkov at gmail.com  Mon Jul  3 13:19:17 2006
From: vvitkov at gmail.com (Vladimir Vitkov)
Date: Mon Jul  3 13:19:12 2006
Subject: [LARTC] routing speciffic traffic over speciffic ISP
Message-ID: <bc7208f80607030419i1a2af924gaa304e4f23bbfdaa@mail.gmail.com>

Hi list,

i have the following situ

2 ISP's one internal network.
Load Balancing between the ISP's (with mpath)

I want to route speciffic traffic over only one of the ISP's more
specifficaly the ICQ traffic

i have the following configs

iptables -t mangle -A PREROUTING -p tcp --dport 5190 -j MARK --set-mark 0x5190

ip ru a from xxx.xxx.xxx.xxx prio 201 t isp_rules1
ip ru a fwmark 0x1 prio 301 lookup isp_rules1

ip ru a fwmark 0x5190 table isp_rules1

question: Is this correct because it is causing more problems than
before it was employed?

Is the sequence ok i.e. mark the needed traffic, then add a rule
somewhere to direct it over one of the isps.

thanks in advance

-- 
? ????????,
???????? ??????

http://www.netsecad.com
http://www.supportbg.com
From martin at linux-ip.net  Mon Jul  3 17:15:19 2006
From: martin at linux-ip.net (Martin A. Brown)
Date: Mon Jul  3 17:15:20 2006
Subject: [LARTC] Advanced routing routing table limits and rule design
In-Reply-To: <Pine.LNX.4.63.0606301411360.30090@solidus.wonderfrog.net>
References: <44A55B87.3060101@positivenetworks.net>
	<Pine.LNX.4.63.0606301411360.30090@solidus.wonderfrog.net>
Message-ID: <Pine.LNX.4.63.0607031005160.30288@solidus.wonderfrog.net>


Good morning LARTC and, specifically, Wayne,

 :  : I am trying to determine how to best increase the number of 
 :  : routing tables available in linux 2.6 to more than 255. 
 : 
 : You are in good company.  The question seems to come up with some 
 : frequency [0]...I'm beginning to think that it needs to be an 
 : FAQ.

Perhaps this will no longer be an FAQ.  Since I just answered this 
question late last week, and my answer is now "wrong", I thought I 
would post a followup message.

 : Sadly, I haven't heard of anybody yet having done this, although 
 : one of the key developers of the kernel VLAN code (Ben Greear) 
 : has recently requested development on this point [1].

Just today, Patrick McHardy has posted a set of patches [0] [1] 
which accommodate the desire for more routing tables.

Good luck and enjoy!

-Martin

 [0] http://marc.theaimsgroup.com/?t=115191334700002&r=1&w=2
 [1] http://marc.theaimsgroup.com/?l=linux-netdev&m=115191325909208&w=2
     http://marc.theaimsgroup.com/?l=linux-netdev&m=115191325901440&w=2
     http://marc.theaimsgroup.com/?l=linux-netdev&m=115191326012390&w=2
     http://marc.theaimsgroup.com/?l=linux-netdev&m=115191325901420&w=2
     http://marc.theaimsgroup.com/?l=linux-netdev&m=115191325911007&w=2

-- 
Martin A. Brown
http://linux-ip.net/
From e1605project at hotmail.com  Mon Jul  3 20:21:44 2006
From: e1605project at hotmail.com (*~ r a K u ~ *)
Date: Mon Jul  3 20:21:35 2006
Subject: [LARTC] Can i attach another qdisc under classes or root qdisc?
In-Reply-To: <Pine.LNX.4.63.0606290825150.30090@solidus.wonderfrog.net>
Message-ID: <BAY123-F9CA5296249852FDFB6D64DD700@phx.gbl>

An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060704/433a7a07/attachment.html
From thiago at vinhas.org  Tue Jul  4 04:27:55 2006
From: thiago at vinhas.org (Thiago Vinhas)
Date: Tue Jul  4 04:24:42 2006
Subject: [LARTC] multipath routing question
Message-ID: <200607032327.55816.thiago@vinhas.org>

Hi,

I was reading some old posts on this list, and found this post 
(http://mailman.ds9a.nl/pipermail/lartc/2005q1/014963.html) with a link for a 
ip route script that is basically what I need.

My question is: when adding ip route rules, should I remove the traditional 
default gateway of my linux router?

Regards,
Thiago Vinhas
From timathewbrown at yahoo.com  Tue Jul  4 15:30:59 2006
From: timathewbrown at yahoo.com (Mathew Brown)
Date: Tue Jul  4 15:30:52 2006
Subject: [LARTC] Simple Rule to Cap P2P Uploads
In-Reply-To: <1151762030.6342.4.camel@ccja.localhost>
Message-ID: <20060704133059.94157.qmail@web55704.mail.re3.yahoo.com>

Thanks for your reply Nikolay.  I feel my first post was somewhat unclear.  I hope the following information clears things up a little more:

1) The machine that I am trying to run do tc on has a single interface that connects it to the the rest of the network.

2) I sometimes have to ssh and scp files from that machine.

3) The machine runs various P2P applications.  I don't want the sum of their uploads to exceed 3 KB/s.

4) As you mentioned, my ADSL uplink is 64000 bps

5) The machine that I have tc running on and the machine with the P2P uploads are the same machine.

Thanks for your comments.  I'll try to check out the kbps vs. kbits.  But is the idea of what I'm trying to do now more clear?

Nikolay Kichukov <hijacker@oldum.net> wrote: Hi Mathew,
your adsl uplink is 64000 bps, correct?

102400kbps > 64kbps
3kbps != 3KB/sec

Another point, tc syntax is 102400kbit, not 102400kbps(as far as I
tested that).

3KB = 3*8 kbit

Test that and let us know if this helps.

-Nik

On Wed, 2006-06-28 at 09:50 -0700, Mathew Brown wrote:
> Hi,
>   I'm new at traffic control and was reading up on HTB and using it to
> put an upper limit on traffic.  I have a 256k DSL with 64k upload
> (which translates to about 5/6KB uploads).  The machine running the
> P2P applications keeps filling up the 64K so my browsing from other
> machines in the network ends up being very slow.  Since there are
> several P2P applications, I wanted to set the entire upload cap to
> something like 3KB/s so it doesn't disrupt browsing.  However, I would
> also like to ssh and scp from this machine without having an upload
> cap.  The machine has a single interface to the network: eth0.  I
> tried the following tc lines but it appears to affect both the P2P
> traffic and my ssh traffic, resulting in a very slow ssh sessions:
>   
> tc qdisc add dev eth0 root handle 1: htb default 3
> tc class add dev eth0 parent 1: classid 1:1 htb rate 102400kbps ceil
> 102400kbps
> tc class add dev eth0 parent 1:1 classid 1:2 htb rate 102400kbps ceil
> 102400kbps
> tc class add dev eth0 parent 1:1 classid 1:3 htb rate 3kbps ceil 3kbps
> tc filter add dev eth0 protocol ip parent 1:0 prio 1 u32 match ip
> dport 22 0xffff flowid 1:2
> 
> Any ideas?  Thanks for your time.
> 
> 
> ______________________________________________________________________
> Do you Yahoo!?
> Next-gen email? Have it all with the all-new Yahoo! Mail Beta.
> _______________________________________________
> LARTC mailing list
> LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
-- 
?????????????????? ????????? ????????????????????????, ????????? ???????????????.
?????? ?????????????????? ????????? ???????????????, ?????? ?????????????????? ????????? ????????????????????????...
-??????????????? ???????????????



 		
---------------------------------
Yahoo! Music Unlimited - Access over 1 million songs.Try it free. 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060704/a69eb14e/attachment.htm
From abhishekm at cdac.in  Wed Jul  5 11:04:38 2006
From: abhishekm at cdac.in (Abhishek Misra)
Date: Wed Jul  5 11:04:38 2006
Subject: [LARTC] wifi network performance is degrading with iproute2
Message-ID: <twig.1152090278.5493@cdac.in>


Hello,

I used iproute2 to do iif specific routing on wifi routers with 2 wifi
802.11b interfaces on non overlapping interfaces.

I set rule as follows on router-2 (shown below)

use table 100 if incomming interface is wlan0
use table 200 if incomming interface is wlan1

all routes in table 100 have wlan1 as oif
all routes in table 200 have wlan0 as oif 



           --wlan0--            --wlan0----
router-1  +         + router-2 +           + router-3
          +         +          +           +
           --wlan1--            --wlan1----

(actual setup used 6 routers linerly)

Theroy says that using 2 interfaces on different channels and ensuring
that data recieved from one interface is forwerded on another will
increace perfornamce.  

I did not observe the same. I found the performance reducing by 1.5 times
when this static rule based routing is compared against OLSR Protocol.

I used iperf for measurements. Both TCP and UDP performance was low.

Please let me know your views on this.
Is rule and multiple table lookup very time consuming ?
From sebastian at wircomargentina.com.ar  Wed Jul  5 21:32:59 2006
From: sebastian at wircomargentina.com.ar (Sebastian Muniz)
Date: Wed Jul  5 21:32:52 2006
Subject: [LARTC] kernel udp rate limit
Message-ID: <44AC13EB.7080007@wircomargentina.com.ar>

Hi List.
First post, be gentle please.
Is there any limit in the linux UDP rate?

I am using linux kernel 2.6 and iperf to measure bandwidth
between two endpoints connected by 100 Mbits ethernet.
Running (as root) iperf -u -s
and iperf -u -c always gives me 1.05 Mbits/seg
even when runned in the same machine.
Can somebody clarify this?

Thanks in advance.
Sebastian

From muthukumar at gmail.com  Wed Jul  5 21:49:27 2006
From: muthukumar at gmail.com (Muthukumar S)
Date: Wed Jul  5 21:49:18 2006
Subject: [LARTC] kernel udp rate limit
In-Reply-To: <44AC13EB.7080007@wircomargentina.com.ar>
References: <44AC13EB.7080007@wircomargentina.com.ar>
Message-ID: <d5c845ac0607051249n52bd8341p87cd96a600b990e4@mail.gmail.com>

iperf --help

Client specific:
  -b, --bandwidth #[KM]    for UDP, bandwidth to send at in bits/sec
                           (default 1 Mbit/sec, implies -u)

If you wanted to push 5 Mbit/sec you would say "iperf -c 1.0.0.1 --udp
--bandwidth 5M"

On 7/5/06, Sebastian Muniz <sebastian@wircomargentina.com.ar> wrote:
> Hi List.
> First post, be gentle please.
> Is there any limit in the linux UDP rate?
>
> I am using linux kernel 2.6 and iperf to measure bandwidth
> between two endpoints connected by 100 Mbits ethernet.
> Running (as root) iperf -u -s
> and iperf -u -c always gives me 1.05 Mbits/seg
> even when runned in the same machine.
> Can somebody clarify this?
>
> Thanks in advance.
> Sebastian
>
> _______________________________________________
> LARTC mailing list
> LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
>
From russell-tcatm at stuart.id.au  Thu Jul  6 02:39:36 2006
From: russell-tcatm at stuart.id.au (Russell Stuart)
Date: Thu Jul  6 03:43:29 2006
Subject: [LARTC] Re: [PATCH 0/2] NET: Accurate packet scheduling for ATM/ADSL
In-Reply-To: <44AA6D25.9000707@trash.net>
References: <1150278004.26181.35.camel@localhost.localdomain>
	<1150286766.5233.15.camel@jzny2>
	<1150287983.3246.27.camel@ras.pc.brisbane.lube>
	<1150292693.5197.1.camel@jzny2>
	<1150843471.17455.2.camel@ras.pc.brisbane.lube>
	<15653CE98281AD4FBD7F70BCEE3666E53CD54A@comxexch01.comx.local>
	<1151000966.5392.34.camel@jzny2>
	<1151066247.4217.254.camel@ras.pc.brisbane.lube>
	<449C06E3.3090406@trash.net>
	<1151282720.4210.46.camel@ras.pc.brisbane.lube>
	<449FC0AF.1050904@trash.net> <44A0CE01.4010109@stuart.id.au>
	<44AA6D25.9000707@trash.net>
Message-ID: <1152146376.4215.59.camel@ras.pc.brisbane.lube>

On Tue, 2006-07-04 at 15:29 +0200, Patrick McHardy wrote:
> Unfortunately I still didn't got to cleaning them up, so I'm sending
> them in their preliminary state. Its not much that is missing, but
> the netem usage of skb->cb needs to be integrated better, I failed
> to move it to the qdisc_skb_cb so far because of circular includes.

Cleanups aside, architecturally the bulk of your patch 
looks like a no-brainier to me.  The calculation of
packet length should be in one place.  Caching it in
skb->cb was a nice touch.

> But nothing unfixable. I'm mostly interested if the current size-tables
> can express what you need for ATM, I wasn't able to understand the
> big comment in tc_core.c in your patch.

Unfortunately you do things in the wrong order for ATM.
See: http://mailman.ds9a.nl/pipermail/lartc/2006q1/018314.html
for an overview of the problem, and then the attached email for
a detailed description of how the current patch addresses it.
It is a trivial fix.

As I said earlier, RTAB and STAB contain the same numbers,
just scaled differently.  The ATM patch stuffed around with
RTAB.  With your patch in place it will have to do the same 
exactly the same thing with STAB - because RTAB and STAB
carry the same data.  So to me the two patches seem
orthogonal.

One observation is the size optimisation you applied to STAB, 
making it variable length, could also be applied to RTAB.  
In fact it should be.  Then they would be identical, apart 
from the scaling.  Even the lookup operation (performed in
qdisc_init_len in your patch) would be identical.

However, now you lot have made me go away and think, I have
another idea on how to attack this.  Perhaps it will be
more palatable to you.  It would replace RTAB and STAB with
a 28 byte structure for most protocol stacks - well all I can
think of off the top of my head, anyway.  RTAB would have to
remain for backwards compatibility, of course.

-------------- next part --------------
An embedded message was scrubbed...
From: Russell Stuart <russell@stuart.id.au>
Subject: Re: Getting ATM patches into the kernel
Date: Fri, 19 May 2006 22:59:34 +1000
Size: 10566
Url: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060706/fff4a390/attachment.mht
From hijacker at oldum.net  Thu Jul  6 08:32:16 2006
From: hijacker at oldum.net (Nikolay Kichukov)
Date: Thu Jul  6 08:32:19 2006
Subject: [LARTC] Simple Rule to Cap P2P Uploads
In-Reply-To: <20060704133059.94157.qmail@web55704.mail.re3.yahoo.com>
References: <20060704133059.94157.qmail@web55704.mail.re3.yahoo.com>
Message-ID: <978458167.3856.1.camel@hpa.oldum.net>

Hello Mathew,
Yes, it is all clear and your setup should work provided you changed the
few tiny bits I suggested.

Best,
-Nik

? ??, 2006-07-04 ? 06:30 -0700, Mathew Brown ??????:
> Thanks for your reply Nikolay.  I feel my first post was somewhat
> unclear.  I hope the following information clears things up a little
> more:
> 
> 1) The machine that I am trying to run do tc on has a single interface
> that connects it to the the rest of the network.
> 
> 2) I sometimes have to ssh and scp files from that machine.
> 
> 3) The machine runs various P2P applications.  I don't want the sum of
> their uploads to exceed 3 KB/s.
> 
> 4) As you mentioned, my ADSL uplink is 64000 bps
> 
> 5) The machine that I have tc running on and the machine with the P2P
> uploads are the same machine.
> 
> Thanks for your comments.  I'll try to check out the kbps vs. kbits.
> But is the idea of what I'm trying to do now more clear?
> 
> Nikolay Kichukov <hijacker@oldum.net> wrote:
>         Hi Mathew,
>         your adsl uplink is 64000 bps, correct?
>         
>         102400kbps > 64kbps
>         3kbps != 3KB/sec
>         
>         Another point, tc syntax is 102400kbit, not 102400kbps(as far
>         as I
>         tested that).
>         
>         3KB = 3*8 kbit
>         
>         Test that and let us know if this helps.
>         
>         -Nik
>         
>         On Wed, 2006-06-28 at 09:50 -0700, Mathew Brown wrote:
>         > Hi,
>         > I'm new at traffic control and was reading up on HTB and
>         using it to
>         > put an upper limit on traffic. I have a 256k DSL with 64k
>         upload
>         > (which translates to about 5/6KB uploads). The machine
>         running the
>         > P2P applications keeps filling up the 64K so my browsing
>         from other
>         > machines in the network ends up being very slow. Since there
>         are
>         > several P2P applications, I wanted to set the entire upload
>         cap to
>         > something like 3KB/s so it doesn't disrupt browsing.
>         However, I would
>         > also like to ssh and scp from this machine without having an
>         upload
>         > cap. The machine has a single interface to the network:
>         eth0. I
>         > tried the following tc lines but it appears to affect both
>         the P2P
>         > traffic and my ssh traffic, resulting in a very slow ssh
>         sessions:
>         > 
>         > tc qdisc add dev eth0 root handle 1: htb default 3
>         > tc class add dev eth0 parent 1: classid 1:1 htb rate
>         102400kbps ceil
>         > 102400kbps
>         > tc class add dev eth0 parent 1:1 classid 1:2 htb rate
>         102400kbps ceil
>         > 102400kbps
>         > tc class add dev eth0 parent 1:1 classid 1:3 htb rate 3kbps
>         ceil 3kbps
>         > tc filter add dev eth0 protocol ip parent 1:0 prio 1 u32
>         match ip
>         > dport 22 0xffff flowid 1:2
>         > 
>         > Any ideas? Thanks for your time.
>         > 
>         > 
>         >
>         ______________________________________________________________________
>         > Do you Yahoo!?
>         > Next-gen email? Have it all with the all-new Yahoo! Mail
>         Beta.
>         > _______________________________________________
>         > LARTC mailing list
>         > LARTC@mailman.ds9a.nl
>         > http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
>         -- 
>         ?????????????????? ????????? ????????????????????????,
>         ????????? ???????????????.
>         ?????? ?????????????????? ????????? ???????????????, ??????
>         ?????????????????? ????????? ????????????????????????...
>         -??????????????? ???????????????
>         
> 
> 
> 
> 
> ______________________________________________________________________
> Yahoo! Music Unlimited - Access over 1 million songs. Try it free. 

From devnull at plugthebox.net  Thu Jul  6 08:49:19 2006
From: devnull at plugthebox.net (devnull@plugthebox.net)
Date: Thu Jul  6 08:43:44 2006
Subject: [LARTC] routing ssh to secondary uplink
Message-ID: <1152168560.16154.0.camel@localhost.localdomain>

Hello,
I'm following this HOWTO
http://linux-ip.net/html/adv-multi-internet.html to route outgoing SSH
from a secondary ISP. I can see using tcpdump,jnettop,iftop that when
one of the computers located in my internal network is trying to SSH to
a box online using SSH, packets are routed via the secondary internet
ethernet card. However, packets don't seem to know how to get back.
        
my script:
route add default gw 10.2.2.1
ip route add table 1 default via SECONDARYGW
iptables -t mangle -A PREROUTING -p tcp --dport 22 -s 192.168.1.0/24 -j
MARK --set-mark 1
iptables -t nat -A POSTROUTING -o eth1 -j  SNAT --to MYSECONDARYIP
iptables -t nat -A POSTROUTING -o $EXT_NIC -s 192.168.1.0/24 -j SNAT
--to MYPRIMARYIP
ip rule add fwmark 1 table 1
ip route flush cache
        
Sincerely,
-- 
devnull@plugthebox.net <devnull@plugthebox.net>

From t.luettgert at pressestimmen.de  Thu Jul  6 12:30:07 2006
From: t.luettgert at pressestimmen.de (Torsten Luettgert)
Date: Thu Jul  6 12:29:58 2006
Subject: [LARTC] routing ssh to secondary uplink
In-Reply-To: <1152168560.16154.0.camel@localhost.localdomain>
References: <1152168560.16154.0.camel@localhost.localdomain>
Message-ID: <1152181807.4365.7.camel@scaramouche.combox.de>

On Do, 2006-07-06 at 09:49 +0300, devnull@plugthebox.net wrote:
> Hello,
> I'm following this HOWTO
> http://linux-ip.net/html/adv-multi-internet.html to route outgoing SSH
> from a secondary ISP. I can see using tcpdump,jnettop,iftop that when
> one of the computers located in my internal network is trying to SSH to
> a box online using SSH, packets are routed via the secondary internet
> ethernet card. However, packets don't seem to know how to get back.

I understand the two uplinks have different ethernet interfaces.
Did you disable rp_filter? Perhaps

echo 0 > /proc/sys/net/ipv4/conf/(interface for ssh)/rp_filter

would help. You can also use tcpdump on that interface to see if
the return packets arrive at your box, and on the inner interface
to see if they leave it.

Regards,
Torsten


From devnull at plugthebox.net  Thu Jul  6 12:52:06 2006
From: devnull at plugthebox.net (devnull@plugthebox.net)
Date: Thu Jul  6 12:46:42 2006
Subject: [LARTC] routing ssh to secondary uplink
In-Reply-To: <1152181807.4365.7.camel@scaramouche.combox.de>
References: <1152168560.16154.0.camel@localhost.localdomain>
	<1152181807.4365.7.camel@scaramouche.combox.de>
Message-ID: <1152183126.16154.27.camel@localhost.localdomain>

Hello,
That worked. thanks =)

On Thu, 2006-07-06 at 12:30 +0200, Torsten Luettgert wrote:
> On Do, 2006-07-06 at 09:49 +0300, devnull@plugthebox.net wrote:
> > Hello,
> > I'm following this HOWTO
> > http://linux-ip.net/html/adv-multi-internet.html to route outgoing SSH
> > from a secondary ISP. I can see using tcpdump,jnettop,iftop that when
> > one of the computers located in my internal network is trying to SSH to
> > a box online using SSH, packets are routed via the secondary internet
> > ethernet card. However, packets don't seem to know how to get back.
> 
> I understand the two uplinks have different ethernet interfaces.
> Did you disable rp_filter? Perhaps
> 
> echo 0 > /proc/sys/net/ipv4/conf/(interface for ssh)/rp_filter
> 
> would help. You can also use tcpdump on that interface to see if
> the return packets arrive at your box, and on the inner interface
> to see if they leave it.
> 
> Regards,
> Torsten
> 
> 
-- 
devnull@plugthebox.net <devnull@plugthebox.net>

From derek at interdart.co.uk  Thu Jul  6 13:17:40 2006
From: derek at interdart.co.uk (derek)
Date: Thu Jul  6 13:17:32 2006
Subject: [LARTC] Logging dropped out-of-sequence packets on a load balanced
	router
Message-ID: <44ACF154.6040308@interdart.co.uk>

Hi,

I am trying to get information on out-of-sequence packets being dropped 
on my load balanced multilink router.

Can anyone give me any information on how best to log/track such packets?

The router is based on Leaf Bering uClib 2.4 (kernel 2.4.26)

The load balancing is being done using teql over a number of gre 
tunnels, each on a separate ethernet  ADSL to a central box where the 
gre tunnels terminate and the packet stream hits the Internet.

If one of the ADSL channels suffers from high latency then it seems that 
packets get dropped - I assume due to excessive packets being out of  
sequence on the remote end.

The effect is particulary noticeable if  one ADSL channel has a higher 
round trip latency than the others, or under heavy load if one channel 
has a lower speed.

Best regards,
Derek
From bogdan at bistrita-net.ro  Thu Jul  6 15:12:29 2006
From: bogdan at bistrita-net.ro (Bogdan Hojda)
Date: Thu Jul  6 15:12:16 2006
Subject: [LARTC] Real time traffic Grapher
In-Reply-To: <44A52945.1030204@netvision.com.py>
References: <OFD4CFFCA9.1D99E3DE-ON8325719C.006EB6CA@comercial.digitel.com.br>
	<44A52945.1030204@netvision.com.py>
Message-ID: <44AD0C3D.1040201@bistrita-net.ro>

Julio E. Gonzalez P. wrote:
> Just check-out bandwidthd. Excelent tool!. A little "abandonware" now...
> but just works.
> 
> http://bandwidthd.sourceforge.net/
> 
> Julio.

Hello.

I'm using bandwidthd too, but I have the following problem: every time I
restart the computer, or restart just the bandwidthd daemon, I loose all
the graphs that bandwidthd draw, and "counting" starts from 0.

What showld I do?

I'm using the standard bandwidthd.conf from Debian/Ubuntu distros, I
modified just subnet and dev parameters.

Thanks.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: bogdan.vcf
Type: text/x-vcard
Size: 280 bytes
Desc: not available
Url : http://mailman.ds9a.nl/pipermail/lartc/attachments/20060706/790742c5/bogdan.vcf
From leeweejin at hotmail.com  Thu Jul  6 18:35:50 2006
From: leeweejin at hotmail.com (lee weejin)
Date: Thu Jul  6 18:35:42 2006
Subject: [LARTC] Optimization on Bandwidth Management-L7 filtering?
In-Reply-To: <1151342066.30132.9.camel@localhost>
Message-ID: <BAY7-F2496F2263AD51464C1F126B9770@phx.gbl>

>>>Try marking only first/new packages/connections, that will be analyzed by 
>>>layer-7 filter
Question: Is it layer-7 filtering able to perform marking the first/new 
packages/connections? May I know how to do that? Thanks.


>From: Andraz Sraka <a@aufbix.org>
>To: lee weejin <leeweejin@hotmail.com>
>CC: lartc@mailman.ds9a.nl
>Subject: Re: [LARTC] Optimization on Bandwidth Management-L7 filtering?
>Date: Mon, 26 Jun 2006 19:14:26 +0200
>
>re
>
>On Sun, 2006-06-11 at 04:32 +0000, lee weejin wrote:
> > Since all the incoming packets was checked one by one-(it is time
> > consuming and will cause the processing delay if it is handling more
> > than 50 PC at a time), thus i am thinking that is there any way to
> > have a random checking on incoming packets ? Scipt or tools? so that
> > it wont check all the incoming packets one follow by another one.
>********************************************************************************

>Try marking only first/new packages/connections, that will be analyzed
>by layer-7 filter in another chain and there do whole connecting mark
>(-j CONNMARK --mark XX). Those mark packages/connections can be then
>picked up by 'tc' for prioritizing traffic or netfilter for
>rejecting/dropping/.. traffic.
>
>regards,
>  Andraz
>
>--
>BOFH excuse #62:
>
>need to wrap system in aluminum foil to fix problem


><< signature.asc >>




><< smime.p7s >>


From usenet at teply.info  Thu Jul  6 22:26:05 2006
From: usenet at teply.info (Florian E. Teply)
Date: Thu Jul  6 22:25:55 2006
Subject: [LARTC] Translation in to german wanted??
Message-ID: <44AD71DD.10100@teply.info>

Hiya List users,
i'm rather new to this Mailinglist (about a couple of minutes to be 
precise ;-) ), but as i think this HOWTO is really great stuff, i just 
wanted to ask whether or not a translation into german language would be 
gladly received or not. To be honest, it's quite a task to translate all 
this, but as this HOWTO helped me a lot in setting up my routing, i just 
wanted to give something back. And even though i'm not too much into all 
this (in terms of knowledge that is), i thought a translation into my 
native tongue could maybe help a little in spreading the word.

So, if it is your will, i would gladly try and produce yet another 
translation of this HOWTO ;-)

Greetings,
Florian
From don at bowenvale.co.nz  Fri Jul  7 15:21:28 2006
From: don at bowenvale.co.nz (Don Gould)
Date: Fri Jul  7 15:21:53 2006
Subject: [LARTC] Hello New MAC / DHCP Request - How to spot the presents of
 a new MAC address...
Message-ID: <44AE5FD8.1020307@bowenvale.co.nz>

Hi All,

How do I find out about new new DHCP connections as they appear?

I want to write a script that will do some stuff based on a new ip
request from a machine on my lan.

ie - new user connects to the lan, DHCP server on my Linux (debian)
gateway gives them an IP, my script is run automatically to change the
firewall rules and start recording their presents, or if it's an unknown
user it will add their MAC to a list of unknown users.

More details of the application can be seen here:
http://www.tcn.bowenvale.co.nz/component/option,com_wrapper/Itemid,23/


Cheers Don
-- 
Don Gould
www.thinkdesignprint.co.nz - www.tcn.bowenvale.co.nz -
www.bowenvale.co.nz - SkypeMe:  ThinkDesignPrint
Upcoming events:  Software Freedom Day - 16 September 2006 -
www.softwarefreedomday.org


-------------- next part --------------
A non-text attachment was scrubbed...
Name: don.vcf
Type: text/x-vcard
Size: 309 bytes
Desc: not available
Url : http://mailman.ds9a.nl/pipermail/lartc/attachments/20060708/53679b77/don.vcf
From rajeshmahajan09 at gmail.com  Sat Jul  8 09:40:57 2006
From: rajeshmahajan09 at gmail.com (Rajesh Mahajan)
Date: Sat Jul  8 09:40:45 2006
Subject: [LARTC] IFB vs IMQ
Message-ID: <c9961d450607080040v3d6e0a97uca2d6ca5cfe7df6a@mail.gmail.com>

Is IFB realy replacement of IMQ

Please Guide

-- 
Failure seldom stops you. What stops you is the fear of failure.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060708/bc055a33/attachment.htm
From leekembel at hotmail.com  Sat Jul  8 19:27:17 2006
From: leekembel at hotmail.com (Lee Kembel)
Date: Sat Jul  8 19:27:10 2006
Subject: [LARTC] routing multiple paths to inet
Message-ID: <BAY103-F7BEFB12630DE5BDA6A09CAB750@phx.gbl>

I have a router used as a gateway for a small lan, I want half the machines 
to use one IP and half to use another IP when using SNAT to reach the 
internet. Both IPs are from the same ISP, same account, just different IPs. 
Heres what I'm trying:

------------------
LAN_IP="10.0.0.1"
LAN_IFACE="eth0"
EXT_IP_1="x.y.246.186"
EXT_IFACE_1="eth1"
EXT_IP_2="x.y.246.187"
EXT_IFACE_2="eth2"
INET_GW="x.y.246.254"
LAN_NET="10.0.0.0/16"
LAN_NET_SERVERS="10.0.0.0/24"

ip route flush table main
ip route flush table servers

ip rule add from $LAN_NET_SERVERS table servers

# First route
ip route add $INET_NET dev $EXT_IFACE_2
ip route add default via $INET_GW dev $EXT_IFACE_2

# Second route, seems similar to the first but doesn’t work
ip route add $INET_NET dev $EXT_IFACE_1 table servers
ip route add default via $INET_GW dev $EXT_IFACE_1 table servers
#At this point the command above fails with "RTNETLINK answers: network
unreachable"

ip route add $LAN_NET dev $LAN_IFACE
------------------

I don't understand why it says $INET_GW is on an unreachable network when I 
just added a route to that network ($INET_NET). I've spent hours reading and 
trying different things, I can't set up a route to the internet on anything 
but the main table (which strangely is very easy in contrast). Help?

Lee


From sheldonh at clue.co.za  Sat Jul  8 20:46:32 2006
From: sheldonh at clue.co.za (Sheldon Hearn)
Date: Sat Jul  8 20:46:58 2006
Subject: [LARTC] Hello New MAC / DHCP Request - How to spot the presents
	of a new MAC address...
In-Reply-To: <44AE5FD8.1020307@bowenvale.co.nz>
References: <44AE5FD8.1020307@bowenvale.co.nz>
Message-ID: <200607082046.32174@axl.clue.co.za>

On Friday 07 July 2006 15:21, Don Gould wrote:
> ie - new user connects to the lan, DHCP server on my Linux (debian)
> gateway gives them an IP, my script is run automatically to change
> the firewall rules and start recording their presents, or if it's an
> unknown user it will add their MAC to a list of unknown users.

I'm sure you could engineer something really impressive, but you could 
probably get away with a lot less effort by simply tailing whatever 
dhcpd logs to (possibly /var/log/messages).

Ciao,
Sheldon.
-- 
Sheldon Hearn
IT Director
Clue Technologies (PTY) Ltd

Web:		http://www.clue.co.za/
Mail:		sheldonh@clue.co.za
Office:		+27-21-913-8840
Mobile:		+27-83-564-3276
Timezone:	SAST (+0200)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url : http://mailman.ds9a.nl/pipermail/lartc/attachments/20060708/30a33d9b/attachment.pgp
From geoff.karl at gmail.com  Sat Jul  8 23:14:24 2006
From: geoff.karl at gmail.com (Geoff Karl)
Date: Sat Jul  8 23:14:12 2006
Subject: [LARTC] Mulitple VLANs containing the same ip subnet NATed on same
	box
Message-ID: <78f747be0607081414i5ad45c8cqe07c309bd080d0@mail.gmail.com>

I know this is not a normal request, but I would like to connect two
vlans into the same box that have the same subnet on them, and then
NAT them out to the Internet.

We don't need to make any connections inbound to them, but only
provide outbound access.

Any suggestions on how to do this?

If I can't do it with routing then I could use something like
user-mode Linux, or other virtualization software.

Thanks,

Geoff
From geoff.karl at gmail.com  Sat Jul  8 23:39:30 2006
From: geoff.karl at gmail.com (Geoff Karl)
Date: Sat Jul  8 23:39:17 2006
Subject: [LARTC] Mulitple VLANs containing the same ip subnet NATed on
	same box
In-Reply-To: <44B023B7.20600@riverviewtech.net>
References: <78f747be0607081414i5ad45c8cqe07c309bd080d0@mail.gmail.com>
	<44B023B7.20600@riverviewtech.net>
Message-ID: <78f747be0607081439k476f6a92uea7725923531645e@mail.gmail.com>

On 7/8/06, Grant Taylor <gtaylor@riverviewtech.net> wrote:
> Geoff Karl wrote:
> > I know this is not a normal request, but I would like to connect two
> > vlans into the same box that have the same subnet on them, and then
> > NAT them out to the Internet.
> >
> > We don't need to make any connections inbound to them, but only
> > provide outbound access.
> >
> > Any suggestions on how to do this?
>
> Bridge the two VLAN interfaces together and assign your internal IP to the bridge interface.  Then you will do standard NATing between your external interface and your bridge interface.  By the way, inbound access will be just as easy as outbound.
>
> > If I can't do it with routing then I could use something like
> > user-mode Linux, or other virtualization software.
>
> I don't think you need any thing as complicated as UML.
>
> You could even do this with 1 network interface with everything being VLANs.
>
> I.e.
>
> eth0.0001       VLAN for workstations
> eth0.0002       VLAN for workstations
> eth0.0003       VLAN for internet access
>
> eth0.0001 and eth0.0002 are bridge together yielding bri0
>
> bri0            internal interface
> eth0.0003       external interface
>
> NAT between bri0 and eth0.0003.
>
> If you ever added a second internet service provider, put them on eth0.0004 and update your routing.
>
>
>
> Grant. . . .
>

Thanks for the reply Grant.

What would happen if workstations on the "workstations" vlan had the
same ip addresses?  Can i bridge two networks that have the same ip
addresses without getting errors.

Geoff
From gtaylor at riverviewtech.net  Sat Jul  8 23:39:58 2006
From: gtaylor at riverviewtech.net (Grant Taylor)
Date: Sat Jul  8 23:41:47 2006
Subject: [LARTC] Mulitple VLANs containing the same ip subnet NATed on
	same	box
In-Reply-To: <78f747be0607081414i5ad45c8cqe07c309bd080d0@mail.gmail.com>
References: <78f747be0607081414i5ad45c8cqe07c309bd080d0@mail.gmail.com>
Message-ID: <44B0262E.3010307@riverviewtech.net>

Geoff Karl wrote:
> I know this is not a normal request, but I would like to connect two
> vlans into the same box that have the same subnet on them, and then
> NAT them out to the Internet.
> 
> We don't need to make any connections inbound to them, but only
> provide outbound access.
> 
> Any suggestions on how to do this?

Bridge the two VLAN interfaces together and assign your internal IP to the bridge interface.  Then you will do standard NATing between your external interface and your bridge interface.  By the way, inbound access will be just as easy as outbound.

> If I can't do it with routing then I could use something like
> user-mode Linux, or other virtualization software.

I don't think you need any thing as complicated as UML.

You could even do this with 1 network interface with everything being VLANs.

I.e.

eth0.0001	VLAN for workstations
eth0.0002	VLAN for workstations
eth0.0003	VLAN for internet access

eth0.0001 and eth0.0002 are bridge together yielding bri0

bri0		internal interface
eth0.0003	external interface

NAT between bri0 and eth0.0003.

If you ever added a second internet service provider, put them on eth0.0004 and update your routing.



Grant. . . .

From gtaylor at riverviewtech.net  Sat Jul  8 23:49:00 2006
From: gtaylor at riverviewtech.net (Grant Taylor)
Date: Sat Jul  8 23:50:41 2006
Subject: [LARTC] Mulitple VLANs containing the same ip subnet NATed on
	same box
In-Reply-To: <78f747be0607081439k476f6a92uea7725923531645e@mail.gmail.com>
References: <78f747be0607081414i5ad45c8cqe07c309bd080d0@mail.gmail.com>	<44B023B7.20600@riverviewtech.net>
	<78f747be0607081439k476f6a92uea7725923531645e@mail.gmail.com>
Message-ID: <44B0284C.6010104@riverviewtech.net>

Geoff Karl wrote:
> Thanks for the reply Grant.

You are welcome.

> What would happen if workstations on the "workstations" vlan had the
> same ip addresses?  Can i bridge two networks that have the same ip
> addresses without getting errors.

Well, seeing as how bridging (EBTables) is a layer 2 bridge, there would be no problem with having the same subnet on both sides of the bridge.  Now if you are asking if there would be a problem with a workstation on VLAN 1 having the same IP as a workstation on VLAN 2, then you would end up with the same situation that you would as if both workstations were on the same VLAN.  However, that being said, if these two workstations never needed to talk there are some things that you can do.  You can set up some EBTables filtering rule to prevent the bridging of the two MAC addresses in question to the other side.  I would block those MAC addresses from being bridged primarily to prevent a (pseudo) multi master type of situation.  Consider if you will if workstation A2 ARPs for the (shared) IP of workstation A1 / B1.  Both workstation A1 and B1 will reply to the ARP saying IP is at MAC <bla>.  So workstation A2 will have two ARP replies to deal with, thus being an IP conflict.  Wh
ere as if you prevent workstation A1 and B1's MACs from being bridged, then both workstations will reply to the ARP, however the replies will not be bridged because they will be filtered out by source MAC.  If you are wondering about the ARP reply form workstation B1 just broadcasting out in to the ether with the requester never actually talking to workstation B2, there is no real problem with this.  Yes, it is wasted traffic, but there is no harm in it.

This bridging while filtering out the conflicting source MACs will allow all other equipment on the networks to communicate with out any problem.



Grant. . . .
From acetyloholina at go2.pl  Sun Jul  9 05:35:10 2006
From: acetyloholina at go2.pl (Mike)
Date: Sun Jul  9 05:34:57 2006
Subject: [LARTC] Acessing multiply servers with same IP's
Message-ID: <200607090535.10566.acetyloholina@go2.pl>

Good day,

My name is Mike and without further ado forgive me that I'll go straight to 
the point.

rtlsrc-2.4.29-2.diff this patch is obsoleted, but it would come in handy when 
trying to solve the IP collisions in networks. I have situation around here 
becouse I intend to connect through my wifi card to many gateways with same 
IP adresses - 192.168.0.1 with /24 mask - then I'd like to use them all as 
Alternative routes, as far as I know it can be done for two of that kind 
gates, thanks to danieldg:
<danieldg> right
<danieldg> one hack, if you only wanted two: add a bridge interface to the 
wireless
<danieldg> then you have wlan0 and br0, both the same
<danieldg> then you could use ebtables to change the MACs of the bridge access
<danieldg> and leave the direct wlan0 access alone (so it would use the "real" 
MAC)
<I_v0> mhm, and when having two different MAC's I can have two different IP's
<I_v0> but I can't make more than one bridge, can I ?
<danieldg> no, not on one interface

The last two lines speak of themselves, only one bridge, only one additional 
MAC, so possibility to use only two gateways. I know that's real simple when 
having each subnet connected to different iface it's just I'll run out of 
interfaces real fast if I'll connect these so.

Can you propose anything in such situation?

Best wishes,
Mike
-- 
Sun, 09 Jul 2006 03:58:25 +0200
From gtaylor at riverviewtech.net  Sun Jul  9 05:57:04 2006
From: gtaylor at riverviewtech.net (Grant Taylor)
Date: Sun Jul  9 05:58:52 2006
Subject: [LARTC] Acessing multiply servers with same IP's
In-Reply-To: <200607090535.10566.acetyloholina@go2.pl>
References: <200607090535.10566.acetyloholina@go2.pl>
Message-ID: <44B07E90.5020908@riverviewtech.net>

Mike wrote:
> Good day,
> 
> My name is Mike and without further ado forgive me that I'll go straight to 
> the point.
> 
> rtlsrc-2.4.29-2.diff this patch is obsoleted, but it would come in handy when 
> trying to solve the IP collisions in networks. I have situation around here 
> becouse I intend to connect through my wifi card to many gateways with same 
> IP adresses - 192.168.0.1 with /24 mask - then I'd like to use them all as 
> Alternative routes, as far as I know it can be done for two of that kind 
> gates, thanks to danieldg:
> <danieldg> right
> <danieldg> one hack, if you only wanted two: add a bridge interface to the 
> wireless
> <danieldg> then you have wlan0 and br0, both the same
> <danieldg> then you could use ebtables to change the MACs of the bridge access
> <danieldg> and leave the direct wlan0 access alone (so it would use the "real" 
> MAC)
> <I_v0> mhm, and when having two different MAC's I can have two different IP's
> <I_v0> but I can't make more than one bridge, can I ?
> <danieldg> no, not on one interface
> 
> The last two lines speak of themselves, only one bridge, only one additional 
> MAC, so possibility to use only two gateways. I know that's real simple when 
> having each subnet connected to different iface it's just I'll run out of 
> interfaces real fast if I'll connect these so.
> 
> Can you propose anything in such situation?
> 
> Best wishes,
> Mike

Use more IPs.  Use a combination of IPTables / EBTables to make your system believe that each different gateway has a different IP address.  If you do this you can easily tell the system routing stack that it has multiple gateways to work with.



Grant. . . .
From russell-tcatm at stuart.id.au  Mon Jul 10 10:44:10 2006
From: russell-tcatm at stuart.id.au (Russell Stuart)
Date: Mon Jul 10 10:48:02 2006
Subject: [LARTC] Re: [PATCH 0/2] NET: Accurate packet scheduling for ATM/ADSL
In-Reply-To: <44AE1497.6010904@trash.net>
References: <1150278004.26181.35.camel@localhost.localdomain>
	<1150286766.5233.15.camel@jzny2>
	<1150287983.3246.27.camel@ras.pc.brisbane.lube>
	<1150292693.5197.1.camel@jzny2>
	<1150843471.17455.2.camel@ras.pc.brisbane.lube>
	<15653CE98281AD4FBD7F70BCEE3666E53CD54A@comxexch01.comx.local>
	<1151000966.5392.34.camel@jzny2>
	<1151066247.4217.254.camel@ras.pc.brisbane.lube>
	<449C06E3.3090406@trash.net>
	<1151282720.4210.46.camel@ras.pc.brisbane.lube>
	<449FC0AF.1050904@trash.net> <44A0CE01.4010109@stuart.id.au>
	<44AA6D25.9000707@trash.net>
	<1152146376.4215.59.camel@ras.pc.brisbane.lube>
	<44AE1497.6010904@trash.net>
Message-ID: <1152521050.4236.180.camel@ras.pc.brisbane.lube>

On Fri, 2006-07-07 at 10:00 +0200, Patrick McHardy wrote:
> Russell Stuart wrote:
> > Unfortunately you do things in the wrong order for ATM.
> > See: http://mailman.ds9a.nl/pipermail/lartc/2006q1/018314.html
> > for an overview of the problem, and then the attached email for
> > a detailed description of how the current patch addresses it.
> > It is a trivial fix.
> 
> Actually that was the part I didn't understand, you keep talking
> (also in that comment in tc_core.c) about an "unknown overhead".
> What is that and why would it be unknown? The mail you attached
> is quite long, is there an simple example that shows what you
> mean?

The "unknown overhead" is just the overhead passed to tc
using the "tc ... overhead xxx" option.  It is probably
what you intended to put into your addend attribute.

It is "unknown" because the kernel currently doesn't use
it.  It is passed in the tc_ratespec, but is ignored by
the kernel as are most fields in there.

The easy way to fix the "ATM" problem described in the big
comment is simply to add the "overhead" to the packet 
length before doing the RTAB lookup.  (Identical comments 
apply to STAB).  If you don't accept this or understand
why, then go read the "long emails" which attempt to
explain it in detail.  Jesper's initial version of the
patch did just that, BTW.

However if you do that then you have to adjust RTAB for
all cases (not just ATM) to reflect that the kernel is 
now adding the overhead.  Thus the RTAB tc sends to the 
kernel now changes for different kernel versions, making 
modern versions of tc incompatible with older kernels, 
and visa versa.  I didn't consider that acceptable.

My solution to this to give the kernel the old format
RTAB (ie the one that assumed the kernel didn't add the
overhead) and a small adjustment.  This small adjustment 
is called cell_align in the ATM patch.  You do the same 
thing with cell_align as the previous solution did with 
the overhead - ie add it in just before looking up RTAB.  
This is in effect all the kernel part of the ATM patch
does - make the kernel accept the cell_align option,
and add it to skb->len before looking up RTAB.

The difference between cell_align and overhead is that
cell_align is always 0 when there is no packetisation,
and even when non zero it is small (less than 1<<cell_log, 
ie less than 8 for typical MTU's).  So for anything bar 
ATM it is zero which means old kernels are completely
unaffected, and even for ATM not sending it produces a 
small error which means older kernels still benefit from
the "ATM" user space patch.   This makes the proposed 
"ATM" version of tc both forward and  backward compatible.

One other point arises here.  The fields in "tc_ratespec"
that "tc" fills and the kernel ignores are there so "tc 
show" will work.  The essence of the problem is "tc"
compiles the stuff you give it into a single "RTAB".  
That "RTAB" can't be reverse compiled into the original 
numbers the user provided.  So if "tc show" is to work,
"tc" has to save that information somewhere.  I don't
think the "tc_ratespec" was the best choice for two
reasons.

Firstly, having the fields show up in tc_ratespec 
makes it seem like the kernel can use them.  It can't,
as the "overhead" example above shows.  Secondly, from
tc's point of view it is inflexible.  Over time new
features have been be added to "tc", and each time a
new way of encoding it in the existing "tc_ratespec" 
has to be invented.  Thus we now have hacks like the
storing the "overhead" in the upper bits of the MPU
figure.

A better solution would be to provide a TLV (ie a 
TCA_XXX constant) for TC's private use.  From the 
kernels point of view it would be an opaque structure
which just saves and echos back when asked.  This
would solve both problems.

> > However, now you lot have made me go away and think, I have
> > another idea on how to attack this.  Perhaps it will be
> > more palatable to you.  It would replace RTAB and STAB with
> > a 28 byte structure for most protocol stacks - well all I can
> > think of off the top of my head, anyway.  RTAB would have to
> > remain for backwards compatibility, of course.
> 
> Can you describe in more detail?

OK, but first I want to make the point that the only
reason I suggest this is to get some sort of ATM
patch into the kernel, as the current patch on the
table is having a rough time.

Alan Cox made the point earlier (if I understood him
correctly) that this tabling lookup probably isn't
a big win on modern CPU's - we may be better off
moving it all into the kernel.  Thinking about this,
I tried to come up with a way of describing the
mapping between skb->len and the on the wire packet
length for every protocol I know.  This is what I
came up with.

Assume we have a packet length L, which is to be
transported by some protocol.  For now we consider
one protocol only, ie: TCP, PPP, ATM, Ethernet or
whatever.   I will generalise it to multiple protocols
later.  I think a generalised transformation can be 
made using using 5 numbers which are applied in this
order:

  Overhead - A fixed overhead that is added to L.

  Mpu      - Minimum packet size.  If the result of
             (Overhead+L) is smaller that this, then 
             the new result becomes this size.

  Round    - The result is then rounded up to this
             many bytes.  For protocols that always
             transmit single bytes this figure would be
             1.  If there were some protocol that
             transmitted data as 4 byte chunks then this
             would be 4.  For ATM it is 48.

  CellPay  - If the packet is broken down into smaller
             packets when sent, then this is the amount
             of data that will fit into each chunk.

  CallOver - This is the additional overhead each cell
             carries.

The idea is the kernel would do this calculation on the
fly for each packet.  If you represent this set of number 
numbers as a comma separated list in the order they were 
presented above, then here are some examples:

  IP:       20
  Ethernet: 18,64
  PPP:      2
  ATM:      0,0,48,48,5

It may be that 5 numbers are a overkill.  It is for all
protocols I am aware of - for those you could get away
with 4.  But I am no expert.

The next step is to generalise for many protocols.  As
the protocols are stacked the length output by one 
protocol becoming the input length for the downstream 
one.  So we just need to apply the same transformation 
serially. I will use '+' to indicate the stacking.  For 
a typical ATM stack, PPPoE over LLC, we have:

  ppp:2+pppoe:6+ethernet:14,64+llc:8+all5:4+atm:0,0,48,48,5

If this were implemented naively, then the kernel would
have to apply the above calculation 6 times, like this:

  Protocol   InputLength    OutputLength
  ---------  ------------   ----------------
  ppp        skb->len       skb->len+2
  pppoe:     skb->len+2     skb->len+2+6
  ethernet:  skb->len+2+6   skb->len+2+6+14
  ... and so on.

But it can be optimised.  In this particular case we can
combine those six operations into 1:

  adsl_pppoe_llc:34,64,48,48,5

The five numbers have the same meaning as before.  It
it not difficult to come up with a generalised rule that
allows you to do this for most cases.  For the remainder
(if they exist - I can't think of any) the kernel would
have to apply the transformation iteratively.

Before going on, it is worth while comparing this to the
current RTAB solution (and by implication STAB):

  1.  Oddly, the number of steps and hence speed for 
      common protocols is probably the same.  Compare:
        RTAB - You have to add an OverHead in the general
               case.
             - You have to scale by cell_log.
             - You have to ensure the overhead+skb->len
               doesn't overflow / underflow the RTAB.
             - You have to do the lookup.
        New  - You have to add overhead.
             - You have to check the MPU.
             - You have to check if you have to apply
               Round,CellPay,CellOver - but you won't
               have to for any protocol except ATM.

  2.  Because of the cell_log, RTAB gives an 100% accurate
      answer 1 time in every (1<<cell_log) packet lengths.
      The new version is always 100% accurate.

  3.  The new version isn't as flexible as RTAB, as least
      from the kernels point of view.  Conceivably there are 
      protocols that could be handled by RTAB that are not 
      handled by the new one.  Since RTAB is computed in
      user space, this implies these new protocols might
      be handled by a user space change only.  The new
      version would always require a kernel change.  Note 
      however that even RTAB required a kernel change for
      ATM, however.

So far we have what your STAB would provide us with - a
way to calculate the packet length.  It takes 5 int's for 
every protocol stack I can think of.  It probably runs
faster for most protocols but is less robust to the
introduction of new protocols.

But some qdisc's need to know how long it takes to send a 
packet.  This is what RTAB provides us with, in fact.  
So if we were to do away with RTAB completely, then we need
a way for the kernel to covert packet lengths into the time
it takes to send a packet.  This is what I discuss next.
The comments apply to both STAB and the new algorithm above,
as they both compute packet lengths.

If J is the time it takes to send one byte over a link, 
then we can compute RTAB from STAB like this:

  for (int i = 0; i < array_length(STAB); i += 1)
    RTAB[i] = STAB[i] * J;

This is exactly the operation "tc" performs now in user
space.  It is possibly in user space because J is usually
less than 1, and thus is most conveniently represented as
a floating point number.  Floating point operations in
the kernel are verboten.

I can think of two ways to move this operation into the
kernel.  The straight forward way is to represent J as a 
scale and a division.  Ie the kernel does:

  RTAB[i] = (STAB[i] << scale) / divisor.

The second way depends on that fact that most CPU's can
multiply two 32 uint's to produce a 64 bit result in a
single operation.   I don't know whether this operation is
available to kernel code.  But if it is, J can be 
represented as a 32 bit fixed point number, with the
implied decimal point after the most significant 8 bits.
Then this operation would suffice:

  extern long long mul64(unsigned long, a, unsigned long b);

  RTAB[i] = (unsigned long)(mul64(STAB[i], J) >> 24);

This method doesn't use division, and is probably faster
on lower end CPU's.  It would handle 100G Ethernet on a 
machine with Hz == 1000, and 1200 bits/sec on a machine
with Hz == 10000.


From e1605project at hotmail.com  Mon Jul 10 11:41:59 2006
From: e1605project at hotmail.com (*~ r a K u ~ *)
Date: Mon Jul 10 11:41:53 2006
Subject: [LARTC] Can i attach another qdisc under classes or root qdisc?
Message-ID: <BAY123-F22E3CD8068CE55EB532131DD6B0@phx.gbl>

An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060710/3f8903af/attachment.htm
From gustavo at angulosolido.pt  Mon Jul 10 13:25:51 2006
From: gustavo at angulosolido.pt (Gustavo Homem)
Date: Mon Jul 10 13:25:46 2006
Subject: [LARTC] simple TOS based setup vs more complex ones
Message-ID: <20060710112551.GF2177@angulosolido.pt>

Hi,

After reading section 9 of LARTC it seemed to me that a pure TOS based QoS setup with be sufficient for a small newtork. Interactive packets could have the highest priority, second highest for DNS and small HTTP packets and lowest prio for all others.

The advantage is that, the setup would be simply a couple of iptables lines, because the default pfifo_fast qdisc already implements priorities.

Questions:

For this case, what is the recommended way to limit the outgoing rate to ensure that nothing is queued on the modem?

Can this be done with pfifo_fast?

Best regards
Gustavo

-- 
Angulo S?lido - Tecnologias de Informa??o
http://angulosolido.pt

From william.bohannan at spidersat.net  Mon Jul 10 13:41:53 2006
From: william.bohannan at spidersat.net (William Bohannan)
Date: Mon Jul 10 13:42:35 2006
Subject: [LARTC] learning iptables
Message-ID: <20060710114226.59CE2459D@outpost.ds9a.nl>

Hi 

I am currently learning iptables and would like to see the output of
shorewall rules in iptables format, as I would like to make a script for the
rules instead of using shorewall.

 

Kind Regards

 

William

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060710/fc30555f/attachment.html
From nikky at mnet.bg  Mon Jul 10 14:20:29 2006
From: nikky at mnet.bg (Nickola Kolev)
Date: Mon Jul 10 14:20:23 2006
Subject: [LARTC] learning iptables
In-Reply-To: <20060710114226.59CE2459D@outpost.ds9a.nl>
References: <20060710114226.59CE2459D@outpost.ds9a.nl>
Message-ID: <20060710152029.dd36dd81.nikky@mnet.bg>

Hello, William,

You can take a look at the man page of iptables-save.

On Mon, 10 Jul 2006 11:41:53 -0000
"William Bohannan" <william.bohannan@spidersat.net> wrote:

> Hi 
> 
> I am currently learning iptables and would like to see the output of
> shorewall rules in iptables format, as I would like to make a script
> for the rules instead of using shorewall.
> 
>  
> 
> Kind Regards
> 
>  
> 
> William
> 
> 

-- 
????????,
??????
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url : http://mailman.ds9a.nl/pipermail/lartc/attachments/20060710/1bf2747c/attachment.pgp
From martin at linux-ip.net  Mon Jul 10 22:45:49 2006
From: martin at linux-ip.net (Martin A. Brown)
Date: Mon Jul 10 22:45:59 2006
Subject: [LARTC] simple TOS based setup vs more complex ones
In-Reply-To: <20060710112551.GF2177@angulosolido.pt>
References: <20060710112551.GF2177@angulosolido.pt>
Message-ID: <Pine.LNX.4.63.0607101448120.1261@solidus.wonderfrog.net>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello Gustavo,

 : After reading section 9 of LARTC it seemed to me that a pure TOS 
 : based QoS setup with be sufficient for a small newtork. 
 : Interactive packets could have the highest priority, second 
 : highest for DNS and small HTTP packets and lowest prio for all 
 : others.
 : 
 : The advantage is that, the setup would be simply a couple of 
 : iptables lines, because the default pfifo_fast qdisc already 
 : implements priorities.

In your proposed system, is still possible for a flood of DNS 
queries to cause queue depths upstream (and queue depths translate 
directly to queue backups and delays).

 : For this case, what is the recommended way to limit the outgoing 
 : rate to ensure that nothing is queued on the modem?

The answer depends on what you are trying to do.  Consider HTB 
and/or HFSC.  Although you might find that TBF is sufficient, you 
are already talking about ToS, so TBF probably won't cut the 
mustard in your situation.

 : Can this be done with pfifo_fast?

Not really.  Although, the actual qdisc proposed is different, 
please see this recent exchange [0] about prio qdisc.

If you are using a work-conserving qdisc (i.e., a qdisc that 
performs no shaping), you'll not really be able to guarantee 
anything about the quality of traffic from one point to another.  
In order to offer some sort of guarantees on any link, your device 
must be the bottleneck.  This requires shaping or, at least, some 
sort of non-work-conserving qdisc.

Good luck,

- -Martin

 [0] http://mailman.ds9a.nl/pipermail/lartc/2006q2/019130.html
     http://mailman.ds9a.nl/pipermail/lartc/2006q2/019138.html
     http://mailman.ds9a.nl/pipermail/lartc/2006q2/019143.html
     http://mailman.ds9a.nl/pipermail/lartc/2006q2/019158.html

- -- 
Martin A. Brown
http://linux-ip.net/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)
Comment: pgf-0.71 (http://linux-ip.net/sw/pine-gpg-filter/)

iD8DBQFEsryFHEoZD1iZ+YcRAmUAAKDb74IxaBWmCgHA8sd1Sy1SVXS4ZACfYkvD
5NhD00yJMOG5CeFTTFPPk+s=
=RmHf
-----END PGP SIGNATURE-----
From gustavo at angulosolido.pt  Tue Jul 11 01:43:40 2006
From: gustavo at angulosolido.pt (Gustavo Homem)
Date: Tue Jul 11 01:43:41 2006
Subject: [LARTC] simple TOS based setup vs more complex ones
In-Reply-To: <Pine.LNX.4.63.0607101448120.1261@solidus.wonderfrog.net>
References: <20060710112551.GF2177@angulosolido.pt>
	<Pine.LNX.4.63.0607101448120.1261@solidus.wonderfrog.net>
Message-ID: <20060710234340.GF15607@angulosolido.pt>

Hi Martin,

On Mon, Jul 10, 2006 at 03:45:49PM -0500, Martin A. Brown wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Hello Gustavo,
> 
>  : After reading section 9 of LARTC it seemed to me that a pure TOS 
>  : based QoS setup with be sufficient for a small newtork. 
>  : Interactive packets could have the highest priority, second 
>  : highest for DNS and small HTTP packets and lowest prio for all 
>  : others.
>  : 
>  : The advantage is that, the setup would be simply a couple of 
>  : iptables lines, because the default pfifo_fast qdisc already 
>  : implements priorities.
> 
> In your proposed system, is still possible for a flood of DNS 
> queries to cause queue depths upstream (and queue depths translate 
> directly to queue backups and delays).

Sure, but I am talking about a simple setup that works for small networks. In such cases there won't be DNS floods, unless someone really wants to generate one.

> 
>  : For this case, what is the recommended way to limit the outgoing 
>  : rate to ensure that nothing is queued on the modem?
> 
> The answer depends on what you are trying to do.  Consider HTB 
> and/or HFSC.  Although you might find that TBF is sufficient, you 
> are already talking about ToS, so TBF probably won't cut the 
> mustard in your situation.
> 
>  : Can this be done with pfifo_fast?
> 
> Not really.  

So the priorities are useless in real world with pfifo_fast, is that it? This is bit surprising, IIUC. This is why I asked.

> Although, the actual qdisc proposed is different, 
> please see this recent exchange [0] about prio qdisc.
> 
> If you are using a work-conserving qdisc (i.e., a qdisc that 
> performs no shaping), you'll not really be able to guarantee 
> anything about the quality of traffic from one point to another.  
> In order to offer some sort of guarantees on any link, your device 
> must be the bottleneck.  This requires shaping or, at least, some 
> sort of non-work-conserving qdisc.
> 

What I was initially looking for was just TOS marking + plus simple interface throtlling, i.e, the simplest form of shapping. If it can't be done with pfifo_fast, my next idea was something like:

	tc qdisc add dev eth0 root handle 1: htb default 10
	tc class add dev eth0 parent 1: classid 1:1 htb rate 7000kbps ceil 7000kbps
	tc class add dev eth0 parent 1:1 classid 1:10 prio

	+

	iptables rules for setting TOS values

Is this right? This seems to be similar to what you proposed here:

http://mailman.ds9a.nl/pipermail/lartc/2006q2/019138.html

For a not so simple approach but which seems to be working well, I have an adaption of Dan Singletary's script here:

http://downloads.angulosolido.pt/QoS/

It uses directly HTB on both directions, for a setup with only 2 network interfaces which is very common (no kernel patching is needed).

Do you want to comment?

Still, I want to test the simplest possible solution and see how far one can go with only a few lines of bash, for both practical and pedagogical purposes. I think it's important to have a simple solution that works for typical scenarios (2 interfaces, linux router with NAT) on stock kernels. **

Best regards
Gustavo

** nothing wrong about patching and compiling kernels, but it brings maintenance overhead everytime there is system upgrade for whatever reason

-- 
Angulo S?lido - Tecnologias de Informa??o
http://angulosolido.pt

> Good luck,
> 
> - -Martin
> 
>  [0] http://mailman.ds9a.nl/pipermail/lartc/2006q2/019130.html
>      http://mailman.ds9a.nl/pipermail/lartc/2006q2/019138.html
>      http://mailman.ds9a.nl/pipermail/lartc/2006q2/019143.html
>      http://mailman.ds9a.nl/pipermail/lartc/2006q2/019158.html
> 
> - -- 
> Martin A. Brown
> http://linux-ip.net/
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.2 (GNU/Linux)
> Comment: pgf-0.71 (http://linux-ip.net/sw/pine-gpg-filter/)
> 
> iD8DBQFEsryFHEoZD1iZ+YcRAmUAAKDb74IxaBWmCgHA8sd1Sy1SVXS4ZACfYkvD
> 5NhD00yJMOG5CeFTTFPPk+s=
> =RmHf
> -----END PGP SIGNATURE-----


From martin at linux-ip.net  Tue Jul 11 04:20:48 2006
From: martin at linux-ip.net (Martin A. Brown)
Date: Tue Jul 11 04:21:01 2006
Subject: [LARTC] simple TOS based setup vs more complex ones
In-Reply-To: <20060710234340.GF15607@angulosolido.pt>
References: <20060710112551.GF2177@angulosolido.pt>
	<Pine.LNX.4.63.0607101448120.1261@solidus.wonderfrog.net>
	<20060710234340.GF15607@angulosolido.pt>
Message-ID: <Pine.LNX.4.63.0607102100520.1261@solidus.wonderfrog.net>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Gustavo,

 : Sure, but I am talking about a simple setup that works for small 
 : networks. In such cases there won't be DNS floods, unless someone 
 : really wants to generate one.

Well, perhaps you could give it a try in your example network and 
see how it fares.  It might fare very well 90% of the time.  If so, 
then you have an OK solution.

 : So the priorities are useless in real world with pfifo_fast, is 
 : that it? This is bit surprising, IIUC. This is why I asked.

Priorities are useless in the real world on a link that we expect to 
be congested (e.g. an ADSL link).  If the link is not congested, 
there's no problem with using priorities.  The question is not 
whether priorities are useless, but rather, how often do you expect 
your link to be congested?

 : What I was initially looking for was just TOS marking + plus 
 : simple interface throtlling, i.e, the simplest form of shapping. 
 : If it can't be done with pfifo_fast, my next idea was something 
 : like:
 : 
 : 	tc qdisc add dev eth0 root handle 1: htb default 10
 : 	tc class add dev eth0 parent 1: classid 1:1 htb rate 7000kbps ceil 7000kbps
 : 	tc class add dev eth0 parent 1:1 classid 1:10 prio
 : 
 : 	+
 : 
 : 	iptables rules for setting TOS values
 : 
 : Is this right? This seems to be similar to what you proposed 
 : here:
 : 
 : http://mailman.ds9a.nl/pipermail/lartc/2006q2/019138.html

Well, indeed, I did post that!  While that may solve the problem of 
the bottleneck, I have to confess, it's not a very good solution 
either!  I'll post a follow-up to that thread shortly.

 : For a not so simple approach but which seems to be working well, 
 : I have an adaption of Dan Singletary's script here:
 : 
 : http://downloads.angulosolido.pt/QoS/
 :
 : It uses directly HTB on both directions, for a setup with only 2 
 : network interfaces which is very common (no kernel patching is 
 : needed).

HTB in both directions is probably the best way to go (shaping 
upload and shaping download).  I haven't examined the HTB_shaper.sh 
assiduously, but from a quick review, it seems quite reasonable 
(and better than my off the cuff remark in the earlier thread).

I'm not crazy about the dropping of the MTU, but otherwise, the 
script seems to make sense.  Basically divide up link capacity into 
components and limit the total transmission rate to the link 
capacity (so we are the bottleneck).

Then, put some packets in each class.  It's so far the best (and 
most general) solution in this thread.

 : Still, I want to test the simplest possible solution and see how 
 : far one can go with only a few lines of bash, for both practical 
 : and pedagogical purposes. I think it's important to have a simple 
 : solution that works for typical scenarios (2 interfaces, linux 
 : router with NAT) on stock kernels. **
 :
 : ** nothing wrong about patching and compiling kernels, but it 
 :    brings maintenance overhead everytime there is system upgrade 
 :    for whatever reason

Understood on the kernel patching/compiling business.  That's not 
usually something you want to throw at beginners.

Well, if the goal is practical administration and pedagogy, I'd 
suggest tcng [0], since the "beauty" of tc is hidden from the user.  
The language of tcng feels more like a programming language than the
arcana of tc.

Good luck,

- -Martin

 [0] http://tcng.sourceforge.net/

- -- 
Martin A. Brown
http://linux-ip.net/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)
Comment: pgf-0.71 (http://linux-ip.net/sw/pine-gpg-filter/)

iD8DBQFEswsEHEoZD1iZ+YcRAhwGAJkBlygjpO6dfT9s+1/yHq91pSAJCQCg8E2a
LRjKTkGjSvQHTLaFReomSlk=
=ikoL
-----END PGP SIGNATURE-----
From gustavo at angulosolido.pt  Tue Jul 11 04:42:26 2006
From: gustavo at angulosolido.pt (Gustavo Homem)
Date: Tue Jul 11 04:42:18 2006
Subject: [LARTC] simple TOS based setup vs more complex ones
In-Reply-To: <Pine.LNX.4.63.0607102100520.1261@solidus.wonderfrog.net>
References: <20060710112551.GF2177@angulosolido.pt>
	<Pine.LNX.4.63.0607101448120.1261@solidus.wonderfrog.net>
	<20060710234340.GF15607@angulosolido.pt>
	<Pine.LNX.4.63.0607102100520.1261@solidus.wonderfrog.net>
Message-ID: <20060711024226.GH15607@angulosolido.pt>

Hello again Martin,

More comments below:

>  : So the priorities are useless in real world with pfifo_fast, is 
>  : that it? This is bit surprising, IIUC. This is why I asked.
> 
> Priorities are useless in the real world on a link that we expect to 
> be congested (e.g. an ADSL link).  If the link is not congested, 
> there's no problem with using priorities.  The question is not 
> whether priorities are useless, but rather, how often do you expect 
> your link to be congested?

Good point... and the answer is: allways.

With the low DSL uploads available a single connection will saturate it - we currently have 20Mbs/400kbps (!) services, for example.

> 
>  : What I was initially looking for was just TOS marking + plus 
>  : simple interface throtlling, i.e, the simplest form of shapping. 
>  : If it can't be done with pfifo_fast, my next idea was something 
>  : like:
>  : 
>  : 	tc qdisc add dev eth0 root handle 1: htb default 10
>  : 	tc class add dev eth0 parent 1: classid 1:1 htb rate 7000kbps ceil 7000kbps
>  : 	tc class add dev eth0 parent 1:1 classid 1:10 prio
>  : 
>  : 	+
>  : 
>  : 	iptables rules for setting TOS values
>  : 
>  : Is this right? This seems to be similar to what you proposed 
>  : here:
>  : 
>  : http://mailman.ds9a.nl/pipermail/lartc/2006q2/019138.html
> 
> Well, indeed, I did post that!  While that may solve the problem of 
> the bottleneck, I have to confess, it's not a very good solution 
> either!  I'll post a follow-up to that thread shortly.
> 

Great.

Meanwhile, I just finished my first trial on this approach. The result is here:

http://downloads.angulosolido.pt/QoS/PRIO_shaper.sh

For SSH interactive traffic and Web Browsing while uploading and downloading, seems to work as well as HTB_shaper, it tested on a single machine.

Of course there is no fairness on each prio band, so tests with multiple workstations should reveal the advantadges of HTB_shaper.


>  : For a not so simple approach but which seems to be working well, 
>  : I have an adaption of Dan Singletary's script here:
>  : 
>  : http://downloads.angulosolido.pt/QoS/
>  :
>  : It uses directly HTB on both directions, for a setup with only 2 
>  : network interfaces which is very common (no kernel patching is 
>  : needed).
> 
> HTB in both directions is probably the best way to go (shaping 
> upload and shaping download).  I haven't examined the HTB_shaper.sh 
> assiduously, but from a quick review, it seems quite reasonable 
> (and better than my off the cuff remark in the earlier thread).
> 
> I'm not crazy about the dropping of the MTU, but otherwise, 

I found that it was causing problems, so that part is gone.

> the 
> script seems to make sense.  Basically divide up link capacity into 
> components and limit the total transmission rate to the link 
> capacity (so we are the bottleneck).
> 
> Then, put some packets in each class.  It's so far the best (and 
> most general) solution in this thread.
> 
>  : Still, I want to test the simplest possible solution and see how 
>  : far one can go with only a few lines of bash, for both practical 
>  : and pedagogical purposes. I think it's important to have a simple 
>  : solution that works for typical scenarios (2 interfaces, linux 
>  : router with NAT) on stock kernels. **
>  :
>  : ** nothing wrong about patching and compiling kernels, but it 
>  :    brings maintenance overhead everytime there is system upgrade 
>  :    for whatever reason
> 
> Understood on the kernel patching/compiling business.  That's not 
> usually something you want to throw at beginners.
> 

And I also don't like to throw it at myself, if it's not really necessary.

(OT: I wonder, if the kernel team doesn't want to include IMQ, what's their recommended solution for this problem, on a router with more than 2 interfaces)

> Well, if the goal is practical administration and pedagogy, I'd 
> suggest tcng [0], since the "beauty" of tc is hidden from the user.  
> The language of tcng feels more like a programming language than the
> arcana of tc.
> 

Thank you for the link. I wasn't aware of this project.

Best regards
Gustavo

-- 
Angulo S?lido - Tecnologias de Informa??o
http://angulosolido.pt

> Good luck,
> 
> - -Martin
> 
>  [0] http://tcng.sourceforge.net/
> 
> - -- 
> Martin A. Brown
> http://linux-ip.net/
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.2 (GNU/Linux)
> Comment: pgf-0.71 (http://linux-ip.net/sw/pine-gpg-filter/)
> 
> iD8DBQFEswsEHEoZD1iZ+YcRAhwGAJkBlygjpO6dfT9s+1/yHq91pSAJCQCg8E2a
> LRjKTkGjSvQHTLaFReomSlk=
> =ikoL
> -----END PGP SIGNATURE-----


From martin at linux-ip.net  Tue Jul 11 04:45:47 2006
From: martin at linux-ip.net (Martin A. Brown)
Date: Tue Jul 11 04:45:52 2006
Subject: VoIP using just prio qdisc? No.  was [ [LARTC] Sanity Check ]
In-Reply-To: <Pine.LNX.4.63.0606260809540.30090@solidus.wonderfrog.net>
References: <200606252208.29528.mdiehl@diehlnet.com>
	<Pine.LNX.4.63.0606260809540.30090@solidus.wonderfrog.net>
Message-ID: <Pine.LNX.4.63.0607102103220.1187@solidus.wonderfrog.net>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello all,

 : So, instead of trying to use a prio qdisc alone, try using a 
 : single HTB class to limit your traffic to a given rate and then 
 : embed your prio qdisc inside that.  There are many other possible 
 : options for nested qdiscs, and maybe somebody on this list will 
 : make a recommendation to you for how s/he solved this problem.

This is a correction/clarification for posterity.  There is still a 
problem with the above, and I'd like to correct it and thank Gustavo 
Homem [0] for pointing out my possibly misleading advice here.

Mike indicated that he was willing to let VoIP traffic out 
regardless of the cost to other flows.  This means that the above 
solution might work acceptably for his needs in this situation...

However, this is not a good general solution!

When evaluating a traffic control mechanism for a particular 
solution, there are a number of different network characteristics 
that we need to keep in mind.  The big three are throughput, delay 
and jitter.

Each traffic control mechanism that we might employ affects at least 
one (and almost always more than one) of the above network 
characteristics.  Selecting the correct mechanism for a given 
application depends on what we are willing to trade.

Some people are willing to trade total throughput for delay (those 
of us who like responsive ssh sessions, for example).

Some people MUST trade delay and jitter for throughput (VoIP 
applications).

So, to return to the problem of a single PRIO qdisc (a 
work-conserving queuing discipline), how can we add some sort of 
non-work-conserving mechanism (shaping) and still take advantage of 
some prioritization.

There are a number of ways to solve this problem, but let's look at 
the following options (+ = good, - = not-so-good):

  A. HTB qdisc, one class, with child PRIO qdisc

     + HTB shapes total dequeued traffic rate to the specified 
       maximum rate.
     + PRIO qdisc ensures that traffic you classify as high 
       priority always has preferential access to full link 
       bandwidth (as limited by HTB's rate)
     - high priority flows can completely starve low priority
       flows

  B. PRIO qdisc, each class contains a TBF qdisc specifying 
     transmisison rate

     + each class gets up to its TBF of throughput before it gets 
       shaped.
     + each class gets is completely isolated from the other classes
       so if the sum of the rates of the TBF qdiscs does not exceed
       link bandwidth, you should see predictable delay and jitter
     - any given class could become backlogged easily and there's
       no sharing between classes

  C. HTB qdisc, HTB children classes[, children sfq or fifo qdiscs]

     + HTB shapes total dequeued traffic rate to the specified 
       maximum rate.
     + HTB children classes can borrow from parent classes, if 
       some bandwidth goes unused
     - must write filters to specify which class receives which 
       packets

The above is just an outline to point out some of the tradeoffs that 
need to be examined and understood when choosing a traffic control 
mechanism for any particular situation.

I was probably a bit facile in my answer to Mike, so I hope this 
post clears up the ambiguity of the recommendation.

Good luck and happy QoS!

- -Martin

 [0] http://mailman.ds9a.nl/pipermail/lartc/2006q3/019232.html

- -- 
Martin A. Brown
http://linux-ip.net/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)
Comment: pgf-0.71 (http://linux-ip.net/sw/pine-gpg-filter/)

iD8DBQFEsxDdHEoZD1iZ+YcRAormAJsGkouYrqoM0q8Zgw0aCaXpZTMKkQCfbc+E
UruTl/GvAVMHqGRqzUwwc0Q=
=Sk64
-----END PGP SIGNATURE-----
From martin at linux-ip.net  Tue Jul 11 04:58:23 2006
From: martin at linux-ip.net (Martin A. Brown)
Date: Tue Jul 11 04:58:27 2006
Subject: [LARTC] simple TOS based setup vs more complex ones
In-Reply-To: <20060711024226.GH15607@angulosolido.pt>
References: <20060710112551.GF2177@angulosolido.pt>
	<Pine.LNX.4.63.0607101448120.1261@solidus.wonderfrog.net>
	<20060710234340.GF15607@angulosolido.pt>
	<Pine.LNX.4.63.0607102100520.1261@solidus.wonderfrog.net>
	<20060711024226.GH15607@angulosolido.pt>
Message-ID: <Pine.LNX.4.63.0607102146270.1261@solidus.wonderfrog.net>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

It's a tennis-game on the LARTC list, Gustavo!  :)

 : > The question is not 
 : > whether priorities are useless, but rather, how often do you expect 
 : > your link to be congested?
 : 
 : Good point... and the answer is: allways.
 : 
 : With the low DSL uploads available a single connection will 
 : saturate it - we currently have 20Mbs/400kbps (!) services, for 
 : example.

Strange ratio--20 to 1, but I don't know a great deal about DSL 
provisioning.

 : Meanwhile, I just finished my first trial on this approach. The 
 : result is here:
 : 
 : http://downloads.angulosolido.pt/QoS/PRIO_shaper.sh
 : 
 : For SSH interactive traffic and Web Browsing while uploading and 
 : downloading, seems to work as well as HTB_shaper, it tested on a 
 : single machine.
 : 
 : Of course there is no fairness on each prio band, so tests with 
 : multiple workstations should reveal the advantadges of 
 : HTB_shaper.

Well, good luck with it.  You could consider following the lartc.org 
HOWTO on PRIO qdiscs with embedded SFQs [0].

 : > I'm not crazy about the dropping of the MTU, but otherwise, 
 : 
 : I found that it was causing problems, so that part is gone.

While it's not a bad idea from a traffic control perspective, there 
are so many ramifications of changing the MTU that I don't find it 
worthwhile.

 : (OT: I wonder, if the kernel team doesn't want to include IMQ, 
 : what's their recommended solution for this problem, on a router 
 : with more than 2 interfaces)

The developers have recently been working on something called ifb, 
which is intended to be a replacement for IMQ.  I don't know too 
much about it, but there are snippets of documentation about the 
'net if you are on good terms with google.

- -Martin

 [0] http://lartc.org/howto/lartc.qdisc.classful.html#AEN903

- -- 
Martin A. Brown
http://linux-ip.net/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)
Comment: pgf-0.71 (http://linux-ip.net/sw/pine-gpg-filter/)

iD8DBQFEsxPRHEoZD1iZ+YcRAsmrAJ9TkcLnQ2TpzJCxHtdk2ACHHN/D+QCfcBof
3aOuyJi5+ZWjlq45ES9xjfE=
=CpY+
-----END PGP SIGNATURE-----
From deslay at gmail.com  Tue Jul 11 06:26:53 2006
From: deslay at gmail.com (Deslay)
Date: Tue Jul 11 06:26:42 2006
Subject: [LARTC] A multi-isp with priority routing and GRE tunneling network
	problem.
Message-ID: <aa12bbc30607102126w4f737e28j10e221f98843c76a@mail.gmail.com>

Hey guys,

i have a problem with building a multi-isp gateway using a GNU/Linux
box with priority routing enalbed and after all.

any ideas what should i do? maybe a step by step intro?

thanks in advanced.


Deslay
From prasad at atc.tcs.co.in  Tue Jul 11 06:41:08 2006
From: prasad at atc.tcs.co.in (Prasad)
Date: Tue Jul 11 06:40:59 2006
Subject: [LARTC] re-routing network traffic.
Message-ID: <44B32BE4.8060804@atc.tcs.co.in>


Hello All,

The following is what I was trying to do:

A packet [Dest: 10.10.10.2, Src: 10.10.10.30] has a route through 
"tunl0".  The bigger problem is that "tunl0" is a tunnel between 
10.10.10.2 and 10.10.10.20...  Which means that after encapsulation 
takes place, the packet would look like [Dest: 10.10.10.2, Src: 
10.10.10.20 [Dest: 10.10.10.2, Src: 10.10.10.30]].

Thing to be noted is that the destination of the packet before and after 
encapsulation is same!

This is what I plan to do:
1. Create a route such that all packets to 10.10.10.2 go through tunl0
2. In POSTROUTING, if destination is 10.10.10.2 and the packet is not 
marked, mark it.
3. Create another route for the packets that are marked.

Is this approach the right one, and is it possible to do such a thing - 
I am specially doubtful about the second step!!

Thanks,
Prasad
From rajendra at subisu.net.np  Tue Jul 11 08:57:37 2006
From: rajendra at subisu.net.np (rajendra@subisu.net.np)
Date: Tue Jul 11 08:57:42 2006
Subject: [LARTC] tcng not working as expected
Message-ID: <2346.202.63.240.23.1152601057.squirrel@mail.subisu.net.np>

Hi,
Looking at the following sample, shouldn't the client1_a be restricted to
35kBps even when there is 50kBps available. Please see the following
configuration and suggest.

What I wanted to do is I have clients grouped on VIP and Poor. The VIP
clients and poor clients may be subscribed with the same bandwidth but I
would like to prioritize the VIP clients. The VIP client will get the
allocated rate. If VIP is not using the links then poor clients will get
allocated rates, otherwise they are supressed. Among the VIP clients they
will get the allocated bandwidth, some may be 64kbps, some may be 128kbps.
e.g. In case of full utilization, the VIP client with 64kbps should get
full 64kbps but the poor client with 128kbps may get much lower.

I will appreciate your suggestion.

regds,
Rajendra.



#include "fields.tc"
#include "ports.tc"

#define LANSIDE eth0
#define WANSIDE eth1

/*######### Shape DOWNLOAD Traffic ############*/
/*#############################################*/
dev LANSIDE {

        egress {
                class ( <$client1_a> ) if  ip_dst == 10.10.10.24;
                class ( <$client1_b> ) if  ip_dst == 10.10.10.22;
                class ( <$client2> ) if  ip_dst == 10.10.10.23;

        htb() {
                //Total Bandwidth
                class (rate 50kBps, ceil 50kBps) {
                        //VIP clients
                        class (rate 40kBps, ceil 50kBps) {
                             $client1_a = class (rate 35kBps, ceil 35kBps) ;
                             $client1_b = class (rate 10kBps, ceil 10kBps) ;

                        }
                        //Poor clients
                        class (rate 10kBps, ceil 50kBps) {
                             $client2 = class (rate 35kBps, ceil 35kBps) ;
                        }
                }


        } //End of qdiscs (HTB)
        }
} //End of device (LANSIDE)


/*######### Shape UPLOAD Traffic ##############*/
/*#############################################*/
~


From jarkap at poczta.onet.pl  Wed Jul 12 08:02:37 2006
From: jarkap at poczta.onet.pl (Jarek Poplawski)
Date: Wed Jul 12 08:02:01 2006
Subject: [LARTC] [PATCH] IMQ for linux-2.6.17.4 with behavior param
Message-ID: <44B4907D.6080503@poczta.onet.pl>

Hi,

I see some inertion on www.linuximq.net, while kernels are at 
full speed, so here is my testing proposition for IMQ with:

- some minor bugs removed in imq.c (like improper err handling 
while registering queue handler),
- changes in ipt_IMQ.c and ip6t_IMQ.c to work with linux-2.6.17.4 
(iptables-1.3.5),
- added functionality to change behavior with module parameter 
(without recompiling).

I hope it should work, but testing was very limited (ipv6 not 
tested).

Best regards,

Jarek P.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: linux-2.6.17.4-imq0.diff.tar.gz
Type: application/x-gzip
Size: 6808 bytes
Desc: not available
Url : http://mailman.ds9a.nl/pipermail/lartc/attachments/20060712/37976abd/linux-2.6.17.4-imq0.diff.tar.bin
From jarkap at poczta.onet.pl  Thu Jul 13 10:39:41 2006
From: jarkap at poczta.onet.pl (Jarek Poplawski)
Date: Thu Jul 13 10:39:15 2006
Subject: [LARTC] [PATCH] IMQ vs. local traffic
Message-ID: <44B606CD.9020600@poczta.onet.pl>

Hello,

Some time ago I've read somewhere that local traffic in IMQ
could hung up the whole system but it was corrected long time
ago. So I was very surprised yesterday when it occurred not true.

While testing IMQ I've observed for some time that - if you tag
some local traffic with iptables both in pre- and postrouting -
kernel is hunging up. It is happening quite quick with SMP
compiled kernel but without SMP is also possible. After setting
soft lockups debbuging they are visible.

And then I've found this strange thing: packets outgoing from lo
to any local address are hooked to IMQ queue from PREROUTING (on
ingress). I know they are going there from OUTPUT for routing
decision and should be delivered to hooks in PREROUTING like IMQ,
but they also should not have IMQ flag set at the moment (they
will be "tagged" by iptables in the POSTROUTING future!). But for
some reasons (probably some shortcut) they do have this flag and
IMQ egress queue is not on their way.

So I added this short test in imq_nf_hook and my soft lockups
are gone.

Jarek P.

PS: The included patch could be applied after linux-2.6.16-imq2
patch or eg. my yesterday version linux-2.6.17.4-imq0.






-------------- next part --------------
diff -Nru linux-2.6.17.4-imq/drivers/net/imq.c linux-2.6.17.4-imq2/drivers/net/imq.c
--- linux-2.6.17.4-imq/drivers/net/imq.c	2006-07-11 22:00:00.000000000 +0200
+++ linux-2.6.17.4-imq2/drivers/net/imq.c	2006-07-12 22:15:51.000000000 +0200
@@ -234,7 +234,8 @@
                   const struct net_device *outdev,
                   int (*okfn)(struct sk_buff *))
 {
-       if ((*pskb)->imq_flags & IMQ_F_ENQUEUE)
+       if ((*pskb)->imq_flags & IMQ_F_ENQUEUE && !(hook == NF_IP_PRE_ROUTING
+               && indev == &loopback_dev))
                return NF_QUEUE;
 
        return NF_ACCEPT;










From jarkap at poczta.onet.pl  Fri Jul 14 07:42:47 2006
From: jarkap at poczta.onet.pl (Jarek Poplawski)
Date: Fri Jul 14 07:42:14 2006
Subject: [LARTC] Re: [PATCH] IMQ vs. local traffic
In-Reply-To: <44B606CD.9020600@poczta.onet.pl>
References: <44B606CD.9020600@poczta.onet.pl>
Message-ID: <44B72ED7.2060605@poczta.onet.pl>

Jarek Poplawski wrote:
...
> And then I've found this strange thing: packets outgoing from lo
> to any local address are hooked to IMQ queue from PREROUTING (on
> ingress). I know they are going there from OUTPUT for routing
> decision and should be delivered to hooks in PREROUTING like IMQ,
> but they also should not have IMQ flag set at the moment (they
> will be "tagged" by iptables in the POSTROUTING future!). But for
> some reasons (probably some shortcut) they do have this flag and
> IMQ egress queue is not on their way.

Bad diagnose! There is no shortcut. Only in my testing procedure: 
  I've switched off the egress hook, so the IMQ flag traveled 
from POSTROUTING to PREROUTING not annoyed. I forgot it isn't the 
real device. Sorry for misleading.

> So I added this short test in imq_nf_hook and my soft lockups
> are gone.

Nevertheles this method works. I dont't know why, yet. It exludes 
one direction of local traffic from queuing but who cares?

Jarek P.

From e1605project at hotmail.com  Fri Jul 14 11:28:47 2006
From: e1605project at hotmail.com (*~ r a K u ~ *)
Date: Fri Jul 14 11:28:42 2006
Subject: [LARTC] how different qdisc at root and leaf working???
Message-ID: <BAY123-F20B07CBC4E8A795BEFB539DD6F0@phx.gbl>

An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060714/691a3ec8/attachment.htm
From azez at ufomechanic.net  Fri Jul 14 10:29:25 2006
From: azez at ufomechanic.net (Amin Azez)
Date: Fri Jul 14 11:34:51 2006
Subject: [LARTC] Re: Bi-directional packet classification with ACK
	prioritization
In-Reply-To: <0633E0EDB4F25F43A2D7179CA11FAFAB255421@xavier.staff.greatlakes.net>
References: <0633E0EDB4F25F43A2D7179CA11FAFAB255421@xavier.staff.greatlakes.net>
Message-ID: <44B755E5.2010000@ufomechanic.net>

* Eliot, Wireless and Server Administrator, Great Lakes Internet wrote,
On 02/06/06 18:06:
> Sorry for making this a cross-post, but the pressure is on for getting
> this bandwidth shaper working.
> 
> I have an interesting dilemma with bi-directional packet classification
> while doing ACK prioritization. This is an overly simplified summary of
> my setup:
> 
> Internet
>   |
> Eth0 
>   |
>   Router
>   |
> Eth1
>   |
> Intranet
> 
> 
> A client on the Intranet establishes a flow to a server on the Internet.
> Packets get classified into 3 different priority bands. Priority 1 is
> for VoIP, DNS, SSH, Telnet, and ACK packets with no data payload.
> Priority 2 is for general traffic that does not fall into band 1 or band
> 3. Priority 3 band is for P2P. 
> 
> When the flow (download) is established, it starts out with the packets
> coming in on Priority Band 2. 
> 
> The client then sends an ACK packet to the server with no data payload. 
> 
> The router then classifies that ACK packet into Priority Band 1 and
> saves the mark that was set to put it in that classification. 
> 
> A response then comes back from the server and the router restores the
> mark it previously saved. Now it is flagged for Priority Band 1. 

I got round this by editing connmark and adding 2 more marks, one for
each direction. When connmark is set, in the conntrack it sets that mark
in the usual place and also in the slot for the current direction.

When the conntrack is used to populate the skb mark, I take the current
direction.

So I get the best of both worlds.

Sam

From e1605project at hotmail.com  Fri Jul 14 11:43:13 2006
From: e1605project at hotmail.com (*~ r a K u ~ *)
Date: Fri Jul 14 11:43:11 2006
Subject: [LARTC] How adventage, disadventage,
	comparison between HTB and HFSC??
Message-ID: <BAY123-F25EBF57CADD6DC47FA203DD6F0@phx.gbl>

An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060714/a2946d66/attachment.html
From martin at linux-ip.net  Fri Jul 14 17:48:46 2006
From: martin at linux-ip.net (Martin A. Brown)
Date: Fri Jul 14 17:48:54 2006
Subject: [LARTC] Can i attach another qdisc under classes or root qdisc?
In-Reply-To: <BAY123-F22E3CD8068CE55EB532131DD6B0@phx.gbl>
References: <BAY123-F22E3CD8068CE55EB532131DD6B0@phx.gbl>
Message-ID: <Pine.LNX.4.63.0607101549050.1261@solidus.wonderfrog.net>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello again Raku,

 : you mean we can define "nested qdisc" but algorithm in nested 
 : qdisc must same as parent class???? i'm not clear it and Is we 
 : can define nested qdisc with algorithm different from parent 
 : class?????

Next try at explaining the concept:

  - qdiscs can be attached to egress (default), ingress and any 
    class
  - classes may only be defined "underneath" (as children of) 
    existing classful qdiscs (CBQ, HTB, PRIO, HFSC)
  - a classful qdisc may only have children classes of the same type 
    (e.g., HTB qdisc can only have HTB classes; HFSC qdisc can only 
    have HFSC classes)
  - classless qdiscs are leaf branches on the tree

Be careful to distinguish classes from qdiscs.

 : tc qdisc add dev eth0 root handle 1: htb
 : //this left node hierachy for manage general package
 : tc class add dev eth0 parent 1: classid 1:1 htb rate 100kbps ceil 100kbps
 : //this right node hierachy for manage real time package
 : tc class add dev eth0 parent 1: classid 1:2 htb rate 100kbps ceil 100kbps
 : // from your adivse at step 4, attach brand-new after define class

 : but Is it true??? because algorithm new qdisc are different from 
 : class algorithm that qdisc attach it.

 : tc qdisc add dev eth0 parent 1:2 classid 10:11 hfsc rate 100kbps
 : tc class add dev eth0 parent 10:11 classid 1:111 hfsc rate 100kbps ceil
 : 100kbps
 : tc class add dev eth0 parent 10:11 classid 1:112 hfsc rate 100kbps ceil
 : 100kbps

Structurally speaking, there's nothing wrong with your hierarchy.  
When you try it out, however, you'll discover that you are not using 
the correct parameters for the hfsc qdisc and class specifications.

 : and Can somebody advise me about HOW TO do later in this topic. i 
 : want to have got traffic shaper and my solotion is ... i want to 
 : manage different traffic package (general package use and real 
 : time package) so now i think about have got a problem with tc 
 : command, ... i think it can't setting to manage different package 
 : with different algorithm HTB and HFSC Do you have any idea about 
 : how to setting tc command example???? thank you ?

Raku, I don't know whether HTB or HFSC would be better for your 
application, but I can tell you that HTB is better-understood by a 
larger number of people.  In the grand scheme of things, HFSC has 
seen far less use.  It's an excellent concept, and if you'd like to 
know more about the concepts behind the queuing discipline, I'd 
suggest the HFSC article by Klaus Rechert and Patrick McHardy [0].

I think a simple hierarchy almost exactly like the one detailed in 
their article is probably what you want.  It sounds like you have 
"realtime" traffic (e.g., VoIP) and bulk traffic.

So, read their documentation, and try to configure your traffic 
control structures as they suggest.  Once you have configured the 
traffic control structures, then add the filters to separate traffic 
into the appropriate classes, e.g.:

  FILTR="tc filter add dev $INTERFACE"

  # -- structure is built, now select some packets
  #
  $FILTR parent 1:0    protocol all prio 1 \
    u32 match ip src 192.168.7.0/24   flowid 1:10
  
  # -- example for grabbing anything at all
  #
  $FILTR parent 1:0    protocol all prio 1 \
    u32 match u32 0x0 0x0 at 0        classid 1:11
  
  # -- example for identifying all UDP traffic
  #
  $FILTR parent 1:0    protocol all prio 1 \
    u32 match u8 0x11 0xff at 9       classid 1:12

These are just example filters (and probably not great examples at 
that).  You should write your filters to select the traffic you want 
to place into each class.

Finally, let me recommend that you keep your class structure as 
simple as possible.

- -Martin

 [0] http://linux-ip.net/tc/hfsc.en/

- -- 
Martin A. Brown
http://linux-ip.net/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)
Comment: pgf-0.71 (http://linux-ip.net/sw/pine-gpg-filter/)

iD8DBQFEt7zjHEoZD1iZ+YcRAqBEAKCnuuyDblK9pKvG4Og12HJovGt3HQCcD3LD
u0rdSUkjmgmBJtJ/gpIfc0M=
=V1fF
-----END PGP SIGNATURE-----
From martin at linux-ip.net  Fri Jul 14 17:52:26 2006
From: martin at linux-ip.net (Martin A. Brown)
Date: Fri Jul 14 17:52:30 2006
Subject: [LARTC] how different qdisc at root and leaf working???
In-Reply-To: <BAY123-F20B07CBC4E8A795BEFB539DD6F0@phx.gbl>
References: <BAY123-F20B07CBC4E8A795BEFB539DD6F0@phx.gbl>
Message-ID: <Pine.LNX.4.63.0607141049270.1261@solidus.wonderfrog.net>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Raku,

 : /bin/false qdisc add dev eth1 handle 1: root htb default 1
 : /bin/false class add dev eth1 parent 1: classid 1:1 htb rate 2048Kbit
 : /bin/false class add dev eth1 parent 1:1 classid 1:21 htb rate 128Kbit ceil 512Kbit prio 2 quantum 1532
 : /bin/false class add dev eth1 parent 1:21 classid 1:299 htb rate 256Kbit ceil 256Kbit prio 4 quantum 1532
 : /bin/false qdisc add dev eth1 handle 299: parent 1:299 hfsc

You must have renamed "tc" to "false".  :)

 : use HTB only for shaper bandwidth in each sevice with setting parameter
 : rate???
 :
 : use HFSC only for manage dequeue traffic after shaper bandwidth from
 : inner class???

In the above traffic control structure, you have not specified any 
classes for the HFSC qdisc.  That means it's effectively doing 
nothing (useful).

Check out my earlier mail--and good luck,

- -Martin

P.S., Can you convince your hotmail account not to send HTML mail?

- -- 
Martin A. Brown
http://linux-ip.net/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)
Comment: pgf-0.71 (http://linux-ip.net/sw/pine-gpg-filter/)

iD8DBQFEt728HEoZD1iZ+YcRAvocAJ9A1rMrv+ubsILi0g5rymI0zO2yWwCfQ3ME
KmUumYYQYm01olICddwvCpg=
=/BSx
-----END PGP SIGNATURE-----
From lesteves at ic.uff.br  Fri Jul 14 22:56:56 2006
From: lesteves at ic.uff.br (Luciana Esteves Neves Hilario)
Date: Fri Jul 14 22:56:29 2006
Subject: [LARTC] I need help with tc filters!!!!!
Message-ID: <004e01c6a788$0be29f70$e10f14c8@setiba>

Skipped content of type multipart/alternative-------------- next part --------------
A non-text attachment was scrubbed...
Name: router_qos_script.sh
Type: application/octet-stream
Size: 4903 bytes
Desc: not available
Url : http://mailman.ds9a.nl/pipermail/lartc/attachments/20060714/0074bf05/router_qos_script.obj
From doc at lanaticasylum.de  Mon Jul 17 12:27:01 2006
From: doc at lanaticasylum.de (Marcus Schmid)
Date: Mon Jul 17 12:26:49 2006
Subject: [LARTC] ipp2p patch for kernel 2.6.17.4
Message-ID: <Pine.LNX.4.58.0607171212520.9208@defiant.lanatic.net>

Hello!

Our dormitory has a linux router w/ two DSL links to the Internet; we used
ipp2p (http://ipp2p.org/) for filtering peer to peer traffic (as we can
not tell whether the content transferred using such p2p tools has been
obtained legally or not, so we block that traffic).

Up to yesterday we were using kernel 2.6.10.11, which worked perfectly
with ipp2p. Now we updated to kernel 2.6.17.4, and ipp2p was broken.

We made a patch for ipp2p to bring the filter back to work again; maybe
the patch is helpful to others, so we decided to put up a webpage for
downloading the patch:

http://www.sieglitzhof.net/~doc/ipp2p/

Ciao,
Marcus Schmid

-------------------------------------------------------------------------
The most difficult thing in the world is to know how to do a thing and to
watch somebody else doing it wrong, without comment.
From jonped at gmail.com  Mon Jul 17 15:34:56 2006
From: jonped at gmail.com (Jon Pedersen)
Date: Mon Jul 17 15:34:50 2006
Subject: [LARTC] How to add multiple filters and netem rules on a single
	interface?
Message-ID: <aecb2b170607170634t710b25bds36f8fdf4b80a649f@mail.gmail.com>

Hi!

We want to run TCP streams to several port numbers through one interface,
each with a different delay set by Netem.
E.g. TCP streams to port 80 could have 50ms delay, while TCP streams to port
81 could have 100 ms delay and so on.

We have tried to solve this by using a combination of tc filter and netem
rules, but we can't get it quite right.
We are considering one class per port, each with their own Netem delay and
the following filter:

tc filter add dev eth0 protocol ip parent (?) prio 1 u32 match ip protocol 6
0xff match u16 80 0xffff at 20

Is this possible? If so, how do you create the class hierarchy and how do
you combine each filter with the netem rule?


Thank you very much in advance!

Jon Pedersen
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060717/30b3b0b3/attachment.htm
From russell-tcatm at stuart.id.au  Tue Jul 18 04:06:49 2006
From: russell-tcatm at stuart.id.au (Russell Stuart)
Date: Tue Jul 18 04:45:54 2006
Subject: [LARTC] RE: [PATCH 0/2] NET: Accurate packet scheduling for ATM/ADSL
In-Reply-To: <1151158431.6716.95.camel@jzny2>
References: <1150278004.26181.35.camel@localhost.localdomain>
	<1150286766.5233.15.camel@jzny2>
	<1150287983.3246.27.camel@ras.pc.brisbane.lube>
	<1150292693.5197.1.camel@jzny2>
	<1150843471.17455.2.camel@ras.pc.brisbane.lube>
	<15653CE98281AD4FBD7F70BCEE3666E53CD54A@comxexch01.comx.local>
	<1151000966.5392.34.camel@jzny2>
	<1151066247.4217.254.camel@ras.pc.brisbane.lube>
	<1151158431.6716.95.camel@jzny2>
Message-ID: <1153188409.13145.5.camel@ras.pc.brisbane.lube>

On Sat, 2006-06-24 at 10:13 -0400, jamal wrote:
> And yes, I was arguing that the tc scheme you describe would not be so
> bad either if the cost of making a generic change is expensive.
<snip>
> Patrick seems to have a simple way to compensate generically for link
> layer fragmentation, so i will not argue the practically; hopefully that
> settles it? ;->

Things seem to have died down.  Patrick's patch seemed 
unrelated to ATM to me.  I did put up another suggestion, 
but I don't think anybody was too impressed with the 
idea.  So that leave the current ATM patch as the only 
one we have on the table that addresses the ATM issue.

Since you don't think it is "too bad", can we proceed 
with it?

From moritz at uplink-verein.ch  Tue Jul 18 18:58:13 2006
From: moritz at uplink-verein.ch (Moritz Gartenmeister)
Date: Tue Jul 18 18:58:03 2006
Subject: [LARTC] ip tunnel and kernel 2.6.17.6
Message-ID: <db42965c0607180958k4bbec97p782b72c2acbfb0a6@mail.gmail.com>

hi all

i ran a few times in troubles with iproute an rtnetlink or netlink_dev
with newer kernels.

i.e. i can compile and recompile the kernel and iproute (all from
sources)... and as soon as i like to add a route to a tunnel:
ip route add 192.168.0.0/24 dev gre_tun
i get:
rtnetlink no such device.

ip link / ip addr is showing the tunnel (also ifconfig).

i assume, that the kernel doesn't support this feature or that iproute
is not ready for this kernel. i also experienced troubles with other
newer kernel. last known working kernel is 2.6.13.

i didn't find any infos about which kernel is working (iproute tested
against it) or any explanation about this.

before i try something impossible and wasting more time, i ask you for
some hints.

regards,
moritz
From lists at andyfurniss.entadsl.com  Tue Jul 18 23:56:42 2006
From: lists at andyfurniss.entadsl.com (Andy Furniss)
Date: Tue Jul 18 23:55:37 2006
Subject: [LARTC] tc ingress policing with multiple subnets
In-Reply-To: <1151764718.6342.19.camel@ccja.localhost>
References: <002b01c69130$de91c270$0600a8c0@hpa>	
	<449FD426.7060804@andyfurniss.entadsl.com>
	<1151764718.6342.19.camel@ccja.localhost>
Message-ID: <44BD591A.3040008@andyfurniss.entadsl.com>

Nikolay Kichukov wrote:

>>If you are shaping ingress you will need to set a rate below the link 
>>speed, or you won't do anything.
>>
> 
> How about a rate that matches the link speed? Will 95% of the link be
> alright for ingress?

Ingress shaping is a kludge - you can do alot better than doing nothing, 
but depending on the speed/buffer size of the link and your requirements 
you will need to sacrifice alot more than 5%. 20% for a start and 
depending on traffic upto 50% - ouch.

Andy.
From lists at andyfurniss.entadsl.com  Wed Jul 19 00:00:58 2006
From: lists at andyfurniss.entadsl.com (Andy Furniss)
Date: Tue Jul 18 23:59:51 2006
Subject: [LARTC] I need help with tc filters!!!!!
In-Reply-To: <004e01c6a788$0be29f70$e10f14c8@setiba>
References: <004e01c6a788$0be29f70$e10f14c8@setiba>
Message-ID: <44BD5A1A.506@andyfurniss.entadsl.com>

Luciana Esteves Neves Hilario wrote:
> Hi Everybody!
> 
>     I need help! I'm doing a tc script with tc filters that have match the Type of Service field in the IP header. This is the script I am using to setup the filters.
> 
> tc filter add dev $DEV parent 1: protocol ip prio $PRIO_CONTROL u32 match ip protocol 6 0xff \
> 
> match u32 00190000 00ff0000 at 0 flowid 1:10

You don't say what the problem is - If it's that the tos doesn't match 
it may be because the last bit is supposed to be cleared/unused and you 
are matching set?

Andy.
From lists at andyfurniss.entadsl.com  Wed Jul 19 00:05:27 2006
From: lists at andyfurniss.entadsl.com (Andy Furniss)
Date: Wed Jul 19 00:04:25 2006
Subject: [LARTC] [PATCH] IMQ vs. local traffic
In-Reply-To: <44B606CD.9020600@poczta.onet.pl>
References: <44B606CD.9020600@poczta.onet.pl>
Message-ID: <44BD5B27.1000104@andyfurniss.entadsl.com>

Jarek Poplawski wrote:

> PS: The included patch could be applied after linux-2.6.16-imq2
> patch or eg. my yesterday version linux-2.6.17.4-imq0.

I think this should go/cc to the IMQ list

linuximq@yahoogroups.com

http://groups.yahoo.com/group/linuximq/

Subscribe by mail and you won't get asked for a yahoo ID.

Andy.
From lists at andyfurniss.entadsl.com  Wed Jul 19 00:11:30 2006
From: lists at andyfurniss.entadsl.com (Andy Furniss)
Date: Wed Jul 19 00:10:23 2006
Subject: [LARTC] IFB vs IMQ
In-Reply-To: <c9961d450607080040v3d6e0a97uca2d6ca5cfe7df6a@mail.gmail.com>
References: <c9961d450607080040v3d6e0a97uca2d6ca5cfe7df6a@mail.gmail.com>
Message-ID: <44BD5C92.6090304@andyfurniss.entadsl.com>

Rajesh Mahajan wrote:
> Is IFB realy replacement of IMQ

Mostly - it hooks before/after netfilter though, so if you really need 
IMQ to hook "in" netfilter (eg. to get denatted addresses on ingress so 
you can seperate INPUT and FORWARD traffic), you still need IMQ.

Andy.
From lists at andyfurniss.entadsl.com  Wed Jul 19 00:35:24 2006
From: lists at andyfurniss.entadsl.com (Andy Furniss)
Date: Wed Jul 19 00:34:16 2006
Subject: [LARTC] IFB working
In-Reply-To: <c9961d450607022037x70bfd255s7c367ab14d610ce2@mail.gmail.com>
References: <c9961d450607021231x511d238brb5f3feffbaa580b6@mail.gmail.com>	<fa8654f10607021353m6f2a4f6craca762781d528df8@mail.gmail.com>
	<c9961d450607022037x70bfd255s7c367ab14d610ce2@mail.gmail.com>
Message-ID: <44BD622C.3020204@andyfurniss.entadsl.com>

Rajesh Mahajan wrote:
> All these documents have one line
> 
> action mirred egress redirect dev dummy0
> 
> what I can understand out of this is that all packets in egress of device
> are being redirected to dummy0, where as the need is to inject dummy 0 with
> packets in ingress of the device so that shaping can be done for packets
> storming in for our system and not the packets leaving our system.
> Policing can be done but here the requirement is for Shaping (queueing).
> With IMQ ingress shaping does work fine but the only question I have is how
> to shape packets coming in ingress of the device

$TC qdisc add dev eth0 ingress
$TC filter add dev eth0 parent ffff: \
protocol ip prio 10 u32 match ip src 192.168.0.10 \
flowid 1:0 \
action mirred egress redirect dev ifb0

Andy.
From kavithak at pal.ece.iisc.ernet.in  Wed Jul 19 08:08:17 2006
From: kavithak at pal.ece.iisc.ernet.in (kavita)
Date: Wed Jul 19 08:08:25 2006
Subject: [LARTC] how to identify RTP packets?
Message-ID: <4756.10.32.19.84.1153289297.squirrel@www.pal.ece.iisc.ernet.in>



 Hi,

   I am working on voice application. I want to identify RTP packets
and set DSCP for those. Is there anyway to accomplish this task either
using tc or iptables. Please help me..

   Thank you




-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

From nikky at mnet.bg  Wed Jul 19 09:38:50 2006
From: nikky at mnet.bg (Nickola Kolev)
Date: Wed Jul 19 09:38:42 2006
Subject: [LARTC] how to identify RTP packets?
In-Reply-To: <4756.10.32.19.84.1153289297.squirrel@www.pal.ece.iisc.ernet.in>
References: <4756.10.32.19.84.1153289297.squirrel@www.pal.ece.iisc.ernet.in>
Message-ID: <20060719103850.2c86bba3.nikky@mnet.bg>

Hello, Kavita,


On Wed, 19 Jul 2006 11:38:17 +0530 (IST)
"kavita" <kavithak@pal.ece.iisc.ernet.in> wrote:

> 
> 
>  Hi,
> 
>    I am working on voice application. I want to identify RTP packets
> and set DSCP for those. Is there anyway to accomplish this task either
> using tc or iptables. Please help me..

Nope, you can't do that, because the transport stream is defined as
src/dst port dinamically by the VoIP control channel, be it
H.323/SIP/MGCP/Skinny/whateva. The only feasible way is to set ToS/DSCP
into the VoIP endpoints/applications. I've seen many devices allowing
you to set up speciffic ToS for the RTP stream.

Well, of course you could you some sort of l7 classification, but that
is speciffic to your needs.

>    Thank you

[ cut ]

Regards,
Nickola
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url : http://mailman.ds9a.nl/pipermail/lartc/attachments/20060719/b71c198b/attachment.pgp
From jarkap at poczta.onet.pl  Wed Jul 19 09:44:24 2006
From: jarkap at poczta.onet.pl (Jarek Poplawski)
Date: Wed Jul 19 09:44:38 2006
Subject: [LARTC] Re: [PATCH] IMQ vs. local traffic
References: <44B606CD.9020600@poczta.onet.pl>
	<44BD5B27.1000104@andyfurniss.entadsl.com>
Message-ID: <loom.20060719T090721-980@post.gmane.org>

Andy Furniss <lists <at> andyfurniss.entadsl.com> writes:

> 
> Jarek Poplawski wrote:
> 
> > PS: The included patch could be applied after linux-2.6.16-imq2
> > patch or eg. my yesterday version linux-2.6.17.4-imq0.
> 
> I think this should go/cc to the IMQ list
> 
> linuximq <at> yahoogroups.com
> 
> http://groups.yahoo.com/group/linuximq/
> 
> Subscribe by mail and you won't get asked for a yahoo ID.

Hello,

I had this intention from the start but when I havn't seen any changes on the
web site (from 2006-03-25), no activity on the group site for long time and no
posibility to read any archives of that group, I thought maybe here would be
some more interest. I've seen some patches here, so I dared to send mine. The
second receiver was Andre Correa (I think he tries to save his address).

After your mail I looked at this group site again and, miracuously, I see some
activity today, so I'll take your advice and subscribe.

Thanks,

Jarek P.


From gustavo at angulosolido.pt  Tue Jul 18 21:10:08 2006
From: gustavo at angulosolido.pt (Gustavo Homem)
Date: Wed Jul 19 10:06:06 2006
Subject: [LARTC] skype specific QoS - assigning skype traffic to an HTB class
Message-ID: <200607182010.09070.gustavo@angulosolido.pt>

Hi,

What do you think about this solution for skype specific QoS:

	function HTB_shape
	{
	###########################################################
	# Shapes the traffic of an interface, limiting the late
	#
	# Arguments are DEV,RATE


	DEV=$1
	RATE=$2

	[...]

	PORT=dport
	if [ $DEV == $EXTIF ]; then
		PORT=sport
	fi

	iptables -t mangle -A MYSHAPER-$DEV -p tcp --$PORT 4000 -j MARK --set-mark 22    					                                
	# skype configured to listen on 4000
	iptables -t mangle -A MYSHAPER-$DEV -p udp --$PORT 4000 -j MARK --set-mark 22    

	[...]

	}

	[...]

	HTB_shape $INTIF $RATEDN
	HTB_shape $EXTIF $RATEUP

?

According to

http://www.skype.com/help/faq/technical.html

we can choose the port that skype will use for sending and receiving traffic. 
For this example port  4000 was chosen, and that port is forwarded from the 
linux router to the internal machine that runs skype for both TCP and UDP 
traffic.

The idea is that since we're shapping on the output of each interface, for the 
external interface we want to filter on the source port whereas for the 
internal one what matters is the destination port.

The complete script is here:

http://downloads.angulosolido.pt/QoS/HTB_shaper.sh

Comments?

Best regards
Gustavo

-- 
 Angulo S?lido - Tecnologias de Informa??o
http://angulosolido.pt
From doudouyam at gmail.com  Wed Jul 19 11:36:20 2006
From: doudouyam at gmail.com (doudouyam)
Date: Wed Jul 19 11:36:11 2006
Subject: [LARTC] PRIO and CBQ
Message-ID: <81c11a560607190236w529e467cl66749deb5bd8d5bc@mail.gmail.com>

Hi,
I'm work on traffic shaping and I would like to know if it's possible to mix
differents Queueing Disciplines ??
I would like to combine the proporties of a PRIO discipline with that of a
CBQ discipline.
I read some documentation and I found nothing about that, can you help me ?

I think to try something like that :

tc qdisc add dev $DEV root handle 1: cbq ?
tc class add dev $DEV parent 1: classid 1:1 cbq ?
tc class add dev $DEV parent 1:1 classid 1:10 cbq ?
tc class add dev $DEV parent 1:1 prio

Normally I've this tree :

           1:(cbq)
               |
               |
             1:1
           /      \
          /         \
1:10(cbq)      1:??(prio)

Or something like that :

tc qdisc add dev $DEV root handle 1: prio band 2
tc class add dev $DEV parent 1: classid 1:2 cbq ?
tc class add dev $DEV parent 1:2 classid 1:3 cbq ?
tc class add dev $DEV parent 1:2 classid 1:4 cbq ?

tc qdisc add dev $DEV parent 1:1 handle 10: pfifo
tc qdisc add dev $DEV parent 1:3 handle 30 sfq
tc qdisc add dev $DEV parent 1:4 handle 40 sfq

            1:(prio)
           /          \
          /            \
       1:1            1:2
         |             /   \
         |            /     \
        10:       1:3    1:4
        (pfifo)      |        |
                      |        |
                     30:     40:
                    (sfq)   (sfq)

Is it possible ??? (the first solution seems to me not possible)


Thanks.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060719/b56e7505/attachment-0001.htm
From doudouyam at gmail.com  Wed Jul 19 12:10:04 2006
From: doudouyam at gmail.com (doudouyam)
Date: Wed Jul 19 12:09:52 2006
Subject: [LARTC] Re: PRIO and CBQ
In-Reply-To: <81c11a560607190236w529e467cl66749deb5bd8d5bc@mail.gmail.com>
References: <81c11a560607190236w529e467cl66749deb5bd8d5bc@mail.gmail.com>
Message-ID: <81c11a560607190310g5c33333ar5fc5d1a81c0bd6c8@mail.gmail.com>

I've made a mistake in the second case:


tc qdisc add dev $DEV root handle 1: prio band 1
tc class add dev $DEV parent 1: classid 1:2 cbq ?
tc class add dev $DEV parent 1:2 classid 1:3 cbq ?
tc class add dev $DEV parent 1:2 classid 1:4 cbq ?

tc qdisc add dev $DEV parent 1:1 handle 10: pfifo
tc qdisc add dev $DEV parent 1:3 handle 30: sfq
tc qdisc add dev $DEV parent 1:4 handle 40: sfq

            1:(prio)
           /          \
          /            \
       1:1            1:2
         |             /   \
         |            /     \
        10:       1:3    1:4
        (pfifo)      |        |
                      |        |
                     30:     40:
                    (sfq)   (sfq)

2006/7/19, doudouyam <doudouyam@gmail.com>:
>
> Hi,
> I'm work on traffic shaping and I would like to know if it's possible to
> mix differents Queueing Disciplines ??
> I would like to combine the proporties of a PRIO discipline with that of a
> CBQ discipline.
> I read some documentation and I found nothing about that, can you help me
> ?
>
> I think to try something like that :
>
> tc qdisc add dev $DEV root handle 1: cbq ?
> tc class add dev $DEV parent 1: classid 1:1 cbq ?
> tc class add dev $DEV parent 1:1 classid 1:10 cbq ?
> tc class add dev $DEV parent 1:1 prio
>
> Normally I've this tree :
>
>            1:(cbq)
>                |
>                |
>              1:1
>            /      \
>           /         \
> 1:10(cbq)      1:??(prio)
>
> Or something like that :
>
> tc qdisc add dev $DEV root handle 1: prio band 2
> tc class add dev $DEV parent 1: classid 1:2 cbq ?
> tc class add dev $DEV parent 1:2 classid 1:3 cbq ?
> tc class add dev $DEV parent 1:2 classid 1:4 cbq ?
>
> tc qdisc add dev $DEV parent 1:1 handle 10: pfifo
> tc qdisc add dev $DEV parent 1:3 handle 30 sfq
> tc qdisc add dev $DEV parent 1:4 handle 40 sfq
>
>             1:(prio)
>            /          \
>           /            \
>        1:1            1:2
>          |             /   \
>          |            /     \
>         10:       1:3    1:4
>         (pfifo)      |        |
>                       |        |
>                      30:     40:
>                     (sfq)   (sfq)
>
> Is it possible ??? (the first solution seems to me not possible)
>
>
> Thanks.
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060719/1aab150e/attachment.html
From lists at andyfurniss.entadsl.com  Wed Jul 19 13:39:16 2006
From: lists at andyfurniss.entadsl.com (Andy Furniss)
Date: Wed Jul 19 13:38:09 2006
Subject: [LARTC] How to add multiple filters and netem rules on a single
	interface?
In-Reply-To: <aecb2b170607170634t710b25bds36f8fdf4b80a649f@mail.gmail.com> 
References: <aecb2b170607170634t710b25bds36f8fdf4b80a649f@mail.gmail.com> 
Message-ID: <44BE19E4.2030100@andyfurniss.entadsl.com>

Andy Furniss wrote:
> Jon Pedersen wrote:
> 
>> Hi!
>>
>> We want to run TCP streams to several port numbers through one interface,
>> each with a different delay set by Netem.
>> E.g. TCP streams to port 80 could have 50ms delay, while TCP streams 
>> to port
>> 81 could have 100 ms delay and so on.
>>
>> We have tried to solve this by using a combination of tc filter and netem
>> rules, but we can't get it quite right.
>> We are considering one class per port, each with their own Netem delay 
>> and
>> the following filter:
>>
>> tc filter add dev eth0 protocol ip parent (?) prio 1 u32 match ip 
>> protocol 6
>> 0xff match u16 80 0xffff at 20
>>
>> Is this possible? If so, how do you create the class hierarchy and how do
>> you combine each filter with the netem rule?
> 
> 
> I've only used netem for simple stuff so am not sure if it's possible 
> this way or not.
> 
> Another way to try would be to use multiple ifbs and filter the 
> different traffic to those.
> 
> Andy.
> 
> 
> 
> 
> 

From doudouyam at gmail.com  Wed Jul 19 15:15:18 2006
From: doudouyam at gmail.com (doudouyam)
Date: Wed Jul 19 15:15:14 2006
Subject: [LARTC] Re: PRIO and CBQ
In-Reply-To: <81c11a560607190310g5c33333ar5fc5d1a81c0bd6c8@mail.gmail.com>
References: <81c11a560607190236w529e467cl66749deb5bd8d5bc@mail.gmail.com>
	<81c11a560607190310g5c33333ar5fc5d1a81c0bd6c8@mail.gmail.com>
Message-ID: <81c11a560607190615j3736a045p9e3d8940d6308eee@mail.gmail.com>

I found a script at http://www.docum.org/docum.org/ which answer at my
question :

tc qdisc del $DEV root
tc qdisc add $DEV root handle 10: cbq bandwidth 10mbit avpkt 1000
tc class add $DEV parent 10:0 classid 10:1 cbq bandwidth 10mbit rate
$RATE_TOT $OPTION prio 3 bounded isolated

tc qdisc add $DEV parent 10:1 handle 20: prio

Is it correct ?


2006/7/19, doudouyam <doudouyam@gmail.com>:
>
> I've made a mistake in the second case:
>
>
>
> tc qdisc add dev $DEV root handle 1: prio band 1
> tc class add dev $DEV parent 1: classid 1:2 cbq ?
> tc class add dev $DEV parent 1:2 classid 1:3 cbq ?
> tc class add dev $DEV parent 1:2 classid 1:4 cbq ?
>
> tc qdisc add dev $DEV parent 1:1 handle 10: pfifo
> tc qdisc add dev $DEV parent 1:3 handle 30: sfq
> tc qdisc add dev $DEV parent 1:4 handle 40: sfq
>
>             1:(prio)
>            /          \
>           /            \
>        1:1            1:2
>          |             /   \
>          |            /     \
>         10:       1:3    1:4
>         (pfifo)      |        |
>                       |        |
>                      30:     40:
>                     (sfq)   (sfq)
>
> 2006/7/19, doudouyam <doudouyam@gmail.com >:
>
> > Hi,
> > I'm work on traffic shaping and I would like to know if it's possible to
> > mix differents Queueing Disciplines ??
> > I would like to combine the proporties of a PRIO discipline with that of
> > a CBQ discipline.
> > I read some documentation and I found nothing about that, can you help
> > me ?
> >
> > I think to try something like that :
> >
> > tc qdisc add dev $DEV root handle 1: cbq ?
> > tc class add dev $DEV parent 1: classid 1:1 cbq ?
> > tc class add dev $DEV parent 1:1 classid 1:10 cbq ?
> > tc class add dev $DEV parent 1:1 prio
> >
> > Normally I've this tree :
> >
> >            1:(cbq)
> >                |
> >                |
> >              1:1
> >            /      \
> >           /         \
> > 1:10(cbq)      1:??(prio)
> >
> > Or something like that :
> >
> > tc qdisc add dev $DEV root handle 1: prio band 2
> > tc class add dev $DEV parent 1: classid 1:2 cbq ?
> > tc class add dev $DEV parent 1:2 classid 1:3 cbq ?
> > tc class add dev $DEV parent 1:2 classid 1:4 cbq ?
> >
> > tc qdisc add dev $DEV parent 1:1 handle 10: pfifo
> > tc qdisc add dev $DEV parent 1:3 handle 30 sfq
> > tc qdisc add dev $DEV parent 1:4 handle 40 sfq
> >
> >             1:(prio)
> >            /          \
> >           /            \
> >        1:1            1:2
> >          |             /   \
> >          |            /     \
> >         10:       1:3    1:4
> >         (pfifo)      |        |
> >                       |        |
> >                      30:     40:
> >                     (sfq)   (sfq)
> >
> > Is it possible ??? (the first solution seems to me not possible)
> >
> >
> > Thanks.
> >
> >
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060719/2ced1660/attachment.htm
From rayvd at digitalpath.net  Wed Jul 19 18:51:48 2006
From: rayvd at digitalpath.net (Ray Van Dolson)
Date: Wed Jul 19 18:51:36 2006
Subject: [LARTC] What am I missing?
Message-ID: <20060719165148.GA21024@digitalpath.net>

On a custom compiled Linux 2.6.13 kernel...

# tc qdisc add dev ppp145 handle ffff: ingress
# tc filter add dev ppp145 parent ffff: protocol ip prio 50 u32 match ip src 0.0.0.0/0 police rate 384kbit burst 10k drop flowid :1
RTNETLINK answers: Invalid argument

This works fine on a CentOS machine and my Fedora Core 2 box with default
kernel.  I'm trying to figure out what is missing in the custom built 2.6.13
kernel.  strace isn't real helpful, and there doesn't appear to be a way to
make tc present more useful error messages...

Non ingress filtering works.  Here's an excerpt from kernel config:

#
# QoS and/or fair queueing
#
CONFIG_NET_SCHED=y
CONFIG_NET_SCH_CLK_JIFFIES=y
# CONFIG_NET_SCH_CLK_GETTIMEOFDAY is not set
# CONFIG_NET_SCH_CLK_CPU is not set
CONFIG_NET_SCH_CBQ=y
CONFIG_NET_SCH_HTB=y
CONFIG_NET_SCH_HFSC=y
CONFIG_NET_SCH_PRIO=y
CONFIG_NET_SCH_RED=y
CONFIG_NET_SCH_SFQ=y
CONFIG_NET_SCH_TEQL=y
CONFIG_NET_SCH_TBF=y
CONFIG_NET_SCH_GRED=y
CONFIG_NET_SCH_DSMARK=y
CONFIG_NET_SCH_NETEM=y
CONFIG_NET_SCH_INGRESS=y
CONFIG_NET_QOS=y
CONFIG_NET_ESTIMATOR=y
CONFIG_NET_CLS=y
# CONFIG_NET_CLS_BASIC is not set
CONFIG_NET_CLS_TCINDEX=y
CONFIG_NET_CLS_ROUTE4=y
CONFIG_NET_CLS_ROUTE=y
CONFIG_NET_CLS_FW=y
CONFIG_NET_CLS_U32=y
CONFIG_CLS_U32_PERF=y
CONFIG_NET_CLS_IND=y
# CONFIG_CLS_U32_MARK is not set
CONFIG_NET_CLS_RSVP=y
CONFIG_NET_CLS_RSVP6=y
# CONFIG_NET_EMATCH is not set
# CONFIG_NET_CLS_ACT is not set
CONFIG_NET_CLS_POLICE=y

Any ideas?  Can paste entire kernel config if necessary.
From russell-tcatm at stuart.id.au  Thu Jul 20 06:56:04 2006
From: russell-tcatm at stuart.id.au (Russell Stuart)
Date: Thu Jul 20 07:50:39 2006
Subject: [LARTC] Re: [PATCH 0/2] NET: Accurate packet scheduling for ATM/ADSL
In-Reply-To: <44BE46A6.8000207@trash.net>
References: <1150278004.26181.35.camel@localhost.localdomain>
	<1150286766.5233.15.camel@jzny2>
	<1150287983.3246.27.camel@ras.pc.brisbane.lube>
	<1150292693.5197.1.camel@jzny2>
	<1150843471.17455.2.camel@ras.pc.brisbane.lube>
	<15653CE98281AD4FBD7F70BCEE3666E53CD54A@comxexch01.comx.local>
	<1151000966.5392.34.camel@jzny2>
	<1151066247.4217.254.camel@ras.pc.brisbane.lube>
	<1151158431.6716.95.camel@jzny2>
	<1153188409.13145.5.camel@ras.pc.brisbane.lube>
	<44BD56A4.9090002@andyfurniss.entadsl.com>
	<1153270932.4242.60.camel@ras.pc.brisbane.lube>
	<44BE46A6.8000207@trash.net>
Message-ID: <1153371364.4231.61.camel@ras.pc.brisbane.lube>

On Wed, 2006-07-19 at 16:50 +0200, Patrick McHardy wrote:
> Please excuse my silence, I was travelling and am still catching up
> with my mails.

Sorry.  Had I realised you were busy I would of
waited.

> > - As it stands, it doesn't help the qdiscs that use 
> >   RTAB.  So unless he proposes to remove RTAB entirely 
> >   the ATM patch as it will still have to go in.
> 
> Why? The length calculated by my STABs (or something similar)
> is used by _all_ qdiscs. Not only for transmission time calculation,
> but also for statistics and estimators.

Oh.  I didn't see where it is used for the time 
calculation in your patch.  Did I miss something,
or is that the unfinished bit?

This is possibly my stumbling block.  If you don't remove
RTAB the ATM patch as stands will be needed.  Your patch
didn't remove RTAB, and you didn't say it was intended to,
so I presume it wasn't going to.

>  If the length calculation
> doesn't fit for ATM, that can be fixed.

Yes of course.  Just to be clear: as far as I am concerned
this never was an issue.

> > - A bit of effort was put into making this current
> >   ATM patch both backwards and forwards compatible.
> >   Patricks patch would work with newer kernels,
> >   obviously.  Older kernels, and in particular the
> >   kernel that Debian is Etch is likely to distribute
> >   would miss out.
> 
> True, but it provides more consistency, and making current
> kernels behave better is more important than old kernels.

I guess provided the new "tc" works with older kernels this
is OK - although a disappoint to me.  Works here being defined
as "works as well as a previous the version of tc does".  For 
me not working would be OK as well provided "tc" issued a 
warning message to the effect that it "needs kernel version 
XXX or above"", but doing that would probably require it to 
look at the kernel version.  Looking at the kernel version 
in tc seems to be frowned upon.

> You seem to have misunderstood my patch. It doesn't need to
> touch RTABs, it just calculates the packet length as seen
> on the wire (whereever it is) and uses that thoughout the
> entire qdisc layer.

No, you have it in reverse - as I said above.  My problem is 
that your patch does not touch RTAB.  Several qdiscs really 
don't care about the length of a packet (other than for 
keeping track of stats) - they just care about how long 
it takes to send.  Off the top of my these are HTB, CBQ 
and TBF.  They use RTAB to make this calculation.  So unless
you replace RTAB with STAB the current ATM patch will still 
be needed.

> > One other point - the optimisation Patrick proposes
> > for STAB (over RTAB) was to make the number of entries
> > variable.  This seems like a good idea.  However there 
> > is no such thing as a free lunch, and if you did 
> > indeed reduce the number of entries to 16 for Ethernet 
> > (as I think Patrick suggested), then each entry would
> > cover 1500/16 = 93 different packet lengths.  Ie,
> > entry 0 would cover packet lengths 0..93, entry 1
> > 94..186, and so on.  A single entry can't be right
> > for all those packet lengths, so again we are back
> > to a average 30% error for typical VOIP length
> > packets.
> 
> My patch doesn't uses fixed sized cells, so it can deal
> with anything, worst case is you use one cell per packet
> size. Optimizing size and lookup speed for ethernet makes
> a lot more sense than optimizing for ADSL.

I was just responding to a point you made earlier, when
you said STAB could only use 16 entries as opposed to the
256 used by RTAB.  I suspect nobody would actually do that 
because of the inaccuracy it creates, so the comparison is
perhaps unfair.  I agree the flexibility of making STAB 
variable length is a good idea, and comes at 0 cost in 
the kernel.

Andy Furniss wrote:
> > Russell Stuart wrote:
> >> The kernel will have to do a shift and a division
> >> for each packet, which I assume is permissible.
> > 
> > 
> > I guess that is for others to decide :-) I think Patrick has a point
> > about sfq/htb drr, Like you I guess, I thought that alot of extra per
> > packet calculations would have got an instant NO.
> 
> Its only done once per packet (currently, it might be interesting to
> override the length for specific classes and their childs, for example
> if you do queueing on eth0 and have an DSL router one hop apart).
> The division is gone in my patch btw.

Unlike the packet length the time calculation can't be
cached in the skb.  Most classes in HTB/CBQ use different
packet transmission rates.

From russell-tcatm at stuart.id.au  Thu Jul 20 07:47:54 2006
From: russell-tcatm at stuart.id.au (Russell Stuart)
Date: Thu Jul 20 07:51:03 2006
Subject: [LARTC] Re: [PATCH 0/2] NET: Accurate packet scheduling for
	ATM/ADSL (RTAB BUG)
In-Reply-To: <20060719210004.GB20264@ms2.inr.ac.ru>
References: <1150843471.17455.2.camel@ras.pc.brisbane.lube>
	<15653CE98281AD4FBD7F70BCEE3666E53CD54A@comxexch01.comx.local>
	<1151000966.5392.34.camel@jzny2>
	<1151066247.4217.254.camel@ras.pc.brisbane.lube>
	<1151158431.6716.95.camel@jzny2>
	<1153188409.13145.5.camel@ras.pc.brisbane.lube>
	<44BD56A4.9090002@andyfurniss.entadsl.com>
	<1153270932.4242.60.camel@ras.pc.brisbane.lube>
	<44BE44E3.9080100@andyfurniss.entadsl.com>
	<Pine.LNX.4.61.0607192114240.9570@tyr.diku.dk>
	<20060719210004.GB20264@ms2.inr.ac.ru>
Message-ID: <1153374474.4231.103.camel@ras.pc.brisbane.lube>

On Thu, 2006-07-20 at 01:00 +0400, Alexey Kuznetsov wrote:
> Hello!

So you really do exist?  I thought it was just
rumour.

> Well, if fixed point arithmetics is not a problem.

It shouldn't be.  Any decimal number can be expressed
as a fraction, eg:

  0.00123 = 123/100000

Which can be calculated as a multiply and a divide. With
MTU's up to 2048, it should be possible to do this with
99.9999% accuracy (ie 2048/2^23).

With a bit more work in userspace (ie in tc), it can be
be reduced to a multiply and a shift.

> Plus, remember, the function is not R*size, it is at least
> R*size+addend, to account for link overhead. Plus account for padding
> of small packets. Plus, when policing it should deaccount already added
> link headers, QoS counts only network payload.

Yes, it is flexible - and has served us well up until
now.  It doesn't work well for ATM, but with a small
bit of extra calculation in the kernel it could.
However, it turns out that ATM is a special case.  If 
ATM's cell payload was 58 bytes instead of 48 bytes 
(say), then it would not be possible to produce a RTAB 
that had small errors (eg < 10%) for smallish packet 
sizes (< 290 bytes).  I seem to have trouble 
explaining why in a concise way that people understand, 
so I won't try here.

So when Alan Cox said our ATM patch didn't solve the 
packetisation problem in general, he was right as our
patch just built upon RTAB.  Patrick's STAB proposal 
in general either for that matter, as it is just another 
implementation of RTAB with the same limitations.  The 
only way I can think of to solve it in general is to 
move many more calculations into the kernel - as I 
proposed in a long winded answer to Patrick earlier 
in this thread.

But doing so would get rid of the table implementation 
and the flexibility it has given us to date.  For that 
reason I feel uncomfortable with it.

The engineering decision becomes this - are there any
other protocols like ATM out there that could justify 
such a change?  (In my more cynical moments I think of 
it differently - has/is the world going to make a 
second engineering fuck up on the scale of ATM again?  
How on earth did anyone decide that pushing data 
packets over ATM, as happens in ADSL, was a good 
idea?)  I know of no other such protocols.  But then
I don't have an encyclopedic knowledge of comms
protocols, so that doesn't mean much.  I suspect you
know a good deal more about them than I do.  What say
you?

From jserink2004 at yahoo.com  Thu Jul 20 08:16:24 2006
From: jserink2004 at yahoo.com (John Serink)
Date: Thu Jul 20 08:16:11 2006
Subject: [LARTC] GRE over IPsec Cisco<-> Linux
Message-ID: <20060720061624.90307.qmail@web54512.mail.yahoo.com>

Hello Lartc Mailing List:

Been working on something the last week and a half and ALMOST have it
working.., just need a few pointers from the wizards on this mailing list to
nail it.

Ok, my setup is a hub and spoke arrangement, hub is Cisco 2821 with IOS 12.4.
Spokes are ruggencom RX1000 routers, Debian based with the following versions
installed:

rx1000test:~# uname -a
Linux rx1000test 2.6.8-16-486-rx #1 Wed Mar 15 15:33:23 UTC 2006 i586 GNU/Linux
rx1000test:~# iptables -v
iptables v1.2.11: no command specified
rx1000test:~# shorewall version
2.2.3
rx1000test:~# ip -V
ip utility, iproute2-ss041019
rx1000test:~# ipsec version
Linux Openswan U2.2.0/K2.6.8-16-486-rx (native)

Openswan is using the Kernel 2.6 native stack NOT klips.

Here is my setup, only one spoke for now:

192.168.1.0/28      160.96.97.248                Dynamic        192.168.1.96/28
 |  192.168.1.1            |                      |         192.168.1.97  |
 |        |    HUB         |                      |  SPOKE         |      |
 |        | +------------+ |                      | +-----------+  |      |
 |        | |            | |                      | |           |  |      |
 +----------+ Cisco 2821 +--------INTERNET----------+ rx1000test+---------+
 |          |            |                          |           |         |
 |          +------------+                          +-----------+         |
 |                                                                        |
 192.168.1.1(ipsec endpoint)----------------------(ipsec endpoint)192.168.1.97
    192.168.1.1(gre endpoint)-----------------(gre endpoint)192.168.1.97
         192.168.2.110  gre tunnel 192.178.2.96/28   192.168.2.97
 
 Here is the setup on te Cisco:
 interface Tunnel6
 	ip address 192.168.2.110 255.255.255.240
 	tunnel source GigabitEthernet0/1
 	tunnel destination 192.168.1.97
	exit
ip route 0.0.0.0 0.0.0.0 160.96.97.250
ip route 192.168.1.96 255.255.255.240 Tunnel6
ip route 192.168.1.97 255.255.255.255 GigabitEthernet0/0
! This last line is required to get around a recusive route error in the cisco

Linux setup:
IPSec.conf
rx1000test:~# cat /etc/ipsec.conf
# /etc/ipsec.conf - Openswan IPsec configuration file
version 2.0     # conforms to second version of ipsec.conf specification
config setup
        # Debug-logging controls:  "none" for (almost) none, "all" for lots.
        klipsdebug=none
        plutodebug=none
    interfaces=%defaultroute
        uniqueids=yes

# Add connections here

conn GDC1
        authby=secret
        auto=start
        left=%defaultroute
        leftsourceip=192.168.1.97
        leftid=@rx1000test
        leftsubnet=192.168.1.96/28
        ike=aes128-md5-modp1024
        esp=aes128-md5
        right=160.96.97.248
        rightsubnet=192.168.1.0/28
        rightsourceip=192.168.1.1
        type=tunnel
        pfs=yes
        keyingtries=0


        #Disable Opportunistic Encryption
include /etc/ipsec.d/examples/no_oe.conf

The IPsec works fine except for the following caveats:
1. Spoke routers cannot ping each other,
2. The cisco has no interfaces for the scope routers so no qos can be done.

Linux GRE setup:
modprobe ip_gre
ip tunnel add GDC1 mode gre remote 192.168.1.1 local 192.168.1.97 ttl 255
ip link set GDC1 up
ip addr add 192.168.2.97/28 peer 192.168.2.110/28 dev GDC1
ip route del 192.168.1.0/28 via 160.96.97.248
ip route add 192.168.1.0/28 via 192.168.2.110

Ok, the ip route del was necessary to get rid of the IPSec route and replace it
with the gre tunnel.

Linux box status:
rx1000test:~# ip addre show
1: lo: <LOOPBACK,UP> mtu 16436 qdisc noqueue
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
3: eth1: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
    link/ether 00:0a:dc:04:7d:dc brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.97/28 brd 192.168.1.255 scope global eth1
4: eth2: <BROADCAST,MULTICAST> mtu 1500 qdisc noop qlen 1000
    link/ether 00:0a:dc:04:7d:dd brd ff:ff:ff:ff:ff:ff
6: w1adsl: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
    link/ether 00:77:77:77:7b:b3 brd ff:ff:ff:ff:ff:ff
9: gre0: <NOARP> mtu 1428 qdisc noop
    link/gre 0.0.0.0 brd 0.0.0.0
12: GDC1@NONE: <POINTOPOINT,NOARP,PROMISC,UP> mtu 1514 qdisc noqueue
    link/gre 192.168.1.97 peer 192.168.1.1
    inet 192.168.2.97 peer 192.168.2.110/28 scope global GDC1
13: ppp1: <POINTOPOINT,MULTICAST,NOARP,UP> mtu 1452 qdisc pfifo_fast qlen 3
    link/ppp
    inet 202.42.98.62 peer 202.42.98.1/32 scope global ppp1
rx1000test:~# ip link show
1: lo: <LOOPBACK,UP> mtu 16436 qdisc noqueue
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
3: eth1: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
    link/ether 00:0a:dc:04:7d:dc brd ff:ff:ff:ff:ff:ff
4: eth2: <BROADCAST,MULTICAST> mtu 1500 qdisc noop qlen 1000
    link/ether 00:0a:dc:04:7d:dd brd ff:ff:ff:ff:ff:ff
6: w1adsl: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
    link/ether 00:77:77:77:7b:b3 brd ff:ff:ff:ff:ff:ff
9: gre0: <NOARP> mtu 1428 qdisc noop
    link/gre 0.0.0.0 brd 0.0.0.0
12: GDC1@NONE: <POINTOPOINT,NOARP,PROMISC,UP> mtu 1514 qdisc noqueue
    link/gre 192.168.1.97 peer 192.168.1.1
13: ppp1: <POINTOPOINT,MULTICAST,NOARP,UP> mtu 1452 qdisc pfifo_fast qlen 3
    link/ppp
rx1000test:~# ip tun show
gre0: gre/ip  remote any  local any  ttl inherit  nopmtudisc
GDC1: gre/ip  remote 192.168.1.1  local 192.168.1.97  ttl 255
rx1000test:~# ip route show
202.42.98.1 dev ppp1  proto kernel  scope link  src 202.42.98.62
192.168.1.0/28 via 192.168.2.110 dev GDC1
192.168.2.96/28 dev GDC1  proto kernel  scope link  src 192.168.2.97
192.168.1.96/28 dev eth1  proto kernel  scope link  src 192.168.1.97
default dev ppp1  scope link


Now, here is my problem:
1. I can ping from the RX1000 ssh session into eth1(192.168.1.97) to all
interfaces and hosts on the network(pefect),
2. From the cisco ssh into Gig0/0(real ip interface) I can ping all tunnel
interfaces, all hosts on 192.168.1.0/28 but not 192.168.1.97(this makes sense,
I'm outside the tunnel if ssh'd into the real IP interface),
3. All hosts on 192.168.1.0/28 can ping everything except addresses other than
eth1 of RX1000 on 192.168.1.96/28. That is I get a ping response from
192.168.1.97 but not from any oterh hosts on that network. tcpdump -i GDC1
shows the ping coming from 192.168.1.7 to 192.168.1.101, but there is no reply.
The ping and response from 192.168.1.7->192.168.1.97 is NOT going via GRE
according to the Cisco debug and tcpdump. Pings to 192.168.1.101 form
192.168.1.7 do go via the tunnel but are never answered. tcpdump -i eth1
indicate that the echo request from 192.168.1.7 uses the tunnel to get to
192.168.1.97 but never leaves the interface.

SO, number 3 is my big anomaly. The hosts that need access to the network,
192.168.1.96/28, don't have any and I can't figure out why.

Note that I am runnign shorewall, if I stop shorewall nothing changes. ALso,
have been watching /var/log/syslog with tail and there are no ping packets
being blocked by shorewall.

Does anybody have any ideas?

Cheers,
John

__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com 
From jserink2004 at yahoo.com  Thu Jul 20 08:23:11 2006
From: jserink2004 at yahoo.com (John Serink)
Date: Thu Jul 20 08:23:00 2006
Subject: [LARTC] Re: GRE over IPsec Cisco<-> Linux
Message-ID: <20060720062311.59460.qmail@web54503.mail.yahoo.com>

Forgot something, see below:

--- John Serink <jserink2004@yahoo.com> wrote:

> Hello Lartc Mailing List:
> 
> Been working on something the last week and a half and ALMOST have it
> working.., just need a few pointers from the wizards on this mailing list to
> nail it.
> 
> Ok, my setup is a hub and spoke arrangement, hub is Cisco 2821 with IOS 12.4.
> Spokes are ruggencom RX1000 routers, Debian based with the following versions
> installed:
> 
> rx1000test:~# uname -a
> Linux rx1000test 2.6.8-16-486-rx #1 Wed Mar 15 15:33:23 UTC 2006 i586
> GNU/Linux
> rx1000test:~# iptables -v
> iptables v1.2.11: no command specified
> rx1000test:~# shorewall version
> 2.2.3
> rx1000test:~# ip -V
> ip utility, iproute2-ss041019
> rx1000test:~# ipsec version
> Linux Openswan U2.2.0/K2.6.8-16-486-rx (native)
> 
> Openswan is using the Kernel 2.6 native stack NOT klips.
> 
> Here is my setup, only one spoke for now:
> 
> 192.168.1.0/28      160.96.97.248                Dynamic       
> 192.168.1.96/28
>  |  192.168.1.1            |                      |         192.168.1.97  |
>  |        |    HUB         |                      |  SPOKE         |      |
>  |        | +------------+ |                      | +-----------+  |      |
>  |        | |            | |                      | |           |  |      |
>  +----------+ Cisco 2821 +--------INTERNET----------+ rx1000test+---------+
>  |          |            |                          |           |         |
>  |          +------------+                          +-----------+         |
>  |                                                                        |
>  192.168.1.1(ipsec endpoint)----------------------(ipsec
> endpoint)192.168.1.97
>     192.168.1.1(gre endpoint)-----------------(gre endpoint)192.168.1.97
>          192.168.2.110  gre tunnel 192.178.2.96/28   192.168.2.97
>  
>  Here is the setup on te Cisco:
>  interface Tunnel6
>  	ip address 192.168.2.110 255.255.255.240
>  	tunnel source GigabitEthernet0/1
>  	tunnel destination 192.168.1.97
> 	exit
> ip route 0.0.0.0 0.0.0.0 160.96.97.250
> ip route 192.168.1.96 255.255.255.240 Tunnel6
> ip route 192.168.1.97 255.255.255.255 GigabitEthernet0/0
> ! This last line is required to get around a recusive route error in the
> cisco
> 
> Linux setup:
> IPSec.conf
> rx1000test:~# cat /etc/ipsec.conf
> # /etc/ipsec.conf - Openswan IPsec configuration file
> version 2.0     # conforms to second version of ipsec.conf specification
> config setup
>         # Debug-logging controls:  "none" for (almost) none, "all" for lots.
>         klipsdebug=none
>         plutodebug=none
>     interfaces=%defaultroute
>         uniqueids=yes
> 
> # Add connections here
> 
> conn GDC1
>         authby=secret
>         auto=start
>         left=%defaultroute
>         leftsourceip=192.168.1.97
>         leftid=@rx1000test
>         leftsubnet=192.168.1.96/28
>         ike=aes128-md5-modp1024
>         esp=aes128-md5
>         right=160.96.97.248
>         rightsubnet=192.168.1.0/28
>         rightsourceip=192.168.1.1
>         type=tunnel
>         pfs=yes
>         keyingtries=0
> 
> 
>         #Disable Opportunistic Encryption
> include /etc/ipsec.d/examples/no_oe.conf
> 
> The IPsec works fine except for the following caveats:
> 1. Spoke routers cannot ping each other,
> 2. The cisco has no interfaces for the scope routers so no qos can be done.
> 
> Linux GRE setup:
> modprobe ip_gre
> ip tunnel add GDC1 mode gre remote 192.168.1.1 local 192.168.1.97 ttl 255
> ip link set GDC1 up
> ip addr add 192.168.2.97/28 peer 192.168.2.110/28 dev GDC1
> ip route del 192.168.1.0/28 via 160.96.97.248
> ip route add 192.168.1.0/28 via 192.168.2.110
> 
> Ok, the ip route del was necessary to get rid of the IPSec route and replace
> it
> with the gre tunnel.
> 
> Linux box status:
> rx1000test:~# ip addre show
> 1: lo: <LOOPBACK,UP> mtu 16436 qdisc noqueue
>     link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
>     inet 127.0.0.1/8 scope host lo
> 3: eth1: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
>     link/ether 00:0a:dc:04:7d:dc brd ff:ff:ff:ff:ff:ff
>     inet 192.168.1.97/28 brd 192.168.1.255 scope global eth1
> 4: eth2: <BROADCAST,MULTICAST> mtu 1500 qdisc noop qlen 1000
>     link/ether 00:0a:dc:04:7d:dd brd ff:ff:ff:ff:ff:ff
> 6: w1adsl: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
>     link/ether 00:77:77:77:7b:b3 brd ff:ff:ff:ff:ff:ff
> 9: gre0: <NOARP> mtu 1428 qdisc noop
>     link/gre 0.0.0.0 brd 0.0.0.0
> 12: GDC1@NONE: <POINTOPOINT,NOARP,PROMISC,UP> mtu 1514 qdisc noqueue
>     link/gre 192.168.1.97 peer 192.168.1.1
>     inet 192.168.2.97 peer 192.168.2.110/28 scope global GDC1
> 13: ppp1: <POINTOPOINT,MULTICAST,NOARP,UP> mtu 1452 qdisc pfifo_fast qlen 3
>     link/ppp
>     inet 202.42.98.62 peer 202.42.98.1/32 scope global ppp1
> rx1000test:~# ip link show
> 1: lo: <LOOPBACK,UP> mtu 16436 qdisc noqueue
>     link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
> 3: eth1: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
>     link/ether 00:0a:dc:04:7d:dc brd ff:ff:ff:ff:ff:ff
> 4: eth2: <BROADCAST,MULTICAST> mtu 1500 qdisc noop qlen 1000
>     link/ether 00:0a:dc:04:7d:dd brd ff:ff:ff:ff:ff:ff
> 6: w1adsl: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
>     link/ether 00:77:77:77:7b:b3 brd ff:ff:ff:ff:ff:ff
> 9: gre0: <NOARP> mtu 1428 qdisc noop
>     link/gre 0.0.0.0 brd 0.0.0.0
> 12: GDC1@NONE: <POINTOPOINT,NOARP,PROMISC,UP> mtu 1514 qdisc noqueue
>     link/gre 192.168.1.97 peer 192.168.1.1
> 13: ppp1: <POINTOPOINT,MULTICAST,NOARP,UP> mtu 1452 qdisc pfifo_fast qlen 3
>     link/ppp
> rx1000test:~# ip tun show
> gre0: gre/ip  remote any  local any  ttl inherit  nopmtudisc
> GDC1: gre/ip  remote 192.168.1.1  local 192.168.1.97  ttl 255
> rx1000test:~# ip route show
> 202.42.98.1 dev ppp1  proto kernel  scope link  src 202.42.98.62
> 192.168.1.0/28 via 192.168.2.110 dev GDC1
> 192.168.2.96/28 dev GDC1  proto kernel  scope link  src 192.168.2.97
> 192.168.1.96/28 dev eth1  proto kernel  scope link  src 192.168.1.97
> default dev ppp1  scope link
> 
> 
> Now, here is my problem:
> 1. I can ping from the RX1000 ssh session into eth1(192.168.1.97) to all
> interfaces and hosts on the network(pefect),
> 2. From the cisco ssh into Gig0/0(real ip interface) I can ping all tunnel
> interfaces, all hosts on 192.168.1.0/28 but not 192.168.1.97(this makes
> sense,
> I'm outside the tunnel if ssh'd into the real IP interface),
> 3. All hosts on 192.168.1.0/28 can ping everything except addresses other
> than
> eth1 of RX1000 on 192.168.1.96/28. That is I get a ping response from
> 192.168.1.97 but not from any oterh hosts on that network. tcpdump -i GDC1
> shows the ping coming from 192.168.1.7 to 192.168.1.101, but there is no
> reply.
> The ping and response from 192.168.1.7->192.168.1.97 is NOT going via GRE
> according to the Cisco debug and tcpdump. Pings to 192.168.1.101 form
> 192.168.1.7 do go via the tunnel but are never answered. tcpdump -i eth1
> indicate that the echo request from 192.168.1.7 uses the tunnel to get to
> 192.168.1.97 but never leaves the interface.
4. I can ping any hosts on the 192.168.1.96/28 network from the ssh into gig0/0
 on the cisco except for 192.168.1.97.

> 
> SO, number 3 is my big anomaly. The hosts that need access to the network,
> 192.168.1.96/28, don't have any and I can't figure out why.
> 
> Note that I am runnign shorewall, if I stop shorewall nothing changes. ALso,
> have been watching /var/log/syslog with tail and there are no ping packets
> being blocked by shorewall.
> 
> Does anybody have any ideas?
> 
> Cheers,
> John
> 
> __________________________________________________
> Do You Yahoo!?
> Tired of spam?  Yahoo! Mail has the best spam protection around 
> http://mail.yahoo.com 
> 


__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com 
From lists at andyfurniss.entadsl.com  Thu Jul 20 14:57:54 2006
From: lists at andyfurniss.entadsl.com (Andy Furniss)
Date: Thu Jul 20 14:57:42 2006
Subject: [LARTC] police rate doesn't work ?
In-Reply-To: <C103D39FF74DF4469EEAE6D38AA9E0B54A280D@els00wmx04.elsag.it>
References: <C103D39FF74DF4469EEAE6D38AA9E0B54A280D@els00wmx04.elsag.it>
Message-ID: <44BF7DD2.9010300@andyfurniss.entadsl.com>

Vitale Alessandro wrote:
> I would like to test police in ingress.
> I use kernel 2.4.20.

FWIW if you try a 2.6 whether or not policers will see marks will depend 
on your config - Packet action will give a new policer that hooks before 
netfilter.

> I use this configuration:
> 
> iptables -t mangle -A PREROUTING -i eth0 -s 10.31.12.2 -d 10.31.11.2 -p udp --dport 1001 -j MARK --set-mark 1
> iptables -t mangle -A PREROUTING -i eth0 -s 10.31.12.2 -d 10.31.11.2 -p udp --dport 1002 -j MARK --set-mark 2
> iptables -t mangle -A PREROUTING -i eth0 -s 10.31.12.2 -d 10.31.11.2 -p udp --dport 1003 -j MARK --set-mark 3
> iptables -t mangle -A PREROUTING -i eth0 -s 10.31.12.2 -d 10.31.11.2 -p udp --dport 1004 -j MARK --set-mark 4
> 
> tc qdisc add dev eth0 handle ffff: ingress
> tc filter add dev eth0 parent ffff: protocol ip prio 1 handle 1 fw police rate 2500000 burst 90k drop
> tc filter add dev eth0 parent ffff: protocol ip prio 1 handle 2 fw police rate 1500000 burst 90k drop
> tc filter add dev eth0 parent ffff: protocol ip prio 1 handle 3 fw police rate 1000000 burst 90k drop
> 
> 
> I generate traffic with smartbits and i made this test:
> 1)len packet layer2 64 byte,

Is that actually possible on eth?

  packets per second 5500 = 2810000 bit per second
> 2)len packet layer2 1000 byte, packets per second 350 = 2800000 bit per second
> 
> The 2 test is good i receive a trafiic with 2500000 rate limit !
> The problem is with 1 test because i received full band 2810000 without any limit!
> 
> Is there any problem with police rate? It doesn't work  with small packets?
> I've to set some other usefull parameter?

On eth shapers/policers will see packets as ip length +14 but there are 
more overheads/mpu.

Currently you can't specify mpu/overhead for policers, It may be added 
soon - but that will be 2.6s I guess.

Andy.
From nata at cnett.com.br  Thu Jul 20 16:28:08 2006
From: nata at cnett.com.br (Nataniel Klug)
Date: Thu Jul 20 16:28:03 2006
Subject: [LARTC] QoS doubt about network machine
Message-ID: <44BF92F8.8030805@cnett.com.br>

    Hello all,

    I am with a doubt about QoS solution... I have a 4 Mbit backbone 
coming from the telco I use... This is the link I serve to my clients, 
so I make this classes:

$TC qdisc add dev $DL root handle 1: htb default 60

CLASS="/sbin/tc class add dev $DL parent"
$CLASS 1: classid 1:1 htb rate 4096Kbit
$CLASS 1:1 classid 1:10 htb rate 256Kbit ceil 3072Kbit burst 15k
$CLASS 1:1 classid 1:20 htb rate 256Kbit ceil 1024Kbit burst 15k
$CLASS 1:1 classid 1:30 htb rate 2048Kbit ceil 3072Kbit burst 15k
$CLASS 1:1 classid 1:40 htb rate 256Kbit ceil 512Kbit burst 15k
$CLASS 1:1 classid 1:50 htb rate 256Kbit ceil 256Kbit burst 15k
$CLASS 1:1 classid 1:60 htb rate 1024Kbit ceil 2048Kbit burst 15k

    I use this classes to put some trafic (going out thru eth3, the 
interface that my clients are connected) like this:

10 - ssh, telnet
20 - voip, msn login, skype, dns
30 - http, https, clientes with garantee band
40 - mail, ftp
50 - p2p
60 - all the rest

    The problem is that I have a network server connected into my 
gateway by a switch. So I have this topology:

router
|
|- ns1 - eth0 (gw) <> eth3 - clients
|- ns2 (mail server / radius server)

    So when my clients try to connect to my ns2 mail server it gets 
shapped by class 40... I dont want that to happens... So I think in 
making something like this:

$TC qdisc add dev $DL root handle 1: htb default 60

CLASS="/sbin/tc class add dev $DL parent"
$CLASS 1: classid 1:1 htb rate 100Mbit
$CLASS 1:1 classid 1:5 htb rate 100Mbit
$CLASS 1:1 classid 1:10 htb rate 256Kbit ceil 3072Kbit burst 15k
$CLASS 1:1 classid 1:20 htb rate 256Kbit ceil 1024Kbit burst 15k
$CLASS 1:1 classid 1:30 htb rate 2048Kbit ceil 3072Kbit burst 15k
$CLASS 1:1 classid 1:40 htb rate 256Kbit ceil 512Kbit burst 15k
$CLASS 1:1 classid 1:50 htb rate 256Kbit ceil 256Kbit burst 15k
$CLASS 1:1 classid 1:60 htb rate 1024Kbit ceil 2048Kbit burst 15k

    And them direct all traffic coming from my ns2 server (using u32 
classifier and src address) to class 1:5...

    Is this correct?

Att,

Nataniel Klug
From jserink2004 at yahoo.com  Fri Jul 21 07:56:35 2006
From: jserink2004 at yahoo.com (John Serink)
Date: Fri Jul 21 07:56:23 2006
Subject: [LARTC] GRE->IPSec, same problem simplified....
Message-ID: <20060721055635.48588.qmail@web54503.mail.yahoo.com>

Hi All:

I have a strange problem that was described in a previous mail but I have
stripped the problem down to the following:
I have a debian based router that I have setup IPSec with GRE over top. The
tunnel addresses are 192.168.2.97 locally, the other side is 192.168.2.110. The
tunnel is 192.168.2.96/28. The end points are locally 192.168.1.97(eth1) and
192.168.1.1 the other side's eth 1. Both local ethernet's are behind NAT of
course.

Now, I have ahost, 192.168.1.101 on the 192.168.1.96/28 network behind the
debbian router. Here is my routing table:
rx1000test:~# ip route show
202.42.98.1 dev ppp1  proto kernel  scope link  src 202.42.98.62
192.168.1.0/28 dev GDC1  scope link
192.168.1.96/28 dev eth1  scope link
default dev ppp1  scope link

This seems really simple to me, anything going to 192.168.1.0/28 must go
through tunnel GDC1. Here is the tunnel:

15: GDC1@NONE: <POINTOPOINT,NOARP,PROMISC,UP> mtu 1428 qdisc noqueue
    link/gre 192.168.1.97 peer 192.168.1.1
    inet 192.168.2.97 peer 192.168.2.110/28 scope global GDC1

Ok, now to check this I run tcpdump -i GDC1, tcpdump -i eth1 not tcp port 22 
and I ping from 192.168.1.101 to 192.168.1.2, here is what I get:

C:\>ping 192.168.1.2 -n 2

Pinging 192.168.1.2 with 32 bytes of data:

Request timed out.
Request timed out.

Ping statistics for 192.168.1.2:
    Packets: Sent = 2, Received = 0, Lost = 2 (100% loss),

rx1000test:~# tcpdump -i GDC1
tcpdump: WARNING: arptype 778 not supported by libpcap - falling back to cooked
socket
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on GDC1, link-type LINUX_SLL (Linux cooked), capture size 96 bytes
13:40:01.296907 IP 192.168.1.2 > 192.168.1.101: icmp 40: echo reply seq 7424
13:40:06.587157 IP 192.168.1.2 > 192.168.1.101: icmp 40: echo reply seq 7680

rx1000test:~# tcpdump -i eth1 not tcp port 22
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth1, link-type EN10MB (Ethernet), capture size 96 bytes
13:40:01.267813 IP 192.168.1.101 > 192.168.1.2: icmp 40: echo request seq 7424
13:40:06.571007 IP 192.168.1.101 > 192.168.1.2: icmp 40: echo request seq 7680

This is bizzare:
The ping to 192.168.1.2, which is clearly part of the 192.168.1.0/28 network
enters Eth1 but does does NOT go through the GDC1 tunnel on its way to
192.168.1.2....but the routing table tells us that it MUST go that way...no?
Then the replay comes back via the tunnel but never goes out eth1.  eh????

I am watching /var/log/syslog and shorewall is not doing anything, but just to
make sure I stop shorewall and redo the test, exactly the same thing.

Does anyone know WHY the pings to 192.168.1.2 are not going into the GDC1
tunnel?
Does anyone know WHY the return pings do not get forwarded out eth1?

Cheers,
John

__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com 
From jarkap at poczta.onet.pl  Fri Jul 21 15:45:18 2006
From: jarkap at poczta.onet.pl (Jarek Poplawski)
Date: Fri Jul 21 15:45:32 2006
Subject: [LARTC] Re: QoS doubt about network machine
References: <44BF92F8.8030805@cnett.com.br>
Message-ID: <loom.20060721T150715-283@post.gmane.org>

Nataniel Klug <nata <at> cnett.com.br> writes:

> 
>     Hello all,
> 
>     I am with a doubt about QoS solution... I have a 4 Mbit backbone 
> coming from the telco I use... This is the link I serve to my clients, 
> so I make this classes:
> 
> $TC qdisc add dev $DL root handle 1: htb default 60
> 
> CLASS="/sbin/tc class add dev $DL parent"
> $CLASS 1: classid 1:1 htb rate 4096Kbit
> $CLASS 1:1 classid 1:10 htb rate 256Kbit ceil 3072Kbit burst 15k
> $CLASS 1:1 classid 1:20 htb rate 256Kbit ceil 1024Kbit burst 15k
> $CLASS 1:1 classid 1:30 htb rate 2048Kbit ceil 3072Kbit burst 15k
> $CLASS 1:1 classid 1:40 htb rate 256Kbit ceil 512Kbit burst 15k
> $CLASS 1:1 classid 1:50 htb rate 256Kbit ceil 256Kbit burst 15k
> $CLASS 1:1 classid 1:60 htb rate 1024Kbit ceil 2048Kbit burst 15k
> 

...
>     So when my clients try to connect to my ns2 mail server it gets 
> shapped by class 40... I dont want that to happens... So I think in 
> making something like this:
> 
> $TC qdisc add dev $DL root handle 1: htb default 60
> 
> CLASS="/sbin/tc class add dev $DL parent"
> $CLASS 1: classid 1:1 htb rate 100Mbit
> $CLASS 1:1 classid 1:5 htb rate 100Mbit
> $CLASS 1:1 classid 1:10 htb rate 256Kbit ceil 3072Kbit burst 15k
> $CLASS 1:1 classid 1:20 htb rate 256Kbit ceil 1024Kbit burst 15k
> $CLASS 1:1 classid 1:30 htb rate 2048Kbit ceil 3072Kbit burst 15k
> $CLASS 1:1 classid 1:40 htb rate 256Kbit ceil 512Kbit burst 15k
> $CLASS 1:1 classid 1:50 htb rate 256Kbit ceil 256Kbit burst 15k
> $CLASS 1:1 classid 1:60 htb rate 1024Kbit ceil 2048Kbit burst 15k
> 
>     And them direct all traffic coming from my ns2 server (using u32 
> classifier and src address) to class 1:5...
> 
>     Is this correct?

I don't think so. Class 1:5 can now take all bandwidth of dev here.
You should limit it's rate and a ceil as a minimum, but I think you would better
add it as another root class: 

CLASS="/sbin/tc class add dev $DL parent"
$CLASS 1: classid 1:1 htb rate 4096Kbit
$CLASS 1: classid 1:5 htb rate 95Mbit
$CLASS 1:1 classid 1:10 htb rate 256Kbit ceil 3072Kbit burst 15k
$CLASS 1:1 classid 1:20 htb rate 256Kbit ceil 1024Kbit burst 15k
$CLASS 1:1 classid 1:30 htb rate 2048Kbit ceil 3072Kbit burst 15k
$CLASS 1:1 classid 1:40 htb rate 256Kbit ceil 512Kbit burst 15k
$CLASS 1:1 classid 1:50 htb rate 256Kbit ceil 256Kbit burst 15k
$CLASS 1:1 classid 1:60 htb rate 1024Kbit ceil 2048Kbit burst 15k

And have a look at this bautiful page:
http://luxik.cdi.cz/~devik/qos/htb/manual/userg.htm

The second advice is to lower you numbers. Probably this rates are only
nominally like this and in reality min. 10% lower. If you don't limit it
yourself they will be limited elsewhere and you will have higher delays.
15k burst is also quite high so possible next delays. Mr Devera has very good
advices there.

Jarek P.

From william.bohannan at spidersat.net  Fri Jul 21 20:31:08 2006
From: william.bohannan at spidersat.net (William Bohannan)
Date: Fri Jul 21 20:32:13 2006
Subject: [LARTC] linux transparent bridge running squid
Message-ID: <20060721183200.66A5F3FB6@outpost.ds9a.nl>

Hi I have been using Shorewall for a while now and find it very useful and easy to configure, I am learning iptables and having trouble getting the bridge to successfully work with squid, although I get it working with Shorewall straight away?  Does anyone know the rules to successfully use squid with a transparent bridge?

Internet ? router - (bridge eth0 ? eth1) ? local lan

auto lo
iface lo inet loopback

auto br0
iface br0 inet static
address 192.168.0.253
netmask 255.255.255.0
network 192.168.0.0
broadcast 192.168.0.255
gateway 192.168.0.254
pre-up /sbin/ip link set eth0 up
pre-up /sbin/ip link set eth1 up
pre-up /usr/sbin/brctl addbr br0
pre-up /usr/sbin/brctl addif br0 eth0
pre-up /usr/sbin/brctl addif br0 eth1

iptables -A INPUT -i br0 -p tcp -d 192.168.0.253 -s 192.168.0.0 --dport 3128 -m state --state NEW,ESTABLISHED -j ACCEPT 
iptables -t nat -A PREROUTING -i br0 -p tcp --dport 80 -j REDIRECT --to-port 3128
echo 1 > /proc/sys/net/ipv4/ip_forward

with no luck ?


kind regards
william


From andy at andybev.com  Fri Jul 21 21:37:32 2006
From: andy at andybev.com (Andrew Beverley)
Date: Fri Jul 21 21:37:30 2006
Subject: [LARTC] linux transparent bridge running squid
In-Reply-To: <20060721183200.66A5F3FB6@outpost.ds9a.nl>
References: <20060721183200.66A5F3FB6@outpost.ds9a.nl>
Message-ID: <44C12CFC.6080109@andybev.com>

 >
> iptables -t nat -A PREROUTING -i br0 -p tcp --dport 80 -j REDIRECT --to-port 3128
 >

This is the same line I use and it works fine. What exactly is the problem? Is it 
clients don't use squid, clients can't access the web, or what?

Andy

From method at b.astral.ro  Sat Jul 22 17:46:51 2006
From: method at b.astral.ro (Dan Cicioiu)
Date: Sat Jul 22 17:46:46 2006
Subject: [LARTC] Re: GRE over IPsec Cisco<-> Linux
In-Reply-To: <20060720062311.59460.qmail@web54503.mail.yahoo.com>
References: <20060720062311.59460.qmail@web54503.mail.yahoo.com>
Message-ID: <44C2486B.7030103@b.astral.ro>

ip route 192.168.1.97 255.255.255.255 GigabitEthernet0/0

that's the problem 
delete the route and all should be ok


John Serink wrote:
> Forgot something, see below:
>
> --- John Serink <jserink2004@yahoo.com> wrote:
>
>   
>> Hello Lartc Mailing List:
>>
>> Been working on something the last week and a half and ALMOST have it
>> working.., just need a few pointers from the wizards on this mailing list to
>> nail it.
>>
>> Ok, my setup is a hub and spoke arrangement, hub is Cisco 2821 with IOS 12.4.
>> Spokes are ruggencom RX1000 routers, Debian based with the following versions
>> installed:
>>
>> rx1000test:~# uname -a
>> Linux rx1000test 2.6.8-16-486-rx #1 Wed Mar 15 15:33:23 UTC 2006 i586
>> GNU/Linux
>> rx1000test:~# iptables -v
>> iptables v1.2.11: no command specified
>> rx1000test:~# shorewall version
>> 2.2.3
>> rx1000test:~# ip -V
>> ip utility, iproute2-ss041019
>> rx1000test:~# ipsec version
>> Linux Openswan U2.2.0/K2.6.8-16-486-rx (native)
>>
>> Openswan is using the Kernel 2.6 native stack NOT klips.
>>
>> Here is my setup, only one spoke for now:
>>
>> 192.168.1.0/28      160.96.97.248                Dynamic       
>> 192.168.1.96/28
>>  |  192.168.1.1            |                      |         192.168.1.97  |
>>  |        |    HUB         |                      |  SPOKE         |      |
>>  |        | +------------+ |                      | +-----------+  |      |
>>  |        | |            | |                      | |           |  |      |
>>  +----------+ Cisco 2821 +--------INTERNET----------+ rx1000test+---------+
>>  |          |            |                          |           |         |
>>  |          +------------+                          +-----------+         |
>>  |                                                                        |
>>  192.168.1.1(ipsec endpoint)----------------------(ipsec
>> endpoint)192.168.1.97
>>     192.168.1.1(gre endpoint)-----------------(gre endpoint)192.168.1.97
>>          192.168.2.110  gre tunnel 192.178.2.96/28   192.168.2.97
>>  
>>  Here is the setup on te Cisco:
>>  interface Tunnel6
>>  	ip address 192.168.2.110 255.255.255.240
>>  	tunnel source GigabitEthernet0/1
>>  	tunnel destination 192.168.1.97
>> 	exit
>> ip route 0.0.0.0 0.0.0.0 160.96.97.250
>> ip route 192.168.1.96 255.255.255.240 Tunnel6
>> ip route 192.168.1.97 255.255.255.255 GigabitEthernet0/0
>> ! This last line is required to get around a recusive route error in the
>> cisco
>>
>> Linux setup:
>> IPSec.conf
>> rx1000test:~# cat /etc/ipsec.conf
>> # /etc/ipsec.conf - Openswan IPsec configuration file
>> version 2.0     # conforms to second version of ipsec.conf specification
>> config setup
>>         # Debug-logging controls:  "none" for (almost) none, "all" for lots.
>>         klipsdebug=none
>>         plutodebug=none
>>     interfaces=%defaultroute
>>         uniqueids=yes
>>
>> # Add connections here
>>
>> conn GDC1
>>         authby=secret
>>         auto=start
>>         left=%defaultroute
>>         leftsourceip=192.168.1.97
>>         leftid=@rx1000test
>>         leftsubnet=192.168.1.96/28
>>         ike=aes128-md5-modp1024
>>         esp=aes128-md5
>>         right=160.96.97.248
>>         rightsubnet=192.168.1.0/28
>>         rightsourceip=192.168.1.1
>>         type=tunnel
>>         pfs=yes
>>         keyingtries=0
>>
>>
>>         #Disable Opportunistic Encryption
>> include /etc/ipsec.d/examples/no_oe.conf
>>
>> The IPsec works fine except for the following caveats:
>> 1. Spoke routers cannot ping each other,
>> 2. The cisco has no interfaces for the scope routers so no qos can be done.
>>
>> Linux GRE setup:
>> modprobe ip_gre
>> ip tunnel add GDC1 mode gre remote 192.168.1.1 local 192.168.1.97 ttl 255
>> ip link set GDC1 up
>> ip addr add 192.168.2.97/28 peer 192.168.2.110/28 dev GDC1
>> ip route del 192.168.1.0/28 via 160.96.97.248
>> ip route add 192.168.1.0/28 via 192.168.2.110
>>
>> Ok, the ip route del was necessary to get rid of the IPSec route and replace
>> it
>> with the gre tunnel.
>>
>> Linux box status:
>> rx1000test:~# ip addre show
>> 1: lo: <LOOPBACK,UP> mtu 16436 qdisc noqueue
>>     link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
>>     inet 127.0.0.1/8 scope host lo
>> 3: eth1: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
>>     link/ether 00:0a:dc:04:7d:dc brd ff:ff:ff:ff:ff:ff
>>     inet 192.168.1.97/28 brd 192.168.1.255 scope global eth1
>> 4: eth2: <BROADCAST,MULTICAST> mtu 1500 qdisc noop qlen 1000
>>     link/ether 00:0a:dc:04:7d:dd brd ff:ff:ff:ff:ff:ff
>> 6: w1adsl: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
>>     link/ether 00:77:77:77:7b:b3 brd ff:ff:ff:ff:ff:ff
>> 9: gre0: <NOARP> mtu 1428 qdisc noop
>>     link/gre 0.0.0.0 brd 0.0.0.0
>> 12: GDC1@NONE: <POINTOPOINT,NOARP,PROMISC,UP> mtu 1514 qdisc noqueue
>>     link/gre 192.168.1.97 peer 192.168.1.1
>>     inet 192.168.2.97 peer 192.168.2.110/28 scope global GDC1
>> 13: ppp1: <POINTOPOINT,MULTICAST,NOARP,UP> mtu 1452 qdisc pfifo_fast qlen 3
>>     link/ppp
>>     inet 202.42.98.62 peer 202.42.98.1/32 scope global ppp1
>> rx1000test:~# ip link show
>> 1: lo: <LOOPBACK,UP> mtu 16436 qdisc noqueue
>>     link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
>> 3: eth1: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
>>     link/ether 00:0a:dc:04:7d:dc brd ff:ff:ff:ff:ff:ff
>> 4: eth2: <BROADCAST,MULTICAST> mtu 1500 qdisc noop qlen 1000
>>     link/ether 00:0a:dc:04:7d:dd brd ff:ff:ff:ff:ff:ff
>> 6: w1adsl: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
>>     link/ether 00:77:77:77:7b:b3 brd ff:ff:ff:ff:ff:ff
>> 9: gre0: <NOARP> mtu 1428 qdisc noop
>>     link/gre 0.0.0.0 brd 0.0.0.0
>> 12: GDC1@NONE: <POINTOPOINT,NOARP,PROMISC,UP> mtu 1514 qdisc noqueue
>>     link/gre 192.168.1.97 peer 192.168.1.1
>> 13: ppp1: <POINTOPOINT,MULTICAST,NOARP,UP> mtu 1452 qdisc pfifo_fast qlen 3
>>     link/ppp
>> rx1000test:~# ip tun show
>> gre0: gre/ip  remote any  local any  ttl inherit  nopmtudisc
>> GDC1: gre/ip  remote 192.168.1.1  local 192.168.1.97  ttl 255
>> rx1000test:~# ip route show
>> 202.42.98.1 dev ppp1  proto kernel  scope link  src 202.42.98.62
>> 192.168.1.0/28 via 192.168.2.110 dev GDC1
>> 192.168.2.96/28 dev GDC1  proto kernel  scope link  src 192.168.2.97
>> 192.168.1.96/28 dev eth1  proto kernel  scope link  src 192.168.1.97
>> default dev ppp1  scope link
>>
>>
>> Now, here is my problem:
>> 1. I can ping from the RX1000 ssh session into eth1(192.168.1.97) to all
>> interfaces and hosts on the network(pefect),
>> 2. From the cisco ssh into Gig0/0(real ip interface) I can ping all tunnel
>> interfaces, all hosts on 192.168.1.0/28 but not 192.168.1.97(this makes
>> sense,
>> I'm outside the tunnel if ssh'd into the real IP interface),
>> 3. All hosts on 192.168.1.0/28 can ping everything except addresses other
>> than
>> eth1 of RX1000 on 192.168.1.96/28. That is I get a ping response from
>> 192.168.1.97 but not from any oterh hosts on that network. tcpdump -i GDC1
>> shows the ping coming from 192.168.1.7 to 192.168.1.101, but there is no
>> reply.
>> The ping and response from 192.168.1.7->192.168.1.97 is NOT going via GRE
>> according to the Cisco debug and tcpdump. Pings to 192.168.1.101 form
>> 192.168.1.7 do go via the tunnel but are never answered. tcpdump -i eth1
>> indicate that the echo request from 192.168.1.7 uses the tunnel to get to
>> 192.168.1.97 but never leaves the interface.
>>     
> 4. I can ping any hosts on the 192.168.1.96/28 network from the ssh into gig0/0
>  on the cisco except for 192.168.1.97.
>
>   
>> SO, number 3 is my big anomaly. The hosts that need access to the network,
>> 192.168.1.96/28, don't have any and I can't figure out why.
>>
>> Note that I am runnign shorewall, if I stop shorewall nothing changes. ALso,
>> have been watching /var/log/syslog with tail and there are no ping packets
>> being blocked by shorewall.
>>
>> Does anybody have any ideas?
>>
>> Cheers,
>> John
>>
>> __________________________________________________
>> Do You Yahoo!?
>> Tired of spam?  Yahoo! Mail has the best spam protection around 
>> http://mail.yahoo.com 
>>
>>     
>
>
> __________________________________________________
> Do You Yahoo!?
> Tired of spam?  Yahoo! Mail has the best spam protection around 
> http://mail.yahoo.com 
> _______________________________________________
> LARTC mailing list
> LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
>
>
>   


From luciano at lugmen.org.ar  Sat Jul 22 18:30:11 2006
From: luciano at lugmen.org.ar (Luciano Ruete)
Date: Sat Jul 22 18:30:13 2006
Subject: [LARTC] linux transparent bridge running squid
In-Reply-To: <20060721183200.66A5F3FB6@outpost.ds9a.nl>
References: <20060721183200.66A5F3FB6@outpost.ds9a.nl>
Message-ID: <200607221330.11210.luciano@lugmen.org.ar>

El Friday 21 July 2006 15:31, William Bohannan escribi?:
> Hi I have been using Shorewall for a while now and find it very useful and
> easy to configure, I am learning iptables and having trouble getting the
> bridge to successfully work with squid, although I get it working with
> Shorewall straight away?  Does anyone know the rules to successfully use
> squid with a transparent bridge?
>
> Internet ? router - (bridge eth0 ? eth1) ? local lan
>
> auto lo
> iface lo inet loopback
>
> auto br0
> iface br0 inet static
> address 192.168.0.253
> netmask 255.255.255.0
> network 192.168.0.0
> broadcast 192.168.0.255
> gateway 192.168.0.254
> pre-up /sbin/ip link set eth0 up
> pre-up /sbin/ip link set eth1 up
> pre-up /usr/sbin/brctl addbr br0
> pre-up /usr/sbin/brctl addif br0 eth0
> pre-up /usr/sbin/brctl addif br0 eth1
>
> iptables -A INPUT -i br0 -p tcp -d 192.168.0.253 -s 192.168.0.0 --dport
> 3128 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -t nat -A
> PREROUTING -i br0 -p tcp --dport 80 -j REDIRECT --to-port 3128 echo 1 >
> /proc/sys/net/ipv4/ip_forward

you are at Link layer in the bridge, packets dont travel up to Network layer, 
so iptables does not even see this packets.
Either you can use ebtables[1] or see 'physdev' in iptables man page.

[1]http://ebtables.sourceforge.net/
-- 
Luciano
From lists at andyfurniss.entadsl.com  Sat Jul 22 20:07:15 2006
From: lists at andyfurniss.entadsl.com (Andy Furniss)
Date: Sat Jul 22 20:06:50 2006
Subject: [LARTC] UDP multicast stream and NAT
In-Reply-To: <20051207221003.32802.qmail@web60924.mail.yahoo.com>
References: <20051207221003.32802.qmail@web60924.mail.yahoo.com>
Message-ID: <44C26953.3070104@andyfurniss.entadsl.com>

Gabriel wrote:
> Hi, my ISP is streaming some local concert using UDP
> multicasting. I followed the instructions on the site which
> described how to set VLC in order to view the stream, but
> it didn't work. I am behind a Linux router/firewall doing
> NAT. Using google, I quickly found out that the
> netfilter/conntrack code doesn't support NATing multicast
> traffic. I thought about bridging the internet facing
> interface (eth0) and (one of) the internal interfaces (the
> one my computer is plugged into). This way I could set my
> IP to be public and no routing/NAT would be done on the
> Linux box. The only problem is that the box has 2 more NICs
> in it and there are other people connected to those NICs
> that need to use that connection (hence need to be NATed).
> 
> Then I tried thinking about a DMZ-like solution where my
> box would be in the DMZ, but I can't see that working
> either because I only have one public IP assigned.
> 
> Can anyone think of any other way for me to be able to view
> the stream?
> 
> Thanks.
> 

I recently changed ISP to one that does multicast so got a chance to play.

If you want to do it properly then www.xorp.org is the place to look - I 
didn't as for our situation proper routing is a bit OTT.

There is a project on sf.net called igmpproxy - I didn't really try with 
this as I read it didn't work, but more recently I've read that it is OK 
if you are carefull with the config.

The way I did it it to use smcroute to set up static route(s) and issue 
igmp joins manually from the gateway.

http://www.cschill.de/smcroute

All I needed to do with iptables was to let multicast dst into the gateway.

If the stream link is a .sdp you can read the addresses, if it's some 
propritory crap then tcpdump -nnvv net 224.0.0.0/4 on the lan side while 
the player is trying to connect to get them - one multicast address = 
dst on incoming one unicast addr for the source.

eg. in the UK for the BBC1 1.2mbit H.264 stream -

smcroute -d
smcroute -a ppp0 132.185.224.80 233.122.227.151 eth0

smcroute -j ppp0 233.122.227.157

to stop

smcroute -l ppp0 233.122.227.157

For those in the UK that can test the BBCs - half of them have been down 
whenever I've looked - so try several

Andy.
From radu at securesystems.ro  Sat Jul 22 23:04:34 2006
From: radu at securesystems.ro (Radu Oprisan)
Date: Sat Jul 22 23:04:35 2006
Subject: [LARTC] linux transparent bridge running squid
In-Reply-To: <200607221330.11210.luciano@lugmen.org.ar>
References: <20060721183200.66A5F3FB6@outpost.ds9a.nl>
	<200607221330.11210.luciano@lugmen.org.ar>
Message-ID: <44C292E2.9070205@securesystems.ro>

Luciano Ruete wrote:
> El Friday 21 July 2006 15:31, William Bohannan escribi?:
>> Hi I have been using Shorewall for a while now and find it very useful and
>> easy to configure, I am learning iptables and having trouble getting the
>> bridge to successfully work with squid, although I get it working with
>> Shorewall straight away?  Does anyone know the rules to successfully use
>> squid with a transparent bridge?
>>
>> Internet ? router - (bridge eth0 ? eth1) ? local lan
>>
>> auto lo
>> iface lo inet loopback
>>
>> auto br0
>> iface br0 inet static
>> address 192.168.0.253
>> netmask 255.255.255.0
>> network 192.168.0.0
>> broadcast 192.168.0.255
>> gateway 192.168.0.254
>> pre-up /sbin/ip link set eth0 up
>> pre-up /sbin/ip link set eth1 up
>> pre-up /usr/sbin/brctl addbr br0
>> pre-up /usr/sbin/brctl addif br0 eth0
>> pre-up /usr/sbin/brctl addif br0 eth1
>>
>> iptables -A INPUT -i br0 -p tcp -d 192.168.0.253 -s 192.168.0.0 --dport
>> 3128 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -t nat -A
>> PREROUTING -i br0 -p tcp --dport 80 -j REDIRECT --to-port 3128 echo 1 >
>> /proc/sys/net/ipv4/ip_forward
> 
> you are at Link layer in the bridge, packets dont travel up to Network layer, 
> so iptables does not even see this packets.
> Either you can use ebtables[1] or see 'physdev' in iptables man page.
> 
> [1]http://ebtables.sourceforge.net/

Also, i need to point this out, be very careful as not to include the
squid machine in the ebtables redirect, as that could end up in an
endless loop.
From alishahi at amnafzar.com  Sun Jul 23 18:43:51 2006
From: alishahi at amnafzar.com (S.Mehdi Sheikhalishahi)
Date: Sun Jul 23 18:54:17 2006
Subject: [LARTC] Why SFQ?
Message-ID: <44C3A747.60804@amnafzar.com>

Hello,
    Why linux users use SFQ as leaf queueing discipline instead of RED 
and other?

-- 
Best Regards,
S.Mehdi Sheikhalishahi,
Bye.


From jarkap at poczta.onet.pl  Mon Jul 24 15:01:55 2006
From: jarkap at poczta.onet.pl (Jarek Poplawski)
Date: Mon Jul 24 15:02:14 2006
Subject: [LARTC] Re: What am I missing?
References: <20060719165148.GA21024@digitalpath.net>
Message-ID: <loom.20060724T144823-710@post.gmane.org>

Ray Van Dolson <rayvd <at> digitalpath.net> writes:

> 
> On a custom compiled Linux 2.6.13 kernel...
> 
> # tc qdisc add dev ppp145 handle ffff: ingress
> # tc filter add dev ppp145 parent ffff: protocol ip prio 50 u32 match ip src
0.0.0.0/0 police rate 384kbit
> burst 10k drop flowid :1
> RTNETLINK answers: Invalid argument
> 
> This works fine on a CentOS machine and my Fedora Core 2 box with default
> kernel.  I'm trying to figure out what is missing in the custom built 2.6.13
> kernel.  strace isn't real helpful, and there doesn't appear to be a way to
> make tc present more useful error messages...
> 
> Non ingress filtering works.  Here's an excerpt from kernel config:
...

> Any ideas?  Can paste entire kernel config if necessary.

You didn't write anything about this box: distro or previous kernel.
Maybe you should try to recompile or get newer version of iproute?

Jarek P.

From william.bohannan at spidersat.net  Mon Jul 24 21:33:57 2006
From: william.bohannan at spidersat.net (William Bohannan)
Date: Mon Jul 24 21:34:12 2006
Subject: [LARTC] linux transparent bridge running squid and dansguardian
In-Reply-To: <200607221330.11210.luciano@lugmen.org.ar>
Message-ID: <004b01c6af58$2156d740$3a02a8c0@william>

Thanks or the quick reply.  Although I have had no success, I have been
trying all day using both physdev and ebtables, neither of which I can get
working :( Please help - below is what I am currently using.


***********************************************************************
#!/bin/sh

PATH=/usr/sbin:/sbin:/bin:/usr/bin

#
# delete all existing rules.
#
iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -X

# Always accept loopback traffic
iptables -A INPUT -i lo -j ACCEPT


# Allow established connections, and those not coming from the outside
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m state --state NEW -i ! eth0 -j ACCEPT
iptables -A FORWARD -i eth0 -o eth1 -m state --state ESTABLISHED,RELATED -j
ACCEPT

# Allow outgoing connections from the LAN side.
iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT

# Masquerade.
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

# Don't forward from the outside to the inside.
#iptables -A FORWARD -i eth0 -o eth0 -j REJECT

# Enable routing.
echo 1 > /proc/sys/net/ipv4/ip_forward

# This line tells ebtables to route (accept) the packages // going to port
80, instead of bridging them: 
ebtables -t broute -A BROUTING -p IPv4 --ip-protocol 6 --ip-destination-port
80 -j redirect --redirect-target ACCEPT 

# This line tells ebtables to route (accept) the packages // going to port
80, instead of bridging them: 
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT
--to-port 8080

# This line is from www.linux.com transparent proxy which allows port 8080
from the local network
#iptables -A INPUT -i eth1 -p tcp -d 192.168.0.253 -s 192.168.0.0 --dport
8080 -m state --state NEW,ESTABLISHED -j ACCEPT 
iptables -A FORWARD -p tcp --dport 80 -m physdev --physdev-in eth1
--physdev-out eth0 -j ACCEPT

**********************************************************************


Please help - if I use Shorewall it works first go?

Internet - (eth0 - eth1) - local lan


Kind regards

William

From nata at cnett.com.br  Tue Jul 25 12:54:02 2006
From: nata at cnett.com.br (Nataniel Klug)
Date: Tue Jul 25 12:54:01 2006
Subject: [LARTC] Routed network + web-cache
Message-ID: <44C5F84A.1090703@cnett.com.br>

    Hello all,

    I have a small ISP and I work all my clients networks over a routed 
network (now I am using 201.35.16.0/24 and 200.140.222.128/25 for my 
clients).

    The gateway server of the ISP is capable of running a web-cache 
(only http) using squid but I dont want that my clients go to the 
internet with the proxy/cache IP. Like when they enter in this site 
www.meuip.com.br it shows only the proxy/gw server ip and not the client ip.

    There is some way to make this happens?

Att,

Nataniel Klug
From viji_171 at yahoo.co.in  Tue Jul 25 16:59:38 2006
From: viji_171 at yahoo.co.in (VijayaLakshmi Seshadri)
Date: Tue Jul 25 16:59:31 2006
Subject: [LARTC] problem in Route add using netlink
Message-ID: <20060725145938.68004.qmail@web8327.mail.in.yahoo.com>

Hi all
   Iam trying to implement "route add " using netlink. The changes are not reflected in the routing table. I have given my code and screen shots of the routing tables.
   
  Can anybody tell me is there any mistake iam making in defining the fields .
  or any other mistake iam commiting
   
  thanxs
   
  viji
   
  //////////////////////////////////// CODE //////////////////////////////////////////////////////
  #include <asm/types.h>
#include <netinet/ether.h>
#include <netinet/in.h>
#include <net/if.h>
#include <stdio.h>
#include <sys/socket.h>
#include <sys/ioctl.h>
#include <linux/netlink.h>
#include <linux/rtnetlink.h>
#include <sys/types.h>
  #define BUFSIZE 192
struct route_info{
        u_int   dstAddr;
        u_int   srcAddr;
        u_int   gateWay;
        char    ifName[IF_NAMESIZE];
};
  void fillRoute (struct route_info *rinfo, const char* dstAddr,
                const char* srcAddr, const char* gateway, const char* ifName)
{
        /* Convert from the standrad numbers and dots notation
           to binary data  */
        inet_aton("192.168.51.0", (struct in_addr *)&rinfo->dstAddr);
        inet_aton("192.168.51.90", (struct in_addr *)&rinfo->gateWay);
}
  int addAttr (struct nlmsghdr *nlhdr, int maxlen, int type,
                void *data, int alen)
{
        struct rtattr *rta;
        int len = RTA_LENGTH(alen);
        if (NLMSG_ALIGN(nlhdr->nlmsg_len) + len > maxlen)
                return -1;
        rta = (struct rtattr*)((char *)nlhdr + NLMSG_ALIGN(nlhdr->nlmsg_len));
        rta->rta_type = type;
        rta->rta_len  = len;
        memcpy(RTA_DATA(rta), data, alen);
        nlhdr->nlmsg_len = NLMSG_ALIGN(nlhdr->nlmsg_len) + len;
        return 0;
}
  int main()
{
        struct nlmsghdr *nlMsg;
        struct rtmsg *rtMsg;
        char dstAddr[30] ;
        char srcAddr[30] ;
        char gateway[30] ;
        char ifName[30];
        char msgBuf[BUFSIZE];
        struct route_info rinfo;
        int sock, len, msgSeq = 0;
        int val, i;
          /* Create Socket */
        if((sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE)) < 0)
                perror("Socket Creation: ");
          /* Initialize the buffer */
        memset(msgBuf, 0, BUFSIZE);
          /* point the header and the msg structure pointers into the buffer */
        nlMsg = (struct nlmsghdr *)msgBuf;
        rtMsg = (struct rtmsg *)NLMSG_DATA(nlMsg);
          /* Fill in the nlmsg header*/
        nlMsg->nlmsg_len = NLMSG_LENGTH(sizeof(struct rtmsg)); // Length ofmessage.
          nlMsg->nlmsg_type = RTM_NEWROUTE;                      // Get the routes from kernel routing table .
          nlMsg->nlmsg_flags = NLM_F_CREATE ;       // The message is a request for dump.
        nlMsg->nlmsg_seq = msgSeq++;                           // Sequence of the message packet.
        nlMsg->nlmsg_pid = getpid();                           // PID of process sending the request.
        rtMsg->rtm_family = AF_INET;
        rtMsg->rtm_table = RT_TABLE_UNSPEC;
        rtMsg->rtm_dst_len = 16;
        rtMsg->rtm_src_len = 16;
        rtMsg->rtm_scope = RT_SCOPE_UNIVERSE;
        rtMsg->rtm_type = RTN_UNICAST;
        rtMsg->rtm_protocol = RTPROT_UNSPEC;
        rtMsg->rtm_flags   = RTM_F_NOTIFY;
          fillRoute (&rinfo, dstAddr, srcAddr, gateway, ifName);
        addAttr (nlMsg, BUFSIZE, RTA_DST,
                        &rinfo.dstAddr, 4);
                addAttr (nlMsg, BUFSIZE, RTA_GATEWAY,
                        &rinfo.gateWay, 4);
          /* Send the request */
        if((val = send(sock, nlMsg, nlMsg->nlmsg_len,0 )) < 0){
                printf("Write To Socket Failed...\n");
                return -1;
        }
        printf (" No of Bytes sent %d \n", val);
        printf (" Value that is sent \n " );
        for (i =0 ; i < val ; i ++)
          printf ("%u", msgBuf[i]);
        printf ("\n");
        close(sock);
return 0;
}
  
//////////////////////////////////////////////////////////////////////////////////////////////////////////
                                OUTPUT
  [root@vijdom]gcc netlink_addroute.c -o addroute
  [root@vijdom]# ./addroute
 No of Bytes sent 44
 Value that is sent
 4400024004000042949672398800216160000101008010429496723242949672085108050429496723242949672085190

  ////////////////////////////////////////////////////////////////////////////////////////////////////////// 
                                SCREEN SHOTS
   
  Routing table before execution of program 
  Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.51.0    *               255.255.255.0   U     0      0        0 eth0
169.254.0.0     *               255.255.0.0     U     0      0        0 eth0
127.0.0.0       *               255.0.0.0       U     0      0        0 lo
default         embedded        0.0.0.0         UG    0      0        0 eth0
   
  Routing table after the execution of program
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.51.0    *               255.255.255.0   U     0      0        0 eth0
169.254.0.0     *               255.255.0.0     U     0      0        0 eth0
127.0.0.0       *               255.0.0.0       U     0      0        0 lo
default         embedded        0.0.0.0         UG    0      0        0 eth0
  
 
   
   
   

 				
---------------------------------
 Find out what India is talking about on Yahoo! Answers India.
SMS memory full? Store all your important SMS in your Yahoo! Mail. Register for SMS BAK UP now! 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060725/abb0f2eb/attachment.html
From araul at adonet.ro  Tue Jul 25 19:31:00 2006
From: araul at adonet.ro (Adorean Alexandru Raul)
Date: Tue Jul 25 19:25:14 2006
Subject: [LARTC] Routed network + web-cache
In-Reply-To: <44C5F84A.1090703@cnett.com.br>
References: <44C5F84A.1090703@cnett.com.br>
Message-ID: <44C65554.8000802@adonet.ro>

Nataniel Klug wrote:
>    Hello all,
>
>    I have a small ISP and I work all my clients networks over a routed 
> network (now I am using 201.35.16.0/24 and 200.140.222.128/25 for my 
> clients).
>
>    The gateway server of the ISP is capable of running a web-cache 
> (only http) using squid but I dont want that my clients go to the 
> internet with the proxy/cache IP. Like when they enter in this site 
> www.meuip.com.br it shows only the proxy/gw server ip and not the 
> client ip.
>
>    There is some way to make this happens?
>
> Att,
>
> Nataniel Klug
> _______________________________________________
> LARTC mailing list
> LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
>
Yelow.
    From what i kow about squid it can't be done. You are stuck, becouse 
the proxy makes the request not the client thus you have proxy server ip.

    Some pages user a TCP header to recognise the ip behind the proxy 
server (X_FORWARDED_FOR i belive..)

Good luck,
Adorean Alexandru Raul
From araul at adonet.ro  Tue Jul 25 19:48:05 2006
From: araul at adonet.ro (Adorean Alexandru Raul)
Date: Tue Jul 25 19:42:18 2006
Subject: [LARTC] problem in Route add using netlink
In-Reply-To: <20060725145938.68004.qmail@web8327.mail.in.yahoo.com>
References: <20060725145938.68004.qmail@web8327.mail.in.yahoo.com>
Message-ID: <44C65955.1040605@adonet.ro>

VijayaLakshmi Seshadri wrote:
> Hi all
>  Iam trying to implement "route add " using netlink. The changes are 
> not reflected in the routing table. I have given my code and screen 
> shots of the routing tables.
>  
> Can anybody tell me is there any mistake iam making in defining the 
> fields .
> or any other mistake iam commiting
>  
> thanxs
>  
> viji
>  
> //////////////////////////////////// CODE 
> //////////////////////////////////////////////////////
> #include <asm/types.h>
> #include <netinet/ether.h>
> #include <netinet/in.h>
> #include <net/if.h>
> #include <stdio.h>
> #include <sys/socket.h>
> #include <sys/ioctl.h>
> #include <linux/netlink.h>
> #include <linux/rtnetlink.h>
> #include <sys/types.h>
> #define BUFSIZE 192
> struct route_info{
>         u_int   dstAddr;
>         u_int   srcAddr;
>         u_int   gateWay;
>         char    ifName[IF_NAMESIZE];
> };
> void fillRoute (struct route_info *rinfo, const char* dstAddr,
>                 const char* srcAddr, const char* gateway, const char* 
> ifName)
> {
>         /* Convert from the standrad numbers and dots notation
>            to binary data  */
>         inet_aton("192.168.51.0", (struct in_addr *)&rinfo->dstAddr);
>         inet_aton("192.168.51.90", (struct in_addr *)&rinfo->gateWay);
> }
> int addAttr (struct nlmsghdr *nlhdr, int maxlen, int type,
>                 void *data, int alen)
> {
>         struct rtattr *rta;
>         int len = RTA_LENGTH(alen);
>         if (NLMSG_ALIGN(nlhdr->nlmsg_len) + len > maxlen)
>                 return -1;
>         rta = (struct rtattr*)((char *)nlhdr + 
> NLMSG_ALIGN(nlhdr->nlmsg_len));
>         rta->rta_type = type;
>         rta->rta_len  = len;
>         memcpy(RTA_DATA(rta), data, alen);
>         nlhdr->nlmsg_len = NLMSG_ALIGN(nlhdr->nlmsg_len) + len;
>         return 0;
> }
> int main()
> {
>         struct nlmsghdr *nlMsg;
>         struct rtmsg *rtMsg;
>         char dstAddr[30] ;
>         char srcAddr[30] ;
>         char gateway[30] ;
>         char ifName[30];
>         char msgBuf[BUFSIZE];
>         struct route_info rinfo;
>         int sock, len, msgSeq = 0;
>         int val, i;
>         /* Create Socket */
>         if((sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE)) < 0)
>                 perror("Socket Creation: ");
>         /* Initialize the buffer */
>         memset(msgBuf, 0, BUFSIZE);
>         /* point the header and the msg structure pointers into the 
> buffer */
>         nlMsg = (struct nlmsghdr *)msgBuf;
>         rtMsg = (struct rtmsg *)NLMSG_DATA(nlMsg);
>         /* Fill in the nlmsg header*/
>         nlMsg->nlmsg_len = NLMSG_LENGTH(sizeof(struct rtmsg)); // 
> Length ofmessage.
>         nlMsg->nlmsg_type = RTM_NEWROUTE;                      // Get 
> the routes from kernel routing table .
>         nlMsg->nlmsg_flags = NLM_F_CREATE ;       // The message is a 
> request for dump.
>         nlMsg->nlmsg_seq = msgSeq++;                           // 
> Sequence of the message packet.
>         nlMsg->nlmsg_pid = getpid();                           // PID 
> of process sending the request.
>         rtMsg->rtm_family = AF_INET;
>         rtMsg->rtm_table = RT_TABLE_UNSPEC;
>         rtMsg->rtm_dst_len = 16;
>         rtMsg->rtm_src_len = 16;
>         rtMsg->rtm_scope = RT_SCOPE_UNIVERSE;
>         rtMsg->rtm_type = RTN_UNICAST;
>         rtMsg->rtm_protocol = RTPROT_UNSPEC;
>         rtMsg->rtm_flags   = RTM_F_NOTIFY;
>         fillRoute (&rinfo, dstAddr, srcAddr, gateway, ifName);
>         addAttr (nlMsg, BUFSIZE, RTA_DST,
>                         &rinfo.dstAddr, 4);
>                 addAttr (nlMsg, BUFSIZE, RTA_GATEWAY,
>                         &rinfo.gateWay, 4);
>         /* Send the request */
>         if((val = send(sock, nlMsg, nlMsg->nlmsg_len,0 )) < 0){
>                 printf("Write To Socket Failed...\n");
>                 return -1;
>         }
>         printf (" No of Bytes sent %d \n", val);
>         printf (" Value that is sent \n " );
>         for (i =0 ; i < val ; i ++)
>           printf ("%u", msgBuf[i]);
>         printf ("\n");
>         close(sock);
> return 0;
> }
>
> //////////////////////////////////////////////////////////////////////////////////////////////////////////
>                               OUTPUT
> [root@vijdom]gcc netlink_addroute.c -o addroute
> [root@vijdom]# ./addroute
>  No of Bytes sent 44
>  Value that is sent
>  4400024004000042949672398800216160000101008010429496723242949672085108050429496723242949672085190
> ////////////////////////////////////////////////////////////////////////////////////////////////////////// 
>
>                               SCREEN SHOTS
>  
> *Routing table before execution of program*
> Kernel IP routing table
> Destination     Gateway         Genmask         Flags Metric Ref    
> Use Iface
> 192.168.51.0    *               255.255.255.0   U     0      0        
> 0 eth0
> 169.254.0.0     *               255.255.0.0     U     0      0        
> 0 eth0
> 127.0.0.0       *               255.0.0.0       U     0      0        0 lo
> default         embedded        0.0.0.0         UG    0      0        
> 0 eth0
>  
> *Routing table after the execution of program
> *Kernel IP routing table
> Destination     Gateway         Genmask         Flags Metric Ref    
> Use Iface
> 192.168.51.0    *               255.255.255.0   U     0      0        
> 0 eth0
> 169.254.0.0     *               255.255.0.0     U     0      0        
> 0 eth0
> 127.0.0.0       *               255.0.0.0       U     0      0        0 lo
> default         embedded        0.0.0.0         UG    0      0        
> 0 eth0
>
>  
>  
>  
>  
>
> ------------------------------------------------------------------------
> Find out what India is talking about on Yahoo! Answers India. 
> <http://us.rd.yahoo.com/mail/in/mailanswersshare/*http://in.answers.yahoo.com/>
> SMS memory full? Store all your important SMS in your Yahoo! Mail. 
> Register for SMS BAK UP now! 
> <http://us.rd.yahoo.com/mail/in/mailbackup/*http://in.mobile.yahoo.com/smsbakup.html> 
>
> ------------------------------------------------------------------------
>
> _______________________________________________
> LARTC mailing list
> LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
>   
I have a similar network 4  /24 ip classess splitet in 7 regions. rhus i 
have to do routing. For this i use:::

/sbin/ip route add class via ip                                 for 
eatch region.


ex:::  /sbin/ip route add 89.34.23.0/26 via 81.181.180.21

89.34.23.0/26 > region ip address
81.181.180.21 > router ip

This i what i use....

looking forward to learning about netlink,

Good luck,
Adorean Alexandru Raul
From luciano at lugmen.org.ar  Tue Jul 25 19:53:43 2006
From: luciano at lugmen.org.ar (Luciano Ruete)
Date: Tue Jul 25 19:49:57 2006
Subject: [LARTC] Routed network + web-cache
In-Reply-To: <44C5F84A.1090703@cnett.com.br>
References: <44C5F84A.1090703@cnett.com.br>
Message-ID: <200607251453.43136.luciano@lugmen.org.ar>

On Tuesday 25 July 2006 07:54, Nataniel Klug wrote:
>     Hello all,
>
>     I have a small ISP and I work all my clients networks over a routed
> network (now I am using 201.35.16.0/24 and 200.140.222.128/25 for my
> clients).
>
>     The gateway server of the ISP is capable of running a web-cache
> (only http) using squid but I dont want that my clients go to the
> internet with the proxy/cache IP. Like when they enter in this site
> www.meuip.com.br it shows only the proxy/gw server ip and not the client
> ip.
>
>     There is some way to make this happens?

yes, but you'll need a patched kernel, couse squid will need to bind non-local 
addresses.

See the squid FAQ about this, and folow de link in there:
http://www.squid-cache.org/Doc/FAQ/FAQ-7.html#ss7.13
--
Luciano
From alexandre at ondainternet.com.br  Tue Jul 25 19:56:03 2006
From: alexandre at ondainternet.com.br (Alexandre J. Correa - Onda Internet)
Date: Tue Jul 25 19:55:29 2006
Subject: [LARTC] Routed network + web-cache
In-Reply-To: <44C65554.8000802@adonet.ro>
References: <44C5F84A.1090703@cnett.com.br> <44C65554.8000802@adonet.ro>
Message-ID: <44C65B33.606@ondainternet.com.br>

Nataniel,

www.balabit.com/downloads/tproxy/linux-2.6/

patch squid, kernel and iptables !!

Sds.

Alexandre J Correa
Onda Internet / OPinguim.net Webhosting
www.ondainternet.com.br
www.opinguim.net



Adorean Alexandru Raul wrote:
> Nataniel Klug wrote:
>>    Hello all,
>>
>>    I have a small ISP and I work all my clients networks over a routed 
>> network (now I am using 201.35.16.0/24 and 200.140.222.128/25 for my 
>> clients).
>>
>>    The gateway server of the ISP is capable of running a web-cache 
>> (only http) using squid but I dont want that my clients go to the 
>> internet with the proxy/cache IP. Like when they enter in this site 
>> www.meuip.com.br it shows only the proxy/gw server ip and not the 
>> client ip.
>>
>>    There is some way to make this happens?
>>
>> Att,
>>
>> Nataniel Klug
>> _______________________________________________
>> LARTC mailing list
>> LARTC@mailman.ds9a.nl
>> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
>>
> Yelow.
>    From what i kow about squid it can't be done. You are stuck, becouse 
> the proxy makes the request not the client thus you have proxy server ip.
> 
>    Some pages user a TCP header to recognise the ip behind the proxy 
> server (X_FORWARDED_FOR i belive..)
> 
> Good luck,
> Adorean Alexandru Raul
> _______________________________________________
> LARTC mailing list
> LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
> 
From luciano at lugmen.org.ar  Tue Jul 25 20:09:13 2006
From: luciano at lugmen.org.ar (Luciano Ruete)
Date: Tue Jul 25 20:05:36 2006
Subject: [LARTC] linux transparent bridge running squid and dansguardian
In-Reply-To: <004b01c6af58$2156d740$3a02a8c0@william>
References: <004b01c6af58$2156d740$3a02a8c0@william>
Message-ID: <200607251509.13588.luciano@lugmen.org.ar>

On Monday 24 July 2006 16:33, William Bohannan wrote:
> Thanks or the quick reply.  Although I have had no success, I have been
> trying all day using both physdev and ebtables, neither of which I can get
> working :( Please help - below is what I am currently using.
>

Try this, it is a one-line simple modified version of your first post script. If this proof of concept works, then add all the others iptables rules that you whant. 

iptables -F
iptables -t nat -F
iptables -t nat -A PREROUTING -m physdev --physdev-in eth1 -p tcp --dport 80 -j REDIRECT --to-port 3128

--
Luciano
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060725/0bbfc7dc/attachment.htm
From Ted.Piotrowski at jhuapl.edu  Tue Jul 25 22:05:46 2006
From: Ted.Piotrowski at jhuapl.edu (Piotrowski, Ted P.)
Date: Tue Jul 25 22:05:33 2006
Subject: [LARTC] bandwidth limitation help
Message-ID: <3C5BFF28444F434695FB134004DF014701B94422@aplesjustice.dom1.jhuapl.edu>

Hi,
 
I am new to the mailing list so I'm not sure if anybody reads these, but
here goes nothing. I recently read: Linux Advanced Routing & Traffic
Control HOWTO and have been trying to test my applications using
bandwidth limitation. All the examples described in the HOWTO do not
simulate the conditions I need to test my software. What I would like is
for my bandwidth limitation to empty my UDP buffer at a given rate. I
have tried using a simple TBF to do this, but all that happens is that
my application floods the TBF buffer at link speed and the TBF buffer
quickly overflows and drops packets. I want the packets to actually stay
in the UDP buffer and be emptied at a given rate without modifying my
application.
 
I don't know if any of you are familiar with netem, but it can be used
in conjuction with tc to add delay to a link. Surprisingly, packets
delayed by netem appear to remain in the UDP buffer until it is time for
them to be sent. I would like this same behavior of keeping the packets
in the UDP buffer, but with bandwidth limitation on the rate at which
the buffer empties, not just packet delay. Has anybody ever done
anything like this or can point me to some resources?
 
Thank you,
Ted P.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060725/6ae3aaff/attachment.html
From prasad at atc.tcs.co.in  Wed Jul 26 07:42:14 2006
From: prasad at atc.tcs.co.in (Prasad)
Date: Wed Jul 26 07:42:03 2006
Subject: [LARTC] IPSec tunnel mode, through a IPIP tunnel
Message-ID: <44C700B6.1060903@atc.tcs.co.in>


Hello Gurus,

I am a small problem with routing and here are the details.

Interfaces on my server:
* ipsec0 - 172.19.58.94
* tunl0 - 172.19.58.94
* eth0 - 172.19.58.94

Now, the problem is that there is another host 172.19.58.200. All 
communication to 172.19.58.200 should be through tunl0, and all the data 
should be secured using IPSec (tunnel mode - because there are more 
machines on my network and 172.19.58.94 is the gateway through which 
they access 172.19.58.200).  How can this be achived???

Here is what I did:

1. Default route for 172.19.58.200 is ipsec0
    route add -host 172.19.58.200 dev ipsec0
2. Mark all packets after being routed through ipsec0
    iptables -t mangle -A POSTROUTING -o ipsec0 -j mark --set-mark 1
3. Create a routing rule and add the new rule
    ip rule add fwmark 1 table tunnel
4. Create routing entries for table 'tunnel'
    ip route add 172.19.58.200 dev tunl0

Well, all this assumes that once the packet enters the ipsec tunnel, 
after encapsulation the packets are routed afresh based on the routing 
tables.  Could the gurus help me fix this!!!

Thanks,
Prasad
From prasad at atc.tcs.co.in  Wed Jul 26 08:48:07 2006
From: prasad at atc.tcs.co.in (Prasad)
Date: Wed Jul 26 08:47:56 2006
Subject: [LARTC] IPSec tunnel mode, through a IPIP tunnel
In-Reply-To: <44C700B6.1060903@atc.tcs.co.in>
References: <44C700B6.1060903@atc.tcs.co.in>
Message-ID: <44C71027.8010009@atc.tcs.co.in>


small info to add:

I am using a 2.4 kernel (RH-9) and the packets currently are going 
through IPSec, then getting routed through eth0 directly (but I want 
them to go through tunl0)

Prasad

Prasad wrote:
>
> Hello Gurus,
>
> I am a small problem with routing and here are the details.
>
> Interfaces on my server:
> * ipsec0 - 172.19.58.94
> * tunl0 - 172.19.58.94
> * eth0 - 172.19.58.94
>
> Now, the problem is that there is another host 172.19.58.200. All 
> communication to 172.19.58.200 should be through tunl0, and all the 
> data should be secured using IPSec (tunnel mode - because there are 
> more machines on my network and 172.19.58.94 is the gateway through 
> which they access 172.19.58.200).  How can this be achived???
>
> Here is what I did:
>
> 1. Default route for 172.19.58.200 is ipsec0
>    route add -host 172.19.58.200 dev ipsec0
> 2. Mark all packets after being routed through ipsec0
>    iptables -t mangle -A POSTROUTING -o ipsec0 -j mark --set-mark 1
> 3. Create a routing rule and add the new rule
>    ip rule add fwmark 1 table tunnel
> 4. Create routing entries for table 'tunnel'
>    ip route add 172.19.58.200 dev tunl0
>
> Well, all this assumes that once the packet enters the ipsec tunnel, 
> after encapsulation the packets are routed afresh based on the routing 
> tables.  Could the gurus help me fix this!!!
>
> Thanks,
> Prasad
> _______________________________________________
> LARTC mailing list
> LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
>

From petre at kgb.ro  Wed Jul 26 15:13:43 2006
From: petre at kgb.ro (Petre Bandac)
Date: Wed Jul 26 15:11:47 2006
Subject: [LARTC] patching iptables for connlimit
Message-ID: <20060726161343.097de260@localhost>

hallo

the patch described at

http://www.netfilter.org/documentation/HOWTO//netfilter-extensions-HOWTO-3.html#ss3.5

works for the FORWARD chain as well ?

thanks,

petre

-- 

Petre Bandac

Network Scientist

-
petre@kgb.ro
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url : http://mailman.ds9a.nl/pipermail/lartc/attachments/20060726/6d63fdc3/signature.pgp
From pereyra.roberto at gmail.com  Wed Jul 26 17:52:42 2006
From: pereyra.roberto at gmail.com (Roberto Pereyra)
Date: Wed Jul 26 17:52:29 2006
Subject: [LARTC] ESFQ and bridges
Message-ID: <f05666f00607260852x1cb1ae08pf3556da686d92d40@mail.gmail.com>

Hi

ESFQ works with bridges ?

Thanks a lot

roberto

-- 
Ing. Roberto Pereyra
ContenidosOnline
Looking for Linux Virtual Private Servers ? Click here:
http://www.spry.com/hosting-affiliate/scripts/t.php?a_aid=426&a_bid=56
From andy at andybev.com  Wed Jul 26 17:56:45 2006
From: andy at andybev.com (Andrew Beverley)
Date: Wed Jul 26 17:56:44 2006
Subject: [LARTC] patching iptables for connlimit
In-Reply-To: <20060726161343.097de260@localhost>
References: <20060726161343.097de260@localhost>
Message-ID: <44C790BD.1010800@andybev.com>

> the patch described at
> 
> http://www.netfilter.org/documentation/HOWTO//netfilter-extensions-HOWTO-3.html#ss3.5
> 
> works for the FORWARD chain as well ?

Yes I've just tried it and it works fine.

If you want to use connlimit and you're using a recent kernel you'll need to take 
a look at the netfilter users mailing list for details on how to use connlimit 
with it. Take a look at:

http://lists.netfilter.org/pipermail/netfilter/2006-July/066227.html

and also the thread index for the other messages. Unfortunately the thread is 
split up into several places in the index.

Andy Beverley

From mf at mfedv.net  Wed Jul 26 19:25:00 2006
From: mf at mfedv.net (Matthias Ferdinand)
Date: Wed Jul 26 19:24:51 2006
Subject: [LARTC] static linking of /usr/sbin/tc?
Message-ID: <F34C7590DF2939867680BB49@[192.168.42.24]>

Hello,

I am trying to revive an old linux server installation, which still has 
libc5. Sadly, most current software does not compile anymore on this 
system, including the tc utility. As with other tools (net-tools, 
coreutils, procps etc.) I tried to compile and statically link 
(LDFLAGS=-static) on a more recent linux machine and copy the static 
binaries over to the old machine.

But no luck with tc. Even on the host where I compiled it (Debian Sarge 
3.1), the static binary (/usr/local/iproute2-2.6.16-060323/usr/sbin/tc) 
does not see any qdisc:

xoff:~# /sbin/tc qdisc ls dev eth0
qdisc pfifo_fast 0: bands 3 priomap  1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1

xoff:~# /usr/local/iproute2-2.6.16-060323/usr/sbin/tc qdisc ls dev eth0
qdisc pfifo_fast 0: [Unknown qdisc, optlen=20]


The source code makes use of dlopen() / dlsym() functions, which may be the 
reason for the failure. Does anybody know a way to make it work in a static 
binary?

Regards
Matthias

From bugfood-ml at fatooh.org  Wed Jul 26 19:49:27 2006
From: bugfood-ml at fatooh.org (Corey Hickey)
Date: Wed Jul 26 19:49:14 2006
Subject: [LARTC] ESFQ and bridges
In-Reply-To: <f05666f00607260852x1cb1ae08pf3556da686d92d40@mail.gmail.com>
References: <f05666f00607260852x1cb1ae08pf3556da686d92d40@mail.gmail.com>
Message-ID: <44C7AB27.5020706@fatooh.org>

Roberto Pereyra wrote:
> Hi
> 
> ESFQ works with bridges ?

...just as well as any other qdisc...

-Corey
From shemminger at osdl.org  Wed Jul 26 21:22:40 2006
From: shemminger at osdl.org (Stephen Hemminger)
Date: Wed Jul 26 21:22:29 2006
Subject: [LARTC] static linking of /usr/sbin/tc?
In-Reply-To: <F34C7590DF2939867680BB49@[192.168.42.24]>
References: <F34C7590DF2939867680BB49@[192.168.42.24]>
Message-ID: <20060726122240.07076818@localhost.localdomain>

On Wed, 26 Jul 2006 19:25:00 +0200
Matthias Ferdinand <mf@mfedv.net> wrote:

> Hello,
> 
> I am trying to revive an old linux server installation, which still has 
> libc5. Sadly, most current software does not compile anymore on this 
> system, including the tc utility. As with other tools (net-tools, 
> coreutils, procps etc.) I tried to compile and statically link 
> (LDFLAGS=-static) on a more recent linux machine and copy the static 
> binaries over to the old machine.
> 
> But no luck with tc. Even on the host where I compiled it (Debian Sarge 
> 3.1), the static binary (/usr/local/iproute2-2.6.16-060323/usr/sbin/tc) 
> does not see any qdisc:
> 
> xoff:~# /sbin/tc qdisc ls dev eth0
> qdisc pfifo_fast 0: bands 3 priomap  1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
> 
> xoff:~# /usr/local/iproute2-2.6.16-060323/usr/sbin/tc qdisc ls dev eth0
> qdisc pfifo_fast 0: [Unknown qdisc, optlen=20]
> 
> The source code makes use of dlopen() / dlsym() functions, which may be the 
> reason for the failure. Does anybody know a way to make it work in a static 
> binary?
>

The dlopen() stuff is just to allow adding support for new qdisc's later.
It also is introspective, it is used to find the qdisc's that are statically
linked in.  Why bother updating it?

You could with some effort change tc to have a list of qdisc structure
pointers and change get_qdisc_kind to walk the list.
From mf at mfedv.net  Wed Jul 26 22:23:12 2006
From: mf at mfedv.net (Matthias Ferdinand)
Date: Wed Jul 26 22:23:04 2006
Subject: [LARTC] static linking of /usr/sbin/tc?
In-Reply-To: <20060726122240.07076818@localhost.localdomain>
References: <F34C7590DF2939867680BB49@[192.168.42.24]>
	<20060726122240.07076818@localhost.localdomain>
Message-ID: <37EF00A45A0DD8427311E75C@[192.168.72.1]>

--On Mittwoch, Juli 26, 2006 12:22:40 -0700 Stephen Hemminger 
<shemminger@osdl.org> wrote:
> On Wed, 26 Jul 2006 19:25:00 +0200
> Matthias Ferdinand <mf@mfedv.net> wrote:
>> But no luck with tc. Even on the host where I compiled it (Debian Sarge
>> 3.1), the static binary (/usr/local/iproute2-2.6.16-060323/usr/sbin/tc)
>> does not see any qdisc:

> You could with some effort change tc to have a list of qdisc structure
> pointers and change get_qdisc_kind to walk the list.

Thanks for the answer, but I guess that would be more trouble than it's 
worth, and probably nobody would use that patched stuff except myself. I 
can do QoS stuff on a Linux router nearby, it would have been just 
aesthetically pleasing to have it all available on the old server.

Regards
Matthias
From avl at strace.net  Thu Jul 27 15:23:49 2006
From: avl at strace.net (Dmitry Labutcky)
Date: Thu Jul 27 15:22:38 2006
Subject: [LARTC] SRR qdisc
Message-ID: <44C8BE65.6060107@strace.net>

Hi all,

I wrote new qdisc SRR (Simple Round Robin). This is just another reimplementation
of round robin packets distributions. I'm not using SQF/ESFQ source code and 
algorithms
in this scheduler. The main goal of this work is not given multistream download 
managers
give all bandwidth resource.
Please testing this: http://mordor.strace.net/sched-srr/

-- 
/bye
----------------------------------------------------------------------
Dmitry U.Labutcky                  System administrator of Swift Trace
mail to: avl@strace.net            Simferopol, Crimea, Ukraine
phone:   +380-652-516546           Yaltinskaya 20, office 502

From rayvd at digitalpath.net  Thu Jul 27 18:45:16 2006
From: rayvd at digitalpath.net (Ray Van Dolson)
Date: Thu Jul 27 18:45:11 2006
Subject: [LARTC] Re: What am I missing?
Message-ID: <20060727164516.GA11363@digitalpath.net>

Follow-up to my own post here:

  http://marc.theaimsgroup.com/?l=lartc&m=115332794424197&w=2

Problem ended up being that the tc included in the iproute RPM in Fedora
Core 2 was built specifically against the headers in the glibc-kernheaders
RPM.

When I switched to a custom kernel (for built-in MPPE support), apparently
some symbols referenced in the glibc-kernheaders package are not present in
the non-RH kernel.  This was causing my issue.

Solution was to modify the .spec file for iproute and tell it to compile
against my custom kernel's headers specifically.

Specifically I had to make the following changes to the .spec file to get
things to work:

 - Modify iproute2-2.4.7-kernel.patch to point to /usr/src/linux/include
 - Do not apply iproute2-2.4.7-misc.patch
 - Do not apply iproute2-2.4.7-in_port_t.patch

This makes everything happy once again!  I'm not sure what the consequenes
are of not applying those RedHat patches, but the tool still works normally
as far as I can tell.

Ray
From mfdutra at gmail.com  Thu Jul 27 19:45:35 2006
From: mfdutra at gmail.com (Marlon Dutra)
Date: Thu Jul 27 19:45:21 2006
Subject: [LARTC] Weird HTB behaviour in 2.6.17
Message-ID: <30dd942a0607271045o73dfc680r6bd2695e257a982b@mail.gmail.com>

Hello,

I've just compiled the kernel 2.6.17 and noticed an odd HTB behaviour.

For instance:

tc class add dev eth0 parent 1:1 classid 1:30 htb rate 1kbit ceil
750Kbit burst 15k
tc filter add dev eth0 parent 1:0 protocol ip prio 15 u32 match ip dst
192.168.5.1 classid 1:30

The filter works ok and the traffic to 192.168.5.1 flows through the
class 1:30, but the rate gets much higher than 750 Kbps.

As far as I realized, the faster the processor is, the higher the
traffic gets above the ceiling.

I've seen that same behaviour in several machines with this kernel,
both with Intel and AMD processors. With a dual Xeon 3 GHz, when my
ceiling is 750 Kbps, I get the traffic about 5 Mbps.

It seems to be something related to clock.

http://mailman.ds9a.nl/pipermail/lartc/2005q3/016981.html

In that post, there is another guy with the same problem, but with 2.6.11.

Any clues?

-- 
Marlon
From altchill at hotmail.com  Fri Jul 28 03:21:10 2006
From: altchill at hotmail.com (Jake Altchill)
Date: Fri Jul 28 03:21:01 2006
Subject: [LARTC] Weird HTB behaviour in 2.6.17
In-Reply-To: <30dd942a0607271045o73dfc680r6bd2695e257a982b@mail.gmail.com>
Message-ID: <BAY106-F1422022811303CCE3104A6D4590@phx.gbl>

What kind of network cards do you have?
What are the tc stats that you get on
the class (anything about giants?)?

There's something funny with the intel gig cards.
Even if the mtu on them is set to 1500
there's something that breaks / confuses htb.
If these are the cards you are using you
need to explicitly set the mtu for your
classes to 16500.


>Hello,
>
>I've just compiled the kernel 2.6.17 and noticed an odd HTB behaviour.
>
>For instance:
>
>tc class add dev eth0 parent 1:1 classid 1:30 htb rate 1kbit ceil
>750Kbit burst 15k
>tc filter add dev eth0 parent 1:0 protocol ip prio 15 u32 match ip dst
>192.168.5.1 classid 1:30
>
>The filter works ok and the traffic to 192.168.5.1 flows through the
>class 1:30, but the rate gets much higher than 750 Kbps.
>
>As far as I realized, the faster the processor is, the higher the
>traffic gets above the ceiling.
>
>I've seen that same behaviour in several machines with this kernel,
>both with Intel and AMD processors. With a dual Xeon 3 GHz, when my
>ceiling is 750 Kbps, I get the traffic about 5 Mbps.
>
>It seems to be something related to clock.
>
>http://mailman.ds9a.nl/pipermail/lartc/2005q3/016981.html
>
>In that post, there is another guy with the same problem, but with 2.6.11.
>
>Any clues?

_________________________________________________________________
Express yourself instantly with MSN Messenger! Download today - it's FREE! 
http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

From sinha.mrinal at yahoo.co.in  Fri Jul 28 06:55:53 2006
From: sinha.mrinal at yahoo.co.in (Mrinal Sinha)
Date: Fri Jul 28 06:55:43 2006
Subject: [LARTC] Problem with routing for multiple uplinks/providers using
	iproute2
Message-ID: <20060728045553.20874.qmail@web8601.mail.in.yahoo.com>

  hi all,
we were trying to configure our system with 2 ethernet catds connected to two different providers using iproute2 so that it recieves and transmits data from both of them. We have followed the configuration as given on lartc's howto 
But the most wierd part of the story is that after we restart the system (We have put the script in rc.local) the system works fine and we can ping both our cards from anywhere in the world. But after sometime none of the cards can be pinged from outside but the site running on the system is accessible from everywhere.
Does anyone has any idea where or wat we are doing wrong, i will really appreciate your help.
Its just so confusing, hopefully its a silly error,
(We are running FC-4 with dual Xeon processors)

thnx in advance,
Mrin
 				
---------------------------------
 Here?s a new way to find what you're looking for - Yahoo! Answers 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060728/f8d36687/attachment.html
From jarkap at poczta.onet.pl  Fri Jul 28 09:29:55 2006
From: jarkap at poczta.onet.pl (Jarek Poplawski)
Date: Fri Jul 28 09:29:19 2006
Subject: [LARTC] Re: Weird HTB behaviour in 2.6.17
In-Reply-To: <30dd942a0607271045o73dfc680r6bd2695e257a982b@mail.gmail.com>
References: <30dd942a0607271045o73dfc680r6bd2695e257a982b@mail.gmail.com>
Message-ID: <eacecc$4p8$1@sea.gmane.org>

On 27-07-2006 19:45, Marlon Dutra wrote:
> Hello,
> 
...

> 
> http://mailman.ds9a.nl/pipermail/lartc/2005q3/016981.html
> 
> In that post, there is another guy with the same problem, but with 2.6.11.

I can't see any problem there! If this guy expected lower rate 
for 1:39 class, he should have lower the ceil. This class had 
much higher traffic then the other class and probably was 
borrowing just when this stats were prepared.

Jarek P.

From rvokal at redhat.com  Fri Jul 28 12:00:24 2006
From: rvokal at redhat.com (Radek =?ISO-8859-1?Q?Vok=E1l?=)
Date: Fri Jul 28 10:01:16 2006
Subject: [LARTC] no PROMISC mode in ip link show
Message-ID: <1154080824.9755.24.camel@localhost.localdomain>

Hi 

When I start arpwatch or tcpdump the Ethernet card eth0 goes into
promiscuous mode but I cannot see it with ifconfig eth0 or ip link show.
The only way I can see it is when I looked at dmesg.

Ifconfig uses the old style IOFLAG way to determine this but looking
into ip code this is supposed to work even with newer kernels (I'm on
2.6.17 now with the latest iproute package) 

I found these links about the issue
http://www.tcpdump.org/lists/workers/2001/01/msg00184.html
http://lists.virus.org/bugtraq-0207/msg00363.html



Radek


-- 
Radek Vok?l <rvokal@redhat.com>

From makevuy at ehas.org  Fri Jul 28 14:43:06 2006
From: makevuy at ehas.org (makevuy)
Date: Fri Jul 28 14:42:55 2006
Subject: [LARTC] Problem with iptables with -j TOS and MARK
Message-ID: <44CA065A.9090903@ehas.org>

Hy,

I would want to mark the packets that are entering in a machine, with a 
mark for using diffserv with DSMARK.

My machine has 2 interfaces, a ethernet and a wireless. The ethernet 
interface is eth1 and the other is wifi0.

Firs, I would want to test that I would be able to mark the tos of the 
paquets that I would be receiving, for this I write in the console of my 
linux:


iptables -A PREROUTING -i eth1 -t mangle -p udp -j TOS --set-tos 0x20

But the TOS doesn't change (I see this with ethereal)

Waht could be the problem?

I've tried the same with the MARK option:

iptables -A PREROUTING -i eth1 -t mangle -p udp -j MARK --set-mark 0x20

and a DSMARK.

Regards.

-- 
Sandra Salmer?n Ntutumu    <makevuy@ehas.org>
Tlf. Analog: +34 914888405 / M?vil: 653574298
Tlf. IP desde FWD: 656212. Ext: 10 / Tel. IP desde EHAS: 010010
Fundaci?n EHAS: Enlace Hispanoamericano de Salud - www.ehas.org
Telemedicina rural para zonas aisladas de pa?ses en desarrollo


From hi100nu at yahoo.com  Fri Jul 28 14:50:46 2006
From: hi100nu at yahoo.com (sonu chouhan)
Date: Fri Jul 28 14:50:33 2006
Subject: [LARTC] Re:Problem with routing for multiple uplinks/providers
Message-ID: <20060728125046.18266.qmail@web32514.mail.mud.yahoo.com>

provide me complete detail of your linux box like firewall script (iptables script), kernel's .config file, multigatway file (i.e. /sbin/ip ....... commands file) so i can check and try to resolve your issue.
   
  sonu....

 		
---------------------------------
Do you Yahoo!?
 Everyone is raving about the  all-new Yahoo! Mail Beta.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060728/c636598d/attachment.htm
From jarkap at poczta.onet.pl  Fri Jul 28 15:57:32 2006
From: jarkap at poczta.onet.pl (Jarek Poplawski)
Date: Fri Jul 28 15:57:52 2006
Subject: [LARTC] Re: Problem with iptables with -j TOS and MARK
In-Reply-To: <44CA065A.9090903@ehas.org>
References: <44CA065A.9090903@ehas.org>
Message-ID: <ead536$d62$1@sea.gmane.org>

On 28-07-2006 14:43, makevuy wrote:
> Hy,
> 
> I would want to mark the packets that are entering in a machine, with a 
> mark for using diffserv with DSMARK.
> 
> My machine has 2 interfaces, a ethernet and a wireless. The ethernet 
> interface is eth1 and the other is wifi0.
> 
> Firs, I would want to test that I would be able to mark the tos of the 
> paquets that I would be receiving, for this I write in the console of my 
> linux:
> 
> 
> iptables -A PREROUTING -i eth1 -t mangle -p udp -j TOS --set-tos 0x20
> 
> But the TOS doesn't change (I see this with ethereal)
> 
> Waht could be the problem?

If I can remember, TOS is inserted for real some time later, so 
try to investigate on forward or postrouting.

Jarek P.

From mfdutra at gmail.com  Fri Jul 28 19:25:32 2006
From: mfdutra at gmail.com (Marlon Dutra)
Date: Fri Jul 28 19:25:18 2006
Subject: [LARTC] Weird HTB behaviour in 2.6.17
In-Reply-To: <BAY106-F1422022811303CCE3104A6D4590@phx.gbl>
References: <30dd942a0607271045o73dfc680r6bd2695e257a982b@mail.gmail.com>
	<BAY106-F1422022811303CCE3104A6D4590@phx.gbl>
Message-ID: <30dd942a0607281025o30fe5345o784ce3e4dca5024b@mail.gmail.com>

On 7/27/06, Jake Altchill <altchill@hotmail.com> wrote:

> What kind of network cards do you have?

When I noticed the problem, I was using a Dell server with an Intel
e1000.

But I reproduced the same problem in my desktop, that's an AMD Semprom
with an nVidia ethernet card. So, different processor, chipset and nic.

> What are the tc stats that you get on the class (anything about
> giants?)?

class htb 1:31 parent 1:1 leaf 31: prio 0 rate 1000bit ceil 750000bit
burst 15Kb cburst 1974b
 Sent 11678670 bytes 2711 pkts (dropped 0, overlimits 0)
 rate 1725Kbit 43pps backlog 13p

As you can see, I have rate in 1725Kbit when my ceiling is 750Kbit. That
difference is low, since I'm testing on my Semprom. If I do the same on
the Dell server, the difference is much higher. Some times over ten
times the ceiling.

With a 2.4 kernel, it works perfectly in both hardwares.

> If these are the cards you are using you need to explicitly set the
> mtu for your classes to 16500.

Sorry, I didn't get it. How should I do that?

-- 
Marlon
From mfdutra at gmail.com  Fri Jul 28 19:28:40 2006
From: mfdutra at gmail.com (Marlon Dutra)
Date: Fri Jul 28 19:28:29 2006
Subject: [LARTC] Re: Weird HTB behaviour in 2.6.17
In-Reply-To: <eacecc$4p8$1@sea.gmane.org>
References: <30dd942a0607271045o73dfc680r6bd2695e257a982b@mail.gmail.com>
	<eacecc$4p8$1@sea.gmane.org>
Message-ID: <30dd942a0607281028l65f68d84w5daed2eee03dfc24@mail.gmail.com>

On 7/28/06, Jarek Poplawski <jarkap@poczta.onet.pl> wrote:

> I can't see any problem there! If this guy expected lower rate for
> 1:39 class, he should have lower the ceil. This class had much higher
> traffic then the other class and probably was borrowing just when this
> stats were prepared.

Indeed. In that case, there is no any problem.

But I still have a problem here, as you can see in my last post.

Regards.

-- 
Marlon
From lists at andyfurniss.entadsl.com  Fri Jul 28 20:53:26 2006
From: lists at andyfurniss.entadsl.com (Andy Furniss)
Date: Fri Jul 28 20:52:58 2006
Subject: [LARTC] Weird HTB behaviour in 2.6.17
In-Reply-To: <30dd942a0607281025o30fe5345o784ce3e4dca5024b@mail.gmail.com>
References: <30dd942a0607271045o73dfc680r6bd2695e257a982b@mail.gmail.com>	<BAY106-F1422022811303CCE3104A6D4590@phx.gbl>
	<30dd942a0607281025o30fe5345o784ce3e4dca5024b@mail.gmail.com>
Message-ID: <44CA5D26.5030209@andyfurniss.entadsl.com>

Marlon Dutra wrote:
  (anything about
>> giants?)?
> 
> 
> class htb 1:31 parent 1:1 leaf 31: prio 0 rate 1000bit ceil 750000bit
> burst 15Kb cburst 1974b
> Sent 11678670 bytes 2711 pkts (dropped 0, overlimits 0)
> rate 1725Kbit 43pps backlog 13p
> 
> As you can see, 

I see you snipped giants even though you were asked about them.

Regardless 11678670/2711 > 1500 so specify your mtu next to every rate 
and ceil.

Andy.
From mfdutra at gmail.com  Fri Jul 28 21:12:41 2006
From: mfdutra at gmail.com (Marlon Dutra)
Date: Fri Jul 28 21:12:27 2006
Subject: [LARTC] Weird HTB behaviour in 2.6.17
In-Reply-To: <44CA5D26.5030209@andyfurniss.entadsl.com>
References: <30dd942a0607271045o73dfc680r6bd2695e257a982b@mail.gmail.com>
	<BAY106-F1422022811303CCE3104A6D4590@phx.gbl>
	<30dd942a0607281025o30fe5345o784ce3e4dca5024b@mail.gmail.com>
	<44CA5D26.5030209@andyfurniss.entadsl.com>
Message-ID: <30dd942a0607281212l4b9ca152j43bd088b5a5332b5@mail.gmail.com>

On 7/28/06, Andy Furniss <lists@andyfurniss.entadsl.com> wrote:

> I see you snipped giants even though you were asked about them.

Oh sorry. Here it goes:

class htb 1:31 parent 1:1 leaf 31: prio 0 rate 1000bit ceil 750000bit
burst 15Kb cburst 1875b
 Sent 23991629 bytes 5227 pkts (dropped 0, overlimits 0)
 rate 1567Kbit 44pps
 lended: 150 borrowed: 5077 giants: 3986
 tokens: -14728330 ctokens: -21365

> Regardless 11678670/2711 > 1500 so specify your mtu next to every rate
> and ceil.

I created the class with "mtu 1500" and the result is above, same
behaviour. Afaik, the default mtu is 1600.

By the way, my ethernet MTU is 1500.

How can I prevent those giants?

-- 
Marlon
From lists at andyfurniss.entadsl.com  Fri Jul 28 21:43:15 2006
From: lists at andyfurniss.entadsl.com (Andy Furniss)
Date: Fri Jul 28 21:42:41 2006
Subject: [LARTC] Weird HTB behaviour in 2.6.17
In-Reply-To: <30dd942a0607281212l4b9ca152j43bd088b5a5332b5@mail.gmail.com>
References: <30dd942a0607271045o73dfc680r6bd2695e257a982b@mail.gmail.com>	<BAY106-F1422022811303CCE3104A6D4590@phx.gbl>	<30dd942a0607281025o30fe5345o784ce3e4dca5024b@mail.gmail.com>	<44CA5D26.5030209@andyfurniss.entadsl.com>
	<30dd942a0607281212l4b9ca152j43bd088b5a5332b5@mail.gmail.com>
Message-ID: <44CA68D3.2040402@andyfurniss.entadsl.com>

Marlon Dutra wrote:
> On 7/28/06, Andy Furniss <lists@andyfurniss.entadsl.com> wrote:
> 
>> I see you snipped giants even though you were asked about them.
> 
> 
> Oh sorry. Here it goes:
> 
> class htb 1:31 parent 1:1 leaf 31: prio 0 rate 1000bit ceil 750000bit
> burst 15Kb cburst 1875b
> Sent 23991629 bytes 5227 pkts (dropped 0, overlimits 0)
> rate 1567Kbit 44pps
> lended: 150 borrowed: 5077 giants: 3986
> tokens: -14728330 ctokens: -21365
> 
>> Regardless 11678670/2711 > 1500 so specify your mtu next to every rate
>> and ceil.
> 
> 
> I created the class with "mtu 1500" and the result is above, same
> behaviour. Afaik, the default mtu is 1600.
> 
> By the way, my ethernet MTU is 1500.
> 
> How can I prevent those giants?

It seems there is a problem with some nics not obeying mtu then (I mean 
ifconfig/ip mtu) maybe it's to do with tso or something.

Normally you shouldn't have to specify mtu to tc if you are running 1500 
- you only need to if you are bigger, which it looks like you are 
whatever ifconfig/ip says.

I would find/lookup what you are really using and tell htb that and then 
check that the giants count is 0.

Andy.







> 

From shemminger at osdl.org  Fri Jul 28 22:54:47 2006
From: shemminger at osdl.org (Stephen Hemminger)
Date: Fri Jul 28 22:54:41 2006
Subject: [LARTC] HTB is buggy?
In-Reply-To: <44CA68D3.2040402@andyfurniss.entadsl.com>
References: <30dd942a0607271045o73dfc680r6bd2695e257a982b@mail.gmail.com>
	<BAY106-F1422022811303CCE3104A6D4590@phx.gbl>
	<30dd942a0607281025o30fe5345o784ce3e4dca5024b@mail.gmail.com>
	<44CA5D26.5030209@andyfurniss.entadsl.com>
	<30dd942a0607281212l4b9ca152j43bd088b5a5332b5@mail.gmail.com>
	<44CA68D3.2040402@andyfurniss.entadsl.com>
Message-ID: <20060728135447.526d1d3c@localhost.localdomain>

I believe there are some unresolved memory management issues with HTB.
It looks like deleting the qdisc is causing some use after free or
memory corruption problems.

See:
	http://bugzilla.kernel.org/show_bug.cgi?id=6681

I don't use HTB so I have no idea if this a new or old problem.
From lists at andyfurniss.entadsl.com  Fri Jul 28 23:57:26 2006
From: lists at andyfurniss.entadsl.com (Andy Furniss)
Date: Fri Jul 28 23:57:09 2006
Subject: [LARTC] Re: HTB is buggy?
In-Reply-To: <20060728135447.526d1d3c@localhost.localdomain>
References: <30dd942a0607271045o73dfc680r6bd2695e257a982b@mail.gmail.com>	<BAY106-F1422022811303CCE3104A6D4590@phx.gbl>	<30dd942a0607281025o30fe5345o784ce3e4dca5024b@mail.gmail.com>	<44CA5D26.5030209@andyfurniss.entadsl.com>	<30dd942a0607281212l4b9ca152j43bd088b5a5332b5@mail.gmail.com>	<44CA68D3.2040402@andyfurniss.entadsl.com>
	<20060728135447.526d1d3c@localhost.localdomain>
Message-ID: <44CA8846.3010909@andyfurniss.entadsl.com>

Stephen Hemminger wrote:
> I believe there are some unresolved memory management issues with HTB.
> It looks like deleting the qdisc is causing some use after free or
> memory corruption problems.
> 
> See:
> 	http://bugzilla.kernel.org/show_bug.cgi?id=6681
> 
> I don't use HTB so I have no idea if this a new or old problem.
> 

Hmm he's doing

crash (and oops) in command like
tc filter del dev ethX protocol ip parent 1:0 prio 5 handle X:XX:XX u32

is that valid - I've always reccomended to del root qdisc and start 
again to change something.

I don't know if it's documented anywhere - none of the man pages in 
iproute2 even mention del (OK remove is there) and tc-filters.8 is 
referenced but not there.

It does say in  tc.8 -

Filters have a three part ID, which is only needed when using a hashed 
filter hierarchy, for which see tc-filters(8)

so maybe it's just tc/kernel failing to give rtnetlink error - which is 
  what I've seen before when trying to delete specific parts of trees.

man tc-htb doesn't even mention tc filter anything.

Andy.
From altchill at hotmail.com  Sat Jul 29 02:50:37 2006
From: altchill at hotmail.com (Jake Altchill)
Date: Sat Jul 29 02:50:27 2006
Subject: [LARTC] Weird HTB behaviour in 2.6.17
In-Reply-To: <30dd942a0607281025o30fe5345o784ce3e4dca5024b@mail.gmail.com>
Message-ID: <BAY106-F29E19ED327929804281AEAD45E0@phx.gbl>


Just append "mtu 16500" at the end of your qdisc
and class (especially class) statements. Like this:

tc class add dev eth0 parent 1:1 classid 1:30 htb rate 1kbit ceil
750Kbit burst 15k mtu 16500

I had a similar problem on Dell 2850s with intel e1000
cards. The mtu on the e1000 interfaces was set to the
default 1500, but the cards didn't obey it all the time.

I suspect that nVidia ethernet driver has similar
problems.

_________________________________________________________________
Express yourself instantly with MSN Messenger! Download today - it's FREE! 
http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

From kaber at trash.net  Sat Jul 29 03:07:50 2006
From: kaber at trash.net (Patrick McHardy)
Date: Sat Jul 29 03:07:37 2006
Subject: [LARTC] Weird HTB behaviour in 2.6.17
In-Reply-To: <44CA68D3.2040402@andyfurniss.entadsl.com>
References: <30dd942a0607271045o73dfc680r6bd2695e257a982b@mail.gmail.com>	<BAY106-F1422022811303CCE3104A6D4590@phx.gbl>	<30dd942a0607281025o30fe5345o784ce3e4dca5024b@mail.gmail.com>	<44CA5D26.5030209@andyfurniss.entadsl.com>	<30dd942a0607281212l4b9ca152j43bd088b5a5332b5@mail.gmail.com>
	<44CA68D3.2040402@andyfurniss.entadsl.com>
Message-ID: <44CAB4E6.90307@trash.net>

Andy Furniss wrote:
> Marlon Dutra wrote:
> 
>> lended: 150 borrowed: 5077 giants: 3986
>> tokens: -14728330 ctokens: -21365
>>
>>> Regardless 11678670/2711 > 1500 so specify your mtu next to every rate
>>> and ceil.
>>
>> I created the class with "mtu 1500" and the result is above, same
>> behaviour. Afaik, the default mtu is 1600.
>>
>> By the way, my ethernet MTU is 1500.
>>
>> How can I prevent those giants?
> 
> 
> It seems there is a problem with some nics not obeying mtu then (I mean
> ifconfig/ip mtu) maybe it's to do with tso or something.


Right, the "problem" is related to TCP segmentation offloading (or
GSO in current kernels). The card gets large chunks of data and is
responsible for creating MTU-sized packets, which essentially means
qdiscs get to see those large chunks of data. You can disable TSO
using ethtool (but it will cost you performance) or configure your
qdisc appropriately.


From baltasar.cevc at former03.de  Sat Jul 29 17:33:56 2006
From: baltasar.cevc at former03.de (former03 | Baltasar Cevc)
Date: Sat Jul 29 17:33:51 2006
Subject: [LARTC] FWMark routing trouble
Message-ID: <543407a389ac4ddaf401fe2030924454@former03.de>

Hi everybody,

I'm trying to set up routing for 2 links to the internet on a box which 
produces traffic itself (e.g. DNS) and will route all our local 
traffic.

AS one route is quick and expensive and the other one slow and cheap, I 
want to be able to route packets for some high-level protocols to the 
second link.

If I correctly understood table 3-2 in 
http://www.faqs.org/docs/iptables/traversingoftables.html that is not 
possible as the routing decision is taken even before the packet 
touches netfilter for the first time.


Is that correct? Does anybody have some hints about how to work around?

Thanx a lot!
Baltasasar

Baltasar Cevc

_____ former 03 gmbh
_____ infanteriestra?e 19 haus 6 eg
_____ D-80797 muenchen

_____ http://www.former03.de

From Daniel at musketa.de  Sun Jul 30 23:09:04 2006
From: Daniel at musketa.de (Daniel Musketa)
Date: Sun Jul 30 23:08:57 2006
Subject: [LARTC] questions about HFSC, VoIP and (dynamic) ingress shaping
Message-ID: <200607302309.05290.Daniel@musketa.de>

Hello,

I just found the great howto and started shaping my internet connection. The 
howto's last update is a liitle in the past now so I have some questions 
about how things are done the best way nowadays ;-)


To ensure a stable and low latency voip communication I added an HFSC qdisc to 
device ppp0 (1 Mbit SDSL). There are two classes (by now): One for SIP and 
RTP and one for the rest.

Question 1: I defined the voip qdisc as

    tc class add dev ppp0 parent 1:1 classid 1:11 \
        hfsc sc umax 1500b dmax 30ms rate 500kbit ul rate 900kbit

but "tc -s class show dev ppp0" shows

    class hfsc 1:11 parent 1:1 sc m1 0bit d 6.0ms m2 500000bit \
    ul m1 0bit d 0us m2 900000bit

Where does the "0bit d 6.0ms" come from, (what does the other stuff exactly 
mean) and what would be a good setting for voip traffic?




This qdisc only affects outgoing traffic. But I also want to control incoming 
packets and keep the isp's queue empty.

Question 2: What is the best solution for doing this: ingress qdisc, IMQ, ... 
(thers's only one link to isp)?



Much traffic on this line is UDP traffic (OpenVPN). 

Question 3: If I do policing on incoming traffic, do UDP transmissions care 
about dropping and reduce transmit speed?




If I begin to control incoming traffic I only want to drop packets that are 
non voip traffic.

Question 4: Is it possible to control what packets are dropped?



I always want to have enough bandwith for incoming voip traffic. But limiting 
the other stuff to static 180 kbit only because voip packets could sometimes 
reach a maximum of 800 kbit sounds not so good.

My idea: A script that periodically (or even better: triggered by asterisk) 
controls the parameters for the ingress shaper (depending on the actual 
upload traffic produced by voip which could easily be measured with tc).

Question 5: Is that possible? Is this necessary at all? Is there already a 
solution?



Regards
Daniel
From andy at andybev.com  Sun Jul 30 23:44:49 2006
From: andy at andybev.com (Andrew Beverley)
Date: Sun Jul 30 23:44:49 2006
Subject: [LARTC] Traffic monitor with view of MARK
Message-ID: <44CD2851.7050205@andybev.com>

Hi,

Does anyone know of a traffic monitoring program that will display a connection's 
MARK value as well as the normal information such as current rate? I use iptraf 
and ntop at the moment but neither seem capable of diplaying a connection's MARK 
value.

Thanks,

Andy
From gustavo at angulosolido.pt  Mon Jul 31 00:52:48 2006
From: gustavo at angulosolido.pt (Gustavo Homem)
Date: Mon Jul 31 00:52:36 2006
Subject: [LARTC] questions about HFSC, VoIP and (dynamic) ingress shaping
In-Reply-To: <200607302309.05290.Daniel@musketa.de>
References: <200607302309.05290.Daniel@musketa.de>
Message-ID: <20060730225248.GD15275@angulosolido.pt>

On Sun, Jul 30, 2006 at 11:09:04PM +0200, Daniel Musketa wrote:
> Hello,
> 
> I just found the great howto and started shaping my internet connection. The 
> howto's last update is a liitle in the past now so I have some questions 
> about how things are done the best way nowadays ;-)
> 
> 
> To ensure a stable and low latency voip communication I added an HFSC qdisc to 
> device ppp0 (1 Mbit SDSL). There are two classes (by now): One for SIP and 
> RTP and one for the rest.
> 
> Question 1: I defined the voip qdisc as
> 
>     tc class add dev ppp0 parent 1:1 classid 1:11 \
>         hfsc sc umax 1500b dmax 30ms rate 500kbit ul rate 900kbit
> 
> but "tc -s class show dev ppp0" shows
> 
>     class hfsc 1:11 parent 1:1 sc m1 0bit d 6.0ms m2 500000bit \
>     ul m1 0bit d 0us m2 900000bit
> 
> Where does the "0bit d 6.0ms" come from, (what does the other stuff exactly 
> mean) and what would be a good setting for voip traffic?
> 
> 
> 
> 
> This qdisc only affects outgoing traffic. But I also want to control incoming 
> packets and keep the isp's queue empty.
> 
> Question 2: What is the best solution for doing this: ingress qdisc, IMQ, ... 
> (thers's only one link to isp)?
> 

If you don't want to patch the kernel and your machine has only two network interfaces you can shape the outgoing traffic to the internal interface instead of the incoming traffic to the internal interface. I have an example script here:

http://downloads.angulosolido.pt/QoS/HTB_shaper_adv.sh

It uses HTB for shapping though.



> 
> 
> Much traffic on this line is UDP traffic (OpenVPN). 
> 
> Question 3: If I do policing on incoming traffic, do UDP transmissions care 
> about dropping and reduce transmit speed?
> 
> 

I don't think so, unless that is implemented at the application level. The UDP packets shouldn't be dropped unless that's acceptable to a certain extend (VoIP) or the application resends as necessary.


> 
> 
> If I begin to control incoming traffic I only want to drop packets that are 
> non voip traffic.
> 
> Question 4: Is it possible to control what packets are dropped?
> 

Depends if you know the ports they use. If you know it, you just have to mark them accordingly.

For example with skype it's a pain in the ass, as it seems not to respect the port chosen on the configuration. I solved that by reserving bandwidth per workstation, so that each one get's TOTAL/N, extensible to TOTAL of the others don't request it. For each workstation there is also a priority rank, but for cases like skype, whose ports we can't control, it ends up being up to each user to ensure there's enough bandwidth on her share for skype to work.

Take a look at the link I pasted above.

> 
> 
> I always want to have enough bandwith for incoming voip traffic. But limiting 
> the other stuff to static 180 kbit only because voip packets could sometimes 
> reach a maximum of 800 kbit sounds not so good.
> 

Sure!

> My idea: A script that periodically (or even better: triggered by asterisk) 
> controls the parameters for the ingress shaper (depending on the actual 
> upload traffic produced by voip which could easily be measured with tc).
> 
> Question 5: Is that possible? Is this necessary at all? Is there already a 
> solution?
> 

I don't think you need this. A setup with HTB solves this problem, since each traffic class has a defined RATE as well as a defined CEIL rate, which it will take whenever available.

I can't comment about HFSC as I never used it. 

Best regards
Gustavo

> 
> 
> Regards
> Daniel
> _______________________________________________
> LARTC mailing list
> LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

-- 
Angulo S?lido - Tecnologias de Informa??o
http://angulosolido.pt

From gustavo at angulosolido.pt  Mon Jul 31 01:01:23 2006
From: gustavo at angulosolido.pt (Gustavo Homem)
Date: Mon Jul 31 01:01:11 2006
Subject: [LARTC] questions about HFSC, VoIP and (dynamic) ingress shaping
In-Reply-To: <20060730225248.GD15275@angulosolido.pt>
References: <200607302309.05290.Daniel@musketa.de>
	<20060730225248.GD15275@angulosolido.pt>
Message-ID: <20060730230123.GF15275@angulosolido.pt>

On Sun, Jul 30, 2006 at 11:52:48PM +0100, Gustavo Homem wrote:
> On Sun, Jul 30, 2006 at 11:09:04PM +0200, Daniel Musketa wrote:
> > Hello,
> > 
> > I just found the great howto and started shaping my internet connection. The 
> > howto's last update is a liitle in the past now so I have some questions 
> > about how things are done the best way nowadays ;-)
> > 
> > 
> > To ensure a stable and low latency voip communication I added an HFSC qdisc to 
> > device ppp0 (1 Mbit SDSL). There are two classes (by now): One for SIP and 
> > RTP and one for the rest.
> > 
> > Question 1: I defined the voip qdisc as
> > 
> >     tc class add dev ppp0 parent 1:1 classid 1:11 \
> >         hfsc sc umax 1500b dmax 30ms rate 500kbit ul rate 900kbit
> > 
> > but "tc -s class show dev ppp0" shows
> > 
> >     class hfsc 1:11 parent 1:1 sc m1 0bit d 6.0ms m2 500000bit \
> >     ul m1 0bit d 0us m2 900000bit
> > 
> > Where does the "0bit d 6.0ms" come from, (what does the other stuff exactly 
> > mean) and what would be a good setting for voip traffic?
> > 
> > 
> > 
> > 
> > This qdisc only affects outgoing traffic. But I also want to control incoming 
> > packets and keep the isp's queue empty.
> > 
> > Question 2: What is the best solution for doing this: ingress qdisc, IMQ, ... 
> > (thers's only one link to isp)?
> > 
> 
> If you don't want to patch the kernel and your machine has only two network interfaces you can shape the outgoing traffic to the internal interface instead of the incoming traffic to the internal interface. I have an example script here:

"you can shape the outgoing traffic to the internal interface instead of the incoming traffic to the *external* interface"

> 
> http://downloads.angulosolido.pt/QoS/HTB_shaper_adv.sh
> 
> It uses HTB for shapping though.
> 
> 
> 
> > 
> > 
> > Much traffic on this line is UDP traffic (OpenVPN). 
> > 
> > Question 3: If I do policing on incoming traffic, do UDP transmissions care 
> > about dropping and reduce transmit speed?
> > 
> > 
> 
> I don't think so, unless that is implemented at the application level. The UDP packets shouldn't be dropped unless that's acceptable to a certain extend (VoIP) or the application resends as necessary.
> 
> 
> > 
> > 
> > If I begin to control incoming traffic I only want to drop packets that are 
> > non voip traffic.
> > 
> > Question 4: Is it possible to control what packets are dropped?
> > 
> 
> Depends if you know the ports they use. If you know it, you just have to mark them accordingly.
> 
> For example with skype it's a pain in the ass, as it seems not to respect the port chosen on the configuration. I solved that by reserving bandwidth per workstation, so that each one get's TOTAL/N, extensible to TOTAL of the others don't request it. For each workstation there is also a priority rank, but for cases like skype, whose ports we can't control, it ends up being up to each user to ensure there's enough bandwidth on her share for skype to work.
> 
> Take a look at the link I pasted above.
> 
> > 
> > 
> > I always want to have enough bandwith for incoming voip traffic. But limiting 
> > the other stuff to static 180 kbit only because voip packets could sometimes 
> > reach a maximum of 800 kbit sounds not so good.
> > 
> 
> Sure!
> 
> > My idea: A script that periodically (or even better: triggered by asterisk) 
> > controls the parameters for the ingress shaper (depending on the actual 
> > upload traffic produced by voip which could easily be measured with tc).
> > 
> > Question 5: Is that possible? Is this necessary at all? Is there already a 
> > solution?
> > 
> 
> I don't think you need this. A setup with HTB solves this problem, since each traffic class has a defined RATE as well as a defined CEIL rate, which it will take whenever available.
> 
> I can't comment about HFSC as I never used it. 
> 
> Best regards
> Gustavo
> 
> > 
> > 
> > Regards
> > Daniel
> > _______________________________________________
> > LARTC mailing list
> > LARTC@mailman.ds9a.nl
> > http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
> 
> -- 
> Angulo S?lido - Tecnologias de Informa??o
> http://angulosolido.pt
> 
> _______________________________________________
> LARTC mailing list
> LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

-- 
Angulo S?lido - Tecnologias de Informa??o
http://angulosolido.pt

From Daniel at musketa.de  Mon Jul 31 01:49:20 2006
From: Daniel at musketa.de (Daniel Musketa)
Date: Mon Jul 31 01:49:14 2006
Subject: [LARTC] questions about HFSC, VoIP and (dynamic) ingress shaping
In-Reply-To: <20060730225248.GD15275@angulosolido.pt>
References: <200607302309.05290.Daniel@musketa.de>
	<20060730225248.GD15275@angulosolido.pt>
Message-ID: <200607310149.20928.Daniel@musketa.de>

Hello, Gustavo,

thank you for your answer.

Am Montag, 31. Juli 2006 00:52 schrieb Gustavo Homem:
> On Sun, Jul 30, 2006 at 11:09:04PM +0200, Daniel Musketa wrote:
[...]
> > This qdisc only affects outgoing traffic. But I also want to control
> > incoming packets and keep the isp's queue empty.
> >
> > Question 2: What is the best solution for doing this: ingress qdisc, IMQ,
> > ... (thers's only one link to isp)?
>
> If you don't want to patch the kernel and your machine has only two network
> interfaces you can shape the outgoing traffic to the internal interface
> instead of the incoming traffic to the internal interface. I have an
> example script here:
>
> http://downloads.angulosolido.pt/QoS/HTB_shaper_adv.sh
>
> It uses HTB for shapping though.


Sorry, I should have explained a little more detailed: (Nearly) all download 
traffic is initiated by the machine itself, so I can't use the "limiting the 
clients" trick here.




> > Much traffic on this line is UDP traffic (OpenVPN).
> >
> > Question 3: If I do policing on incoming traffic, do UDP transmissions
> > care about dropping and reduce transmit speed?
>
> I don't think so, unless that is implemented at the application level. The
> UDP packets shouldn't be dropped unless that's acceptable to a certain
> extend (VoIP) or the application resends as necessary.

I am sure OpenVPN resends dropped packets (sooner or later) but don't know yet 
if it adapts its transmit rate to the rate of the reply packets ...





> > If I begin to control incoming traffic I only want to drop packets that
> > are non voip traffic.
> >
> > Question 4: Is it possible to control what packets are dropped?
>
> Depends if you know the ports they use. If you know it, you just have to
> mark them accordingly.
>
> For example with skype it's a pain in the ass, 

The only voip traffic (over ppp0) is produced by an asterisk server (on the 
same machine). I know all used ports (SIP and RTP) and for outgoing packets I 
already mark them with iptables.




> > My idea: A script that periodically (or even better: triggered by
> > asterisk) controls the parameters for the ingress shaper (depending on
> > the actual upload traffic produced by voip which could easily be measured
> > with tc).
> >
> > Question 5: Is that possible? Is this necessary at all? Is there already
> > a solution?
>
> I don't think you need this. A setup with HTB solves this problem, since
> each traffic class has a defined RATE as well as a defined CEIL rate, which
> it will take whenever available.

But then I need IMQ and a patched kernel, right?


> Best regards
> Gustavo

Muito obrigado pela sua ajuda ...
Daniel
From jarkap at poczta.onet.pl  Mon Jul 31 08:23:40 2006
From: jarkap at poczta.onet.pl (Jarek Poplawski)
Date: Mon Jul 31 08:23:12 2006
Subject: [LARTC] Re: Problem with iptables with -j TOS and MARK
In-Reply-To: <ead536$d62$1@sea.gmane.org>
References: <44CA065A.9090903@ehas.org> <ead536$d62$1@sea.gmane.org>
Message-ID: <eak7k5$fgv$1@sea.gmane.org>

On 28-07-2006 15:57, Jarek Poplawski wrote:
> On 28-07-2006 14:43, makevuy wrote:
>> Hy,
>>
>> I would want to mark the packets that are entering in a machine, with 
>> a mark for using diffserv with DSMARK.
>>
>> My machine has 2 interfaces, a ethernet and a wireless. The ethernet 
>> interface is eth1 and the other is wifi0.
>>
>> Firs, I would want to test that I would be able to mark the tos of the 
>> paquets that I would be receiving, for this I write in the console of 
>> my linux:
>>
>>
>> iptables -A PREROUTING -i eth1 -t mangle -p udp -j TOS --set-tos 0x20
>>
>> But the TOS doesn't change (I see this with ethereal)
>>
>> Waht could be the problem?
> 
> If I can remember, TOS is inserted for real some time later, so try to 
> investigate on forward or postrouting.

After short weekend testing my memory turned out to be faulty 
again - it can remember only every second bit (because it's old!).

Iptables -j TOS and -j DSCP should change a tos field of ip 
headers at once (this could be seen with -j LOG everywhere after 
this setting). This field can influent the way a packet is 
classified by some qdisc like prio, but not directly - inner 
priority field is taken for this. And this priority is computed 
from tos only in forward.

So probably ethereal showed packets before changes or you have 
some problem with iptables.

Jarek P.

From jarkap at poczta.onet.pl  Mon Jul 31 09:03:20 2006
From: jarkap at poczta.onet.pl (Jarek Poplawski)
Date: Mon Jul 31 09:03:00 2006
Subject: [LARTC] Re: problem in Route add using netlink
In-Reply-To: <20060725145938.68004.qmail@web8327.mail.in.yahoo.com>
References: <20060725145938.68004.qmail@web8327.mail.in.yahoo.com>
Message-ID: <eak9ui$kso$1@sea.gmane.org>

On 25-07-2006 16:59, VijayaLakshmi Seshadri wrote:
> Hi all
>  Iam trying to implement "route add " using netlink. The changes are not 
> reflected in the routing table. I have given my code and screen shots of 
> the routing tables.
>  
> Can anybody tell me is there any mistake iam making in defining the fields .
> or any other mistake iam commiting
>  
> thanxs
>  
> viji

I had some free time at the weekend - it's probably to late and I 
hope you've found this bugs yet, but maybe someone else (like me) 
will be looking here some day with similar problem, so here is 
what I've found.

Jarek P

>  
> //////////////////////////////////// CODE 
> //////////////////////////////////////////////////////
> #include <asm/types.h>
> #include <netinet/ether.h>
> #include <netinet/in.h>
> #include <net/if.h>
> #include <stdio.h>
> #include <sys/socket.h>
> #include <sys/ioctl.h>
> #include <linux/netlink.h>
> #include <linux/rtnetlink.h>
> #include <sys/types.h>
> #define BUFSIZE 192
> struct route_info{
>         u_int   dstAddr;
>         u_int   srcAddr;
>         u_int   gateWay;
>         char    ifName[IF_NAMESIZE];
> };
> void fillRoute (struct route_info *rinfo, const char* dstAddr,
>                 const char* srcAddr, const char* gateway, const char* 
> ifName)
> {
>         /* Convert from the standrad numbers and dots notation
>            to binary data  */
>         inet_aton("192.168.51.0", (struct in_addr *)&rinfo->dstAddr);
>         inet_aton("192.168.51.90", (struct in_addr *)&rinfo->gateWay);
> }

Of corse you always have to be sure to have the valid route to 
192.168.51.90 on the testing box...

> int addAttr (struct nlmsghdr *nlhdr, int maxlen, int type,
>                 void *data, int alen)
> {
>         struct rtattr *rta;
>         int len = RTA_LENGTH(alen);
>         if (NLMSG_ALIGN(nlhdr->nlmsg_len) + len > maxlen)
>                 return -1;
>         rta = (struct rtattr*)((char *)nlhdr + 
> NLMSG_ALIGN(nlhdr->nlmsg_len));
>         rta->rta_type = type;
>         rta->rta_len  = len;
>         memcpy(RTA_DATA(rta), data, alen);
>         nlhdr->nlmsg_len = NLMSG_ALIGN(nlhdr->nlmsg_len) + len;
>         return 0;
> }
> int main()
> {
>         struct nlmsghdr *nlMsg;
>         struct rtmsg *rtMsg;
>         char dstAddr[30] ;
>         char srcAddr[30] ;
>         char gateway[30] ;
>         char ifName[30];
>         char msgBuf[BUFSIZE];
>         struct route_info rinfo;
>         int sock, len, msgSeq = 0;
>         int val, i;
>         /* Create Socket */
>         if((sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE)) < 0)
>                 perror("Socket Creation: ");
>         /* Initialize the buffer */
>         memset(msgBuf, 0, BUFSIZE);
>         /* point the header and the msg structure pointers into the 
> buffer */
>         nlMsg = (struct nlmsghdr *)msgBuf;
>         rtMsg = (struct rtmsg *)NLMSG_DATA(nlMsg);
>         /* Fill in the nlmsg header*/
>         nlMsg->nlmsg_len = NLMSG_LENGTH(sizeof(struct rtmsg)); // Length 
> ofmessage.
>         nlMsg->nlmsg_type = RTM_NEWROUTE;                      // Get 
> the routes from kernel routing table .
>         nlMsg->nlmsg_flags = NLM_F_CREATE ;       // The message is a 

// the flag is needed here
nlMsg->nlmsg_flags = NLM_F_CREATE | NLM_F_REQUEST;

> request for dump.
>         nlMsg->nlmsg_seq = msgSeq++;                           // 
> Sequence of the message packet.
>         nlMsg->nlmsg_pid = getpid();                           // PID of 
> process sending the request.
>         rtMsg->rtm_family = AF_INET;
>         rtMsg->rtm_table = RT_TABLE_UNSPEC;
>         rtMsg->rtm_dst_len = 16;
>         rtMsg->rtm_src_len = 16;

// this should be address' lenghts in bits so:
          rtMsg->rtm_dst_len = 32;
          rtMsg->rtm_src_len = 32;

>         rtMsg->rtm_scope = RT_SCOPE_UNIVERSE;
>         rtMsg->rtm_type = RTN_UNICAST;
>         rtMsg->rtm_protocol = RTPROT_UNSPEC;
>         rtMsg->rtm_flags   = RTM_F_NOTIFY;
>         fillRoute (&rinfo, dstAddr, srcAddr, gateway, ifName);
>         addAttr (nlMsg, BUFSIZE, RTA_DST,
>                         &rinfo.dstAddr, 4);
>                 addAttr (nlMsg, BUFSIZE, RTA_GATEWAY,
>                         &rinfo.gateWay, 4);
>         /* Send the request */
>         if((val = send(sock, nlMsg, nlMsg->nlmsg_len,0 )) < 0){
>                 printf("Write To Socket Failed...\n");
>                 return -1;
>         }
>         printf (" No of Bytes sent %d \n", val);
>         printf (" Value that is sent \n " );
>         for (i =0 ; i < val ; i ++)
>           printf ("%u", msgBuf[i]);
>         printf ("\n");
>         close(sock);
> return 0;
> }
> 
> //////////////////////////////////////////////////////////////////////////////////////////////////////////
>                               OUTPUT
> [root@vijdom]gcc netlink_addroute.c -o addroute
> [root@vijdom]# ./addroute
>  No of Bytes sent 44
>  Value that is sent
>  4400024004000042949672398800216160000101008010429496723242949672085108050429496723242949672085190
> ////////////////////////////////////////////////////////////////////////////////////////////////////////// 
> 
>                               SCREEN SHOTS
>  
> *Routing table before execution of program*
> Kernel IP routing table
> Destination     Gateway         Genmask         Flags Metric Ref    Use 
> Iface
> 192.168.51.0    *               255.255.255.0   U     0      0        0 eth0
> 169.254.0.0     *               255.255.0.0     U     0      0        0 eth0
> 127.0.0.0       *               255.0.0.0       U     0      0        0 lo
> default         embedded        0.0.0.0         UG    0      0        0 eth0
>  
> *Routing table after the execution of program
> *Kernel IP routing table
> Destination     Gateway         Genmask         Flags Metric Ref    Use 
> Iface
> 192.168.51.0    *               255.255.255.0   U     0      0        0 eth0
> 169.254.0.0     *               255.255.0.0     U     0      0        0 eth0
> 127.0.0.0       *               255.0.0.0       U     0      0        0 lo
> default         embedded        0.0.0.0         UG    0      0        0 eth0
> 
>  
>  
>  
>  
> 
> ------------------------------------------------------------------------
> Find out what India is talking about on Yahoo! Answers India. 
> <http://us.rd.yahoo.com/mail/in/mailanswersshare/*http://in.answers.yahoo.com/>
> SMS memory full? Store all your important SMS in your Yahoo! Mail. 
> Register for SMS BAK UP now! 
> <http://us.rd.yahoo.com/mail/in/mailbackup/*http://in.mobile.yahoo.com/smsbakup.html> 
> 
> 
> 
> ------------------------------------------------------------------------
> 
> _______________________________________________
> LARTC mailing list
> LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

From jarkap at poczta.onet.pl  Mon Jul 31 09:24:40 2006
From: jarkap at poczta.onet.pl (Jarek Poplawski)
Date: Mon Jul 31 09:24:01 2006
Subject: [LARTC] Re: problem in Route add using netlink
In-Reply-To: <eak9ui$kso$1@sea.gmane.org>
References: <20060725145938.68004.qmail@web8327.mail.in.yahoo.com>
	<eak9ui$kso$1@sea.gmane.org>
Message-ID: <eakb6i$ntj$1@sea.gmane.org>

On 31-07-2006 09:03, Jarek Poplawski wrote:
...
> Of corse you always have to be sure to have the valid route to 

Cursed! I wish I could "spel" too:

http://www.cherwell.org/of_corse_we_can_spel

Jarek P.

From sinha.mrinal at yahoo.co.in  Mon Jul 31 10:43:31 2006
From: sinha.mrinal at yahoo.co.in (Mrinal Sinha)
Date: Mon Jul 31 10:43:23 2006
Subject: [LARTC] Problem with routing for multiple uplinks/providers using
	iproute2
In-Reply-To: <7a3751050607290434i7ac9213bx239d9cc3676933d5@mail.gmail.com>
Message-ID: <20060731084331.64083.qmail@web8612.mail.in.yahoo.com>

serban,
thanks for the reply, i dont think thers any irq takin place still i am a newbie so will wish if u chk the two lines which has anythin to do with the eth*

169:     723767     725131     723893     724004   IO-APIC-level  uhci_hcd:usb2, eth0
185:      57275      56839      56322      56789   IO-APIC-level  uhci_hcd:usb4, eth1

we have made an rc.init file which contains the required command for iproute to be executed and this file gets executed by rc.local.
So the rc.init file is,

#!/bin/sh

P1_NET=144.16.129.0/20
P2_NET=202.141.12.177/28
IF1=eth0
IF2=eth1
T1=vsnl
T2=ernet
P1=144.16.141.30
P2=202.141.12.177
IP1=144.16.129.50
IP2=202.141.12.183

ip route add $P1_NET dev $IF1 src $IP1 table $T1

ip route add default via $P1 table $T1

ip route add $P2_NET dev $IF2 src $IP2 table $T2

ip route add default via $P2 table $T2

ip route del default

ip route add default scope global nexthop via 144.16.141.30 dev eth0 weight 1 nexthop via 202.141.12.178 dev eth1 weight 1

ip route add $P1_NET dev $IF1 src $IP1
ip route add $P2_NET dev $IF2 src $IP2
ip rule add from $IP1 table $T1
ip rule add from $IP2 table $T2
touch /var/lock/subsys/local
echo "keycode 14 = BackSpace" | loadkeys

hope this helps in understanding the problem

thanks and Regards,
Mrinal

Serban Murariu <smurariu@gmail.com> wrote: could you paste your rc.local?

also make sure that your nics are not doing any irq sharing; cat
/proc/interrupts and look for a line that states (for example)   5:
409350163          XT-PIC  eth2, eth1


 				
---------------------------------
 Here?s a new way to find what you're looking for - Yahoo! Answers 
 				
---------------------------------
 Here?s a new way to find what you're looking for - Yahoo! Answers 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060731/a1772ea0/attachment.html
From rajeshmahajan09 at gmail.com  Mon Jul 31 10:52:19 2006
From: rajeshmahajan09 at gmail.com (Rajesh Mahajan)
Date: Mon Jul 31 10:52:05 2006
Subject: [LARTC] IFB vs IMQ
In-Reply-To: <44BD5C92.6090304@andyfurniss.entadsl.com>
References: <c9961d450607080040v3d6e0a97uca2d6ca5cfe7df6a@mail.gmail.com>
	<44BD5C92.6090304@andyfurniss.entadsl.com>
Message-ID: <c9961d450607310152g1f82f24p5164d2ca8a9ef7fb@mail.gmail.com>

can u please explain where IFB really place in linux network stack

Is iptables rules applicable on it


On 7/19/06, Andy Furniss <lists@andyfurniss.entadsl.com> wrote:
> Rajesh Mahajan wrote:
> > Is IFB realy replacement of IMQ
>
> Mostly - it hooks before/after netfilter though, so if you really need
> IMQ to hook "in" netfilter (eg. to get denatted addresses on ingress so
> you can seperate INPUT and FORWARD traffic), you still need IMQ.
>
> Andy.
>
From gustavo at angulosolido.pt  Mon Jul 31 11:33:18 2006
From: gustavo at angulosolido.pt (Gustavo Homem)
Date: Mon Jul 31 11:33:40 2006
Subject: [LARTC] questions about HFSC, VoIP and (dynamic) ingress shaping
In-Reply-To: <200607310149.20928.Daniel@musketa.de>
References: <200607302309.05290.Daniel@musketa.de>
	<20060730225248.GD15275@angulosolido.pt>
	<200607310149.20928.Daniel@musketa.de>
Message-ID: <200607311033.18262.gustavo@angulosolido.pt>

Hello Daniel,

> >
> > If you don't want to patch the kernel and your machine has only two
> > network interfaces you can shape the outgoing traffic to the internal
> > interface instead of the incoming traffic to the internal interface. I
> > have an example script here:
> >
> > http://downloads.angulosolido.pt/QoS/HTB_shaper_adv.sh
> >
> > It uses HTB for shapping though.
>
> Sorry, I should have explained a little more detailed: (Nearly) all
> download traffic is initiated by the machine itself, so I can't use the
> "limiting the clients" trick here.

Ah... I see...

> > > Question 4: Is it possible to control what packets are dropped?
> >
> > Depends if you know the ports they use. If you know it, you just have to
> > mark them accordingly.
> >
> > For example with skype it's a pain in the ass,
>
> The only voip traffic (over ppp0) is produced by an asterisk server (on the
> same machine). I know all used ports (SIP and RTP) and for outgoing packets
> I already mark them with iptables.
>

So you can match the to the appropriate class.

> > > My idea: A script that periodically (or even better: triggered by
> > > asterisk) controls the parameters for the ingress shaper (depending on
> > > the actual upload traffic produced by voip which could easily be
> > > measured with tc).
> > >
> > > Question 5: Is that possible? Is this necessary at all? Is there
> > > already a solution?
> >
> > I don't think you need this. A setup with HTB solves this problem, since
> > each traffic class has a defined RATE as well as a defined CEIL rate,
> > which it will take whenever available.
>
> But then I need IMQ and a patched kernel, right?

For the script I pointed you don't need it, because HTB is part of the 
standard kernel.

However for your case, where most of the incoming traffic goes directly to the 
router machine I think so.

If you decide to go that way, take a look at this howto:

http://www.tldp.org/HOWTO/ADSL-Bandwidth-Management-HOWTO/index.html

Boa sorte!
Gustavo

>
> > Best regards
> > Gustavo
>
> Muito obrigado pela sua ajuda ...
> Daniel
> _______________________________________________
> LARTC mailing list
> LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

-- 
 Angulo S?lido - Tecnologias de Informa??o
http://angulosolido.pt
From don at bowenvale.co.nz  Mon Jul 31 13:49:18 2006
From: don at bowenvale.co.nz (Don Gould)
Date: Mon Jul 31 13:49:30 2006
Subject: [LARTC] HOWTO: Hello New MAC / DHCP Request - How to spot the
 presents	of a new MAC address...
In-Reply-To: <200607082046.32174@axl.clue.co.za>
References: <44AE5FD8.1020307@bowenvale.co.nz>
	<200607082046.32174@axl.clue.co.za>
Message-ID: <44CDEE3E.3000606@bowenvale.co.nz>



Sheldon Hearn wrote:
> I'm sure you could engineer something really impressive, but you could 
> probably get away with a lot less effort by simply tailing whatever 
> dhcpd logs to (possibly /var/log/messages).

Yes, that discussion has been had some where...

Some research in to dnsmasq and a few emails to the guy who wrote it
showed up the answer...

> You may not need to make any source changes at all: dnsmasq will call a custom script whenever a DHCP lease is created or destroyed: see the --dhcp-script flag in the manpage for details. The MAC address and IP address and name of the host are passed to the script. 


-- 
Don Gould
www.thinkdesignprint.co.nz - www.tcn.bowenvale.co.nz -
www.bowenvale.co.nz - www.hearingbooks.co.nz - SkypeMe:  ThinkDesignPrint


From lists at andyfurniss.entadsl.com  Mon Jul 31 15:41:49 2006
From: lists at andyfurniss.entadsl.com (Andy Furniss)
Date: Mon Jul 31 15:41:08 2006
Subject: [LARTC] questions about HFSC, VoIP and (dynamic) ingress shaping
In-Reply-To: <200607302309.05290.Daniel@musketa.de>
References: <200607302309.05290.Daniel@musketa.de>
Message-ID: <44CE089D.8080304@andyfurniss.entadsl.com>

Daniel Musketa wrote:
> Hello,
> 
> I just found the great howto and started shaping my internet connection. The 
> howto's last update is a liitle in the past now so I have some questions 
> about how things are done the best way nowadays ;-)
> 
> 
> To ensure a stable and low latency voip communication I added an HFSC qdisc to 
> device ppp0 (1 Mbit SDSL). There are two classes (by now): One for SIP and 
> RTP and one for the rest.
> 
> Question 1: I defined the voip qdisc as
> 
>     tc class add dev ppp0 parent 1:1 classid 1:11 \
>         hfsc sc umax 1500b dmax 30ms rate 500kbit ul rate 900kbit
> 
> but "tc -s class show dev ppp0" shows
> 
>     class hfsc 1:11 parent 1:1 sc m1 0bit d 6.0ms m2 500000bit \
>     ul m1 0bit d 0us m2 900000bit
> 
> Where does the "0bit d 6.0ms" come from, (what does the other stuff exactly 
> mean) and what would be a good setting for voip traffic?

I still get confused thinking about hfsc and the examples I've seen. I 
think it's because I can't get away from thinking about what really 
happens and the numbers like dmax must relate to something other than 
max delay, which will be related to your setup - hmm I suppose you 
should change the numbers to fit.... - see I'm confused again :-) Also 
the original paper and bsd docs relate to something different to linux 
hfsc which has link share and upper limit curves (which make it alot 
more useful). Just take it that any suggestions I make are probably 
wrong :-)

You can specify the settings for a class in two ways and tc shows only 
one of them.

dmax 30ms @ 500 kbit with 1500 packet - the bitrate latency of a 1500 
byte packet @ 500kbit is 24ms you say 30 so there is 6ms "spare" so a 
plot of that curve will 6ms at 0bit and then 500kbit. This is more like 
I would have for a bulk class - which I would also make ls not rt/sc.

Since this is voip I don't think you'll need anything like 1500 byte anyway.

For rt/sc you can - as long as you adjust the other curves you can have 
an m1 of  say 1mbit (ie link speed or if you have more than 1 rt link 
speed/number of rt classes) and an m2 of the long term rate like 500kbit 
- this I think is how a class for rt traffic should be specified.


> This qdisc only affects outgoing traffic. But I also want to control incoming 
> packets and keep the isp's queue empty.
> 
> Question 2: What is the best solution for doing this: ingress qdisc, IMQ, ... 
> (thers's only one link to isp)?

Ingress shaping (by which I mean where you are the wrong end of a 
bottleneck) is not totally doable like egress - depends on link speed, 
requirements and what the users do to some extent. You will need to 
sacrifice bandwidth whether you police or shape - say 20% to 50%. You 
will need to keep buffers (virtual or real fairly short - headdropping 
would be nicer than tail for real queues, but you can't without hacking 
code) and waste bandwidth by dropping packets that already used your 
link (though you can think of these as coming out of what you already 
sacrificed, you will still be billed/metered if you pay like that). 
There are other tweaks you can try eg when I had a 500kbit link, getting 
out of tcp slowstart using connbytes to mark and sending first XkB bulk 
to a shorter lower rate queue than normal.

IFB is an in kernel replacement for IMQ - there are still things you 
can't do with it or policers eg if you are doing nat and need to get the 
ingress traffic after it's been denatted by netfilter.

> 
> Much traffic on this line is UDP traffic (OpenVPN). 
> 
> Question 3: If I do policing on incoming traffic, do UDP transmissions care 
> about dropping and reduce transmit speed?
> 

Yes if it's tcp in udp for vpn then it will behave like tcp - for other 
udp it will be app specific.

> 
> If I begin to control incoming traffic I only want to drop packets that are 
> non voip traffic.
> 
> Question 4: Is it possible to control what packets are dropped?
> 

Yes - well maybe, if you use policers + actions you can choose what 
happens to overrate traffic. I think you will need to test what really 
happens, though - maybe it will work out on average rather than for 
definate (I am thinking that the overlimits traffic does not get 
accounted for by meters/ rate estimators).

> 
> 
> I always want to have enough bandwith for incoming voip traffic. But limiting 
> the other stuff to static 180 kbit only because voip packets could sometimes 
> reach a maximum of 800 kbit sounds not so good.
> 
> My idea: A script that periodically (or even better: triggered by asterisk) 
> controls the parameters for the ingress shaper (depending on the actual 
> upload traffic produced by voip which could easily be measured with tc).
> 
> Question 5: Is that possible? Is this necessary at all? Is there already a 
> solution?

Could be one way to do it, though it maybe unneccesary depending on what 
you do eg ifb or policers - in fact I think both could work without 
scripting. One bonus of scripting would be if you can change things 
before the new ingress traffic starts - queueing/policing only react 
when it's too late so it's really hard to avoid brief (maybe 
insignificant for most people) latency bursts (this applies to every new 
tcp connection aswell).

Andy.

From lists at andyfurniss.entadsl.com  Mon Jul 31 15:47:53 2006
From: lists at andyfurniss.entadsl.com (Andy Furniss)
Date: Mon Jul 31 15:47:17 2006
Subject: [LARTC] IFB vs IMQ
In-Reply-To: <c9961d450607310152g1f82f24p5164d2ca8a9ef7fb@mail.gmail.com>
References: <c9961d450607080040v3d6e0a97uca2d6ca5cfe7df6a@mail.gmail.com>	
	<44BD5C92.6090304@andyfurniss.entadsl.com>
	<c9961d450607310152g1f82f24p5164d2ca8a9ef7fb@mail.gmail.com>
Message-ID: <44CE0A09.5060002@andyfurniss.entadsl.com>

Rajesh Mahajan wrote:
> can u please explain where IFB really place in linux network stack
> 
> Is iptables rules applicable on it

I don't know exactly - as for iptables rules, you can use marks if you 
are hooking ifb on egress as it's after netfilter.

I suppose what's possible depends on your setup and what you need to do.

Andy.
From lists at andyfurniss.entadsl.com  Mon Jul 31 15:53:21 2006
From: lists at andyfurniss.entadsl.com (Andy Furniss)
Date: Mon Jul 31 15:52:40 2006
Subject: [LARTC] Why SFQ?
In-Reply-To: <44C3A747.60804@amnafzar.com>
References: <44C3A747.60804@amnafzar.com>
Message-ID: <44CE0B51.8000606@andyfurniss.entadsl.com>

S.Mehdi Sheikhalishahi wrote:
> Hello,
>    Why linux users use SFQ as leaf queueing discipline instead of RED 
> and other?
> 

We don't all - I guess alot of the examples do though.

SFQ does rough fairness for individual connections within a class - 
nothing else does (well RED a bit). It does have less desireable aspects 
like perturb causing packet reordering and not using perturb means its 
less fair between flows.

Andy.


From lists at andyfurniss.entadsl.com  Mon Jul 31 16:00:23 2006
From: lists at andyfurniss.entadsl.com (Andy Furniss)
Date: Mon Jul 31 15:59:41 2006
Subject: [LARTC] SRR qdisc
In-Reply-To: <44C8BE65.6060107@strace.net>
References: <44C8BE65.6060107@strace.net>
Message-ID: <44CE0CF7.1000105@andyfurniss.entadsl.com>

Dmitry Labutcky wrote:
> Hi all,
> 
> I wrote new qdisc SRR (Simple Round Robin). This is just another 
> reimplementation
> of round robin packets distributions. I'm not using SQF/ESFQ source code 
> and algorithms
> in this scheduler. The main goal of this work is not given multistream 
> download managers
> give all bandwidth resource.
> Please testing this: http://mordor.strace.net/sched-srr/
> 


Haven't looked yet, but IIRC someone posted a patch on netdev for sfq to 
do this - possibly used jhash aswell. The man page incorrectly says sfq 
doesn't use dst port anyway IIRC.

It would be nice to have something better than (e)sfq eg for esfq multi 
level - for user fairness and connection fairness within that. 
Preferably fair without packet reordering aswell - maybe a bit of a tall 
order.

Andy.

From mfdutra at gmail.com  Mon Jul 31 18:53:35 2006
From: mfdutra at gmail.com (Marlon Dutra)
Date: Mon Jul 31 18:53:23 2006
Subject: [LARTC] Weird HTB behaviour in 2.6.17
In-Reply-To: <44CAB4E6.90307@trash.net>
References: <30dd942a0607271045o73dfc680r6bd2695e257a982b@mail.gmail.com>
	<BAY106-F1422022811303CCE3104A6D4590@phx.gbl>
	<30dd942a0607281025o30fe5345o784ce3e4dca5024b@mail.gmail.com>
	<44CA5D26.5030209@andyfurniss.entadsl.com>
	<30dd942a0607281212l4b9ca152j43bd088b5a5332b5@mail.gmail.com>
	<44CA68D3.2040402@andyfurniss.entadsl.com> <44CAB4E6.90307@trash.net>
Message-ID: <30dd942a0607310953rf3c9389y9df5ad6b465308fc@mail.gmail.com>

Hello,

On 7/28/06, Patrick McHardy <kaber@trash.net> wrote:

> Right, the "problem" is related to TCP segmentation offloading (or GSO
> in current kernels). The card gets large chunks of data and is
> responsible for creating MTU-sized packets, which essentially means
> qdiscs get to see those large chunks of data. You can disable TSO
> using ethtool (but it will cost you performance) or configure your
> qdisc appropriately.

Thanks a lot. It was exactly that. I turned the tso off and HTB is
working properly.

How can I know the largest chunk of data the kernel sends to the card,
so that I can configure qdisc appropriately?

In the last post, Jake Altchill recommended using mtu 16500 in the
qdiscs, but I'm not sure whether that's a real or just a big number.

Regards.

-- 
Marlon
From russell-tcatm at stuart.id.au  Mon Jul 31 01:06:06 2006
From: russell-tcatm at stuart.id.au (Russell Stuart)
Date: Mon Jul 31 23:32:24 2006
Subject: [LARTC] Re: [PATCH 0/2] NET: Accurate packet scheduling for ATM/ADSL
In-Reply-To: <1153371364.4231.61.camel@ras.pc.brisbane.lube>
References: <1150278004.26181.35.camel@localhost.localdomain>
	<1150286766.5233.15.camel@jzny2>
	<1150287983.3246.27.camel@ras.pc.brisbane.lube>
	<1150292693.5197.1.camel@jzny2>
	<1150843471.17455.2.camel@ras.pc.brisbane.lube>
	<15653CE98281AD4FBD7F70BCEE3666E53CD54A@comxexch01.comx.local>
	<1151000966.5392.34.camel@jzny2>
	<1151066247.4217.254.camel@ras.pc.brisbane.lube>
	<1151158431.6716.95.camel@jzny2>
	<1153188409.13145.5.camel@ras.pc.brisbane.lube>
	<44BD56A4.9090002@andyfurniss.entadsl.com>
	<1153270932.4242.60.camel@ras.pc.brisbane.lube>
	<44BE46A6.8000207@trash.net>
	<1153371364.4231.61.camel@ras.pc.brisbane.lube>
Message-ID: <1154300766.4236.5.camel@ras.pc.brisbane.lube>

On Thu, 2006-07-20 at 14:56 +1000, Russell Stuart wrote:
> On Wed, 2006-07-19 at 16:50 +0200, Patrick McHardy wrote:
> > Please excuse my silence, I was travelling and am still catching up
> > with my mails.
> 
> Sorry.  Had I realised you were busy I would of
> waited.
> 
> > > - As it stands, it doesn't help the qdiscs that use 
> > >   RTAB.  So unless he proposes to remove RTAB entirely 
> > >   the ATM patch as it will still have to go in.
> > 
> > Why? The length calculated by my STABs (or something similar)
> > is used by _all_ qdiscs. Not only for transmission time calculation,
> > but also for statistics and estimators.
> 
> Oh.  I didn't see where it is used for the time 
> calculation in your patch.  Did I miss something,
> or is that the unfinished bit?
> 
> This is possibly my stumbling block.  If you don't remove
> RTAB the ATM patch as stands will be needed.  Your patch
> didn't remove RTAB, and you didn't say it was intended to,
> so I presume it wasn't going to.

It has gone quiet again.  In my mind the one unresolved issue
is whether Patrick intended to remove RTAB with his patch.
If not, the ATM patch as it stands will have to go in.

Patrick - it would be nice to hear from you.



From oscar at ufomechanic.net  Tue Aug  1 11:28:23 2006
From: oscar at ufomechanic.net (Oscar Mechanic)
Date: Tue Aug  1 11:28:15 2006
Subject: [LARTC] how to save iproute
In-Reply-To: <1151768560.5095.75.camel@localhost.localdomain>
References: <1151768560.5095.75.camel@localhost.localdomain>
Message-ID: <1154424503.4282.52.camel@OSCARLAPLIN>

Say if I have a few routes like this 

ip rule add from 19.21.12.12 lookup 200
ip route add default via 10.0.0.253
ip rule add to 13.1.2.2 lookup 201
ip route add default via 10.0.0.254
ip route add default via 10.0.0.254

How do I save them, I have looked through the list and have googled this
Q for some time and do not have an concrete answers. I have read that
you just save and rerun the command but that does not work as the "from
all to" is not valid it has to be the "to" without the "from all". I
have used multiple versions of iproute2 and still the same problem. I
written a script and put in many sed's to get around problems but its
nasty code. Surely someone solved this is there a "saveall" script or
bin that is distro independant. 

Thanks.



From baltasar.cevc at former03.de  Tue Aug  1 11:54:17 2006
From: baltasar.cevc at former03.de (former03 | Baltasar Cevc)
Date: Tue Aug  1 11:54:15 2006
Subject: [LARTC] IProute/conntrack issues
Message-ID: <f458c3e43c24a8f20d950041b74bd625@former03.de>

Hi everybody,

sorry for posting again, however I've moved the problem now ;-)
After digging a bit deeper, I've successfully set up the routing as 
such, it works for incoming as well as outgoing packets that take the 
default route.
Changing some of the routes using IP works as well.
When I mark some outgoing packets in order to send them via another 
route (the fast leased line instead of the slow DSL link), packets go 
out there, the answer comes in, however, they never reach the internal 
host, as far as I can track down the problem the connection tracking 
does not recognize the answer as belonging to a known connection, so 
that the reverse NAT will fail (we use SNAT on outgoing packets).

Any help or hints are appreciated!

Thanx,
Baltasar

Some more information:

### Routing looks like
ofc:/home/bc# ip ru sh
0:      from all lookup local
5001:   from <extip leased line>/29 lookup IQ
5002:   from <extip DSL> lookup DSL
6001:   from all fwmark 0x1 lookup IQ
6002:   from all fwmark 0x2 lookup DSL
32765:  from all lookup main
32766:  from all lookup OVERRIDEdefault
32767:  from all lookup default
ofc:/home/bc# ip ro sh table IQ
default via <extip leased line> dev eth0
ofc:/home/bc# ip ro sh table DSL
default dev ppp0  scope link

main contains local the link routes, OVERRIDEdefault has same contents 
as DSL (default route via ppp0)

Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
  pkts bytes target     prot opt in     out     source               
destination
   133 12567 ACCEPT     all  --  any    any     anywhere             
priv172.net.hoster03.de/12
    16  3560 ACCEPT     all  --  any    any     anywhere             
priv192.net.hoster03.de/16
     0     0 ACCEPT     all  --  any    any     anywhere             
priv10.net.hoster03.de/8
     0     0 MARK       tcp  --  any    any     anywhere             
anywhere            tcp dpt:www MARK set 0x1


### excert from /proc/net/ip_conntrack
tcp      6 38 SYN_RECV src=172.26.26.6 dst=<destination ip> sport=65431 
dport=80 packets=1 bytes=60 src=<destination ip> dst=<extip leased 
line> sport=80 dport=65431 packets=6 bytes=360 mark=0 use=1

### tcpdump excerpt of eth0
11:34:22.048909 IP (tos 0x0, ttl  63, id 64917, offset 0, flags [DF], 
length: 60) <hostname leased line>.65431 > <destination hostname>.www: 
S [tcp sum ok] 2180804841:2180804841(0) win 65535 <mss 1368,nop,wscale 
2,nop,nop,timestamp 2652608360 0>
11:34:22.069640 IP (tos 0x0, ttl  50, id 0, offset 0, flags [DF], 
length: 60) <destination hostname>.www > <hostname leased line>.65431: 
S [tcp sum ok] 3611549187:3611549187(0) ack 2180804842 win 5792 <mss 
1460,nop,nop,timestamp 2779605849 2652608360,nop,wscale 2>
[there are more packets like the last as the other host apparently 
tries to resend]

[there are no packets on ppp0 at the time of the connection]



--
Baltasar Cevc

_____ former 03 gmbh
_____ infanteriestra?e 19 haus 6 eg
_____ D-80797 muenchen

_____ http://www.former03.de

From t.luettgert at pressestimmen.de  Tue Aug  1 13:31:26 2006
From: t.luettgert at pressestimmen.de (Torsten Luettgert)
Date: Tue Aug  1 13:30:47 2006
Subject: [LARTC] IProute/conntrack issues
In-Reply-To: <f458c3e43c24a8f20d950041b74bd625@former03.de>
References: <f458c3e43c24a8f20d950041b74bd625@former03.de>
Message-ID: <1154431886.2379.10.camel@murdegern.cbxnet.de>

On Tue, 2006-08-01 at 11:54 +0200, former03 | Baltasar Cevc wrote:
> Hi everybody,
> 
> When I mark some outgoing packets in order to send them via another 
> route (the fast leased line instead of the slow DSL link), packets go 
> out there, the answer comes in, however, they never reach the internal 
> host

Sound like another case of /proc/sys/net/ipv4/conf/*/rp_filter
needing to be set zero.

rp_filter causes packets to be dropped that arrive at an interface
the kernel wouldn't route the sender address to.

Regards,
Torsten

From makevuy at ehas.org  Tue Aug  1 14:18:39 2006
From: makevuy at ehas.org (makevuy)
Date: Tue Aug  1 14:18:44 2006
Subject: [LARTC] About iptables with set --tos option
Message-ID: <44CF469F.9080605@ehas.org>

Hello,

I want to set the TOS of packets that are entering in my network with 
value 0x00 (or other). For this, I'm using iptables with the next comand:

iptables -t mangle -A FORWARD -i eth1 -s 0/0 -j TOS --set-tos 0x00

The problem ocurrs when my packets have a previous TOS of value 
difference from 0x00, because the comand do the next operation:

OLD_TOS + 0x00 = OLD_TOS

I would want to know if is possible with iptables, change the TOS of the 
packets, althought  the TOS of the packets that are arriving to my 
network is difference from 0x00.

Thanks ad Regards.

-- 
Sandra Salmer?n Ntutumu    <makevuy@ehas.org>
Tlf. Analog: +34 914888405 / M?vil: 653574298
Tlf. IP desde FWD: 656212. Ext: 10 / Tel. IP desde EHAS: 010010
Fundaci?n EHAS: Enlace Hispanoamericano de Salud - www.ehas.org
Telemedicina rural para zonas aisladas de pa?ses en desarrollo


From baltasar.cevc at former03.de  Tue Aug  1 14:34:47 2006
From: baltasar.cevc at former03.de (former03 | Baltasar Cevc)
Date: Tue Aug  1 14:34:46 2006
Subject: [LARTC] IProute/conntrack issues
In-Reply-To: <1154431886.2379.10.camel@murdegern.cbxnet.de>
References: <f458c3e43c24a8f20d950041b74bd625@former03.de>
	<1154431886.2379.10.camel@murdegern.cbxnet.de>
Message-ID: <63122cff0208cb98ce0ad072534ed31b@former03.de>

Hi Torsten, hi list,

Thanx for help!

On 01.08.2006, at 13:31, Torsten Luettgert wrote:
> On Tue, 2006-08-01 at 11:54 +0200, former03 | Baltasar Cevc wrote:
>> Hi everybody,
>>
>> When I mark some outgoing packets in order to send them via another
>> route (the fast leased line instead of the slow DSL link), packets go
>> out there, the answer comes in, however, they never reach the internal
>> host
>
> Sound like another case of /proc/sys/net/ipv4/conf/*/rp_filter
> needing to be set zero.
That was indeed the problem.

A follow up-question as I don't really understand connmark yet: is 
there a possiblity to mark ll connections (or packets thereof) related 
to marked connections? I want to route FTP connections via the 
secondary interface. For active mode that just works fine, however I 
don't know how to find out it's an outgoing ftp-data connection...

Thanx,

Baltasar

--
Baltasar Cevc

_____ former 03 gmbh
_____ infanteriestra?e 19 haus 6 eg
_____ D-80797 muenchen

_____ http://www.former03.de

From mark0201_tw at yahoo.com  Wed Aug  2 08:48:15 2006
From: mark0201_tw at yahoo.com (Mark Chao)
Date: Wed Aug  2 08:48:02 2006
Subject: [LARTC] iproute2-051007 TC static linked Makefile how to 
Message-ID: <20060802064815.55221.qmail@web60716.mail.yahoo.com>

Hi All

I'm the newbie in iproute2. For some reason, I have to
use static linked instead of dynamic. My kernel is
2.4.18-14 (Redhat 8.0). After patching 
htb3.6_tc.diff, still comes out "Unknown qdisc
"htb"..." by "tc qdisc add dev eth0 root handle 1: htb
default 20" command. Or any examples/web link discuss
about iproute2 static linked? Please advise!

BR
Mark

__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com 
From geraldhuet at yahoo.fr  Wed Aug  2 10:55:41 2006
From: geraldhuet at yahoo.fr (gerald HUET)
Date: Wed Aug  2 10:55:26 2006
Subject: [LARTC] iptables u32 kernel 2.6.17
Message-ID: <20060802085541.33422.qmail@web26504.mail.ukl.yahoo.com>

hi everybody,

I used to test this rules on my gateway :
iptables -I FORWARD -p udp -m length --length 39 -m
u32 --u32 '27&0x8f=7' --u32 '31=0x527c4833' -j DROP

This was working with a 2.6.16 kernel but now i
upgraded to 2.6.17 it give me the following message :
[ 5333.870000] ip_tables: u32 match: invalid size 0 !=
2028
iptables: Unknown error -1


I tried to do some modifications on ipt_u32.c
following  modifications which work for ipp2p
(http://www.sieglitzhof.net/~doc/ipp2p/) without any
succes. 

Does anyone have an explication why the problem occurs
whith the new kernel and how to solve it ?

Thanks in advance


	

	
		
___________________________________________________________________________ 
D?couvrez un nouveau moyen de poser toutes vos questions quelque soit le sujet ! 
Yahoo! Questions/R?ponses pour partager vos connaissances, vos opinions et vos exp?riences. 
http://fr.answers.yahoo.com 

From msc at antzsystem.de  Wed Aug  2 12:08:40 2006
From: msc at antzsystem.de (Markus Schulz)
Date: Wed Aug  2 12:08:49 2006
Subject: [LARTC] FWMark routing trouble
In-Reply-To: <543407a389ac4ddaf401fe2030924454@former03.de>
References: <543407a389ac4ddaf401fe2030924454@former03.de>
Message-ID: <200608021208.41393.msc@antzsystem.de>

Am Samstag, 29. Juli 2006 17:33 schrieb former03 | Baltasar Cevc:
> Hi everybody,
>
> I'm trying to set up routing for 2 links to the internet on a box
> which produces traffic itself (e.g. DNS) and will route all our local
> traffic.
>
> AS one route is quick and expensive and the other one slow and cheap,
> I want to be able to route packets for some high-level protocols to
> the second link.
>
> If I correctly understood table 3-2 in
> http://www.faqs.org/docs/iptables/traversingoftables.html that is not
> possible as the routing decision is taken even before the packet
> touches netfilter for the first time.
>
>
> Is that correct? Does anybody have some hints about how to work
> around?

It's possible with Policy Routing. Look at 
http://www.policyrouting.org/PolicyRoutingBook/ONLINE/TOC.html for 
documentation about it.

(Simplest?) way to do it: (only short excerpt)

- Mark the specific application packets with iptables in PREROUTING 
chain
...
- add rules for routing fwmarked packets to seperate routing tables
ip rule add fwmark <your fwmark #1> table <routing table for slow apps>
ip rule add fwmark <your fwmark #2> table <routing table for fast apps>

- build both routing tables
ip route add default via $PTP1 dev <device #1> src $IP1 proto static 
table <routing table for slow apps>
ip route add default via $PTP2 dev <device #2> src $IP2 proto static 
table <routing table for fast apps>

(Proto static needs kernel patches, but you don't really need this)


-- 
Markus Schulz 
From rvokal at redhat.com  Wed Aug  2 15:15:00 2006
From: rvokal at redhat.com (=?ISO-8859-1?Q?Radek_Vok=E1l?=)
Date: Wed Aug  2 15:14:56 2006
Subject: [LARTC] no PROMISC mode .. 
Message-ID: <44D0A554.1000300@redhat.com>

Hi,

I'm not convinced I'm facing a bug, I was reading some code and
also reading some threads and finally reached this conclusion, please 
let me know if it's not clear enough and also if you don't agree :
    - The case it shows the flag with iproute is
because it's using a single flag set.
      That was working on kernels linux <2.1.x. (2.0 etc.)
      Basically the mechanism was :
             ---
               strncpy(ifr.ifr_name, our_device, IFNAMSIZ);
               ioctl(sock, SIOCGIFFLAGS, &ifr);
               ifr.ifr_flags |= IFF_PROMISC;
               ioctl(sock, SIOCSIFFLAGS, &ifr);
            ---
      And only one could set the IFF_PROMISC, because if another process
decided to set it too, then it was cleared...
   - Now, with kernels 2.2 and onwards, we have a different 
implementation of it, there's a counter of how many promiscuous requests 
have been set, and therefore a new implementation of the code to handle 
it and remove the one promiscuous limitation, that has been called a 
membership. This allows the kernel to have more than one request and 
remove the above problem.

     Today, a process has to request to be part of that "packet domain"
and use the interface in promiscuous mode, then the counter will know if
there's another request (so it can handle unsets), and then, if the
process does not need anymore this mode, it will just request to be 
removed to that membership, decreasing the counter.

     The code nowadays is fairly close to this :
        -----
                  struct packet_mreq mr;
                  [.....]
                  memset(&amp;mr,0,sizeof(mr));
                  mr.mr_ifindex = ifr.ifr_ifindex;
                  mr.mr_type = PACKET_MR_PROMISC;
                  setsockopt(sock, SOL_PACKET, PACKET_ADD_MEMBERSHIP, (char
*)&mr, sizeof(mr));
        -----

That would explain why I can't see it with ip or older ifconfig, any 
call set by ioctl(SIOCGIFFLAGS) can only bee seen by the same call 
family. I've checked pcap, and seems to do the right thing by setting it :
       ----
       setsockopt(3, SOL_PACKET, PACKET_ADD_MEMBERSHIP,
"\\3\\0\\0\\0\\1\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0", 16) = 0
       ----
Hence I can't see it with neither ip or ifconfig.

  Is there any reason why (ip) is not using a membership check/set 
instead of using ioctl() ?


Radek
From t.luettgert at pressestimmen.de  Wed Aug  2 15:52:39 2006
From: t.luettgert at pressestimmen.de (Torsten Luettgert)
Date: Wed Aug  2 15:52:02 2006
Subject: [LARTC] iptables u32 kernel 2.6.17
In-Reply-To: <20060802085541.33422.qmail@web26504.mail.ukl.yahoo.com>
References: <20060802085541.33422.qmail@web26504.mail.ukl.yahoo.com>
Message-ID: <1154526759.2369.12.camel@murdegern.cbxnet.de>

On Wed, 2006-08-02 at 10:55 +0200, gerald HUET wrote:
> [ 5333.870000] ip_tables: u32 match: invalid size 0 !=
> 2028
> iptables: Unknown error -1
> 
> I tried to do some modifications on ipt_u32.c
> following  modifications which work for ipp2p
> (http://www.sieglitzhof.net/~doc/ipp2p/) without any
> succes. 

Hm, that should have worked - it's the same problem for
all the little-maintained stuff in patch-o-matic.

> Does anyone have an explication why the problem occurs
> whith the new kernel and how to solve it ?

The parameters to checkentry() and match() changed
incompatibly between 2.6.16 and 2.6.17.

The u32 match in current SVN works with 2.6.17
(but not with 2.6.16 or earlier).

You need to
svn co http://svn.netfilter.org/netfilter/trunk/patch-o-matic-ng

then patch your kernel and recompile.

Regards,
Torsten

From pch at packetconsulting.pl  Wed Aug  2 23:30:29 2006
From: pch at packetconsulting.pl (Piotr Chytla)
Date: Wed Aug  2 23:34:53 2006
Subject: [LARTC] iptables u32 kernel 2.6.17
In-Reply-To: <1154526759.2369.12.camel@murdegern.cbxnet.de>
References: <20060802085541.33422.qmail@web26504.mail.ukl.yahoo.com>
	<1154526759.2369.12.camel@murdegern.cbxnet.de>
Message-ID: <20060802213029.GA29316@packetconsulting.pl>

On Wed, Aug 02, 2006 at 03:52:39PM +0200, Torsten Luettgert wrote:
> On Wed, 2006-08-02 at 10:55 +0200, gerald HUET wrote:
> > [ 5333.870000] ip_tables: u32 match: invalid size 0 !=
> > 2028
> > iptables: Unknown error -1
> > 
> > I tried to do some modifications on ipt_u32.c
> > following  modifications which work for ipp2p
> > (http://www.sieglitzhof.net/~doc/ipp2p/) without any
> > succes. 
> 
> Hm, that should have worked - it's the same problem for
> all the little-maintained stuff in patch-o-matic.
> 
> > Does anyone have an explication why the problem occurs
> > whith the new kernel and how to solve it ?
> 
> The parameters to checkentry() and match() changed
> incompatibly between 2.6.16 and 2.6.17.
> 
> The u32 match in current SVN works with 2.6.17
> (but not with 2.6.16 or earlier).
> 
> You need to
> svn co http://svn.netfilter.org/netfilter/trunk/patch-o-matic-ng
> 
> then patch your kernel and recompile.

apply also patch from attachment. 2.6.17 needs matchsize in ipt_match struct.

triss:~# iptables -I FORWARD -p udp -m length --length 39 -m u32 --u32 '27&0x8f=7' --u32 '31=0x527c4833' -j DROP

triss:~# iptables -L FORWARD -vn
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source destination         
    0     0 DROP       udp  --  *      *       0.0.0.0/0 0.0.0.0/0           length 39 u32 0x1f=0x527c4833 

seems working.

/pch



-- 
Dyslexia bug unpatched since 1977 ...
exploit has been leaked to the underground.
-------------- next part --------------
--- ipt_u32.c	2006-08-02 22:34:29.000000000 +0200
+++ /usr/src/linux-2.6.17.6/net/ipv4/netfilter/ipt_u32.c	2006-08-02 22:45:43.000000000 +0200
@@ -217,6 +217,7 @@
 static struct ipt_match u32_match = { 
 	.name 		= "u32",
 	.match		= &match,
+	.matchsize	= sizeof(struct ipt_u32),
 	.checkentry	= &checkentry,
 	.me		= THIS_MODULE
 };
From shemminger at osdl.org  Wed Aug  2 21:58:50 2006
From: shemminger at osdl.org (Stephen Hemminger)
Date: Thu Aug  3 00:11:54 2006
Subject: [LARTC] [PATCH 2/6] htb: remove lock macro
In-Reply-To: <20060802125636.3028ba91@dxpl.pdx.osdl.net>
References: <20060802125636.3028ba91@dxpl.pdx.osdl.net>
Message-ID: <20060802125850.748fb0aa@dxpl.pdx.osdl.net>

Get rid of the macro's being used to obscure the locking.

Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
---
 net/sched/sch_htb.c |   18 ++++++++----------
 1 files changed, 8 insertions(+), 10 deletions(-)

diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 73094e7..c0b80b7 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -72,8 +72,6 @@ #define HTB_HSIZE 16	/* classid hash siz
 #define HTB_EWMAC 2	/* rate average over HTB_EWMAC*HTB_HSIZE sec */
 #define HTB_RATECM 1    /* whether to use rate computer */
 #define HTB_HYSTERESIS 1/* whether to use mode hysteresis for speedup */
-#define HTB_QLOCK(S) spin_lock_bh(&(S)->dev->queue_lock)
-#define HTB_QUNLOCK(S) spin_unlock_bh(&(S)->dev->queue_lock)
 #define HTB_VER 0x30011	/* major must be matched with number suplied by TC as version */
 
 #if HTB_VER >> 16 != TC_HTB_PROTOVER
@@ -667,7 +665,7 @@ static void htb_rate_timer(unsigned long
 	struct list_head *p;
 
 	/* lock queue so that we can muck with it */
-	HTB_QLOCK(sch);
+	spin_lock_bh(&sch->dev->queue_lock);
 
 	q->rttim.expires = jiffies + HZ;
 	add_timer(&q->rttim);
@@ -681,7 +679,7 @@ static void htb_rate_timer(unsigned long
 		RT_GEN (cl->sum_bytes,cl->rate_bytes);
 		RT_GEN (cl->sum_packets,cl->rate_packets);
 	}
-	HTB_QUNLOCK(sch);
+	spin_unlock_bh(&sch->dev->queue_lock);
 }
 #endif
 
@@ -1089,7 +1087,7 @@ static int htb_dump(struct Qdisc *sch, s
 	unsigned char	 *b = skb->tail;
 	struct rtattr *rta;
 	struct tc_htb_glob gopt;
-	HTB_QLOCK(sch);
+	spin_lock_bh(&sch->dev->queue_lock);
 	gopt.direct_pkts = q->direct_pkts;
 
 	gopt.version = HTB_VER;
@@ -1100,10 +1098,10 @@ static int htb_dump(struct Qdisc *sch, s
 	RTA_PUT(skb, TCA_OPTIONS, 0, NULL);
 	RTA_PUT(skb, TCA_HTB_INIT, sizeof(gopt), &gopt);
 	rta->rta_len = skb->tail - b;
-	HTB_QUNLOCK(sch);
+	spin_unlock_bh(&sch->dev->queue_lock);
 	return skb->len;
 rtattr_failure:
-	HTB_QUNLOCK(sch);
+	spin_unlock_bh(&sch->dev->queue_lock);
 	skb_trim(skb, skb->tail - skb->data);
 	return -1;
 }
@@ -1116,7 +1114,7 @@ static int htb_dump_class(struct Qdisc *
 	struct rtattr *rta;
 	struct tc_htb_opt opt;
 
-	HTB_QLOCK(sch);
+	spin_lock_bh(&sch->dev->queue_lock);
 	tcm->tcm_parent = cl->parent ? cl->parent->classid : TC_H_ROOT;
 	tcm->tcm_handle = cl->classid;
 	if (!cl->level && cl->un.leaf.q)
@@ -1133,10 +1131,10 @@ static int htb_dump_class(struct Qdisc *
 	opt.level = cl->level; 
 	RTA_PUT(skb, TCA_HTB_PARMS, sizeof(opt), &opt);
 	rta->rta_len = skb->tail - b;
-	HTB_QUNLOCK(sch);
+	spin_unlock_bh(&sch->dev->queue_lock);
 	return skb->len;
 rtattr_failure:
-	HTB_QUNLOCK(sch);
+	spin_unlock_bh(&sch->dev->queue_lock);
 	skb_trim(skb, b - skb->data);
 	return -1;
 }
-- 
1.4.0

From shemminger at osdl.org  Wed Aug  2 21:56:36 2006
From: shemminger at osdl.org (Stephen Hemminger)
Date: Thu Aug  3 00:12:08 2006
Subject: [LARTC] [PATCH 0/6] htb:  cleanup
Message-ID: <20060802125636.3028ba91@dxpl.pdx.osdl.net>

The HTB scheduler code is a mess, this patch set does some basic
house cleaning.  The first four should cause no code change, but the
last two need more testing.

-- 
Stephen Hemminger <shemminger@osdl.org>
"And in the Packet there writ down that doome"
From shemminger at osdl.org  Thu Aug  3 00:03:40 2006
From: shemminger at osdl.org (Stephen Hemminger)
Date: Thu Aug  3 00:12:24 2006
Subject: [LARTC] [PATCH 5/6] htb: use hlist for hash lists.
In-Reply-To: <20060802125636.3028ba91@dxpl.pdx.osdl.net>
References: <20060802125636.3028ba91@dxpl.pdx.osdl.net>
Message-ID: <20060802150340.7faabd1d@dxpl.pdx.osdl.net>

Use hlist instead of list for the hash list. This saves
space, and we can check for double delete better.

Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
---
 net/sched/sch_htb.c |   49 +++++++++++++++++++++++++++----------------------
 1 files changed, 27 insertions(+), 22 deletions(-)

diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 528d5c5..7853c6f 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -104,7 +104,7 @@ #endif
 	/* topology */
 	int level;		/* our level (see above) */
 	struct htb_class *parent;	/* parent class */
-	struct list_head hlist;	/* classid hash list item */
+	struct hlist_node hlist;	/* classid hash list item */
 	struct list_head sibling;	/* sibling list item */
 	struct list_head children;	/* children list */
 
@@ -163,8 +163,8 @@ static inline long L2T(struct htb_class 
 
 struct htb_sched {
 	struct list_head root;	/* root classes list */
-	struct list_head hash[HTB_HSIZE];	/* hashed by classid */
-	struct list_head drops[TC_HTB_NUMPRIO];	/* active leaves (for drops) */
+	struct hlist_head hash[HTB_HSIZE];	/* hashed by classid */
+	struct list_head drops[TC_HTB_NUMPRIO];/* active leaves (for drops) */
 
 	/* self list - roots of self generating tree */
 	struct rb_root row[TC_HTB_MAXDEPTH][TC_HTB_NUMPRIO];
@@ -220,12 +220,13 @@ #endif
 static inline struct htb_class *htb_find(u32 handle, struct Qdisc *sch)
 {
 	struct htb_sched *q = qdisc_priv(sch);
-	struct list_head *p;
+	struct hlist_node *p;
+	struct htb_class *cl;
+
 	if (TC_H_MAJ(handle) != sch->handle)
 		return NULL;
 
-	list_for_each(p, q->hash + htb_hash(handle)) {
-		struct htb_class *cl = list_entry(p, struct htb_class, hlist);
+	hlist_for_each_entry(cl, p, q->hash + htb_hash(handle), hlist) {
 		if (cl->classid == handle)
 			return cl;
 	}
@@ -675,7 +676,9 @@ static void htb_rate_timer(unsigned long
 {
 	struct Qdisc *sch = (struct Qdisc *)arg;
 	struct htb_sched *q = qdisc_priv(sch);
-	struct list_head *p;
+	struct hlist_node *p;
+	struct htb_class *cl;
+
 
 	/* lock queue so that we can muck with it */
 	spin_lock_bh(&sch->dev->queue_lock);
@@ -686,9 +689,8 @@ static void htb_rate_timer(unsigned long
 	/* scan and recompute one bucket at time */
 	if (++q->recmp_bucket >= HTB_HSIZE)
 		q->recmp_bucket = 0;
-	list_for_each(p, q->hash + q->recmp_bucket) {
-		struct htb_class *cl = list_entry(p, struct htb_class, hlist);
 
+	hlist_for_each_entry(cl,p, q->hash + q->recmp_bucket, hlist) {
 		RT_GEN(cl->sum_bytes, cl->rate_bytes);
 		RT_GEN(cl->sum_packets, cl->rate_packets);
 	}
@@ -1041,10 +1043,10 @@ static void htb_reset(struct Qdisc *sch)
 	int i;
 
 	for (i = 0; i < HTB_HSIZE; i++) {
-		struct list_head *p;
-		list_for_each(p, q->hash + i) {
-			struct htb_class *cl =
-			    list_entry(p, struct htb_class, hlist);
+		struct hlist_node *p;
+		struct htb_class *cl;
+
+		hlist_for_each_entry(cl, p, q->hash + i, hlist) {
 			if (cl->level)
 				memset(&cl->un.inner, 0, sizeof(cl->un.inner));
 			else {
@@ -1091,7 +1093,7 @@ static int htb_init(struct Qdisc *sch, s
 
 	INIT_LIST_HEAD(&q->root);
 	for (i = 0; i < HTB_HSIZE; i++)
-		INIT_LIST_HEAD(q->hash + i);
+		INIT_HLIST_HEAD(q->hash + i);
 	for (i = 0; i < TC_HTB_NUMPRIO; i++)
 		INIT_LIST_HEAD(q->drops + i);
 
@@ -1269,7 +1271,8 @@ static void htb_destroy_class(struct Qdi
 						  struct htb_class, sibling));
 
 	/* note: this delete may happen twice (see htb_delete) */
-	list_del(&cl->hlist);
+	if (!hlist_unhashed(&cl->hlist))
+		hlist_del(&cl->hlist);
 	list_del(&cl->sibling);
 
 	if (cl->prio_activity)
@@ -1317,7 +1320,9 @@ static int htb_delete(struct Qdisc *sch,
 	sch_tree_lock(sch);
 
 	/* delete from hash and active; remainder in destroy_class */
-	list_del_init(&cl->hlist);
+	if (!hlist_unhashed(&cl->hlist))
+		hlist_del(&cl->hlist);
+
 	if (cl->prio_activity)
 		htb_deactivate(q, cl);
 
@@ -1381,7 +1386,7 @@ static int htb_change_class(struct Qdisc
 
 		cl->refcnt = 1;
 		INIT_LIST_HEAD(&cl->sibling);
-		INIT_LIST_HEAD(&cl->hlist);
+		INIT_HLIST_NODE(&cl->hlist);
 		INIT_LIST_HEAD(&cl->children);
 		INIT_LIST_HEAD(&cl->un.leaf.drop_list);
 
@@ -1420,7 +1425,7 @@ static int htb_change_class(struct Qdisc
 		cl->cmode = HTB_CAN_SEND;
 
 		/* attach to the hash list and parent's family */
-		list_add_tail(&cl->hlist, q->hash + htb_hash(classid));
+		hlist_add_head(&cl->hlist, q->hash + htb_hash(classid));
 		list_add_tail(&cl->sibling,
 			      parent ? &parent->children : &q->root);
 	} else
@@ -1520,10 +1525,10 @@ static void htb_walk(struct Qdisc *sch, 
 		return;
 
 	for (i = 0; i < HTB_HSIZE; i++) {
-		struct list_head *p;
-		list_for_each(p, q->hash + i) {
-			struct htb_class *cl =
-			    list_entry(p, struct htb_class, hlist);
+		struct hlist_node *p;
+		struct htb_class *cl;
+
+		hlist_for_each_entry(cl, p, q->hash + i, hlist) {
 			if (arg->count < arg->skip) {
 				arg->count++;
 				continue;
-- 
1.4.0

From shemminger at osdl.org  Thu Aug  3 00:09:29 2006
From: shemminger at osdl.org (Stephen Hemminger)
Date: Thu Aug  3 00:12:50 2006
Subject: [LARTC] [PATCH 6/6] htb: rbtree cleanup
In-Reply-To: <20060802125636.3028ba91@dxpl.pdx.osdl.net>
References: <20060802125636.3028ba91@dxpl.pdx.osdl.net>
Message-ID: <20060802150929.2e1ba806@dxpl.pdx.osdl.net>

Add code to initialize rb tree nodes, and check for double deletion.
This is not a real fix, but I can make it trap sometimes and may
be a bandaid for: http://bugzilla.kernel.org/show_bug.cgi?id=6681

Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
---
 net/sched/sch_htb.c |   34 +++++++++++++++++++++++++++-------
 1 files changed, 27 insertions(+), 7 deletions(-)

diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 7853c6f..3f3e9df 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -366,7 +366,7 @@ static void htb_add_to_wait_tree(struct 
  * When we are past last key we return NULL.
  * Average complexity is 2 steps per call.
  */
-static void htb_next_rb_node(struct rb_node **n)
+static inline void htb_next_rb_node(struct rb_node **n)
 {
 	*n = rb_next(*n);
 }
@@ -388,6 +388,18 @@ static inline void htb_add_class_to_row(
 	}
 }
 
+/* If this triggers, it is a bug in this code, but it need not be fatal */
+static void htb_safe_rb_erase(struct rb_node *rb, struct rb_root *root)
+{
+	if (RB_EMPTY_NODE(rb)) {
+		WARN_ON(1);
+	} else {
+		rb_erase(rb, root);
+		RB_CLEAR_NODE(rb);
+	}
+}
+
+
 /**
  * htb_remove_class_from_row - removes class from its row
  *
@@ -401,10 +413,12 @@ static inline void htb_remove_class_from
 
 	while (mask) {
 		int prio = ffz(~mask);
+
 		mask &= ~(1 << prio);
 		if (q->ptr[cl->level][prio] == cl->node + prio)
 			htb_next_rb_node(q->ptr[cl->level] + prio);
-		rb_erase(cl->node + prio, q->row[cl->level] + prio);
+
+		htb_safe_rb_erase(cl->node + prio, q->row[cl->level] + prio);
 		if (!q->row[cl->level][prio].rb_node)
 			m |= 1 << prio;
 	}
@@ -472,7 +486,7 @@ static void htb_deactivate_prios(struct 
 				p->un.inner.ptr[prio] = NULL;
 			}
 
-			rb_erase(cl->node + prio, p->un.inner.feed + prio);
+			htb_safe_rb_erase(cl->node + prio, p->un.inner.feed + prio);
 
 			if (!p->un.inner.feed[prio].rb_node)
 				mask |= 1 << prio;
@@ -739,7 +753,7 @@ #define HTB_ACCNT(T,B,R) toks = diff + c
 		htb_change_class_mode(q, cl, &diff);
 		if (old_mode != cl->cmode) {
 			if (old_mode != HTB_CAN_SEND)
-				rb_erase(&cl->pq_node, q->wait_pq + cl->level);
+				htb_safe_rb_erase(&cl->pq_node, q->wait_pq + cl->level);
 			if (cl->cmode != HTB_CAN_SEND)
 				htb_add_to_wait_tree(q, cl, diff);
 		}
@@ -782,7 +796,7 @@ static long htb_do_events(struct htb_sch
 		if (time_after(cl->pq_key, q->jiffies)) {
 			return cl->pq_key - q->jiffies;
 		}
-		rb_erase(p, q->wait_pq + level);
+		htb_safe_rb_erase(p, q->wait_pq + level);
 		diff = PSCHED_TDIFF_SAFE(q->now, cl->t_c, (u32) cl->mbuffer);
 		htb_change_class_mode(q, cl, &diff);
 		if (cl->cmode != HTB_CAN_SEND)
@@ -1279,7 +1293,7 @@ static void htb_destroy_class(struct Qdi
 		htb_deactivate(q, cl);
 
 	if (cl->cmode != HTB_CAN_SEND)
-		rb_erase(&cl->pq_node, q->wait_pq + cl->level);
+		htb_safe_rb_erase(&cl->pq_node, q->wait_pq + cl->level);
 
 	kfree(cl);
 }
@@ -1370,6 +1384,8 @@ static int htb_change_class(struct Qdisc
 
 	if (!cl) {		/* new class */
 		struct Qdisc *new_q;
+		int prio;
+
 		/* check for valid classid */
 		if (!classid || TC_H_MAJ(classid ^ sch->handle)
 		    || htb_find(classid, sch))
@@ -1389,6 +1405,10 @@ static int htb_change_class(struct Qdisc
 		INIT_HLIST_NODE(&cl->hlist);
 		INIT_LIST_HEAD(&cl->children);
 		INIT_LIST_HEAD(&cl->un.leaf.drop_list);
+		RB_CLEAR_NODE(&cl->pq_node);
+
+		for (prio = 0; prio < TC_HTB_NUMPRIO; prio++)
+			RB_CLEAR_NODE(&cl->node[prio]);
 
 		/* create leaf qdisc early because it uses kmalloc(GFP_KERNEL)
 		   so that can't be used inside of sch_tree_lock
@@ -1404,7 +1424,7 @@ static int htb_change_class(struct Qdisc
 
 			/* remove from evt list because of level change */
 			if (parent->cmode != HTB_CAN_SEND) {
-				rb_erase(&parent->pq_node, q->wait_pq);
+				htb_safe_rb_erase(&parent->pq_node, q->wait_pq);
 				parent->cmode = HTB_CAN_SEND;
 			}
 			parent->level = (parent->parent ? parent->parent->level
-- 
1.4.0

From shemminger at osdl.org  Thu Aug  3 00:09:43 2006
From: shemminger at osdl.org (Stephen Hemminger)
Date: Thu Aug  3 00:13:12 2006
Subject: [LARTC] [PATCH 3/6] htb: if HTB_HYSTERIS cleanup
In-Reply-To: <20060802125636.3028ba91@dxpl.pdx.osdl.net>
References: <20060802125636.3028ba91@dxpl.pdx.osdl.net>
Message-ID: <20060802150943.2b5f7de5@dxpl.pdx.osdl.net>

Change the conditional compilation around HTB_HYSTERSIS
since code was splitting mid expression.

Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
---
 net/sched/sch_htb.c |   27 +++++++++++++++++----------
 1 files changed, 17 insertions(+), 10 deletions(-)

diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index c0b80b7..d8c1a6b 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -483,6 +483,20 @@ static void htb_deactivate_prios(struct 
 		htb_remove_class_from_row(q,cl,mask);
 }
 
+#if HTB_HYSTERESIS
+static inline long htb_lowater(const struct htb_class *cl)
+{
+	return cl->cmode != HTB_CANT_SEND ? -cl->cbuffer : 0;
+}
+static inline long htb_hiwater(const struct htb_class *cl)
+{
+	return cl->cmode == HTB_CAN_SEND ? -cl->buffer : 0;
+}
+#else
+#define htb_lowater(cl)	(0)
+#define htb_hiwater(cl)	(0)
+#endif
+
 /**
  * htb_class_mode - computes and returns current class mode
  *
@@ -499,19 +513,12 @@ htb_class_mode(struct htb_class *cl,long
 {
     long toks;
 
-    if ((toks = (cl->ctokens + *diff)) < (
-#if HTB_HYSTERESIS
-	    cl->cmode != HTB_CANT_SEND ? -cl->cbuffer :
-#endif
-       	    0)) {
+    if ((toks = (cl->ctokens + *diff)) < htb_lowater(cl)) {
 	    *diff = -toks;
 	    return HTB_CANT_SEND;
     }
-    if ((toks = (cl->tokens + *diff)) >= (
-#if HTB_HYSTERESIS
-	    cl->cmode == HTB_CAN_SEND ? -cl->buffer :
-#endif
-	    0))
+
+    if ((toks = (cl->tokens + *diff)) >= htb_hiwater(cl))
 	    return HTB_CAN_SEND;
 
     *diff = -toks;
-- 
1.4.0

From shemminger at osdl.org  Thu Aug  3 00:11:50 2006
From: shemminger at osdl.org (Stephen Hemminger)
Date: Thu Aug  3 00:13:29 2006
Subject: [LARTC] [PATCH 1/6] htb: remove broken debug code
In-Reply-To: <20060802125636.3028ba91@dxpl.pdx.osdl.net>
References: <20060802125636.3028ba91@dxpl.pdx.osdl.net>
Message-ID: <20060802151150.2c320102@dxpl.pdx.osdl.net>


The HTB network scheduler had debug code that wouldn't compile
and confused and obfuscated the code, remove it.

Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
---
 net/sched/sch_htb.c |  302 ++++++---------------------------------------------
 1 files changed, 34 insertions(+), 268 deletions(-)

diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 880a339..73094e7 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -70,7 +70,6 @@ #include <linux/rbtree.h>
 
 #define HTB_HSIZE 16	/* classid hash size */
 #define HTB_EWMAC 2	/* rate average over HTB_EWMAC*HTB_HSIZE sec */
-#undef HTB_DEBUG	/* compile debugging support (activated by tc tool) */
 #define HTB_RATECM 1    /* whether to use rate computer */
 #define HTB_HYSTERESIS 1/* whether to use mode hysteresis for speedup */
 #define HTB_QLOCK(S) spin_lock_bh(&(S)->dev->queue_lock)
@@ -81,51 +80,6 @@ #if HTB_VER >> 16 != TC_HTB_PROTOVER
 #error "Mismatched sch_htb.c and pkt_sch.h"
 #endif
 
-/* debugging support; S is subsystem, these are defined:
-  0 - netlink messages
-  1 - enqueue
-  2 - drop & requeue
-  3 - dequeue main
-  4 - dequeue one prio DRR part
-  5 - dequeue class accounting
-  6 - class overlimit status computation
-  7 - hint tree
-  8 - event queue
- 10 - rate estimator
- 11 - classifier 
- 12 - fast dequeue cache
-
- L is level; 0 = none, 1 = basic info, 2 = detailed, 3 = full
- q->debug uint32 contains 16 2-bit fields one for subsystem starting
- from LSB
- */
-#ifdef HTB_DEBUG
-#define HTB_DBG_COND(S,L) (((q->debug>>(2*S))&3) >= L)
-#define HTB_DBG(S,L,FMT,ARG...) if (HTB_DBG_COND(S,L)) \
-	printk(KERN_DEBUG FMT,##ARG)
-#define HTB_CHCL(cl) BUG_TRAP((cl)->magic == HTB_CMAGIC)
-#define HTB_PASSQ q,
-#define HTB_ARGQ struct htb_sched *q,
-#define static
-#undef __inline__
-#define __inline__
-#undef inline
-#define inline
-#define HTB_CMAGIC 0xFEFAFEF1
-#define htb_safe_rb_erase(N,R) do { BUG_TRAP((N)->rb_color != -1); \
-		if ((N)->rb_color == -1) break; \
-		rb_erase(N,R); \
-		(N)->rb_color = -1; } while (0)
-#else
-#define HTB_DBG_COND(S,L) (0)
-#define HTB_DBG(S,L,FMT,ARG...)
-#define HTB_PASSQ
-#define HTB_ARGQ
-#define HTB_CHCL(cl)
-#define htb_safe_rb_erase(N,R) rb_erase(N,R)
-#endif
-
-
 /* used internaly to keep status of single class */
 enum htb_cmode {
     HTB_CANT_SEND,		/* class can't send and can't borrow */
@@ -136,9 +90,6 @@ enum htb_cmode {
 /* interior & leaf nodes; props specific to leaves are marked L: */
 struct htb_class
 {
-#ifdef HTB_DEBUG
-	unsigned magic;
-#endif
     /* general class parameters */
     u32 classid;
     struct gnet_stats_basic bstats;
@@ -238,7 +189,6 @@ struct htb_sched
     int nwc_hit;	/* this to disable mindelay complaint in dequeue */
 
     int defcls;		/* class where unclassified flows go to */
-    u32 debug;		/* subsystem debug levels */
 
     /* filters for qdisc itself */
     struct tcf_proto *filter_list;
@@ -354,75 +304,21 @@ #endif
 	return cl;
 }
 
-#ifdef HTB_DEBUG
-static void htb_next_rb_node(struct rb_node **n);
-#define HTB_DUMTREE(root,memb) if(root) { \
-	struct rb_node *n = (root)->rb_node; \
-	while (n->rb_left) n = n->rb_left; \
-	while (n) { \
-		struct htb_class *cl = rb_entry(n, struct htb_class, memb); \
-		printk(" %x",cl->classid); htb_next_rb_node (&n); \
-	} }
-
-static void htb_debug_dump (struct htb_sched *q)
-{
-	int i,p;
-	printk(KERN_DEBUG "htb*g j=%lu lj=%lu\n",jiffies,q->jiffies);
-	/* rows */
-	for (i=TC_HTB_MAXDEPTH-1;i>=0;i--) {
-		printk(KERN_DEBUG "htb*r%d m=%x",i,q->row_mask[i]);
-		for (p=0;p<TC_HTB_NUMPRIO;p++) {
-			if (!q->row[i][p].rb_node) continue;
-			printk(" p%d:",p);
-			HTB_DUMTREE(q->row[i]+p,node[p]);
-		}
-		printk("\n");
-	}
-	/* classes */
-	for (i = 0; i < HTB_HSIZE; i++) {
-		struct list_head *l;
-		list_for_each (l,q->hash+i) {
-			struct htb_class *cl = list_entry(l,struct htb_class,hlist);
-			long diff = PSCHED_TDIFF_SAFE(q->now, cl->t_c, (u32)cl->mbuffer);
-			printk(KERN_DEBUG "htb*c%x m=%d t=%ld c=%ld pq=%lu df=%ld ql=%d "
-					"pa=%x f:",
-				cl->classid,cl->cmode,cl->tokens,cl->ctokens,
-				cl->pq_node.rb_color==-1?0:cl->pq_key,diff,
-				cl->level?0:cl->un.leaf.q->q.qlen,cl->prio_activity);
-			if (cl->level)
-			for (p=0;p<TC_HTB_NUMPRIO;p++) {
-				if (!cl->un.inner.feed[p].rb_node) continue;
-				printk(" p%d a=%x:",p,cl->un.inner.ptr[p]?rb_entry(cl->un.inner.ptr[p], struct htb_class,node[p])->classid:0);
-				HTB_DUMTREE(cl->un.inner.feed+p,node[p]);
-			}
-			printk("\n");
-		}
-	}
-}
-#endif
 /**
  * htb_add_to_id_tree - adds class to the round robin list
  *
  * Routine adds class to the list (actually tree) sorted by classid.
  * Make sure that class is not already on such list for given prio.
  */
-static void htb_add_to_id_tree (HTB_ARGQ struct rb_root *root,
+static void htb_add_to_id_tree (struct rb_root *root,
 		struct htb_class *cl,int prio)
 {
 	struct rb_node **p = &root->rb_node, *parent = NULL;
-	HTB_DBG(7,3,"htb_add_id_tree cl=%X prio=%d\n",cl->classid,prio);
-#ifdef HTB_DEBUG
-	if (cl->node[prio].rb_color != -1) { BUG_TRAP(0); return; }
-	HTB_CHCL(cl);
-	if (*p) {
-		struct htb_class *x = rb_entry(*p,struct htb_class,node[prio]);
-		HTB_CHCL(x);
-	}
-#endif
+
 	while (*p) {
 		struct htb_class *c; parent = *p;
 		c = rb_entry(parent, struct htb_class, node[prio]);
-		HTB_CHCL(c);
+
 		if (cl->classid > c->classid)
 			p = &parent->rb_right;
 		else 
@@ -440,16 +336,10 @@ #endif
  * already in the queue.
  */
 static void htb_add_to_wait_tree (struct htb_sched *q,
-		struct htb_class *cl,long delay,int debug_hint)
+				  struct htb_class *cl,long delay)
 {
 	struct rb_node **p = &q->wait_pq[cl->level].rb_node, *parent = NULL;
-	HTB_DBG(7,3,"htb_add_wt cl=%X key=%lu\n",cl->classid,cl->pq_key);
-#ifdef HTB_DEBUG
-	if (cl->pq_node.rb_color != -1) { BUG_TRAP(0); return; }
-	HTB_CHCL(cl);
-	if ((delay <= 0 || delay > cl->mbuffer) && net_ratelimit())
-		printk(KERN_ERR "HTB: suspicious delay in wait_tree d=%ld cl=%X h=%d\n",delay,cl->classid,debug_hint);
-#endif
+
 	cl->pq_key = q->jiffies + PSCHED_US2JIFFIE(delay);
 	if (cl->pq_key == q->jiffies)
 		cl->pq_key++;
@@ -490,14 +380,11 @@ static void htb_next_rb_node(struct rb_n
 static inline void htb_add_class_to_row(struct htb_sched *q, 
 		struct htb_class *cl,int mask)
 {
-	HTB_DBG(7,2,"htb_addrow cl=%X mask=%X rmask=%X\n",
-			cl->classid,mask,q->row_mask[cl->level]);
-	HTB_CHCL(cl);
 	q->row_mask[cl->level] |= mask;
 	while (mask) {
 		int prio = ffz(~mask);
 		mask &= ~(1 << prio);
-		htb_add_to_id_tree(HTB_PASSQ q->row[cl->level]+prio,cl,prio);
+		htb_add_to_id_tree(q->row[cl->level]+prio,cl,prio);
 	}
 }
 
@@ -511,18 +398,16 @@ static __inline__ void htb_remove_class_
 		struct htb_class *cl,int mask)
 {
 	int m = 0;
-	HTB_CHCL(cl);
+
 	while (mask) {
 		int prio = ffz(~mask);
 		mask &= ~(1 << prio);
 		if (q->ptr[cl->level][prio] == cl->node+prio)
 			htb_next_rb_node(q->ptr[cl->level]+prio);
-		htb_safe_rb_erase(cl->node + prio,q->row[cl->level]+prio);
+		rb_erase(cl->node + prio,q->row[cl->level]+prio);
 		if (!q->row[cl->level][prio].rb_node) 
 			m |= 1 << prio;
 	}
-	HTB_DBG(7,2,"htb_delrow cl=%X mask=%X rmask=%X maskdel=%X\n",
-			cl->classid,mask,q->row_mask[cl->level],m);
 	q->row_mask[cl->level] &= ~m;
 }
 
@@ -537,11 +422,9 @@ static void htb_activate_prios(struct ht
 {
 	struct htb_class *p = cl->parent;
 	long m,mask = cl->prio_activity;
-	HTB_DBG(7,2,"htb_act_prios cl=%X mask=%lX cmode=%d\n",cl->classid,mask,cl->cmode);
-	HTB_CHCL(cl);
 
 	while (cl->cmode == HTB_MAY_BORROW && p && mask) {
-		HTB_CHCL(p);
+
 		m = mask; while (m) {
 			int prio = ffz(~m);
 			m &= ~(1 << prio);
@@ -551,13 +434,11 @@ static void htb_activate_prios(struct ht
 				   reset bit in mask as parent is already ok */
 				mask &= ~(1 << prio);
 			
-			htb_add_to_id_tree(HTB_PASSQ p->un.inner.feed+prio,cl,prio);
+			htb_add_to_id_tree(p->un.inner.feed+prio,cl,prio);
 		}
-		HTB_DBG(7,3,"htb_act_pr_aft p=%X pact=%X mask=%lX pmode=%d\n",
-				p->classid,p->prio_activity,mask,p->cmode);
 		p->prio_activity |= mask;
 		cl = p; p = cl->parent;
-		HTB_CHCL(cl);
+
 	}
 	if (cl->cmode == HTB_CAN_SEND && mask)
 		htb_add_class_to_row(q,cl,mask);
@@ -574,8 +455,7 @@ static void htb_deactivate_prios(struct 
 {
 	struct htb_class *p = cl->parent;
 	long m,mask = cl->prio_activity;
-	HTB_DBG(7,2,"htb_deact_prios cl=%X mask=%lX cmode=%d\n",cl->classid,mask,cl->cmode);
-	HTB_CHCL(cl);
+
 
 	while (cl->cmode == HTB_MAY_BORROW && p && mask) {
 		m = mask; mask = 0; 
@@ -591,16 +471,15 @@ static void htb_deactivate_prios(struct 
 				p->un.inner.ptr[prio] = NULL;
 			}
 			
-			htb_safe_rb_erase(cl->node + prio,p->un.inner.feed + prio);
+			rb_erase(cl->node + prio,p->un.inner.feed + prio);
 			
 			if (!p->un.inner.feed[prio].rb_node) 
 				mask |= 1 << prio;
 		}
-		HTB_DBG(7,3,"htb_deact_pr_aft p=%X pact=%X mask=%lX pmode=%d\n",
-				p->classid,p->prio_activity,mask,p->cmode);
+
 		p->prio_activity &= ~mask;
 		cl = p; p = cl->parent;
-		HTB_CHCL(cl);
+
 	}
 	if (cl->cmode == HTB_CAN_SEND && mask) 
 		htb_remove_class_from_row(q,cl,mask);
@@ -655,8 +534,6 @@ htb_change_class_mode(struct htb_sched *
 { 
 	enum htb_cmode new_mode = htb_class_mode(cl,diff);
 	
-	HTB_CHCL(cl);
-	HTB_DBG(7,1,"htb_chging_clmode %d->%d cl=%X\n",cl->cmode,new_mode,cl->classid);
 
 	if (new_mode == cl->cmode)
 		return;	
@@ -681,7 +558,7 @@ htb_change_class_mode(struct htb_sched *
 static __inline__ void htb_activate(struct htb_sched *q,struct htb_class *cl)
 {
 	BUG_TRAP(!cl->level && cl->un.leaf.q && cl->un.leaf.q->q.qlen);
-	HTB_CHCL(cl);
+
 	if (!cl->prio_activity) {
 		cl->prio_activity = 1 << (cl->un.leaf.aprio = cl->un.leaf.prio);
 		htb_activate_prios(q,cl);
@@ -699,7 +576,7 @@ static __inline__ void 
 htb_deactivate(struct htb_sched *q,struct htb_class *cl)
 {
 	BUG_TRAP(cl->prio_activity);
-	HTB_CHCL(cl);
+
 	htb_deactivate_prios(q,cl);
 	cl->prio_activity = 0;
 	list_del_init(&cl->un.leaf.drop_list);
@@ -739,7 +616,6 @@ #endif
 
     sch->q.qlen++;
     sch->bstats.packets++; sch->bstats.bytes += skb->len;
-    HTB_DBG(1,1,"htb_enq_ok cl=%X skb=%p\n",(cl && cl != HTB_DIRECT)?cl->classid:0,skb);
     return NET_XMIT_SUCCESS;
 }
 
@@ -771,7 +647,6 @@ static int htb_requeue(struct sk_buff *s
 
     sch->q.qlen++;
     sch->qstats.requeues++;
-    HTB_DBG(1,1,"htb_req_ok cl=%X skb=%p\n",(cl && cl != HTB_DIRECT)?cl->classid:0,skb);
     return NET_XMIT_SUCCESS;
 }
 
@@ -793,7 +668,6 @@ static void htb_rate_timer(unsigned long
 
 	/* lock queue so that we can muck with it */
 	HTB_QLOCK(sch);
-	HTB_DBG(10,1,"htb_rttmr j=%ld\n",jiffies);
 
 	q->rttim.expires = jiffies + HZ;
 	add_timer(&q->rttim);
@@ -803,8 +677,7 @@ static void htb_rate_timer(unsigned long
 		q->recmp_bucket = 0;
 	list_for_each (p,q->hash+q->recmp_bucket) {
 		struct htb_class *cl = list_entry(p,struct htb_class,hlist);
-		HTB_DBG(10,2,"htb_rttmr_cl cl=%X sbyte=%lu spkt=%lu\n",
-				cl->classid,cl->sum_bytes,cl->sum_packets);
+
 		RT_GEN (cl->sum_bytes,cl->rate_bytes);
 		RT_GEN (cl->sum_packets,cl->rate_packets);
 	}
@@ -828,7 +701,6 @@ static void htb_charge_class(struct htb_
 {	
 	long toks,diff;
 	enum htb_cmode old_mode;
-	HTB_DBG(5,1,"htb_chrg_cl cl=%X lev=%d len=%d\n",cl->classid,level,bytes);
 
 #define HTB_ACCNT(T,B,R) toks = diff + cl->T; \
 	if (toks > cl->B) toks = cl->B; \
@@ -837,24 +709,7 @@ #define HTB_ACCNT(T,B,R) toks = diff + c
 	cl->T = toks
 
 	while (cl) {
-		HTB_CHCL(cl);
 		diff = PSCHED_TDIFF_SAFE(q->now, cl->t_c, (u32)cl->mbuffer);
-#ifdef HTB_DEBUG
-		if (diff > cl->mbuffer || diff < 0 || PSCHED_TLESS(q->now, cl->t_c)) {
-			if (net_ratelimit())
-				printk(KERN_ERR "HTB: bad diff in charge, cl=%X diff=%lX now=%Lu then=%Lu j=%lu\n",
-				       cl->classid, diff,
-#ifdef CONFIG_NET_SCH_CLK_GETTIMEOFDAY
-				       q->now.tv_sec * 1000000ULL + q->now.tv_usec,
-				       cl->t_c.tv_sec * 1000000ULL + cl->t_c.tv_usec,
-#else
-				       (unsigned long long) q->now,
-				       (unsigned long long) cl->t_c,
-#endif
-				       q->jiffies);
-			diff = 1000;
-		}
-#endif
 		if (cl->level >= level) {
 			if (cl->level == level) cl->xstats.lends++;
 			HTB_ACCNT (tokens,buffer,rate);
@@ -864,15 +719,14 @@ #endif
 		}
 		HTB_ACCNT (ctokens,cbuffer,ceil);
 		cl->t_c = q->now;
-		HTB_DBG(5,2,"htb_chrg_clp cl=%X diff=%ld tok=%ld ctok=%ld\n",cl->classid,diff,cl->tokens,cl->ctokens);
 
 		old_mode = cl->cmode; diff = 0;
 		htb_change_class_mode(q,cl,&diff);
 		if (old_mode != cl->cmode) {
 			if (old_mode != HTB_CAN_SEND)
-				htb_safe_rb_erase(&cl->pq_node,q->wait_pq+cl->level);
+				rb_erase(&cl->pq_node,q->wait_pq+cl->level);
 			if (cl->cmode != HTB_CAN_SEND)
-				htb_add_to_wait_tree (q,cl,diff,1);
+				htb_add_to_wait_tree (q,cl,diff);
 		}
 		
 #ifdef HTB_RATECM
@@ -899,8 +753,7 @@ #endif
 static long htb_do_events(struct htb_sched *q,int level)
 {
 	int i;
-	HTB_DBG(8,1,"htb_do_events l=%d root=%p rmask=%X\n",
-			level,q->wait_pq[level].rb_node,q->row_mask[level]);
+
 	for (i = 0; i < 500; i++) {
 		struct htb_class *cl;
 		long diff;
@@ -910,30 +763,13 @@ static long htb_do_events(struct htb_sch
 
 		cl = rb_entry(p, struct htb_class, pq_node);
 		if (time_after(cl->pq_key, q->jiffies)) {
-			HTB_DBG(8,3,"htb_do_ev_ret delay=%ld\n",cl->pq_key - q->jiffies);
 			return cl->pq_key - q->jiffies;
 		}
-		htb_safe_rb_erase(p,q->wait_pq+level);
+		rb_erase(p,q->wait_pq+level);
 		diff = PSCHED_TDIFF_SAFE(q->now, cl->t_c, (u32)cl->mbuffer);
-#ifdef HTB_DEBUG
-		if (diff > cl->mbuffer || diff < 0 || PSCHED_TLESS(q->now, cl->t_c)) {
-			if (net_ratelimit())
-				printk(KERN_ERR "HTB: bad diff in events, cl=%X diff=%lX now=%Lu then=%Lu j=%lu\n",
-				       cl->classid, diff,
-#ifdef CONFIG_NET_SCH_CLK_GETTIMEOFDAY
-				       q->now.tv_sec * 1000000ULL + q->now.tv_usec,
-				       cl->t_c.tv_sec * 1000000ULL + cl->t_c.tv_usec,
-#else
-				       (unsigned long long) q->now,
-				       (unsigned long long) cl->t_c,
-#endif
-				       q->jiffies);
-			diff = 1000;
-		}
-#endif
 		htb_change_class_mode(q,cl,&diff);
 		if (cl->cmode != HTB_CAN_SEND)
-			htb_add_to_wait_tree (q,cl,diff,2);
+			htb_add_to_wait_tree (q,cl,diff);
 	}
 	if (net_ratelimit())
 		printk(KERN_WARNING "htb: too many events !\n");
@@ -966,7 +802,7 @@ htb_id_find_next_upper(int prio,struct r
  * Find leaf where current feed pointers points to.
  */
 static struct htb_class *
-htb_lookup_leaf(HTB_ARGQ struct rb_root *tree,int prio,struct rb_node **pptr,u32 *pid)
+htb_lookup_leaf(struct rb_root *tree,int prio,struct rb_node **pptr,u32 *pid)
 {
 	int i;
 	struct {
@@ -981,8 +817,6 @@ htb_lookup_leaf(HTB_ARGQ struct rb_root 
 	sp->pid = pid;
 
 	for (i = 0; i < 65535; i++) {
-		HTB_DBG(4,2,"htb_lleaf ptr=%p pid=%X\n",*sp->pptr,*sp->pid);
-		
 		if (!*sp->pptr && *sp->pid) { 
 			/* ptr was invalidated but id is valid - try to recover 
 			   the original or next ptr */
@@ -1002,7 +836,6 @@ htb_lookup_leaf(HTB_ARGQ struct rb_root 
 		} else {
 			struct htb_class *cl;
 			cl = rb_entry(*sp->pptr,struct htb_class,node[prio]);
-			HTB_CHCL(cl);
 			if (!cl->level) 
 				return cl;
 			(++sp)->root = cl->un.inner.feed[prio].rb_node;
@@ -1022,15 +855,13 @@ htb_dequeue_tree(struct htb_sched *q,int
 	struct sk_buff *skb = NULL;
 	struct htb_class *cl,*start;
 	/* look initial class up in the row */
-	start = cl = htb_lookup_leaf (HTB_PASSQ q->row[level]+prio,prio,
+	start = cl = htb_lookup_leaf (q->row[level]+prio,prio,
 			q->ptr[level]+prio,q->last_ptr_id[level]+prio);
 	
 	do {
 next:
 		BUG_TRAP(cl); 
 		if (!cl) return NULL;
-		HTB_DBG(4,1,"htb_deq_tr prio=%d lev=%d cl=%X defic=%d\n",
-				prio,level,cl->classid,cl->un.leaf.deficit[level]);
 
 		/* class can be empty - it is unlikely but can be true if leaf
 		   qdisc drops packets in enqueue routine or if someone used
@@ -1044,7 +875,7 @@ next:
 			if ((q->row_mask[level] & (1 << prio)) == 0)
 				return NULL; 
 			
-			next = htb_lookup_leaf (HTB_PASSQ q->row[level]+prio,
+			next = htb_lookup_leaf (q->row[level]+prio,
 					prio,q->ptr[level]+prio,q->last_ptr_id[level]+prio);
 
 			if (cl == start) /* fix start if we just deleted it */
@@ -1061,15 +892,13 @@ next:
 		}
 		q->nwc_hit++;
 		htb_next_rb_node((level?cl->parent->un.inner.ptr:q->ptr[0])+prio);
-		cl = htb_lookup_leaf (HTB_PASSQ q->row[level]+prio,prio,q->ptr[level]+prio,
+		cl = htb_lookup_leaf (q->row[level]+prio,prio,q->ptr[level]+prio,
 				q->last_ptr_id[level]+prio);
 
 	} while (cl != start);
 
 	if (likely(skb != NULL)) {
 		if ((cl->un.leaf.deficit[level] -= skb->len) < 0) {
-			HTB_DBG(4,2,"htb_next_cl oldptr=%p quant_add=%d\n",
-				level?cl->parent->un.inner.ptr[prio]:q->ptr[0][prio],cl->un.leaf.quantum);
 			cl->un.leaf.deficit[level] += cl->un.leaf.quantum;
 			htb_next_rb_node((level?cl->parent->un.inner.ptr:q->ptr[0])+prio);
 		}
@@ -1095,7 +924,6 @@ static void htb_delay_by(struct Qdisc *s
 	mod_timer(&q->timer, q->jiffies + delay);
 	sch->flags |= TCQ_F_THROTTLED;
 	sch->qstats.overlimits++;
-	HTB_DBG(3,1,"htb_deq t_delay=%ld\n",delay);
 }
 
 static struct sk_buff *htb_dequeue(struct Qdisc *sch)
@@ -1104,13 +932,8 @@ static struct sk_buff *htb_dequeue(struc
 	struct htb_sched *q = qdisc_priv(sch);
 	int level;
 	long min_delay;
-#ifdef HTB_DEBUG
-	int evs_used = 0;
-#endif
 
 	q->jiffies = jiffies;
-	HTB_DBG(3,1,"htb_deq dircnt=%d qlen=%d\n",skb_queue_len(&q->direct_queue),
-			sch->q.qlen);
 
 	/* try to dequeue direct packets as high prio (!) to minimize cpu work */
 	if ((skb = __skb_dequeue(&q->direct_queue)) != NULL) {
@@ -1131,9 +954,6 @@ #endif
 		if (time_after_eq(q->jiffies, q->near_ev_cache[level])) {
 			delay = htb_do_events(q,level);
 			q->near_ev_cache[level] = q->jiffies + (delay ? delay : HZ);
-#ifdef HTB_DEBUG
-			evs_used++;
-#endif
 		} else
 			delay = q->near_ev_cache[level] - q->jiffies;	
 		
@@ -1151,20 +971,8 @@ #endif
 			}
 		}
 	}
-#ifdef HTB_DEBUG
-	if (!q->nwc_hit && min_delay >= 10*HZ && net_ratelimit()) {
-		if (min_delay == LONG_MAX) {
-			printk(KERN_ERR "HTB: dequeue bug (%d,%lu,%lu), report it please !\n",
-					evs_used,q->jiffies,jiffies);
-			htb_debug_dump(q);
-		} else 
-			printk(KERN_WARNING "HTB: mindelay=%ld, some class has "
-					"too small rate\n",min_delay);
-	}
-#endif
 	htb_delay_by (sch,min_delay > 5*HZ ? 5*HZ : min_delay);
 fin:
-	HTB_DBG(3,1,"htb_deq_end %s j=%lu skb=%p\n",sch->dev->name,q->jiffies,skb);
 	return skb;
 }
 
@@ -1198,7 +1006,6 @@ static void htb_reset(struct Qdisc* sch)
 {
 	struct htb_sched *q = qdisc_priv(sch);
 	int i;
-	HTB_DBG(0,1,"htb_reset sch=%p, handle=%X\n",sch,sch->handle);
 
 	for (i = 0; i < HTB_HSIZE; i++) {
 		struct list_head *p;
@@ -1213,10 +1020,6 @@ static void htb_reset(struct Qdisc* sch)
 			}
 			cl->prio_activity = 0;
 			cl->cmode = HTB_CAN_SEND;
-#ifdef HTB_DEBUG
-			cl->pq_node.rb_color = -1;
-			memset(cl->node,255,sizeof(cl->node));
-#endif
 
 		}
 	}
@@ -1238,10 +1041,6 @@ static int htb_init(struct Qdisc *sch, s
 	struct rtattr *tb[TCA_HTB_INIT];
 	struct tc_htb_glob *gopt;
 	int i;
-#ifdef HTB_DEBUG
-	printk(KERN_INFO "HTB init, kernel part version %d.%d\n",
-			  HTB_VER >> 16,HTB_VER & 0xffff);
-#endif
 	if (!opt || rtattr_parse_nested(tb, TCA_HTB_INIT, opt) ||
 			tb[TCA_HTB_INIT-1] == NULL ||
 			RTA_PAYLOAD(tb[TCA_HTB_INIT-1]) < sizeof(*gopt)) {
@@ -1254,8 +1053,6 @@ #endif
 				HTB_VER >> 16,HTB_VER & 0xffff,gopt->version);
 		return -EINVAL;
 	}
-	q->debug = gopt->debug;
-	HTB_DBG(0,1,"htb_init sch=%p handle=%X r2q=%d\n",sch,sch->handle,gopt->rate2quantum);
 
 	INIT_LIST_HEAD(&q->root);
 	for (i = 0; i < HTB_HSIZE; i++)
@@ -1292,18 +1089,13 @@ static int htb_dump(struct Qdisc *sch, s
 	unsigned char	 *b = skb->tail;
 	struct rtattr *rta;
 	struct tc_htb_glob gopt;
-	HTB_DBG(0,1,"htb_dump sch=%p, handle=%X\n",sch,sch->handle);
 	HTB_QLOCK(sch);
 	gopt.direct_pkts = q->direct_pkts;
 
-#ifdef HTB_DEBUG
-	if (HTB_DBG_COND(0,2))
-		htb_debug_dump(q);
-#endif
 	gopt.version = HTB_VER;
 	gopt.rate2quantum = q->rate2quantum;
 	gopt.defcls = q->defcls;
-	gopt.debug = q->debug;
+	gopt.debug = 0;
 	rta = (struct rtattr*)b;
 	RTA_PUT(skb, TCA_OPTIONS, 0, NULL);
 	RTA_PUT(skb, TCA_HTB_INIT, sizeof(gopt), &gopt);
@@ -1319,16 +1111,11 @@ rtattr_failure:
 static int htb_dump_class(struct Qdisc *sch, unsigned long arg,
 	struct sk_buff *skb, struct tcmsg *tcm)
 {
-#ifdef HTB_DEBUG
-	struct htb_sched *q = qdisc_priv(sch);
-#endif
 	struct htb_class *cl = (struct htb_class*)arg;
 	unsigned char	 *b = skb->tail;
 	struct rtattr *rta;
 	struct tc_htb_opt opt;
 
-	HTB_DBG(0,1,"htb_dump_class handle=%X clid=%X\n",sch->handle,cl->classid);
-
 	HTB_QLOCK(sch);
 	tcm->tcm_parent = cl->parent ? cl->parent->classid : TC_H_ROOT;
 	tcm->tcm_handle = cl->classid;
@@ -1410,11 +1197,7 @@ static struct Qdisc * htb_leaf(struct Qd
 
 static unsigned long htb_get(struct Qdisc *sch, u32 classid)
 {
-#ifdef HTB_DEBUG
-	struct htb_sched *q = qdisc_priv(sch);
-#endif
 	struct htb_class *cl = htb_find(classid,sch);
-	HTB_DBG(0,1,"htb_get clid=%X q=%p cl=%p ref=%d\n",classid,q,cl,cl?cl->refcnt:0);
 	if (cl) 
 		cl->refcnt++;
 	return (unsigned long)cl;
@@ -1433,7 +1216,6 @@ static void htb_destroy_filters(struct t
 static void htb_destroy_class(struct Qdisc* sch,struct htb_class *cl)
 {
 	struct htb_sched *q = qdisc_priv(sch);
-	HTB_DBG(0,1,"htb_destrycls clid=%X ref=%d\n", cl?cl->classid:0,cl?cl->refcnt:0);
 	if (!cl->level) {
 		BUG_TRAP(cl->un.leaf.q);
 		sch->q.qlen -= cl->un.leaf.q->q.qlen;
@@ -1456,7 +1238,7 @@ static void htb_destroy_class(struct Qdi
 		htb_deactivate (q,cl);
 	
 	if (cl->cmode != HTB_CAN_SEND)
-		htb_safe_rb_erase(&cl->pq_node,q->wait_pq+cl->level);
+		rb_erase(&cl->pq_node,q->wait_pq+cl->level);
 	
 	kfree(cl);
 }
@@ -1465,7 +1247,6 @@ static void htb_destroy_class(struct Qdi
 static void htb_destroy(struct Qdisc* sch)
 {
 	struct htb_sched *q = qdisc_priv(sch);
-	HTB_DBG(0,1,"htb_destroy q=%p\n",q);
 
 	del_timer_sync (&q->timer);
 #ifdef HTB_RATECM
@@ -1488,7 +1269,6 @@ static int htb_delete(struct Qdisc *sch,
 {
 	struct htb_sched *q = qdisc_priv(sch);
 	struct htb_class *cl = (struct htb_class*)arg;
-	HTB_DBG(0,1,"htb_delete q=%p cl=%X ref=%d\n",q,cl?cl->classid:0,cl?cl->refcnt:0);
 
 	// TODO: why don't allow to delete subtree ? references ? does
 	// tc subsys quarantee us that in htb_destroy it holds no class
@@ -1512,11 +1292,7 @@ static int htb_delete(struct Qdisc *sch,
 
 static void htb_put(struct Qdisc *sch, unsigned long arg)
 {
-#ifdef HTB_DEBUG
-	struct htb_sched *q = qdisc_priv(sch);
-#endif
 	struct htb_class *cl = (struct htb_class*)arg;
-	HTB_DBG(0,1,"htb_put q=%p cl=%X ref=%d\n",q,cl?cl->classid:0,cl?cl->refcnt:0);
 
 	if (--cl->refcnt == 0)
 		htb_destroy_class(sch,cl);
@@ -1542,7 +1318,7 @@ static int htb_change_class(struct Qdisc
 	parent = parentid == TC_H_ROOT ? NULL : htb_find (parentid,sch);
 
 	hopt = RTA_DATA(tb[TCA_HTB_PARMS-1]);
-	HTB_DBG(0,1,"htb_chg cl=%p(%X), clid=%X, parid=%X, opt/prio=%d, rate=%u, buff=%d, quant=%d\n", cl,cl?cl->classid:0,classid,parentid,(int)hopt->prio,hopt->rate.rate,hopt->buffer,hopt->quantum);
+
 	rtab = qdisc_get_rtab(&hopt->rate, tb[TCA_HTB_RTAB-1]);
 	ctab = qdisc_get_rtab(&hopt->ceil, tb[TCA_HTB_CTAB-1]);
 	if (!rtab || !ctab) goto failure;
@@ -1567,9 +1343,6 @@ static int htb_change_class(struct Qdisc
 		INIT_LIST_HEAD(&cl->hlist);
 		INIT_LIST_HEAD(&cl->children);
 		INIT_LIST_HEAD(&cl->un.leaf.drop_list);
-#ifdef HTB_DEBUG
-		cl->magic = HTB_CMAGIC;
-#endif
 
 		/* create leaf qdisc early because it uses kmalloc(GFP_KERNEL)
 		   so that can't be used inside of sch_tree_lock
@@ -1585,7 +1358,7 @@ #endif
 
 			/* remove from evt list because of level change */
 			if (parent->cmode != HTB_CAN_SEND) {
-				htb_safe_rb_erase(&parent->pq_node,q->wait_pq /*+0*/);
+				rb_erase(&parent->pq_node,q->wait_pq);
 				parent->cmode = HTB_CAN_SEND;
 			}
 			parent->level = (parent->parent ? parent->parent->level
@@ -1607,13 +1380,6 @@ #endif
 		/* attach to the hash list and parent's family */
 		list_add_tail(&cl->hlist, q->hash+htb_hash(classid));
 		list_add_tail(&cl->sibling, parent ? &parent->children : &q->root);
-#ifdef HTB_DEBUG
-		{ 
-			int i;
-			for (i = 0; i < TC_HTB_NUMPRIO; i++) cl->node[i].rb_color = -1;
-			cl->pq_node.rb_color = -1;
-		}
-#endif
 	} else sch_tree_lock(sch);
 
 	/* it used to be a nasty bug here, we have to check that node
@@ -1654,7 +1420,7 @@ static struct tcf_proto **htb_find_tcf(s
 	struct htb_sched *q = qdisc_priv(sch);
 	struct htb_class *cl = (struct htb_class *)arg;
 	struct tcf_proto **fl = cl ? &cl->filter_list : &q->filter_list;
-	HTB_DBG(0,2,"htb_tcf q=%p clid=%X fref=%d fl=%p\n",q,cl?cl->classid:0,cl?cl->filter_cnt:q->filter_cnt,*fl);
+
 	return fl;
 }
 
@@ -1663,7 +1429,7 @@ static unsigned long htb_bind_filter(str
 {
 	struct htb_sched *q = qdisc_priv(sch);
 	struct htb_class *cl = htb_find (classid,sch);
-	HTB_DBG(0,2,"htb_bind q=%p clid=%X cl=%p fref=%d\n",q,classid,cl,cl?cl->filter_cnt:q->filter_cnt);
+
 	/*if (cl && !cl->level) return 0;
 	  The line above used to be there to prevent attaching filters to 
 	  leaves. But at least tc_index filter uses this just to get class 
@@ -1684,7 +1450,7 @@ static void htb_unbind_filter(struct Qdi
 {
 	struct htb_sched *q = qdisc_priv(sch);
 	struct htb_class *cl = (struct htb_class *)arg;
-	HTB_DBG(0,2,"htb_unbind q=%p cl=%p fref=%d\n",q,cl,cl?cl->filter_cnt:q->filter_cnt);
+
 	if (cl) 
 		cl->filter_cnt--; 
 	else 
-- 
1.4.0

From shemminger at osdl.org  Thu Aug  3 00:12:57 2006
From: shemminger at osdl.org (Stephen Hemminger)
Date: Thu Aug  3 00:13:47 2006
Subject: [LARTC] [PATCH 6/6] htb: rbtree cleanup
In-Reply-To: <20060802125636.3028ba91@dxpl.pdx.osdl.net>
References: <20060802125636.3028ba91@dxpl.pdx.osdl.net>
Message-ID: <20060802151257.21af2d0b@dxpl.pdx.osdl.net>

Add code to initialize rb tree nodes, and check for double deletion.
This is not a real fix, but I can make it trap sometimes and may
be a bandaid for: http://bugzilla.kernel.org/show_bug.cgi?id=6681

Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
---
 net/sched/sch_htb.c |   34 +++++++++++++++++++++++++++-------
 1 files changed, 27 insertions(+), 7 deletions(-)

diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 7853c6f..3f3e9df 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -366,7 +366,7 @@ static void htb_add_to_wait_tree(struct 
  * When we are past last key we return NULL.
  * Average complexity is 2 steps per call.
  */
-static void htb_next_rb_node(struct rb_node **n)
+static inline void htb_next_rb_node(struct rb_node **n)
 {
 	*n = rb_next(*n);
 }
@@ -388,6 +388,18 @@ static inline void htb_add_class_to_row(
 	}
 }
 
+/* If this triggers, it is a bug in this code, but it need not be fatal */
+static void htb_safe_rb_erase(struct rb_node *rb, struct rb_root *root)
+{
+	if (RB_EMPTY_NODE(rb)) {
+		WARN_ON(1);
+	} else {
+		rb_erase(rb, root);
+		RB_CLEAR_NODE(rb);
+	}
+}
+
+
 /**
  * htb_remove_class_from_row - removes class from its row
  *
@@ -401,10 +413,12 @@ static inline void htb_remove_class_from
 
 	while (mask) {
 		int prio = ffz(~mask);
+
 		mask &= ~(1 << prio);
 		if (q->ptr[cl->level][prio] == cl->node + prio)
 			htb_next_rb_node(q->ptr[cl->level] + prio);
-		rb_erase(cl->node + prio, q->row[cl->level] + prio);
+
+		htb_safe_rb_erase(cl->node + prio, q->row[cl->level] + prio);
 		if (!q->row[cl->level][prio].rb_node)
 			m |= 1 << prio;
 	}
@@ -472,7 +486,7 @@ static void htb_deactivate_prios(struct 
 				p->un.inner.ptr[prio] = NULL;
 			}
 
-			rb_erase(cl->node + prio, p->un.inner.feed + prio);
+			htb_safe_rb_erase(cl->node + prio, p->un.inner.feed + prio);
 
 			if (!p->un.inner.feed[prio].rb_node)
 				mask |= 1 << prio;
@@ -739,7 +753,7 @@ #define HTB_ACCNT(T,B,R) toks = diff + c
 		htb_change_class_mode(q, cl, &diff);
 		if (old_mode != cl->cmode) {
 			if (old_mode != HTB_CAN_SEND)
-				rb_erase(&cl->pq_node, q->wait_pq + cl->level);
+				htb_safe_rb_erase(&cl->pq_node, q->wait_pq + cl->level);
 			if (cl->cmode != HTB_CAN_SEND)
 				htb_add_to_wait_tree(q, cl, diff);
 		}
@@ -782,7 +796,7 @@ static long htb_do_events(struct htb_sch
 		if (time_after(cl->pq_key, q->jiffies)) {
 			return cl->pq_key - q->jiffies;
 		}
-		rb_erase(p, q->wait_pq + level);
+		htb_safe_rb_erase(p, q->wait_pq + level);
 		diff = PSCHED_TDIFF_SAFE(q->now, cl->t_c, (u32) cl->mbuffer);
 		htb_change_class_mode(q, cl, &diff);
 		if (cl->cmode != HTB_CAN_SEND)
@@ -1279,7 +1293,7 @@ static void htb_destroy_class(struct Qdi
 		htb_deactivate(q, cl);
 
 	if (cl->cmode != HTB_CAN_SEND)
-		rb_erase(&cl->pq_node, q->wait_pq + cl->level);
+		htb_safe_rb_erase(&cl->pq_node, q->wait_pq + cl->level);
 
 	kfree(cl);
 }
@@ -1370,6 +1384,8 @@ static int htb_change_class(struct Qdisc
 
 	if (!cl) {		/* new class */
 		struct Qdisc *new_q;
+		int prio;
+
 		/* check for valid classid */
 		if (!classid || TC_H_MAJ(classid ^ sch->handle)
 		    || htb_find(classid, sch))
@@ -1389,6 +1405,10 @@ static int htb_change_class(struct Qdisc
 		INIT_HLIST_NODE(&cl->hlist);
 		INIT_LIST_HEAD(&cl->children);
 		INIT_LIST_HEAD(&cl->un.leaf.drop_list);
+		RB_CLEAR_NODE(&cl->pq_node);
+
+		for (prio = 0; prio < TC_HTB_NUMPRIO; prio++)
+			RB_CLEAR_NODE(&cl->node[prio]);
 
 		/* create leaf qdisc early because it uses kmalloc(GFP_KERNEL)
 		   so that can't be used inside of sch_tree_lock
@@ -1404,7 +1424,7 @@ static int htb_change_class(struct Qdisc
 
 			/* remove from evt list because of level change */
 			if (parent->cmode != HTB_CAN_SEND) {
-				rb_erase(&parent->pq_node, q->wait_pq);
+				htb_safe_rb_erase(&parent->pq_node, q->wait_pq);
 				parent->cmode = HTB_CAN_SEND;
 			}
 			parent->level = (parent->parent ? parent->parent->level
-- 
1.4.0

From t.luettgert at pressestimmen.de  Thu Aug  3 01:47:34 2006
From: t.luettgert at pressestimmen.de (Torsten Luettgert)
Date: Thu Aug  3 01:46:51 2006
Subject: [LARTC] iptables u32 kernel 2.6.17
In-Reply-To: <20060802213029.GA29316@packetconsulting.pl>
References: <20060802085541.33422.qmail@web26504.mail.ukl.yahoo.com>
	<1154526759.2369.12.camel@murdegern.cbxnet.de>
	<20060802213029.GA29316@packetconsulting.pl>
Message-ID: <1154562454.2391.3.camel@murdegern.cbxnet.de>

On Wed, 2006-08-02 at 23:30 +0200, Piotr Chytla wrote:

> apply also patch from attachment. 2.6.17 needs matchsize in ipt_match struct.

Whoopsie. I missed that in the patch I sent to netfilter-devel a while
ago.
Thanks for doing it yourself.

Regards,
Torsten

From vitula at kme.cz  Thu Aug  3 08:17:33 2006
From: vitula at kme.cz (=?iso-8859-2?Q?Ing._V=EDt=ECzslav_Vitula?=)
Date: Thu Aug  3 08:20:29 2006
Subject: [LARTC] Maximum count of qdiscs
Message-ID: <000301c6b6c4$822f48e0$0300a8c0@KME.local>

Hi,

 

Fedora 4, 2.6.15.6

 

What is the maximum count of qdiscs attached to one dev ?

 

It seems, that only 2048 qdiscs can be attached. Is this correct ?

 

If I try to attache more qdiscs, it complains that file already exists and
error talking to kernel.

 

How to increase this count ?

 

Thank You

 

vitula

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060803/ac0afab6/attachment.html
From aleksandr at mikrovisata.net  Thu Aug  3 09:43:55 2006
From: aleksandr at mikrovisata.net (Aleksandr)
Date: Thu Aug  3 09:43:41 2006
Subject: [LARTC] Maximum count of qdiscs
In-Reply-To: <000301c6b6c4$822f48e0$0300a8c0@KME.local>
References: <000301c6b6c4$822f48e0$0300a8c0@KME.local>
Message-ID: <44D1A93B.2040703@mikrovisata.net>

Ing. V?t?zslav Vitula wrote:
> Hi,
> Fedora 4, 2.6.15.6
> What is the maximum count of qdiscs attached to one dev ?
> It seems, that only 2048 qdiscs can be attached. Is this correct ?
> If I try to attache more qdiscs, it complains that file already exists 
> and error talking to kernel.

I have attached 16128 htb classes with sfq qdiscs and currently have no 
problems.


-- 
Pagarbiai,
Aleksandr Perepliot?ikov
UAB "Mikrovisatos TV", IT Departamentas

From doudouyam at gmail.com  Thu Aug  3 18:06:35 2006
From: doudouyam at gmail.com (doudouyam)
Date: Thu Aug  3 18:06:22 2006
Subject: [LARTC] tc filter
Message-ID: <81c11a560608030906t525d6232vf135053463ce6a8f@mail.gmail.com>

Hi,
Is it possible to make a filter with tc which exclude an IP like iptables ??

ex:
iptable -t mangle -A PREROUTING -i eth0 -d ! 192.168.1.222 -j MARK ...

I try the ! with tc but it doesn't work.
Thanks,
doude.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060803/dee061c8/attachment.htm
From mrd at alkemio.org  Thu Aug  3 21:57:00 2006
From: mrd at alkemio.org (Matthew R. Dempsky)
Date: Thu Aug  3 21:56:48 2006
Subject: [LARTC] Ethernet equipment testing with two NICs
Message-ID: <20060803195700.GA2994@odin.dempsky.org>

I have a Linux 2.6.16 machine with two gigabit ethernet adapters that I 
would like to use for testing Ethernet equipment---right now just an 
Ethernet cable, but later switches, bridges, etc.

I tried assigning the two adapters IPs of 192.168.50.1 and 192.168.51.1 
and then setup the routing table to direct 192.168.51.0/24 traffic to 
the first adapter, and 192.168.50.0/24 traffic to the second, but when I 
run ``ping -I 192.168.50.1 192.168.51.1'' the packets are routed over lo 
instead of eth0/eth1.

Can someone suggest an alternative setup that will work?

Thanks.
From michael.auckland at gmail.com  Fri Aug  4 04:36:18 2006
From: michael.auckland at gmail.com (Michael)
Date: Fri Aug  4 04:36:06 2006
Subject: [LARTC] route mail through different gateway
Message-ID: <35207fdf0608031936y2fe970d6pb855fc2f7557d5de@mail.gmail.com>

Hi All,

I've got server with one LAN card eth0 ip=10.0.0.5

default access t ointernety done through ADSL router gw 10.0.0.1
we got second internet access through another ADSL router gw 10.0.0.2

I want to send all e-mail out through gw 10.0.0.2
How it can be done?
I've tried to mark packets:
iptables -t mangle -A OUTPUT -p tcp --dport 25 -j MARK --set-mark 0x1
and
ip ru add fwmark 0x1 table mail.out
ip ro add default via 10.0.0.2 lookup mail.out

But it is dosen't work
Any help?

-- 
--
Michael
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060804/063e5e9c/attachment.html
From abel.martin.ruiz at gmail.com  Fri Aug  4 12:09:26 2006
From: abel.martin.ruiz at gmail.com (=?ISO-8859-1?Q?Abel_Mart=EDn?=)
Date: Fri Aug  4 12:09:11 2006
Subject: [LARTC] IFB support in 2.6.17 kernel
Message-ID: <915136920608040309r5c7b0e6auf8990d1fddcaedc2@mail.gmail.com>

Hi,

I'm trying to activate IFB device support in a 2.6.17 kernel from Debian
Sid. I read that IFB device is the replacement for IMQ device, but I haven't
found any useful documentantion on how to activate this feature and the
kernel documentation lacks of this information. I remember that IMQ could be
activated in the 'Network devices' menu in 2.6.8 kernels, but this option no
longer exists. Where can I find some information about this? I found a
ifb.cfile in the kernel source directory tree, but I'm not sure if an
ifb module
will be generated, as this option doesn't seem to be available during the
kernel configuration.

Thanks.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060804/dc26fc15/attachment.htm
From lists at andyfurniss.entadsl.com  Fri Aug  4 12:49:32 2006
From: lists at andyfurniss.entadsl.com (Andy Furniss)
Date: Fri Aug  4 12:49:22 2006
Subject: [LARTC] IFB support in 2.6.17 kernel
In-Reply-To: <915136920608040309r5c7b0e6auf8990d1fddcaedc2@mail.gmail.com>
References: <915136920608040309r5c7b0e6auf8990d1fddcaedc2@mail.gmail.com>
Message-ID: <44D3263C.6060608@andyfurniss.entadsl.com>

Abel Mart?n wrote:
> Hi,
> 
> I'm trying to activate IFB device support in a 2.6.17 kernel from Debian
> Sid. I read that IFB device is the replacement for IMQ device, but I 
> haven't
> found any useful documentantion on how to activate this feature and the
> kernel documentation lacks of this information. I remember that IMQ 
> could be
> activated in the 'Network devices' menu in 2.6.8 kernels, but this 
> option no
> longer exists. Where can I find some information about this? I found a
> ifb.cfile in the kernel source directory tree, but I'm not sure if an
> ifb module
> will be generated, as this option doesn't seem to be available during the
> kernel configuration.
> 
> Thanks.

ifb = intermediate functional block in device drivers --> network device 
support

depends on NET and NET_CLS_ACT (actions under qos and fair queuing)


Andy

From abel.martin.ruiz at gmail.com  Fri Aug  4 13:56:47 2006
From: abel.martin.ruiz at gmail.com (=?ISO-8859-1?Q?Abel_Mart=EDn?=)
Date: Fri Aug  4 13:56:36 2006
Subject: [LARTC] IFB support in 2.6.17 kernel
In-Reply-To: <44D3263C.6060608@andyfurniss.entadsl.com>
References: <915136920608040309r5c7b0e6auf8990d1fddcaedc2@mail.gmail.com>
	<44D3263C.6060608@andyfurniss.entadsl.com>
Message-ID: <915136920608040456w66b39340hd233fa57bf433f95@mail.gmail.com>

Hi Andy and Vadim!

Thanks for your help. I already read
http://linux-net.osdl.org/index.php/IFB, but is not enough for me. To be
honest, I realized the problem is I must read the man pages for tc,
considering traffic shaping is not a piece of cake. Copy & paste examples
from the web won't help much doing traffic shaping.

Sorry for the inconvenience.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060804/e6c83ae5/attachment.html
From don at bowenvale.co.nz  Sat Aug  5 11:57:27 2006
From: don at bowenvale.co.nz (Don Gould)
Date: Sat Aug  5 11:57:39 2006
Subject: [LARTC] How to become your IP range...
Message-ID: <44D46B87.4010003@bowenvale.co.nz>

I have laptops visiting my network.

If they're configured for DHCP then I have no problem.

However if they're got static IPs set then I want my server to set it 
self up automatically to provide internet access.

Eg.

Laptop Ip: 192.168.6.234 - just because the owners admin decided to.
Laptop default GW:  192.168.6.37 - also very random, but allowable...

My servers lan side is eth1, on detecting a packets running around with 
the ip range above, it will then assign a new ip range to it self so 
that the laptop will function.

Has anyone heard of an OSS system that will do this?

Cheers Don

-- 
Don Gould
www.thinkdesignprint.co.nz - www.tcn.bowenvale.co.nz - 
www.bowenvale.co.nz - www.hearingbooks.co.nz - SkypeMe:  ThinkDesignPrint

From rmo at sunnmore.net  Sat Aug  5 17:05:41 2006
From: rmo at sunnmore.net (Roy-Magne Mo)
Date: Sat Aug  5 17:05:28 2006
Subject: [LARTC] How to become your IP range...
In-Reply-To: <44D46B87.4010003@bowenvale.co.nz>
References: <44D46B87.4010003@bowenvale.co.nz>
Message-ID: <44D4B3C5.80601@sunnmore.net>

Don Gould wrote:
> I have laptops visiting my network.
> 
> If they're configured for DHCP then I have no problem.
> 
> However if they're got static IPs set then I want my server to set it
> self up automatically to provide internet access.
> 
> Eg.
> 
> Laptop Ip: 192.168.6.234 - just because the owners admin decided to.
> Laptop default GW:  192.168.6.37 - also very random, but allowable...
> 
> My servers lan side is eth1, on detecting a packets running around with
> the ip range above, it will then assign a new ip range to it self so
> that the laptop will function.
> 
> Has anyone heard of an OSS system that will do this?

You are possibly looking for the proxy ARP feature, look into that.

-- 
Roy-Magne Mo

From oscar at ufomechanic.net  Mon Aug  7 14:01:09 2006
From: oscar at ufomechanic.net (Oscar Mechanic)
Date: Sun Aug 13 11:41:59 2006
Subject: [LARTC] route mail through different gateway
In-Reply-To: <35207fdf0608031936y2fe970d6pb855fc2f7557d5de@mail.gmail.com>
References: <35207fdf0608031936y2fe970d6pb855fc2f7557d5de@mail.gmail.com>
Message-ID: <1154952069.4237.81.camel@OSCARLAPLIN>

Silly mistake I always make is too forget to put in NAT on GW.
But what you have done should work. Have you confirmed that this works

on 10.0.0.5
ip route del default
ip route add default via 10.0.0.2
ip route flush cache

If that works maybe try
# Dont know which one of these I think your right it should be output
iptables -t mangle -A PREROUTING -p tcp --dport 25 -j MARK --set-mark
0x1 
iptables -t mangle -A OUTPUT -p tcp --dport 25 -j MARK --set-mark 0x1 
ip rule add from 10.0.0.0/8 fwmark 1 lookup 200
ip route add default via 10.0.0.2 table 200

# The I would try tcpdump -vv -ni eth? and look at the MACs
# or  and check the mark
iptables -I POSTROUTING -p tcp --dport 25 -j LOG

On Fri, 2006-08-04 at 14:36 +1200, Michael wrote:
> Hi All,
> 
> I've got server with one LAN card eth0 ip=10.0.0.5
> 
> default access t ointernety done through ADSL router gw 10.0.0.1
> we got second internet access through another ADSL router gw 10.0.0.2
> 
> I want to send all e-mail out through gw 10.0.0.2
> How it can be done?
> I've tried to mark packets:
> iptables -t mangle -A OUTPUT -p tcp --dport 25 -j MARK --set-mark 0x1 
> and 
> ip ru add fwmark 0x1 table mail.out
> ip ro add default via 10.0.0.2 lookup mail.out
> 
> But it is dosen't work
> Any help?
> 
> -- 
> --
> Michael 
> _______________________________________________
> LARTC mailing list
> LARTC@mailman.ds9a.nlhttp://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

From lists at andyfurniss.entadsl.com  Mon Aug  7 17:06:01 2006
From: lists at andyfurniss.entadsl.com (Andy Furniss)
Date: Sun Aug 13 11:42:07 2006
Subject: [LARTC] tc filter
In-Reply-To: <81c11a560608030906t525d6232vf135053463ce6a8f@mail.gmail.com>
References: <81c11a560608030906t525d6232vf135053463ce6a8f@mail.gmail.com>
Message-ID: <44D756D9.8070603@andyfurniss.entadsl.com>

doudouyam wrote:
> Hi,
> Is it possible to make a filter with tc which exclude an IP like 
> iptables ??
> 
> ex:
> iptable -t mangle -A PREROUTING -i eth0 -d ! 192.168.1.222 -j MARK ...
> 
> I try the ! with tc but it doesn't work.
> Thanks,
> doude.

Not directly, but you can just match the address then follow it with a 
filter that matches everything else.

Andy.
From justin at expertron.co.za  Tue Aug  8 14:07:37 2006
From: justin at expertron.co.za (Justin Schoeman)
Date: Sun Aug 13 11:43:45 2006
Subject: [LARTC] netfilter patch-o-matic: where did all the patches go?
Message-ID: <44D87E89.10706@expertron.co.za>

Hi all,

I haven't been paying attention to this for a while, but now that I 
download the latest patch-o-matic-ng, I see that most of the patches are 
gone...

Anybody have an idea where I can download the 'extras' repository? 
Specifically geoip.

Thanks!

-justin
From samueldg at arcoscom.com  Wed Aug  9 01:08:35 2006
From: samueldg at arcoscom.com (=?ISO-8859-1?Q?Samuel_D=EDaz_Garc=EDa?=)
Date: Sun Aug 13 11:45:12 2006
Subject: [LARTC] Info about IFB
Message-ID: <44D91973.2020805@arcoscom.com>

Hi, I'm looking for info about IFB devices and how I can use it to 
incomming traffic shapping.

Has IFB any web about it?
Do any body known where I can find more info about it?

I found this:
http://linux-net.osdl.org/index.php/IFB

But I can't stand fine how to use it to allow many ifb's devices or how 
to use it with "tc actions".

Any help?

Thanks

-- 
    Samuel D?az Garc?a
     Director Gerente
ArcosCom Wireless, S.L.L.

CIF: B11828068
c/ Romero Gago, 19
Arcos de la Frontera
11630 - Cadiz

http://www.arcoscom.com

mailto:samueldg@arcoscom.com
msn: samueldg@arcoscom.com

M?vil: 651 93 72 48
Tlfn.: 956 70 13 15
Fax:   956 70 34 83
From william.bohannan at spidersat.net  Wed Aug  9 17:09:24 2006
From: william.bohannan at spidersat.net (William Bohannan)
Date: Sun Aug 13 11:46:58 2006
Subject: [LARTC] getting a local name on a network
Message-ID: <000001c6bbc5$d43e9360$0702a8c0@william>

Hi I have written my firewall rules and it is working great, blocking p2p
with layer7 and ipp2p between pm and 6am, also using ulog to get in all into
mysql only problem is when it comes to accounting for the local traffic as
all it shows is ip address, I have been looking around for a command to get
the "windoz" name from an ip address then a quick script to change the log
entries to also have names.  Wondering if anyone has done this?

 

Kind Regards

 

William Bohannan

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060809/496f52ba/attachment.html
From jarkao2 at o2.pl  Thu Aug 10 13:25:13 2006
From: jarkao2 at o2.pl (Jarek Poplawski)
Date: Sun Aug 13 11:48:51 2006
Subject: [LARTC] Re: how to save iproute
In-Reply-To: <1154424503.4282.52.camel@OSCARLAPLIN>
References: <1151768560.5095.75.camel@localhost.localdomain>
	<1154424503.4282.52.camel@OSCARLAPLIN>
Message-ID: <ebf51i$i1n$1@sea.gmane.org>

On 01-08-2006 11:28, Oscar Mechanic wrote:
> Say if I have a few routes like this 
> 
> ip rule add from 19.21.12.12 lookup 200
> ip route add default via 10.0.0.253
> ip rule add to 13.1.2.2 lookup 201
> ip route add default via 10.0.0.254
> ip route add default via 10.0.0.254
> 
> How do I save them, I have looked through the list and have googled this
> Q for some time and do not have an concrete answers. I have read that
> you just save and rerun the command but that does not work as the "from
> all to" is not valid it has to be the "to" without the "from all". I
> have used multiple versions of iproute2 and still the same problem. I
> written a script and put in many sed's to get around problems but its
> nasty code. Surely someone solved this is there a "saveall" script or
> bin that is distro independant. 

Maybe I miss your point, but ip doesn't care if you write a 
command by hand (from shell) or run it from a shell script.
If you don't use "from ...", it is the same as if you've written 
"from all". It doesn't contradict with "to ..." which is another 
parameter.

After your last command there will be an error because it repeats 
the previous one.

If you add in a script:
set -x
before the first command, you will see, which end with errors.

Jarek P.

From jarkao2 at o2.pl  Thu Aug 10 15:14:54 2006
From: jarkao2 at o2.pl (Jarek Poplawski)
Date: Sun Aug 13 11:49:32 2006
Subject: [LARTC] Re: route mail through different gateway
In-Reply-To: <35207fdf0608031936y2fe970d6pb855fc2f7557d5de@mail.gmail.com>
References: <35207fdf0608031936y2fe970d6pb855fc2f7557d5de@mail.gmail.com>
Message-ID: <ebfbf7$85b$1@sea.gmane.org>

On 04-08-2006 04:36, Michael wrote:
> Hi All,
> 
> I've got server with one LAN card eth0 ip=10.0.0.5 <http://10.0.0.5>
> 
> default access t ointernety done through ADSL router gw 10.0.0.1 
> <http://10.0.0.1>
> we got second internet access through another ADSL router gw 10.0.0.2 
> <http://10.0.0.2>
> 
> I want to send all e-mail out through gw 10.0.0.2 <http://10.0.0.2>
> How it can be done?
> I've tried to mark packets:
> iptables -t mangle -A OUTPUT -p tcp --dport 25 -j MARK --set-mark 0x1
> and
> ip ru add fwmark 0x1 table mail.out
> ip ro add default via 10.0.0.2 <http://10.0.0.2> lookup mail.out

You mean:

ip ro add default via 10.0.0.2 table mail.out

Try this also:

echo 0 > /proc/sys/net/ipv4/conf/all/rp_filter

Jarek P.

PS: I hope you have this mail.out properly added (or replace this 
with a number e.g.: 100) and fwmark enabled in kernel config.

From jarkao2 at o2.pl  Thu Aug 10 15:38:54 2006
From: jarkao2 at o2.pl (Jarek Poplawski)
Date: Sun Aug 13 11:49:39 2006
Subject: [LARTC] Re: tc filter
In-Reply-To: <81c11a560608030906t525d6232vf135053463ce6a8f@mail.gmail.com>
References: <81c11a560608030906t525d6232vf135053463ce6a8f@mail.gmail.com>
Message-ID: <ebfcs8$d3n$1@sea.gmane.org>

On 03-08-2006 18:06, doudouyam wrote:
> Hi,
> Is it possible to make a filter with tc which exclude an IP like iptables ??
> 
> ex:
> iptable -t mangle -A PREROUTING -i eth0 -d ! 192.168.1.222 
> <http://192.168.1.222> -j MARK ...

Maybe there is something like this, I don't know, but you can try 
two filters in turn e.g.:

# tc filter add dev eth0 parent 1: proto ip pref 100 \
	u32 match ip dst 192.168.1.222 police drop

(or some other "flowid 1:xx" instead of "police drop")

# tc filter add dev eth0 parent 1: proto ip pref 101 \
	u32 match ip dst 192.168.1.0/24 flowid 1:99

Jarek P.

From doudouyam at gmail.com  Fri Aug 11 15:43:08 2006
From: doudouyam at gmail.com (doudouyam)
Date: Sun Aug 13 11:52:52 2006
Subject: [LARTC] problem with PRIO
Message-ID: <81c11a560608110643y760f0f9flbbb5e551d318e2ba@mail.gmail.com>

Hi,

I try to use the PRIO scheduler on a 2.6.17 kernel.
I use a simple configuration :

        $TC qdisc add dev $dev root handle 1: prio bands 2 priomap 1 1 1 1 1
1 1 1 1 1 1 1 1 1 1 1

        $TC qdisc add dev $dev parent 1:1 handle 10:0 sfq perturb10
        $TC qdisc add dev $dev parent 1:2 handle 20:0 sfq perturb 10


And i put filters for my trafic, the 2 streams are correctly put in each
class but the stream in the the first class isn't prioritorize.
Where is my mistake ?
I test that on a montejade board (armv5 big endian) and i try with other
architecture (x86 with 2.6.16 kernel) and I had the same problem.
Can you help me ?

Thanks
Doude
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060811/a36175b1/attachment.html
From covici at ccs.covici.com  Sun Aug 13 04:04:49 2006
From: covici at ccs.covici.com (John covici)
Date: Sun Aug 13 11:56:41 2006
Subject: [LARTC] trying to prioritize voip traffick
Message-ID: <17630.35009.794502.706457@ccs.covici.com>

I am using a server with asterisk and I am trying to prioritize voip
traffick -- I am a newbie at this traffic shaping, so please bear with
me.  I used the script below and what happens is thatall traffic in
the bulk class stops after a couple of minutes.  Also, should I
include the ports for rtp in the filter statements with the ports 5061
and 4569?  Note I have a fairly big pipe -- supposed to be able to do
the full 100mb out.


Here is the script.

#!/bin/sh
#####################################
############ VARIABLES ##############
#                                   #
e=eth0       # interface
t1=70Mbit  # size of your WAN - remember you can't max this or you'll  experience latency. 75-80% of max is a good place to start.
el=100Mbit   # size of eth0
w=7.5Mbit   # weighting of your WAN (10% of t1)
sizeCitrix=5Mbit
sizeVoIP=55Mbit

sizeBulk=10Mbit

weightCitrix=0.5Mbit
weightVoIP=5.5Mbit
weightBulk=1Mbit


#                                   #
#####################################
#####################################

# Delete any old rules #
set -v
set -x
tc qdisc del root dev $e

## each class is able to take more bandwidth as it is available, but must
## surrender it as the higher priorities (2, 3, then 4) need it.
## The lower the priority number, the more priority it gets. Thus when
## there is extra bandwidth available, the lower number classes get it as
## they need it.

# root qdisc /  qdisc = queueing discipline #
tc qdisc add dev $e root handle 1:0 cbq bandwidth 100Mbit avpkt 1000 cell 8||exit 1

tc class add dev $e parent 1:0 classid 1:1 cbq bandwidth 100Mbit rate $t1 weight $w prio 8 allot 1514 cell 8 maxburst 20 avpkt 1000 bounded||exit 1

# child qdiscs (like child nodes on a tree) #
tc class add dev $e parent 1:1 classid 1:3 cbq bandwidth 100Mbit rate $sizeCitrix weight $weightCitrix prio 8 allot 1514 cell 8 maxburst 20 avpkt 300 isolated||exit 1
tc qdisc add dev $e parent 1:3 handle 30: sfq perturb 20||exit 1

tc class add dev $e parent 1:1 classid 1:5 cbq bandwidth 100Mbit rate $sizeVoIP weight $weightVoIP prio 8 allot 1514 cell 8 maxburst 20 avpkt 204 bounded ||exit 1



tc class add dev $e parent 1:1 classid 1:9 cbq bandwidth 100Mbit rate $sizeBulk weight $weightBulk prio 8 allot 1514 cell 8 maxburst 20 avpkt 1000||exit 1
tc qdisc add dev $e parent 1:9 handle 90: sfq perturb 20||exit 1

#####################################
############### Citrix ##############
#                                   #

# SSH #
tc filter add dev $e protocol ip parent 1:0 prio 1 u32 match ip sport 22 0xffff flowid 1:3||exit 1
tc filter add dev $e protocol ip parent 1:0 prio 1 u32 match ip dport 22 0xffff flowid 1:3||exit 1


#####################################
############### VoIP ################
#                                   #

# IAX # this is the old format - IAX2 should be what's really seen going 
#on
tc filter add dev $e protocol ip parent 1:0 prio 1 u32 match ip sport 5061 0xffff flowid 1:5||exit 1
tc filter add dev $e protocol ip parent 1:0 prio 1 u32 match ip dport 5061 0xffff flowid 1:5||exit 1

# IAX2 #
tc filter add dev $e protocol ip parent 1:0 prio 1 u32 match ip sport 4569 0xffff flowid 1:5||exit 1
tc filter add dev $e protocol ip parent 1:0 prio 1 u32 match ip dport 4569 0xffff flowid 1:5||exit 1


#####################################
######### Bulk / Default ############
#                                   #

tc filter add dev $e protocol ip parent 1:0 prio 3 u32 match ip src 0.0.0.0/0 flowid 1:9||exit 1
tc filter add dev $e protocol ip parent 1:0 prio 3 u32 match ip dst 0.0.0.0/0 flowid 1:9||exit 1


Any assistance would be appreciated.

-- 
Your life is like a penny.  You're going to lose it.  The question is:
How do
you spend it?

         John Covici
         covici@ccs.covici.com
From tgraf at suug.ch  Thu Aug 10 14:36:02 2006
From: tgraf at suug.ch (Thomas Graf)
Date: Sun Aug 13 11:58:02 2006
Subject: [LARTC] Re: [PATCH 0/6] htb: cleanup
In-Reply-To: <20060802.151816.30182208.davem@davemloft.net>
References: <20060802125636.3028ba91@dxpl.pdx.osdl.net>
	<20060802.151816.30182208.davem@davemloft.net>
Message-ID: <20060810123602.GE14627@postel.suug.ch>

* David Miller <davem@davemloft.net> 2006-08-02 15:18
> From: Stephen Hemminger <shemminger@osdl.org>
> Date: Wed, 2 Aug 2006 12:56:36 -0700
> 
> > The HTB scheduler code is a mess, this patch set does some basic
> > house cleaning.  The first four should cause no code change, but the
> > last two need more testing.
> 
> These patches look fine to me.  Once everyone think's they
> are ready just let me know and I'll push them into net-2.6.19

I think they are ready.
From kaber at trash.net  Sun Aug 13 13:34:48 2006
From: kaber at trash.net (Patrick McHardy)
Date: Sun Aug 13 13:34:29 2006
Subject: [LARTC] netfilter patch-o-matic: where did all the patches go?
In-Reply-To: <44D87E89.10706@expertron.co.za>
References: <44D87E89.10706@expertron.co.za>
Message-ID: <44DF0E58.3050903@trash.net>

Justin Schoeman wrote:
> I haven't been paying attention to this for a while, but now that I
> download the latest patch-o-matic-ng, I see that most of the patches are
> gone...
> 
> Anybody have an idea where I can download the 'extras' repository?
> Specifically geoip.


We removed all patches that we don't want to maintain ourselves. Most
of the patches that are actually used by people are now maintained in
external repositories, runme --download will fetch them for you.

From tizone at gmail.com  Sun Aug 13 22:18:25 2006
From: tizone at gmail.com (=?ISO-8859-1?Q?Andr=E9s_Ghigliazza?=)
Date: Sun Aug 13 22:18:10 2006
Subject: [LARTC] ingress and flowid
In-Reply-To: <e55f48520608091233k1c9fa4fche7ad14a8888b28a1@mail.gmail.com>
References: <e55f48520608091233k1c9fa4fche7ad14a8888b28a1@mail.gmail.com>
Message-ID: <e55f48520608131318q33f5fc68yd38e38040d81aa3a@mail.gmail.com>

Hi there,

I am trying to understand our router / firewall, that was configured
by another person. It is a Debian GNU/Linux with several
configurations with tc and iptables.

I have a question about flowid in ingress qdisc. As fas as I know,
this qdisc is a dummy one, and flowid is just used with :1 because the
traffic have to be redirected to something.

However, in our router, there are some filters of ingress qdisc, that
have differents flowids (:1, :2 and :5). Does that have any sense?

Thanks very much,

tizo
From simvirus at gmail.com  Mon Aug 14 02:42:06 2006
From: simvirus at gmail.com (Sim)
Date: Mon Aug 14 02:41:51 2006
Subject: [LARTC] HTB and BOND Interface
Message-ID: <d3e73af70608131742n52d8ec24nd2f0dcb7c9580ac0@mail.gmail.com>

Hi!

Is it HTB fully compatible with BOND interface?

I have this setup (mode= fault tolerance) :

BOND0 -> ETH0 + ETH1
BOND1 -> ETH2 + ETH3

( http://www.kernel.org/pub/linux/kernel/people/marcelo/linux-2.4/Documentation/networking/bonding.txt
)

HTB work very well with Class over BOND0.
If I add Class for BOND1 it generate balance errors.

Also with HTB.init (http://sourceforge.net/projects/htbinit) I have
the some problem

bond0                     (upload)
bond0-10
bond0-10:15
bond0-10:20
bond0-10:20:25
bond1-10                 (download)
bond1-10:15
bond1-10:20
bond1-10:20:25

( File bond0* and bond1* are identical )

Thanks for eventual answers!

Sim
From pereyra.roberto at gmail.com  Mon Aug 14 12:27:51 2006
From: pereyra.roberto at gmail.com (Roberto Pereyra)
Date: Mon Aug 14 12:27:35 2006
Subject: [LARTC] trying to prioritize voip traffick
In-Reply-To: <17630.35009.794502.706457@ccs.covici.com>
References: <17630.35009.794502.706457@ccs.covici.com>
Message-ID: <f05666f00608140327wc9d7017vac480b0968cb1e72@mail.gmail.com>

Hi

Take a look to this link:

http://www.krisk.org/astlinux/misc/astshape

roberto

2006/8/12, John covici <covici@ccs.covici.com>:
> I am using a server with asterisk and I am trying to prioritize voip
> traffick -- I am a newbie at this traffic shaping, so please bear with
> me.  I used the script below and what happens is thatall traffic in
> the bulk class stops after a couple of minutes.  Also, should I
> include the ports for rtp in the filter statements with the ports 5061
> and 4569?  Note I have a fairly big pipe -- supposed to be able to do
> the full 100mb out.
>
>
> Here is the script.
>
> #!/bin/sh
> #####################################
> ############ VARIABLES ##############
> #                                   #
> e=eth0       # interface
> t1=70Mbit  # size of your WAN - remember you can't max this or you'll  experience latency. 75-80% of max is a good place to start.
> el=100Mbit   # size of eth0
> w=7.5Mbit   # weighting of your WAN (10% of t1)
> sizeCitrix=5Mbit
> sizeVoIP=55Mbit
>
> sizeBulk=10Mbit
>
> weightCitrix=0.5Mbit
> weightVoIP=5.5Mbit
> weightBulk=1Mbit
>
>
> #                                   #
> #####################################
> #####################################
>
> # Delete any old rules #
> set -v
> set -x
> tc qdisc del root dev $e
>
> ## each class is able to take more bandwidth as it is available, but must
> ## surrender it as the higher priorities (2, 3, then 4) need it.
> ## The lower the priority number, the more priority it gets. Thus when
> ## there is extra bandwidth available, the lower number classes get it as
> ## they need it.
>
> # root qdisc /  qdisc = queueing discipline #
> tc qdisc add dev $e root handle 1:0 cbq bandwidth 100Mbit avpkt 1000 cell 8||exit 1
>
> tc class add dev $e parent 1:0 classid 1:1 cbq bandwidth 100Mbit rate $t1 weight $w prio 8 allot 1514 cell 8 maxburst 20 avpkt 1000 bounded||exit 1
>
> # child qdiscs (like child nodes on a tree) #
> tc class add dev $e parent 1:1 classid 1:3 cbq bandwidth 100Mbit rate $sizeCitrix weight $weightCitrix prio 8 allot 1514 cell 8 maxburst 20 avpkt 300 isolated||exit 1
> tc qdisc add dev $e parent 1:3 handle 30: sfq perturb 20||exit 1
>
> tc class add dev $e parent 1:1 classid 1:5 cbq bandwidth 100Mbit rate $sizeVoIP weight $weightVoIP prio 8 allot 1514 cell 8 maxburst 20 avpkt 204 bounded ||exit 1
>
>
>
> tc class add dev $e parent 1:1 classid 1:9 cbq bandwidth 100Mbit rate $sizeBulk weight $weightBulk prio 8 allot 1514 cell 8 maxburst 20 avpkt 1000||exit 1
> tc qdisc add dev $e parent 1:9 handle 90: sfq perturb 20||exit 1
>
> #####################################
> ############### Citrix ##############
> #                                   #
>
> # SSH #
> tc filter add dev $e protocol ip parent 1:0 prio 1 u32 match ip sport 22 0xffff flowid 1:3||exit 1
> tc filter add dev $e protocol ip parent 1:0 prio 1 u32 match ip dport 22 0xffff flowid 1:3||exit 1
>
>
> #####################################
> ############### VoIP ################
> #                                   #
>
> # IAX # this is the old format - IAX2 should be what's really seen going
> #on
> tc filter add dev $e protocol ip parent 1:0 prio 1 u32 match ip sport 5061 0xffff flowid 1:5||exit 1
> tc filter add dev $e protocol ip parent 1:0 prio 1 u32 match ip dport 5061 0xffff flowid 1:5||exit 1
>
> # IAX2 #
> tc filter add dev $e protocol ip parent 1:0 prio 1 u32 match ip sport 4569 0xffff flowid 1:5||exit 1
> tc filter add dev $e protocol ip parent 1:0 prio 1 u32 match ip dport 4569 0xffff flowid 1:5||exit 1
>
>
> #####################################
> ######### Bulk / Default ############
> #                                   #
>
> tc filter add dev $e protocol ip parent 1:0 prio 3 u32 match ip src 0.0.0.0/0 flowid 1:9||exit 1
> tc filter add dev $e protocol ip parent 1:0 prio 3 u32 match ip dst 0.0.0.0/0 flowid 1:9||exit 1
>
>
> Any assistance would be appreciated.
>
> --
> Your life is like a penny.  You're going to lose it.  The question is:
> How do
> you spend it?
>
>          John Covici
>          covici@ccs.covici.com
> _______________________________________________
> LARTC mailing list
> LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
>


-- 
Ing. Roberto Pereyra
ContenidosOnline
Looking for Linux Virtual Private Servers ? Click here:
http://www.spry.com/hosting-affiliate/scripts/t.php?a_aid=426&a_bid=56
From pereyra.roberto at gmail.com  Mon Aug 14 13:00:12 2006
From: pereyra.roberto at gmail.com (Roberto Pereyra)
Date: Mon Aug 14 12:59:58 2006
Subject: [LARTC] enable p2p to some host (ipp2p)
Message-ID: <f05666f00608140400x3f47569ckfe834bb95c91e91a@mail.gmail.com>

Hi

I using ipp2p to block p2p traffic.

How to enable to use p2p to me host in my net ?

I using this setup:

iptables -A FORWARD -m ipp2p --ipp2p --bit --apple --winmx --soul --ares -j DROP


This setup:

iptables -A FORWARD -m ipp2p --ipp2p --bit --apple --winmx --soul
--ares -d ! mynet -j DROP

iptables -A FORWARD -m ipp2p --ipp2p --bit --apple --winmx --soul
--ares -s ! mynet -j DROP


not works ....


roberto


-- 
Ing. Roberto Pereyra
ContenidosOnline
Looking for Linux Virtual Private Servers ? Click here:
http://www.spry.com/hosting-affiliate/scripts/t.php?a_aid=426&a_bid=56
From simvirus at gmail.com  Mon Aug 14 13:24:55 2006
From: simvirus at gmail.com (Sim)
Date: Mon Aug 14 13:24:41 2006
Subject: [LARTC] Re: HTB and BOND Interface
In-Reply-To: <d3e73af70608131742n52d8ec24nd2f0dcb7c9580ac0@mail.gmail.com>
References: <d3e73af70608131742n52d8ec24nd2f0dcb7c9580ac0@mail.gmail.com>
Message-ID: <d3e73af70608140424s546bd9a4n50990afe339e6269@mail.gmail.com>

> Hi!
>
> Is it HTB fully compatible with BOND interface?
>
> I have this setup (mode= fault tolerance) :
>
> BOND0 -> ETH0 + ETH1
> BOND1 -> ETH2 + ETH3
>
> ( http://www.kernel.org/pub/linux/kernel/people/marcelo/linux-2.4/Documentation/networking/bonding.txt
> )
>
> HTB work very well with Class over BOND0.
> If I add Class for BOND1 it generate balance errors.
>
> Also with HTB.init (http://sourceforge.net/projects/htbinit) I have
> the some problem
>
> bond0                     (upload)
> bond0-10
> bond0-10:15
> bond0-10:20
> bond0-10:20:25
> bond1-10                 (download)
> bond1-10:15
> bond1-10:20
> bond1-10:20:25
>
> ( File bond0* and bond1* are identical )
>
> Thanks for eventual answers!


Can I create something about " tc qdisc add dev $DEV handle ffff:
ingress  " for use only BOND0 interface ?


Here my actual script:

/sbin/tc qdisc del dev bond0 root
/sbin/tc qdisc add dev bond0 root handle 1 htb default 15 r2q 100

/sbin/tc class add dev bond0 parent 1: classid 1:10 htb rate 7.6Mbit burst 15k

/sbin/tc class add dev bond0 parent 1:10 classid 1:15 htb rate 100Kbit
ceil 1Mbit burst 15k
/sbin/tc qdisc add dev bond0 parent 1:15 handle 15 sfq perturb 10

/sbin/tc class add dev bond0 parent 1:10 classid 1:20 htb rate 1.5Mbit
ceil 6Mbit burst 15k
/sbin/tc qdisc add dev bond0 parent 1:20 handle 20 sfq perturb 10
/sbin/tc filter add dev bond0 parent 1:0 protocol ip prio 100 u32
match ip src 192.168.2.0/24 classid 1:20
/sbin/tc filter add dev bond0 parent 1:0 protocol ip prio 100 u32
match ip src 192.168.3.0/24 classid 1:20
/sbin/tc filter add dev bond0 parent 1:0 protocol ip prio 100 u32
match ip src 192.168.6.0/24 classid 1:20

/sbin/tc class add dev bond0 parent 1:10 classid 1:30 htb rate 1.5Mbit
ceil 6Mbit burst 15k
/sbin/tc qdisc add dev bond0 parent 1:30 handle 30 sfq perturb 10
/sbin/tc filter add dev bond0 parent 1:0 protocol ip prio 100 u32
match ip src 192.168.4.0/24 classid 1:30
/sbin/tc filter add dev bond0 parent 1:0 protocol ip prio 100 u32
match ip src 192.168.5.0/24 classid 1:30
/sbin/tc filter add dev bond0 parent 1:0 protocol ip prio 100 u32
match ip dst 192.168.7.0/24 classid 1:30

/sbin/tc class add dev bond0 parent 1:10 classid 1:38 htb rate 2Mbit
ceil 3Mbit burst 15k
/sbin/tc qdisc add dev bond0 parent 1:38 handle 38 sfq perturb 10
/sbin/tc filter add dev bond0 parent 1:0 protocol ip prio 100 u32
match ip src 192.168.8.0/24 classid 1:38

/sbin/tc class add dev bond0 parent 1:10 classid 1:39 htb rate 1Mbit
ceil 4Mbit burst 15k
/sbin/tc qdisc add dev bond0 parent 1:39 handle 39 sfq perturb 10

/sbin/tc class add dev bond0 parent 1:39 classid 1:3956 htb rate
256Kbit ceil 1Mbit burst 15k
/sbin/tc qdisc add dev bond0 parent 1:3956 handle 3956 sfq perturb 10
/sbin/tc filter add dev bond0 parent 1:0 protocol ip prio 100 u32
match ip src 192.168.9.15/32 classid 1:3956
/sbin/tc filter add dev bond0 parent 1:0 protocol ip prio 100 u32
match ip src 192.168.9.35/32 classid 1:3956

/sbin/tc class add dev bond0 parent 1:39 classid 1:3999 htb rate
768Kbit ceil 4Mbit burst 15k
/sbin/tc qdisc add dev bond0 parent 1:3999 handle 3999 sfq perturb 10
/sbin/tc filter add dev bond0 parent 1:0 protocol ip prio 100 u32
match ip src 192.168.9.0/24 classid 1:3999


Thanks!
From lburatti at zacmi.it  Mon Aug 14 16:03:08 2006
From: lburatti at zacmi.it (lburatti@zacmi.it)
Date: Mon Aug 14 16:02:55 2006
Subject: [LARTC] luca buratti is out of office
Message-ID: <OFDA4BD595.33CA6875-ONC12571CA.004D3145-C12571CA.004D3145@zacmi.it>


Sar? assente dall'ufficio a partire dal  14/08/2006 e non torner? fino al
28/08/2006.

Risponder? al messaggio al mio ritorno.

Trend Scan Mail:
this message is virus free.

From jrompen at gmail.com  Mon Aug 14 17:42:37 2006
From: jrompen at gmail.com (Jacques Rompen)
Date: Mon Aug 14 17:42:26 2006
Subject: [LARTC] Routing packets over multiple links (NICS) all on the same
	ISP all with same gateway.
Message-ID: <10c138640608140842x66bdc222q1f444e6d25f59582@mail.gmail.com>

Ok ive been trying to get this to work for about half a year now. Ive
searched all over the internet for a solution for
my  problem. Ive found some solutions, but they only led me to yet more
problems.

What we want to do is the following:
I live in a student complex with 7 other people. Every room has its own
internet connection from the same ISP.
Ip, gateway, subnet are asigned through dhcp on mac-adres basis. Every
internet connection is capped at 20mbit
up/down.
We want to get all computers on an internal network. So we need some sort of
router that accepts all 8 internet
connections and routes it out over a gbit nic -> switch -> internal network
So we have a computer with 10 nics and "hopefully" enough internal bandwith.

Attempt 1
I read that FreeBSD was the choice for network/router/servers. So after alot
of problems installing FreeBSD
i found out that FreeBSD doesnt support multiple gateway routing to start
with.

Attempt 2
 Ive tried the nano guide http://www.ssi.bg/~ja/nano.txt with the julian
patches on FC5 2.6 kernel. The problem
there was that it only used 1 external nic. I think because
all external connections had the same gateway. It didnt
handle the routing like it supposed to do.

Attempt 3:
Ive tried to follow the following guide
http://www.leglug.org/node/Load%20Balancing%20Across%20Multiple%20Links
I first tried to use this script in a 2.6 kernel (no julian
patch, ip_route_multipath_cache enabled) It could not find any match for the
"-m random --average 50 " function. So after trying al kinds of things and
searching the net a
lot, i found out that 2.6 kernel doesnt support this random match??
Anyway, so ive installed Slackware 10.2 on the box with a 2.4.32 kernel.
Ofcourse with multipath routing enabled
in the kernel. Again it couldnt: load match 'random:
/usr/lib/iptables/libipt_random.so'
As far as i know it should be available in iptables 1.3.3 that comes with
slackware 10.2.

I know that trunking/bonding the 8 nics with the swicht in the complex would
be the ideal solution, but first of all
 the isp won't do this, and seccond im not even sure if the switch supports
this (if i could even get acces to it)

Some help would be greatly apreciated.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060814/a79cb772/attachment.htm
From luciano at lugmen.org.ar  Mon Aug 14 18:21:22 2006
From: luciano at lugmen.org.ar (Luciano Ruete)
Date: Mon Aug 14 18:15:13 2006
Subject: [LARTC] Routing packets over multiple links (NICS) all on the
	same ISP all with same gateway.
In-Reply-To: <10c138640608140842x66bdc222q1f444e6d25f59582@mail.gmail.com>
References: <10c138640608140842x66bdc222q1f444e6d25f59582@mail.gmail.com>
Message-ID: <200608141321.22643.luciano@lugmen.org.ar>

On Monday 14 August 2006 12:42, Jacques Rompen wrote:
> Ok ive been trying to get this to work for about half a year now. Ive
> searched all over the internet for a solution for
> my  problem. Ive found some solutions, but they only led me to yet more
> problems.
>
> What we want to do is the following:
> I live in a student complex with 7 other people. Every room has its own
> internet connection from the same ISP.
> Ip, gateway, subnet are asigned through dhcp on mac-adres basis. Every
> internet connection is capped at 20mbit
> up/down.
> We want to get all computers on an internal network. So we need some sort
> of router that accepts all 8 internet
> connections and routes it out over a gbit nic -> switch -> internal network
> So we have a computer with 10 nics and "hopefully" enough internal
> bandwith.

one simple solution is in this post[1] (read all the thread if you whant a 
context). Bassically it uses iptables CONNMARK to remembre to which iface(and 
certanly wich src ip) each connection flow belongs. 

You will have to use same gw in all ifaces, maybe the ip route "onlink" 
ption(command line) make your script simpler. No need to use julian patch and 
certanly DO NOT USE CONFIG_IP_ROUTE_MULTIPATH_CACHED in your kernel config.

Feel free to post any doubts.

Greets.

[1]http://mailman.ds9a.nl/pipermail/lartc/2006q2/018964.html
-- 
--
Luciano
From tizone at gmail.com  Mon Aug 14 22:21:10 2006
From: tizone at gmail.com (=?ISO-8859-1?Q?Andr=E9s_Ghigliazza?=)
Date: Mon Aug 14 22:20:55 2006
Subject: [LARTC] tc and HTB
Message-ID: <e55f48520608141321w21e2ed8emf5b253dc3860b818@mail.gmail.com>

Hi,

I have a Debian that is connected to Internet in eth0, and to a LAN in
eth1. I wanted to control traffic with HTB, dividing it depending on
what kind of traffic is (Mail, Application Server and others).

Would it be good to use HTB qdisc in eth0 egress to control outgoing
traffic and HTB qdisc in eth1 egress to control incoming traffic? Or
the only way to control incoming traffic is with eth0 ingress?

Thanks very much,

tizo
From luciano at lugmen.org.ar  Mon Aug 14 22:41:48 2006
From: luciano at lugmen.org.ar (Luciano Ruete)
Date: Mon Aug 14 22:35:42 2006
Subject: [LARTC] tc and HTB
In-Reply-To: <e55f48520608141321w21e2ed8emf5b253dc3860b818@mail.gmail.com>
References: <e55f48520608141321w21e2ed8emf5b253dc3860b818@mail.gmail.com>
Message-ID: <200608141741.48488.luciano@lugmen.org.ar>

On Monday 14 August 2006 17:21, Andr?s Ghigliazza wrote:
> Hi,
>
> I have a Debian that is connected to Internet in eth0, and to a LAN in
> eth1. I wanted to control traffic with HTB, dividing it depending on
> what kind of traffic is (Mail, Application Server and others).
>
> Would it be good to use HTB qdisc in eth0 egress to control outgoing
> traffic and HTB qdisc in eth1 egress to control incoming traffic? Or
> the only way to control incoming traffic is with eth0 ingress?

INET-eth0-Router-eth1-LAN

in eth0 egress htb qdisc(you shape uplink here)
in eth1 egress htb qdisc(you shape downlink here)

this feets perfectly if it is the LAN traffic the one you whant to shape. If 
it is the traffic from the server itself you will need an ingress policy in 
eth0.

--
Luciano
From simvirus at gmail.com  Mon Aug 14 23:17:58 2006
From: simvirus at gmail.com (Sim)
Date: Mon Aug 14 23:17:44 2006
Subject: [LARTC] tc and HTB
In-Reply-To: <200608141741.48488.luciano@lugmen.org.ar>
References: <e55f48520608141321w21e2ed8emf5b253dc3860b818@mail.gmail.com>
	<200608141741.48488.luciano@lugmen.org.ar>
Message-ID: <d3e73af70608141417w551f7ed1k819e5a8d64f64c@mail.gmail.com>

>
> INET-eth0-Router-eth1-LAN
>
> in eth0 egress htb qdisc(you shape uplink here)
> in eth1 egress htb qdisc(you shape downlink here)
>
> this feets perfectly if it is the LAN traffic the one you whant to shape. If
> it is the traffic from the server itself you will need an ingress policy in
> eth0.
>

Hi Luciano! Can you help me for use only one interface for upload/download?

Is it possible shape traffic with " ingress policy " ?

I haven't found documents for this policy.

Thanks!

Sim
From luciano at lugmen.org.ar  Tue Aug 15 01:23:06 2006
From: luciano at lugmen.org.ar (Luciano Ruete)
Date: Tue Aug 15 01:22:52 2006
Subject: [LARTC] tc and HTB
In-Reply-To: <d3e73af70608141417w551f7ed1k819e5a8d64f64c@mail.gmail.com>
References: <e55f48520608141321w21e2ed8emf5b253dc3860b818@mail.gmail.com>
	<200608141741.48488.luciano@lugmen.org.ar>
	<d3e73af70608141417w551f7ed1k819e5a8d64f64c@mail.gmail.com>
Message-ID: <200608142023.06265.luciano@lugmen.org.ar>

El Monday 14 August 2006 18:17, Sim escribi?:
> > INET-eth0-Router-eth1-LAN
> >
> > in eth0 egress htb qdisc(you shape uplink here)
> > in eth1 egress htb qdisc(you shape downlink here)
> >
> > this feets perfectly if it is the LAN traffic the one you whant to shape.
> > If it is the traffic from the server itself you will need an ingress
> > policy in eth0.
>
> Hi Luciano! Can you help me for use only one interface for upload/download?
>
> Is it possible shape traffic with " ingress policy " ?
>
> I haven't found documents for this policy.

This is LARTC mailing list and the first document to attend before posting a 
FAQ is to read the LARTC HOWTO.
All from LARTC:
http://lartc.org/howto/lartc.adv-qdisc.ingress.html
http://lartc.org/howto/lartc.adv-filter.policing.html

with examples like:
http://lartc.org/howto/lartc.cookbook.synflood-protect.html

Alternative you can use imq:
http://lartc.org/howto/lartc.imq.html


RTFM! (sorry can't avoid that :-P)
-- 
Luciano
From kristiadi_himawan at dtp.net.id  Tue Aug 15 09:16:40 2006
From: kristiadi_himawan at dtp.net.id (Kristiadi Himawan)
Date: Tue Aug 15 09:16:25 2006
Subject: [LARTC] smallest rate
In-Reply-To: <f05666f00608140327wc9d7017vac480b0968cb1e72@mail.gmail.com>
References: <17630.35009.794502.706457@ccs.covici.com>
	<f05666f00608140327wc9d7017vac480b0968cb1e72@mail.gmail.com>
Message-ID: <44E174D8.7050407@dtp.net.id>


Hi, anyone know the smallest rate for tc, is it possible using 0 bps ?


From julius.junghans at gmx.de  Tue Aug 15 17:17:16 2006
From: julius.junghans at gmx.de (Julius Junghans)
Date: Tue Aug 15 17:18:36 2006
Subject: [LARTC] howto reduce the ping?
Message-ID: <200608151717.17048.julius.junghans@gmx.de>

Hi,

with the attached config my gaming ping is still +20ms, even if the line isn't  
saturated..can anybody give me a hint how to get a better response time? 
my line: 1024/128kbit

outbound:
one htb qdisc for gaming (7kbps) prio 0 ceil 14kbps<- should get more traffic 
when needed. 
Htb again for irc and default.


inbound:
css, irc, p2p, default <- same shema as before, give css enough bandwith and 
allocate the rest for the other classes.

Are packets in 1:10 (css) are transfered as fast as they arrive?


 

Same config without line breaks:
http://phpfi.com/140959

#!/bin/bash

OUTBOUND_DEV=ppp0
INBOUND_DEV=imq0

start_outbound()
{
    echo "Starting outbound"

    tc qdisc add dev ppp0 root handle 1: htb default 90
    #max upload
    tc class add dev ppp0 parent 1: classid 1:1 htb rate 14kbps

    #css
    tc class add dev ppp0 parent 1:1 classid 1:10 htb rate 9kbps ceil 14kbps 
prio 1
    iptables -t mangle -A POSTROUTING -p tcp --dport 27020:27039 -j 
CLASSIFY --set-class 1:10
    iptables -t mangle -A POSTROUTING -p udp --dport 27000:27015 -j 
CLASSIFY --set-class 1:10

    #irc
    tc class add dev ppp0 parent 1:1 classid 1:20 htb rate 1kbps ceil 1kbps 
prio 2
    iptables -t mangle -A POSTROUTING -p tcp --dport 6667 -j 
CLASSIFY --set-class 1:20

    #default
    tc class add dev ppp0 parent 1:1 classid 1:90 htb rate 4kbps ceil 4kbps 
prio 3
}

stop_outbound_tc()
{
    echo "Stopping outbound tc"
    tc qdisc del dev ppp0 root    2> /dev/null > /dev/null
    tc qdisc del dev ppp0 ingress 2> /dev/null > /dev/null
}

stop_outbound_iptables()
{
    echo "Stopping outbound iptables"

    #css
    iptables -t mangle -D POSTROUTING -p tcp --dport 27020:27039 -j 
CLASSIFY --set-class 1:10
    iptables -t mangle -D POSTROUTING -p udp --dport 27000:27015 -j 
CLASSIFY --set-class 1:10

    #irc
    iptables -t mangle -D POSTROUTING -p tcp --dport 6667 -j 
CLASSIFY --set-class 1:20

    #default
    iptables -t mangle -D POSTROUTING -j CLASSIFY --set-class 1:90
}

start_inbound_device()
{
    echo "Starting inbound device"
    ip link set $INBOUND_DEV up
}

stop_inbound_device()
{
    echo "Stopping inbound device"
    ip link set $INBOUND_DEV down
}

start_inbound()
{
    echo "Starting inbound"
    tc qdisc add dev imq0 root handle 1: htb default 90

    #max download rate
    tc class add dev $INBOUND_DEV parent 1: classid 1:1 htb rate 110kbps


    #css
    tc class add dev $INBOUND_DEV parent 1:1 classid 1:10 htb rate 30kbps ceil 
110kbps prio 1
    iptables -t mangle -A PREROUTING -i ppp0 -p udp --sport 27000:27015 -j 
MARK --set-mark 1
    iptables -t mangle -A PREROUTING -i ppp0 -p tcp --sport 27020:27039 -j 
MARK --set-mark 1
    tc filter add dev $INBOUND_DEV parent 1:0 protocol ip prio 1 handle 1 fw 
classid 1:10

    #irc
    tc class add dev $INBOUND_DEV parent 1:1 classid 1:20 htb rate 10kbps ceil 
10kbps prio 2
    iptables -t mangle -A PREROUTING -i ppp0 -p tcp --sport 6667 -j 
MARK --set-mark 2
    tc filter add dev $INBOUND_DEV parent 1:0 protocol ip prio 2 handle 2 fw 
classid 1:20

    #p2p
    tc class add dev $INBOUND_DEV parent 1:1 classid 1:30 htb rate 40kbps ceil 
40kbps prio 3
    iptables -t mangle -A PREROUTING -p tcp --dport 6881:6999 -j 
MARK --set-mark 3
    tc filter add dev $INBOUND_DEV parent 1:0 protocol ip prio 3 handle 3 fw 
classid 1:30

    #default
    tc class add dev $INBOUND_DEV parent 1:1 classid 1:90 htb rate 30kbps ceil 
30kbps prio 4
  
    #fetch all incoming stuff and redirect it to imq0
    iptables -t mangle -A PREROUTING -i ppp0 -j IMQ --todev 0
}

stop_inbound_tc()
{
    echo "Stopping inbound tc"
    tc qdisc del dev $INBOUND_DEV root    2> /dev/null > /dev/null
    tc qdisc del dev $INBOUND_DEV ingress 2> /dev/null > /dev/null
}

stop_inbound_iptables()
{
    echo "Stopping inbound iptables"
    #css
    iptables -t mangle -D PREROUTING -i ppp0 -p udp --sport 27000:27015 -j 
MARK --set-mark 1
    iptables -t mangle -D PREROUTING -i ppp0 -p tcp --sport 27020:27039 -j 
MARK --set-mark 1
 
    #irc
    iptables -t mangle -D PREROUTING -i ppp0 -p tcp --sport 6667 -j 
MARK --set-mark 2
   
    #p2p
    iptables -t mangle -D PREROUTING -p tcp --dport 6881:6999 -j 
MARK --set-mark 3
   
    #default
    iptables -t mangle -D PREROUTING -j MARK --set-mark 4

    #fetch all incoming stuff and redirect it to imq0
    iptables -t mangle -D PREROUTING -i ppp0 -j IMQ --todev 0
}

start()
{
    start_outbound
    start_inbound_device
    start_inbound
}

stop()
{
    stop_outbound_tc
    stop_outbound_iptables
    stop_inbound_tc
    stop_inbound_device
    stop_inbound_iptables
}

show()
{
    echo "Outbound --- Outbound --- Outbound --- Outbound --- Outbound --- 
Outbound"
    echo "qdisc: -------------------------------------"
    tc -s -d qdisc show dev $OUTBOUND_DEV
    echo "classes: -----------------------------------"
    tc -s class show dev $OUTBOUND_DEV
    echo "filters: -----------------------------------"
    tc filter show dev $OUTBOUND_DEV

    echo "Inbound --- Inbound --- Inbound --- Inbound --- Inbound --- Inbound"
    echo "qdisc: -------------------------------------"
    tc -s -d qdisc show dev $INBOUND_DEV
    echo "classes: -----------------------------------"
    tc -s class show dev $INBOUND_DEV
    echo "filters: -----------------------------------"
    tc filter show dev $INBOUND_DEV
}


case "$1" in
    start)
        start
        ;;
    stop)
        stop
        ;;
    show)
        show
        ;;
    *)
        echo "Usage: /etc/init.d/shaper {start|stop|show}"
        exit 1
        ;;
esac



greets
Julius
From william.bohannan at spidersat.net  Tue Aug 15 17:30:01 2006
From: william.bohannan at spidersat.net (William Bohannan)
Date: Tue Aug 15 17:30:20 2006
Subject: [LARTC] smallest rate
In-Reply-To: <44E174D8.7050407@dtp.net.id>
Message-ID: <002001c6c07f$b42c2790$67020a0a@william>

So far the smallest rate I have been able to get is 1, why not use a
firewall if you want 0?

Kind Regards
William


-----Original Message-----
From: lartc-bounces@mailman.ds9a.nl [mailto:lartc-bounces@mailman.ds9a.nl]
On Behalf Of Kristiadi Himawan
Sent: 15 August 2006 07:17
To: lartc@mailman.ds9a.nl
Subject: [LARTC] smallest rate


Hi, anyone know the smallest rate for tc, is it possible using 0 bps ?


_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

From william.bohannan at spidersat.net  Tue Aug 15 17:36:43 2006
From: william.bohannan at spidersat.net (William Bohannan)
Date: Tue Aug 15 17:37:35 2006
Subject: [LARTC] Accounting using ip addresses and ulogd
Message-ID: <002101c6c080$a366ad80$67020a0a@william>

Hi use traffic shaping on my local lan and it keeps all drops packets by
logging them to mysql via ulogd.  Since there is windows and apple users on
the network I would like to have their "computer names" instead of ip
address to make for easy accounting.  Does anyone know of a script or tool
to get the ip address of a drop packet and turn it into a computer name (via
wins or something like that?)?

 

Kind Regards

 

William 

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060815/edae2574/attachment.html
From marek at piasta.pl  Tue Aug 15 17:43:29 2006
From: marek at piasta.pl (Marek Kierdelewicz)
Date: Tue Aug 15 17:38:02 2006
Subject: [LARTC] howto reduce the ping?
In-Reply-To: <200608151717.17048.julius.junghans@gmx.de>
References: <200608151717.17048.julius.junghans@gmx.de>
Message-ID: <20060815174329.545d81e2@localhost.localdomain>

> Hi,

Hi there

> 
> with the attached config my gaming ping is still +20ms, even if the
> line isn't saturated..can anybody give me a hint how to get a better
> response time? my line: 1024/128kbit

Try using tc filters instead of CLASSIFY and see if that helps. I've
seen some strange shaping behavior with it...

Another thing is prioritizing some of the htb classes. You can
set priority 1 for class 1:10 (css) and priority 2 for 1:20, 1:90
(lower is better). This way you're sure that css is getting max upload
speed if any other traffic is fighting his way out of your coputer.

You can do the same thing for download, but with your connection I
think that upload will be the most likely bottleneck.

cheers
-- 
Marek Kierdelewicz
Kierownik Dzia?u System?w Sieciowych, KoBa
Manager of Network Systems Department, KoBa
tel. (85) 7406466; fax. (85) 7406467
e-mail: admin@koba.pl
From julius.junghans at gmx.de  Tue Aug 15 20:38:38 2006
From: julius.junghans at gmx.de (Julius Junghans)
Date: Tue Aug 15 20:39:56 2006
Subject: [LARTC] howto reduce the ping?
In-Reply-To: <20060815174329.545d81e2@localhost.localdomain>
References: <200608151717.17048.julius.junghans@gmx.de>
	<20060815174329.545d81e2@localhost.localdomain>
Message-ID: <200608152038.40023.julius.junghans@gmx.de>

Am Dienstag 15 August 2006 17:43 schrieb Marek Kierdelewicz:
> > Hi,
>
> Hi there
>
> > with the attached config my gaming ping is still +20ms, even if the
> > line isn't saturated..can anybody give me a hint how to get a better
> > response time? my line: 1024/128kbit
>
> Try using tc filters instead of CLASSIFY and see if that helps. I've
> seen some strange shaping behavior with it...
Ive found only one explanation for port ranges on the mailing list and the 
author wasn't sure if it was correct...so i ask here:

#port range 27020:27039, protocol tcp

#iptables -t mangle -A POSTROUTING -p tcp --dport 27020:27039 -j 
CLASSIFY --set-class 1:10
    tc filter add dev ppp0 protocol ip parent 1: prio 1 u32 match ip dport 
27020 0x13 match ip protocol 6 0xff flowid 1:10

#port range 27000:27015, protocol udp

    #iptables -t mangle -A POSTROUTING -p udp --dport 27000:27015 -j 
CLASSIFY --set-class 1:10
    tc filter add dev ppp0 protocol ip parent 1: prio 1 u32 match ip dport 
27000 0x21 match ip protocol 17 0xff flowid 1:10

are the tc filters correct for the port ranges and the protocol?

>
> Another thing is prioritizing some of the htb classes. You can
> set priority 1 for class 1:10 (css) and priority 2 for 1:20, 1:90
> (lower is better). This way you're sure that css is getting max upload
> speed if any other traffic is fighting his way out of your coputer.
>
> You can do the same thing for download, but with your connection I
> think that upload will be the most likely bottleneck.
>
> cheers
From marek at piasta.pl  Wed Aug 16 00:09:11 2006
From: marek at piasta.pl (Marek Kierdelewicz)
Date: Wed Aug 16 00:03:23 2006
Subject: [LARTC] howto reduce the ping?
In-Reply-To: <200608152038.40023.julius.junghans@gmx.de>
References: <200608151717.17048.julius.junghans@gmx.de>
	<20060815174329.545d81e2@localhost.localdomain>
	<200608152038.40023.julius.junghans@gmx.de>
Message-ID: <20060816000911.6e466722@localhost.localdomain>


> #port range 27020:27039, protocol tcp
> 
> #iptables -t mangle -A POSTROUTING -p tcp --dport 27020:27039 -j 
> CLASSIFY --set-class 1:10
>     tc filter add dev ppp0 protocol ip parent 1: prio 1 u32 match ip
> dport 27020 0x13 match ip protocol 6 0xff flowid 1:10
> 

My choice would be fw filter:
iptables -t mangle -A POSTROUTING -p tcp --dport 27020:27039 -j MARK
--set-mark 0x10
tc filter add dev ppp0 protocol ip parent 1:0 prio 1 handle 0x10 fw
classid 1:10


> #port range 27000:27015, protocol udp
> 
>     #iptables -t mangle -A POSTROUTING -p udp --dport 27000:27015 -j 
> CLASSIFY --set-class 1:10
>     tc filter add dev ppp0 protocol ip parent 1: prio 1 u32 match ip
> dport 27000 0x21 match ip protocol 17 0xff flowid 1:10

iptables -t mangle -A POSTROUTING -p udp --dport 27000:27015 -j MARK
--set-mark 0x10

(filter same as above...only one needed)
tc filter add dev ppp0 protocol ip parent 1:0 prio 1 handle 0x10 fw
classid 1:10

Hope that helps.

cheers
-- 
Marek Kierdelewicz
Kierownik Dzia?u System?w Sieciowych, KoBa
Manager of Network Systems Department, KoBa
tel. (85) 7406466; fax. (85) 7406467
e-mail: admin@koba.pl
From julius.junghans at gmx.de  Wed Aug 16 01:34:51 2006
From: julius.junghans at gmx.de (Julius Junghans)
Date: Wed Aug 16 01:36:04 2006
Subject: [LARTC] howto reduce the ping?
In-Reply-To: <20060816000911.6e466722@localhost.localdomain>
References: <200608151717.17048.julius.junghans@gmx.de>
	<200608152038.40023.julius.junghans@gmx.de>
	<20060816000911.6e466722@localhost.localdomain>
Message-ID: <200608160134.52431.julius.junghans@gmx.de>

Am Mittwoch 16 August 2006 00:09 schrieb Marek Kierdelewicz:
> > #port range 27020:27039, protocol tcp
> >
> > #iptables -t mangle -A POSTROUTING -p tcp --dport 27020:27039 -j
> > CLASSIFY --set-class 1:10
> >     tc filter add dev ppp0 protocol ip parent 1: prio 1 u32 match ip
> > dport 27020 0x13 match ip protocol 6 0xff flowid 1:10
>
> My choice would be fw filter:
> iptables -t mangle -A POSTROUTING -p tcp --dport 27020:27039 -j MARK
> --set-mark 0x10
> tc filter add dev ppp0 protocol ip parent 1:0 prio 1 handle 0x10 fw
> classid 1:10
Ah, thats what you mean. Tried to avoid iptables at all...
Thx, will try that tomorrow.

>
> > #port range 27000:27015, protocol udp
> >
> >     #iptables -t mangle -A POSTROUTING -p udp --dport 27000:27015 -j
> > CLASSIFY --set-class 1:10
> >     tc filter add dev ppp0 protocol ip parent 1: prio 1 u32 match ip
> > dport 27000 0x21 match ip protocol 17 0xff flowid 1:10
>
> iptables -t mangle -A POSTROUTING -p udp --dport 27000:27015 -j MARK
> --set-mark 0x10
>
> (filter same as above...only one needed)
> tc filter add dev ppp0 protocol ip parent 1:0 prio 1 handle 0x10 fw
> classid 1:10
>
> Hope that helps.
>
> cheers

greets
Julius
From jarkao2 at o2.pl  Wed Aug 16 11:36:12 2006
From: jarkao2 at o2.pl (Jarek Poplawski)
Date: Wed Aug 16 11:35:49 2006
Subject: [LARTC] Re: Routing packets over multiple links (NICS) all on the
 same ISP all with same gateway.
In-Reply-To: <10c138640608140842x66bdc222q1f444e6d25f59582@mail.gmail.com>
References: <10c138640608140842x66bdc222q1f444e6d25f59582@mail.gmail.com>
Message-ID: <ebuoth$aeu$1@sea.gmane.org>

On 14-08-2006 17:42, Jacques Rompen wrote:
...
> What we want to do is the following:
> I live in a student complex with 7 other people. Every room has its own 
> internet connection from the same ISP.
> Ip, gateway, subnet are asigned through dhcp on mac-adres basis. Every 
> internet connection is capped at 20mbit
> up/down.
> We want to get all computers on an internal network. So we need some 
> sort of router that accepts all 8 internet
> connections and routes it out over a gbit nic -> switch -> internal network
> So we have a computer with 10 nics and "hopefully" enough internal bandwith.

Maybe you have some other reasons to make one gateway but to have 
internal network you only need to set a second address from local 
range (not colliding with that used by ISP) on each box.

But if you really need this together and with multipath, setting 
CONFIG_IP_ROUTE_MULTIPATH = "y" and 
CONFIG_IP_ROUTE_MULTIPATH_CACHED = "n" (!) should change 
multipath randomly.

Jarek P.


From jarkao2 at o2.pl  Wed Aug 16 12:16:24 2006
From: jarkao2 at o2.pl (Jarek Poplawski)
Date: Wed Aug 16 12:16:15 2006
Subject: [LARTC] Re: tc filter
In-Reply-To: <ebfcs8$d3n$1@sea.gmane.org>
References: <81c11a560608030906t525d6232vf135053463ce6a8f@mail.gmail.com>
	<ebfcs8$d3n$1@sea.gmane.org>
Message-ID: <ebur8t$hpn$1@sea.gmane.org>

On 10-08-2006 15:38, Jarek Poplawski wrote:
...
> # tc filter add dev eth0 parent 1: proto ip pref 100 \
>     u32 match ip dst 192.168.1.222 police drop

Should be:
# tc filter add dev eth0 parent 1: proto ip pref 100 \
u32 match ip dst 192.168.1.222 flowid 1: police \ 
              conform-exceed drop/drop

or:
# tc filter add dev eth0 parent 1: proto ip pref 100 \
u32 match ip dst 192.168.1.222 flowid 1: action drop

Jarek P.

From jrompen at gmail.com  Wed Aug 16 14:50:32 2006
From: jrompen at gmail.com (Jacques Rompen)
Date: Wed Aug 16 14:50:16 2006
Subject: [LARTC] Re: Routing packets over multiple links (NICS) all on the
	same ISP all with same gateway.
In-Reply-To: <ebuoth$aeu$1@sea.gmane.org>
References: <10c138640608140842x66bdc222q1f444e6d25f59582@mail.gmail.com>
	<ebuoth$aeu$1@sea.gmane.org>
Message-ID: <10c138640608160550v64ad239fw287ab7cfbcb7f150@mail.gmail.com>

On 8/16/06, Jarek Poplawski <jarkao2@o2.pl> wrote:
>
> On 14-08-2006 17:42, Jacques Rompen wrote:
> ...
> > What we want to do is the following:
> > I live in a student complex with 7 other people. Every room has its own
> > internet connection from the same ISP.
> > Ip, gateway, subnet are asigned through dhcp on mac-adres basis. Every
> > internet connection is capped at 20mbit
> > up/down.
> > We want to get all computers on an internal network. So we need some
> > sort of router that accepts all 8 internet
> > connections and routes it out over a gbit nic -> switch -> internal
> network
> > So we have a computer with 10 nics and "hopefully" enough internal
> bandwith.
>
> Maybe you have some other reasons to make one gateway but to have
> internal network you only need to set a second address from local
> range (not colliding with that used by ISP) on each box.
>
> But if you really need this together and with multipath, setting
> CONFIG_IP_ROUTE_MULTIPATH = "y" and
> CONFIG_IP_ROUTE_MULTIPATH_CACHED = "n" (!) should change
> multipath randomly.
>
> Jarek P.
>
>
> _______________________________________________
> LARTC mailing list
> LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
>

The 2 ips on every box wouldnt work because: Most people here are complete
network newbies, we want to connect more then 8 computers (most people have
a laptop and pc), we would only have a 20mbit internal network.

Im a bit confused. In the 2.4 kernel there issent even an option
ip_route_multipath_cached, only ip_route_multipath. Or am i mistaking here?
If there issent, then I couldnt have put it to 'Y' so why didnt the random
function work?

In the 2.6 kernel there is a option ip_route_multipath and
ip_route_multipath_cached. But if i dont say 'Y' to
ip_route_multipatch_cached i cant say yes to round_robin, random_match etc.
I thought i needed that option random_match set to 'y'. (im not sure if its
exactly spelled like that, but i'm talking about the four or five sub
options to ip_route_multipath_cached)
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060816/f15b7c98/attachment.htm
From jrompen at gmail.com  Wed Aug 16 15:11:56 2006
From: jrompen at gmail.com (Jacques Rompen)
Date: Wed Aug 16 15:11:42 2006
Subject: [LARTC] Routing packets over multiple links (NICS) all on the
	same ISP all with same gateway.
In-Reply-To: <200608141321.22643.luciano@lugmen.org.ar>
References: <10c138640608140842x66bdc222q1f444e6d25f59582@mail.gmail.com>
	<200608141321.22643.luciano@lugmen.org.ar>
Message-ID: <10c138640608160611w76a3498bv8d74d460541ddf4b@mail.gmail.com>

On 8/14/06, Luciano Ruete <luciano@lugmen.org.ar> wrote:

> On Monday 14 August 2006 12:42, Jacques Rompen wrote:
> > Ok ive been trying to get this to work for about half a year now. Ive
> > searched all over the internet for a solution for
> > my  problem. Ive found some solutions, but they only led me to yet more
> > problems.
> >
> > What we want to do is the following:
> > I live in a student complex with 7 other people. Every room has its own
> > internet connection from the same ISP.
> > Ip, gateway, subnet are asigned through dhcp on mac-adres basis. Every
> > internet connection is capped at 20mbit
> > up/down.
> > We want to get all computers on an internal network. So we need some
> sort
> > of router that accepts all 8 internet
> > connections and routes it out over a gbit nic -> switch -> internal
> network
> > So we have a computer with 10 nics and "hopefully" enough internal
> > bandwith.
>
> one simple solution is in this post[1] (read all the thread if you whant a
> context). Bassically it uses iptables CONNMARK to remembre to which
> iface(and
> certanly wich src ip) each connection flow belongs.
>
> You will have to use same gw in all ifaces, maybe the ip route "onlink"
> ption(command line) make your script simpler. No need to use julian patch
> and
> certanly DO NOT USE CONFIG_IP_ROUTE_MULTIPATH_CACHED in your kernel
> config.
>
> Feel free to post any doubts.
>
> Greets.
>
> [1]http://mailman.ds9a.nl/pipermail/lartc/2006q2/018964.html
> --
> --
> Luciano


Hi Luciano,

Ive tried the above solution but then with juliano's patch instead of
conmark. It didnt work then because this part of the script:

ip ro add default  nexthop via x.x.x.x dev eth1 weight 1 nexthop via
y.y.y.y dev eth2
ip route add default table provider1 via x.x.x.x dev eth1
ip route add default table provider2 via y.y.y.y dev eth2
# and most important
ip rule add fwmark 0x1 table provider1
ip rule add fwmark 0x2 table provider2

somehow looked at the default gateway x.x.x.x or y.y.y.y instead of to the
"dev ethx"
Because the gateway adresses were both the same x.x.x.x = y.y.y.y all the
outgoing packets were routed out over eth1.
Im not totaly sure, but the conmark line's only make sure that packets that
go out over some nic get back over the same nic? Or do they infact fix the
"same gateway"problem?

This is why i tried to get the script from my first post with random match
to work. This guy does exactly what i need to do, but somehow i can't get
random match to work. You think i should use a 2.6 or a 2.4 kernel?

Regards and thanks,

Jacques
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060816/8c1d538e/attachment.html
From jarkao2 at o2.pl  Wed Aug 16 15:52:24 2006
From: jarkao2 at o2.pl (Jarek Poplawski)
Date: Wed Aug 16 15:51:38 2006
Subject: [LARTC] Re: Routing packets over multiple links (NICS) all on the
 same ISP all with same gateway.
In-Reply-To: <10c138640608160550v64ad239fw287ab7cfbcb7f150@mail.gmail.com>
References: <10c138640608140842x66bdc222q1f444e6d25f59582@mail.gmail.com>	<ebuoth$aeu$1@sea.gmane.org>
	<10c138640608160550v64ad239fw287ab7cfbcb7f150@mail.gmail.com>
Message-ID: <ebv7te$tjt$1@sea.gmane.org>

On 16-08-2006 14:50, Jacques Rompen wrote:
...
> The 2 ips on every box wouldnt work because: Most people here are 
> complete network newbies, we want to connect more then 8 computers (most 
> people have a laptop and pc), we would only have a 20mbit internal network.
>  
> Im a bit confused. In the 2.4 kernel there issent even an option 
> ip_route_multipath_cached, only ip_route_multipath. Or am i mistaking here?
> If there issent, then I couldnt have put it to 'Y' so why didnt the 
> random function work?
>  
> In the 2.6 kernel there is a option ip_route_multipath and 
> ip_route_multipath_cached. But if i dont say 'Y' to 
> ip_route_multipatch_cached i cant say yes to round_robin, random_match 
> etc. I thought i needed that option random_match set to 'y'. (im not 
> sure if its exactly spelled like that, but i'm talking about the four or 
> five sub options to ip_route_multipath_cached)

As far as I know multipath cached should work for routing output 
of a current box but it's not working for router (if something 
has not changed lately). Multipath without "cached" should do 
simple randomization, but maybe for the begining it would be 
better to assign fixed paths by source ip and save experimenting 
with multipaths for later.

Jarek P.

From jrompen at gmail.com  Wed Aug 16 16:18:31 2006
From: jrompen at gmail.com (Jacques Rompen)
Date: Wed Aug 16 16:18:15 2006
Subject: [LARTC] Re: Routing packets over multiple links (NICS) all on the
	same ISP all with same gateway.
In-Reply-To: <ebv7te$tjt$1@sea.gmane.org>
References: <10c138640608140842x66bdc222q1f444e6d25f59582@mail.gmail.com>
	<ebuoth$aeu$1@sea.gmane.org>
	<10c138640608160550v64ad239fw287ab7cfbcb7f150@mail.gmail.com>
	<ebv7te$tjt$1@sea.gmane.org>
Message-ID: <10c138640608160718m50bf56dbn35b121ed68e984d6@mail.gmail.com>

On 8/16/06, Jarek Poplawski <jarkao2@o2.pl> wrote:
>
> As far as I know multipath cached should work for routing output
> of a current box but it's not working for router (if something
> has not changed lately). Multipath without "cached" should do
> simple randomization, but maybe for the begining it would be
> better to assign fixed paths by source ip and save experimenting
> with multipaths for later.
>
> Jarek P.


Hi Jarek,

I will try with only multipath.

Ive tried the static routes. But still ive had trouble getting this code to
work
ip ro add default  nexthop via x.x.x.x dev eth1 weight 1 nexthop via
y.y.y.y dev eth2
ip route add default table provider1 via x.x.x.x dev eth1
ip route add default table provider2 via y.y.y.y dev eth2
because x.x.x.x = y.y.y.y in my case. Somehow it doesnt look at the eth
device anymore.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060816/7f405bdc/attachment.htm
From 2z7mbt002 at sneakemail.com  Wed Aug 16 17:16:18 2006
From: 2z7mbt002 at sneakemail.com (Yves BLUSSEAU)
Date: Wed Aug 16 17:16:15 2006
Subject: [LARTC] How to bypass traffic control for one IP
Message-ID: <28632-76882@sneakemail.com>

Hi all,

i have a problem: i have an adsl modem that is connected to internet. I can't manage this modem.
Between my PC and the modem i have a linux firewall that make the NAT and the traffic shapping.
I have create a script that limit the bandwidth of the "external" interface of the firewall so i can manage my bandwidth for my internet application.
The problem is that i need to access the adsl modem at full bandwith (100mbits) from my PC (through the linux firewall).
So i need a configuration where all the internet IP are limited by the traffic control and where the IP of the modem is not slowdown by traffic shapping.

Who have an idea for such configuration ?

Thanks in advance.

Yves
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060816/fb8632ec/attachment.html
From luciano at lugmen.org.ar  Wed Aug 16 18:03:44 2006
From: luciano at lugmen.org.ar (Luciano Ruete)
Date: Wed Aug 16 17:57:31 2006
Subject: [LARTC] Routing packets over multiple links (NICS) all on the
	same ISP all with same gateway.
In-Reply-To: <10c138640608160611w76a3498bv8d74d460541ddf4b@mail.gmail.com>
References: <10c138640608140842x66bdc222q1f444e6d25f59582@mail.gmail.com>
	<200608141321.22643.luciano@lugmen.org.ar>
	<10c138640608160611w76a3498bv8d74d460541ddf4b@mail.gmail.com>
Message-ID: <200608161303.44888.luciano@lugmen.org.ar>

On Wednesday 16 August 2006 10:11, Jacques Rompen wrote:
> On 8/14/06, Luciano Ruete <luciano@lugmen.org.ar> wrote:
> > On Monday 14 August 2006 12:42, Jacques Rompen wrote:
> > > Ok ive been trying to get this to work for about half a year now. Ive
> > > searched all over the internet for a solution for
> > > my  problem. Ive found some solutions, but they only led me to yet more
> > > problems.
> > >
> > > What we want to do is the following:
> > > I live in a student complex with 7 other people. Every room has its own
> > > internet connection from the same ISP.
> > > Ip, gateway, subnet are asigned through dhcp on mac-adres basis. Every
> > > internet connection is capped at 20mbit
> > > up/down.
> > > We want to get all computers on an internal network. So we need some
> >
> > sort
> >
> > > of router that accepts all 8 internet
> > > connections and routes it out over a gbit nic -> switch -> internal
> >
> > network
> >
> > > So we have a computer with 10 nics and "hopefully" enough internal
> > > bandwith.
> >
> > one simple solution is in this post[1] (read all the thread if you whant
> > a context). Bassically it uses iptables CONNMARK to remembre to which
> > iface(and
> > certanly wich src ip) each connection flow belongs.
> >
> > You will have to use same gw in all ifaces, maybe the ip route "onlink"
> > ption(command line) make your script simpler. No need to use julian patch
> > and
> > certanly DO NOT USE CONFIG_IP_ROUTE_MULTIPATH_CACHED in your kernel
> > config.
> >
> > Feel free to post any doubts.
> >
> > Greets.
> >
> > [1]http://mailman.ds9a.nl/pipermail/lartc/2006q2/018964.html
> > --
> > --
> > Luciano
>
> Hi Luciano,
>
> Ive tried the above solution but then with juliano's patch instead of
> conmark. It didnt work then because this part of the script:
>
> ip ro add default  nexthop via x.x.x.x dev eth1 weight 1 nexthop via
> y.y.y.y dev eth2
> ip route add default table provider1 via x.x.x.x dev eth1
> ip route add default table provider2 via y.y.y.y dev eth2
> # and most important
> ip rule add fwmark 0x1 table provider1
> ip rule add fwmark 0x2 table provider2
>
> somehow looked at the default gateway x.x.x.x or y.y.y.y instead of to the
> "dev ethx"
> Because the gateway adresses were both the same x.x.x.x = y.y.y.y all the
> outgoing packets were routed out over eth1.

ok, what if you try with onlink:
ip ro add default  nexthop via x.x.x.x eth1 onlink nexthop via x.x.x.x eth2 
onlink and so on...

> Im not totaly sure, but the conmark line's only make sure that packets that
> go out over some nic get back over the same nic? Or do they infact fix the
> "same gateway"problem?

You are rigth, connmark does not solve the "same gw" problem, connmark is to 
guarantice that packet that belongs to a session dialog keeps the same src 
address. There is no need to patch the kernel, and it works perfectly well. 

> This is why i tried to get the script from my first post with random match
> to work. This guy does exactly what i need to do, but somehow i can't get
> random match to work. You think i should use a 2.6 or a 2.4 kernel?

I heavly recommend you to use a 2.6 CONNMARK enabled kernel, without julian's 
patchset and without setting CONFIG_IP_ROUTE_MULTIPATH_CACHED (turn it off) 
in my experience this is the simplest and robust solution.

Iptables random module comes with 2.6 stock kernel(at least now i can confirm 
2.6.8 and above, but i think all 2.6), if the onlink tip does not work, you 
can compile a 2.6 kernel with random enabled and try again. You can post the 
script that you are ussing, it should convine PREROUTING -j MARK rules with 
ip ru add fw MARK table mytableX. 
 
--
Luciano
From luciano at lugmen.org.ar  Wed Aug 16 18:18:40 2006
From: luciano at lugmen.org.ar (Luciano Ruete)
Date: Wed Aug 16 18:12:14 2006
Subject: [LARTC] Routing packets over multiple links (NICS) all on the
	same ISP all with same gateway.
In-Reply-To: <200608161303.44888.luciano@lugmen.org.ar>
References: <10c138640608140842x66bdc222q1f444e6d25f59582@mail.gmail.com>
	<10c138640608160611w76a3498bv8d74d460541ddf4b@mail.gmail.com>
	<200608161303.44888.luciano@lugmen.org.ar>
Message-ID: <200608161318.40236.luciano@lugmen.org.ar>

On Wednesday 16 August 2006 13:03, Luciano Ruete wrote:
> On Wednesday 16 August 2006 10:11, Jacques Rompen wrote:
> > On 8/14/06, Luciano Ruete <luciano@lugmen.org.ar> wrote:
> > > On Monday 14 August 2006 12:42, Jacques Rompen wrote:
> > > > Ok ive been trying to get this to work for about half a year now. Ive
> > > > searched all over the internet for a solution for
> > > > my  problem. Ive found some solutions, but they only led me to yet
> > > > more problems.
> > > >
> > > > What we want to do is the following:
> > > > I live in a student complex with 7 other people. Every room has its
> > > > own internet connection from the same ISP.
> > > > Ip, gateway, subnet are asigned through dhcp on mac-adres basis.
> > > > Every internet connection is capped at 20mbit
> > > > up/down.
> > > > We want to get all computers on an internal network. So we need some
> > >
> > > sort
> > >
> > > > of router that accepts all 8 internet
> > > > connections and routes it out over a gbit nic -> switch -> internal
> > >
> > > network
> > >
> > > > So we have a computer with 10 nics and "hopefully" enough internal
> > > > bandwith.
> > >
> > > one simple solution is in this post[1] (read all the thread if you
> > > whant a context). Bassically it uses iptables CONNMARK to remembre to
> > > which iface(and
> > > certanly wich src ip) each connection flow belongs.
> > >
> > > You will have to use same gw in all ifaces, maybe the ip route "onlink"
> > > ption(command line) make your script simpler. No need to use julian
> > > patch and
> > > certanly DO NOT USE CONFIG_IP_ROUTE_MULTIPATH_CACHED in your kernel
> > > config.
> > >
> > > Feel free to post any doubts.
> > >
> > > Greets.
> > >
> > > [1]http://mailman.ds9a.nl/pipermail/lartc/2006q2/018964.html
> > > --
> > > --
> > > Luciano
> >
> > Hi Luciano,
> >
> > Ive tried the above solution but then with juliano's patch instead of
> > conmark. It didnt work then because this part of the script:
> >
> > ip ro add default  nexthop via x.x.x.x dev eth1 weight 1 nexthop via
> > y.y.y.y dev eth2
> > ip route add default table provider1 via x.x.x.x dev eth1
> > ip route add default table provider2 via y.y.y.y dev eth2
> > # and most important
> > ip rule add fwmark 0x1 table provider1
> > ip rule add fwmark 0x2 table provider2
> >
> > somehow looked at the default gateway x.x.x.x or y.y.y.y instead of to
> > the "dev ethx"
> > Because the gateway adresses were both the same x.x.x.x = y.y.y.y all the
> > outgoing packets were routed out over eth1.
>
> ok, what if you try with onlink:
> ip ro add default  nexthop via x.x.x.x eth1 onlink nexthop via x.x.x.x eth2
> onlink and so on...

and forget to say, to be really shure, del any trace of
x.x.x.x dev ethx scope link 
in "ip ro ls". Where x.x.x.x is the gw ip, the onlink will force to drop the 
packet on the named device even if there is no physical route to that host.
--
Luciano
From clowncoder at clowncode.net  Wed Aug 16 19:21:43 2006
From: clowncoder at clowncode.net (clowncoder)
Date: Wed Aug 16 19:21:34 2006
Subject: [LARTC] New ClowToolKit version availlable
Message-ID: <1155748903.3839.9.camel@localhost.localdomain>

Hello
The real-time monitoring tool that can monitor all connexions
of all interfaces and the qdisc has been cleaned of a few bugs.
Try the new version at http://clowncode.net 

Regards to all of you.
Clowncoder.

From kartheekpn at yahoo.co.in  Thu Aug 17 08:31:25 2006
From: kartheekpn at yahoo.co.in (KartheeK)
Date: Thu Aug 17 08:31:12 2006
Subject: [LARTC] Bonding + Shaping --> Is it Possible?
Message-ID: <20060817063125.22903.qmail@web8507.mail.in.yahoo.com>

Hello All,

I was curious to know if I can do traffic shaping on abonded Interface?
Ex: I have to interfaces eth1 and eth2 which i have bonded together as bond0 , now the question is can I do shaping on eth1 and eth2 ??

Thanks
KartheeK

 				
---------------------------------
 Here's a new way to find what you're looking for - Yahoo! Answers 
Send FREE SMS to your friend's mobile from Yahoo! Messenger Version 8. Get it NOW
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060817/9f3e2b67/attachment.htm
From jarkao2 at o2.pl  Thu Aug 17 08:54:11 2006
From: jarkao2 at o2.pl (Jarek Poplawski)
Date: Thu Aug 17 08:53:42 2006
Subject: [LARTC] Re: Routing packets over multiple links (NICS) all on the
 same ISP all with same gateway.
In-Reply-To: <10c138640608160718m50bf56dbn35b121ed68e984d6@mail.gmail.com>
References: <10c138640608140842x66bdc222q1f444e6d25f59582@mail.gmail.com>	<ebuoth$aeu$1@sea.gmane.org>	<10c138640608160550v64ad239fw287ab7cfbcb7f150@mail.gmail.com>	<ebv7te$tjt$1@sea.gmane.org>
	<10c138640608160718m50bf56dbn35b121ed68e984d6@mail.gmail.com>
Message-ID: <ec13pb$ee8$1@sea.gmane.org>

On 16-08-2006 16:18, Jacques Rompen wrote:
> 
> 
> On 8/16/06, *Jarek Poplawski* <jarkao2@o2.pl <mailto:jarkao2@o2.pl>> wrote:
> 
>     As far as I know multipath cached should work for routing output
>     of a current box but it's not working for router (if something
>     has not changed lately). Multipath without "cached" should do
>     simple randomization, but maybe for the begining it would be
>     better to assign fixed paths by source ip and save experimenting
>     with multipaths for later.
> 
>     Jarek P.
> 
>  
> Hi Jarek,
>  
> I will try with only multipath.
>  
> Ive tried the static routes. But still ive had trouble getting this code 
> to work
> ip ro add default  nexthop via x.x.x.x dev eth1 weight 1 nexthop via
> y.y.y.y dev eth2
> ip route add default table provider1 via x.x.x.x dev eth1
> ip route add default table provider2 via y.y.y.y dev eth2
> because x.x.x.x = y.y.y.y in my case. Somehow it doesnt look at the eth 
> device anymore.

Anyway in my opinion it should work.
Try something like this:

#IP_ROUTE_MULTIPATH = "y"
#(if 2.6.x  IP_ROUTE_MULTIPATH_CACHED = "n" !)
#Here with CONNMARK method (so without Anastasov's patch!).
#Change 192.168.0.0/24 and eth0 to your local network
#address/mask and interface.

ip route add default nexthop via x.x.x.x dev eth1 \
   nexthop via x.x.x.x dev eth2

ip route add 192.168.0.0/24 dev eth0 table 101
ip route add default via x.x.x.x dev eth1 table 101

ip route add 192.168.0.0/24 dev eth0 table 102
ip route add default via x.x.x.x dev eth2 table 102

ip rule add fwmark 1 table 101
ip rule add fwmark 2 table 102

iptables -t mangle -A POSTROUTING -o eth1 -j MARK --set-mark 1
iptables -t mangle -A POSTROUTING -o eth2 -j MARK --set-mark 2

iptables -t mangle -A POSTROUTING -j CONNMARK --save-mark
iptables -t mangle -A PREROUTING -j CONNMARK --restore-mark

echo 0 > /proc/sys/net/ipv4/conf/all/rp_filter

You should also add NAT (MASQERADE) rules.

Nexthop devices will be changed randomly per flow (with some 
caching) so try with destinations from different networks.

Jarek P.

From hijacker at oldum.net  Thu Aug 17 12:32:05 2006
From: hijacker at oldum.net (nikolay)
Date: Thu Aug 17 12:31:58 2006
Subject: [LARTC] How to bypass traffic control for one IP
References: <28632-76882@sneakemail.com>
Message-ID: <016d01c6c1e8$630f5340$0600a8c0@hpa>

why would you want to "access" the adsl modem at 100Mbps?

What is the speed your ISP provides to the adsl modem?

-nik
----- Original Message ----- 
From: "Yves BLUSSEAU" <2z7mbt002@sneakemail.com>
To: <lartc@mailman.ds9a.nl>
Sent: Wednesday, August 16, 2006 6:16 PM
Subject: [LARTC] How to bypass traffic control for one IP


Hi all,

i have a problem: i have an adsl modem that is connected to internet. I 
can't manage this modem.
Between my PC and the modem i have a linux firewall that make the NAT and 
the traffic shapping.
I have create a script that limit the bandwidth of the "external" interface 
of the firewall so i can manage my bandwidth for my internet application.
The problem is that i need to access the adsl modem at full bandwith 
(100mbits) from my PC (through the linux firewall).
So i need a configuration where all the internet IP are limited by the 
traffic control and where the IP of the modem is not slowdown by traffic 
shapping.

Who have an idea for such configuration ?

Thanks in advance.

Yves


--------------------------------------------------------------------------------


> _______________________________________________
> LARTC mailing list
> LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
> 

From shadur at systemec.nl  Thu Aug 17 16:49:21 2006
From: shadur at systemec.nl (Rens Houben)
Date: Thu Aug 17 16:48:50 2006
Subject: [LARTC] TCNG and filter priorities
Message-ID: <20060817144921.GA6074@systemec.nl>

Hello,

	A while ago I switched a bandwidth management setup from
bash shell script using tc to a MUCH more readable tcng solution (yes,
the same one I asked for help with earlier. It worked perfectly, thanks)
and it's working very well.

However, one of our clients now has a slightly unique situation, in that
they're using colocation hosting to host their webserver with us, but
keep the database server it connects to on their own connection, which
only gets 2 Mbit to the outer world. I need to set up a special rule in
the shaping script to specifically cover that connection and that
connection only at a speed of 10 Mbit.

Now back when I used tc directly I could just add a higher prio value to
the tc filter statement, but I can't find the proper syntax to TCNG to
make this setup work. What am I missing?



-- 
Rens Houben                           |    opinions are mine
Resident linux guru and sysadmin      | if my employers have one
Systemec Internet Services.           |they'll tell you themselves
PGP key at http://marduk.systemec.nl/~shadur/shadur.key.asc
From luciano at lugmen.org.ar  Thu Aug 17 19:11:17 2006
From: luciano at lugmen.org.ar (Luciano Ruete)
Date: Thu Aug 17 19:04:49 2006
Subject: [LARTC] Re: Routing packets over multiple links (NICS) all on the
	same ISP all with same gateway.
In-Reply-To: <ec13pb$ee8$1@sea.gmane.org>
References: <10c138640608140842x66bdc222q1f444e6d25f59582@mail.gmail.com>
	<10c138640608160718m50bf56dbn35b121ed68e984d6@mail.gmail.com>
	<ec13pb$ee8$1@sea.gmane.org>
Message-ID: <200608171411.17528.luciano@lugmen.org.ar>

On Thursday 17 August 2006 03:54, Jarek Poplawski wrote:
> On 16-08-2006 16:18, Jacques Rompen wrote:
> > On 8/16/06, *Jarek Poplawski* <jarkao2@o2.pl <mailto:jarkao2@o2.pl>>
> > wrote:
> >
> >     As far as I know multipath cached should work for routing output
> >     of a current box but it's not working for router (if something
> >     has not changed lately). Multipath without "cached" should do
> >     simple randomization, but maybe for the begining it would be
> >     better to assign fixed paths by source ip and save experimenting
> >     with multipaths for later.
> >
> >     Jarek P.
> >
> >
> > Hi Jarek,
> >
> > I will try with only multipath.
> >
> > Ive tried the static routes. But still ive had trouble getting this code
> > to work
> > ip ro add default  nexthop via x.x.x.x dev eth1 weight 1 nexthop via
> > y.y.y.y dev eth2
> > ip route add default table provider1 via x.x.x.x dev eth1
> > ip route add default table provider2 via y.y.y.y dev eth2
> > because x.x.x.x = y.y.y.y in my case. Somehow it doesnt look at the eth
> > device anymore.
>
> Anyway in my opinion it should work.
> Try something like this:
>
> #IP_ROUTE_MULTIPATH = "y"
> #(if 2.6.x  IP_ROUTE_MULTIPATH_CACHED = "n" !)
> #Here with CONNMARK method (so without Anastasov's patch!).
> #Change 192.168.0.0/24 and eth0 to your local network
> #address/mask and interface.
>
> ip route add default nexthop via x.x.x.x dev eth1 \
>    nexthop via x.x.x.x dev eth2
>
> ip route add 192.168.0.0/24 dev eth0 table 101
> ip route add default via x.x.x.x dev eth1 table 101
>
> ip route add 192.168.0.0/24 dev eth0 table 102
> ip route add default via x.x.x.x dev eth2 table 102
>
> ip rule add fwmark 1 table 101
> ip rule add fwmark 2 table 102
>
> iptables -t mangle -A POSTROUTING -o eth1 -j MARK --set-mark 1
> iptables -t mangle -A POSTROUTING -o eth2 -j MARK --set-mark 2
>
> iptables -t mangle -A POSTROUTING -j CONNMARK --save-mark
> iptables -t mangle -A PREROUTING -j CONNMARK --restore-mark
>
> echo 0 > /proc/sys/net/ipv4/conf/all/rp_filter


if all ethx are on the same switch, you will need:
echo 1 > /proc/sys/net/ipv4/conf/all/arp_ignore
#you can also do it in a per iface basis

by default, if you recive an arp request(whohas) on a iface(iface1), asking 
for an ip that another iface(iface2) has, then the arp request is ansered 
with the MAC address of the first iface(iface1). If all devices are in the 
same fisical segment this can lead to a single device answer for all IPs, or 
to a total caos. 

This one is very hard to catch and i forgot to mention, now solved :-)

--
Luciano
From jrompen at gmail.com  Thu Aug 17 19:48:39 2006
From: jrompen at gmail.com (Jacques Rompen)
Date: Thu Aug 17 19:48:23 2006
Subject: [LARTC] Re: Routing packets over multiple links (NICS) all on the
	same ISP all with same gateway.
In-Reply-To: <200608171411.17528.luciano@lugmen.org.ar>
References: <10c138640608140842x66bdc222q1f444e6d25f59582@mail.gmail.com>
	<10c138640608160718m50bf56dbn35b121ed68e984d6@mail.gmail.com>
	<ec13pb$ee8$1@sea.gmane.org>
	<200608171411.17528.luciano@lugmen.org.ar>
Message-ID: <10c138640608171048x7797d67bxcef05f3f1b64c0d8@mail.gmail.com>

On 8/17/06, Luciano Ruete <luciano@lugmen.org.ar> wrote:
>
>
>
> if all ethx are on the same switch, you will need:
> echo 1 > /proc/sys/net/ipv4/conf/all/arp_ignore
> #you can also do it in a per iface basis
>
> by default, if you recive an arp request(whohas) on a iface(iface1),
> asking
> for an ip that another iface(iface2) has, then the arp request is ansered
> with the MAC address of the first iface(iface1). If all devices are in the
> same fisical segment this can lead to a single device answer for all IPs,
> or
> to a total caos.
>
> This one is very hard to catch and i forgot to mention, now solved :-)
>
> --
> Luciano


I will try all this tommorow, don't have acces to the box right now.

About turning of arp. If you turn them all of, wouldnt the nics (ip's) be
unfindable from the outside world? Or does the switch they connect to
respond to such an arp request aswell?
But what you are saying is that if i had a box with 2 nics each connected to
a different ISP, so each nic with a different gateway and ip. That if nic1
would recieve a arp request for the ip from nic2, it would respond with
mac-adres from nic1. So that could mean that all packets would come in over
nic1, even if they have destination ip(nic2)? Seems to me that this is never
realy desirable. Especialy if nic2 would have an static ip and i would
unplug nic2 on purpose.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060817/538fdda8/attachment.html
From luciano at lugmen.org.ar  Thu Aug 17 21:02:52 2006
From: luciano at lugmen.org.ar (Luciano Ruete)
Date: Thu Aug 17 21:02:42 2006
Subject: [LARTC] Re: Routing packets over multiple links (NICS) all on the
	same ISP all with same gateway.
In-Reply-To: <10c138640608171048x7797d67bxcef05f3f1b64c0d8@mail.gmail.com>
References: <10c138640608140842x66bdc222q1f444e6d25f59582@mail.gmail.com>
	<200608171411.17528.luciano@lugmen.org.ar>
	<10c138640608171048x7797d67bxcef05f3f1b64c0d8@mail.gmail.com>
Message-ID: <200608171602.52232.luciano@lugmen.org.ar>

On Thursday 17 August 2006 14:48, Jacques Rompen wrote:
> On 8/17/06, Luciano Ruete <luciano@lugmen.org.ar> wrote:
> > if all ethx are on the same switch, you will need:
> > echo 1 > /proc/sys/net/ipv4/conf/all/arp_ignore
> > #you can also do it in a per iface basis
> >
> > by default, if you recive an arp request(whohas) on a iface(iface1),
> > asking
> > for an ip that another iface(iface2) has, then the arp request is ansered
> > with the MAC address of the first iface(iface1). If all devices are in
> > the same fisical segment this can lead to a single device answer for all
> > IPs, or
> > to a total caos.
> >
> > This one is very hard to catch and i forgot to mention, now solved :-)
> >
> > --
> > Luciano
>
> I will try all this tommorow, don't have acces to the box right now.
>
> About turning of arp. If you turn them all of, wouldnt the nics (ip's) be
> unfindable from the outside world? Or does the switch they connect to
> respond to such an arp request aswell?

what you're turning off is that the device answers arp(whohas) requests for 
ips that are not from that specific device itself. The ips assigned to the 
device will cotinue answer as normal.

> But what you are saying is that if i had a box with 2 nics each connected
> to a different ISP, so each nic with a different gateway and ip. That if
> nic1 would recieve a arp request for the ip from nic2, it would respond
> with mac-adres from nic1. 

exactly!

> So that could mean that all packets would come in 
> over nic1, even if they have destination ip(nic2)? 

exactly, and will arrive destiny anyway, but they are incoming for the wrong 
iface.

> Seems to me that this is 
> never realy desirable.  

It is a really cuestionable default, but for shure that there are reasons for 
this(maybe a thread in lkml archives could answer this cuestion), reasons 
that i do not know.

> Especialy if nic2 would have an static ip and i  
> would unplug nic2 on purpose.

well thats the other scenario where i face the same problem, first guess is 
obvious MAC cache, and you tend to think that is fucked up, and no, it is 
this crossed arp answer.

--
Luciano
From gregoriandres at yahoo.com.ar  Fri Aug 18 03:46:08 2006
From: gregoriandres at yahoo.com.ar (LinuXKiD)
Date: Fri Aug 18 03:45:59 2006
Subject: [LARTC] Routing packets over multiple links (NICS) all on thesame
	ISP all with same gateway.
In-Reply-To: <200608161303.44888.luciano@lugmen.org.ar>
Message-ID: <FPEELEMAJNGBAMLHHOBHIELPGIAA.gregoriandres@yahoo.com.ar>


Hi !

Luciano: thanks for your posts on lugmen.org.ar and lartc!

I've read all of them, and I've a question:

What diferrence bewtween this:

-> ip ro add default  NEXTHOP via x.x.x.x dev eth1 weight 1  \ 
			    NEXTHOP via y.y.y.y dev eth2


and this:

->  ip route add x.x.x.x MPATH RR via y.y.y.y via z.z.z.z

I work with 2.4 Kernel Series. Is connvenient upgrade to 2.6 ?

Other question about this:

iptables -t mangle -A POSTROUTING -o eth0 -j CONNMARK --set-mark 0x1
iptables -t mangle -A POSTROUTING -o eth1 -j CONNMARK --set-mark 0x2

My problem is that I use CONNMARK's marks in order to mark P2P traffic.
Can I've a way to have diferents mark with CONNMARK ?

Thank you!!

Andres.
From kartheekpn at yahoo.co.in  Fri Aug 18 05:56:40 2006
From: kartheekpn at yahoo.co.in (KartheeK)
Date: Fri Aug 18 05:56:26 2006
Subject: [LARTC] Bonding + Shaping --> Is it Possible?
Message-ID: <20060818035640.39275.qmail@web8506.mail.in.yahoo.com>

Skipped content of type multipart/alternative-------------- next part --------------
_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
From samueldg at arcoscom.com  Fri Aug 18 08:23:00 2006
From: samueldg at arcoscom.com (=?ISO-8859-1?Q?Samuel_D=EDaz_Garc=EDa?=)
Date: Fri Aug 18 08:22:49 2006
Subject: [LARTC] Info about IFB
In-Reply-To: <44D91973.2020805@arcoscom.com>
References: <44D91973.2020805@arcoscom.com>
Message-ID: <44E55CC4.2040600@arcoscom.com>

Any help?

Samuel D?az Garc?a escribi?:
> Hi, I'm looking for info about IFB devices and how I can use it to 
> incomming traffic shapping.
> 
> Has IFB any web about it?
> Do any body known where I can find more info about it?
> 
> I found this:
> http://linux-net.osdl.org/index.php/IFB
> 
> But I can't stand fine how to use it to allow many ifb's devices or how 
> to use it with "tc actions".
> 
> Any help?
> 
> Thanks
> 

-- 
    Samuel D?az Garc?a
     Director Gerente
ArcosCom Wireless, S.L.L.

CIF: B11828068
c/ Romero Gago, 19
Arcos de la Frontera
11630 - Cadiz

http://www.arcoscom.com

mailto:samueldg@arcoscom.com
msn: samueldg@arcoscom.com

M?vil: 651 93 72 48
Tlfn.: 956 70 13 15
Fax:   956 70 34 83
From lists at andyfurniss.entadsl.com  Fri Aug 18 11:41:52 2006
From: lists at andyfurniss.entadsl.com (Andy Furniss)
Date: Fri Aug 18 11:41:24 2006
Subject: [LARTC] Info about IFB
In-Reply-To: <44D91973.2020805@arcoscom.com>
References: <44D91973.2020805@arcoscom.com>
Message-ID: <44E58B60.3040108@andyfurniss.entadsl.com>

Samuel D?az Garc?a wrote:
> Hi, I'm looking for info about IFB devices and how I can use it to 
> incomming traffic shapping.
> 
> Has IFB any web about it?
> Do any body known where I can find more info about it?
> 
> I found this:
> http://linux-net.osdl.org/index.php/IFB
> 
> But I can't stand fine how to use it to allow many ifb's devices or how 
> to use it with "tc actions".
> 
> Any help?
> 
> Thanks
> 

To use many you'll need to specify the number with modprobe -

modprobe ifb numifbs=20

ip link ls should show them all - you need to ip link set up dev ifbXX 
aswell.

to send arp coming in on eth0 to ifb19 which has a tbf on it (just to 
see counters - would be silly to really limit arp)

ip link set up ifb19
tc qdisc add dev ifb19 root tbf limit 2k rate 20kbit buffer 2k

tc qdisc add dev eth0 ingress
tc filter add dev eth0 parent ffff: protocol arp prio 1 u32 match u32 0 
0 flowid 1:1 action mirred egress redirect dev ifb19

The flowid 1:1 is what the classification will be when the packet 
returns from the ifb - unless you are shaping again (on a real dev - you 
can't chain ifbs) it doesn't really matter what you put, but you do need 
one as wothout it the rule will be accepted, but won't work (apart from 
as a counter)

look at counters with -

tc -s qdisc ls dev ifb19
tc -s filter ls dev eth0 parent ffff:

If you want to do the same sort of thing on egress you need to put 
something classfull on the interface rather than the default pfifo_fast 
  prio will do.

Some examples show using marks aswell, it's not needed as such and 
doesn't always work as the netfilter bits keep getting out of sync with 
  ifb.

Andy.


From lists at andyfurniss.entadsl.com  Fri Aug 18 12:13:22 2006
From: lists at andyfurniss.entadsl.com (Andy Furniss)
Date: Fri Aug 18 12:12:53 2006
Subject: [LARTC] howto reduce the ping?
In-Reply-To: <200608151717.17048.julius.junghans@gmx.de>
References: <200608151717.17048.julius.junghans@gmx.de>
Message-ID: <44E592C2.3080509@andyfurniss.entadsl.com>

Julius Junghans wrote:
> Hi,
> 
> with the attached config my gaming ping is still +20ms, even if the line isn't  
> saturated..can anybody give me a hint how to get a better response time? 
> my line: 1024/128kbit

Does not saturated mean no other traffic - I mean if you really have 
128kbit up eg. dsl then the bitrate latency of a 1500 byte packet is 
about 90ms so that's the best jitter you can get. Without tweaking and 
recompiling htb it's likely to be 2x that.

You also have to consider overheads (you can patch for dsl/atm 
overheads), and with htb it's better to have your game class with a high 
rate and the lesser classes can just borrow the spare.

You shouldn't see any difference in latency with/without htb on the 
interface - as long as there is no other traffic.

If I had 128kbit up I would consider reducing mtu on ppp0 or using 
netfilter to mss clamp so that outbound bulk packets were smaller.

For the ingress shaping to work you need to sacrifice bandwidth - quite 
alot for some traffic. you also need short queues so you drop packets.

If you do not specify htb/hfsc will pickup queue lengths from the 
interface defaults - 3 for ppp, 32 for imq, 1000 for eth - not always 
what you want.

Use counters to verify your classification is working -

iptables -L -v -n

tc -s class ls dev ppp0 etc


Andy.
From lists at andyfurniss.entadsl.com  Fri Aug 18 12:28:16 2006
From: lists at andyfurniss.entadsl.com (Andy Furniss)
Date: Fri Aug 18 12:27:41 2006
Subject: [LARTC] Re: tc filter
In-Reply-To: <ebur8t$hpn$1@sea.gmane.org>
References: <81c11a560608030906t525d6232vf135053463ce6a8f@mail.gmail.com>	<ebfcs8$d3n$1@sea.gmane.org>
	<ebur8t$hpn$1@sea.gmane.org>
Message-ID: <44E59640.9040207@andyfurniss.entadsl.com>

Jarek Poplawski wrote:

> Should be:
> # tc filter add dev eth0 parent 1: proto ip pref 100 \
> u32 match ip dst 192.168.1.222 flowid 1: police \              
> conform-exceed drop/drop

Looks a bit iffy but I haven't tried it - I thought that would be drop 
whether under or over - if it's valid at all without action/ a police rate.

Andy.
From lists at andyfurniss.entadsl.com  Fri Aug 18 12:41:20 2006
From: lists at andyfurniss.entadsl.com (Andy Furniss)
Date: Fri Aug 18 12:40:44 2006
Subject: [LARTC] enable p2p to some host (ipp2p)
In-Reply-To: <f05666f00608140400x3f47569ckfe834bb95c91e91a@mail.gmail.com>
References: <f05666f00608140400x3f47569ckfe834bb95c91e91a@mail.gmail.com>
Message-ID: <44E59950.4080302@andyfurniss.entadsl.com>

Roberto Pereyra wrote:
> Hi
> 
> I using ipp2p to block p2p traffic.
> 
> How to enable to use p2p to me host in my net ?
> 
> I using this setup:
> 
> iptables -A FORWARD -m ipp2p --ipp2p --bit --apple --winmx --soul --ares 
> -j DROP
> 
> 
> This setup:
> 
> iptables -A FORWARD -m ipp2p --ipp2p --bit --apple --winmx --soul
> --ares -d ! mynet -j DROP
> 
> iptables -A FORWARD -m ipp2p --ipp2p --bit --apple --winmx --soul
> --ares -s ! mynet -j DROP
> 
> 
> not works ....

Don't know really as I don't use ipp2p - but you could just match and 
return/accept mynet traffic before the ipp2p rules are hit.

Andy.
From lists at andyfurniss.entadsl.com  Fri Aug 18 12:55:18 2006
From: lists at andyfurniss.entadsl.com (Andy Furniss)
Date: Fri Aug 18 12:54:50 2006
Subject: [LARTC] ingress and flowid
In-Reply-To: <e55f48520608131318q33f5fc68yd38e38040d81aa3a@mail.gmail.com>
References: <e55f48520608091233k1c9fa4fche7ad14a8888b28a1@mail.gmail.com>
	<e55f48520608131318q33f5fc68yd38e38040d81aa3a@mail.gmail.com>
Message-ID: <44E59C96.6090304@andyfurniss.entadsl.com>

Andr?s Ghigliazza wrote:
> Hi there,
> 
> I am trying to understand our router / firewall, that was configured
> by another person. It is a Debian GNU/Linux with several
> configurations with tc and iptables.
> 
> I have a question about flowid in ingress qdisc. As fas as I know,
> this qdisc is a dummy one, and flowid is just used with :1 because the
> traffic have to be redirected to something.
> 
> However, in our router, there are some filters of ingress qdisc, that
> have differents flowids (:1, :2 and :5). Does that have any sense?

If they are before the mirred egress redirect dev dummyX then they will 
not affect the shaping/classification on the dummy setup, but will be 
restored when the packets leave dummy - so you can shape again if say 
you were doing it on egress (you can't filter redirected packets twice 
to avoid loops). I don't know whether they carry over to egress when 
it's done on ingress.

Andy.
From linux at arcoscom.com  Fri Aug 18 12:55:13 2006
From: linux at arcoscom.com (linux@arcoscom.com)
Date: Fri Aug 18 12:55:06 2006
Subject: [LARTC] enable p2p to some host (ipp2p)
In-Reply-To: <44E59950.4080302@andyfurniss.entadsl.com>
References: <f05666f00608140400x3f47569ckfe834bb95c91e91a@mail.gmail.com>
	<44E59950.4080302@andyfurniss.entadsl.com>
Message-ID: <36002.195.55.244.106.1155898513.squirrel@www.arcoscom.com>

In theory, for all p2p traffic matched by ipp2p you only need "--ipp2p"
parameter, not the rest you put.

You could use this:

#FIRST allow your net p2p traffic:
iptables -A FORWARD -d mynet -m ipp2p --ipp2p -j ACCEPT
iptables -A FORWARD -s mynet -m ipp2p --ipp2p -j ACCEPT

#Next, drop not your net p2p traffic:
iptables -A FORWARD -m ipp2p --ipp2p -j DROP

If these don't works (I remember some months ago I test it and don't works
fine), you'll need many rules, one per p2p type of traffic, as this:

iptables -A FORWARD -d mynet -m ipp2p --bit -j ACCEPT
iptables -A FORWARD -s mynet -m ipp2p --bit -j ACCEPT
iptables -A FORWARD -m ipp2p --bit -j DROP

iptables -A FORWARD -d mynet -m ipp2p --apple -j ACCEPT
iptables -A FORWARD -s mynet -m ipp2p --apple -j ACCEPT
iptables -A FORWARD -m ipp2p --apple -j DROP

...

iptables -A FORWARD -d mynet -m ipp2p --soul -j ACCEPT
iptables -A FORWARD -s mynet -m ipp2p --soul -j ACCEPT
iptables -A FORWARD -m ipp2p --soul -j DROP


Or if you don't want to write much, you can use:

export p2p_list="bit apple ... soul"
for i in ${p2p_list}; do
   iptables -A FORWARD -d mynet -m ipp2p --$i -j ACCEPT
   iptables -A FORWARD -s mynet -m ipp2p --$i -j ACCEPT
   iptables -A FORWARD -m ipp2p --$i -j DROP
done;

> Roberto Pereyra wrote:
>> Hi
>>
>> I using ipp2p to block p2p traffic.
>>
>> How to enable to use p2p to me host in my net ?
>>
>> I using this setup:
>>
>> iptables -A FORWARD -m ipp2p --ipp2p --bit --apple --winmx --soul --ares
>> -j DROP
>>
>>
>> This setup:
>>
>> iptables -A FORWARD -m ipp2p --ipp2p --bit --apple --winmx --soul
>> --ares -d ! mynet -j DROP
>>
>> iptables -A FORWARD -m ipp2p --ipp2p --bit --apple --winmx --soul
>> --ares -s ! mynet -j DROP
>>
>>
>> not works ....
>
> Don't know really as I don't use ipp2p - but you could just match and
> return/accept mynet traffic before the ipp2p rules are hit.
>
> Andy.
> _______________________________________________
> LARTC mailing list
> LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
>


From linux at arcoscom.com  Fri Aug 18 13:23:20 2006
From: linux at arcoscom.com (ArcosCom Linux User)
Date: Fri Aug 18 13:23:03 2006
Subject: [LARTC] Info about IFB
In-Reply-To: <44E58B60.3040108@andyfurniss.entadsl.com>
References: <44D91973.2020805@arcoscom.com>
	<44E58B60.3040108@andyfurniss.entadsl.com>
Message-ID: <43381.195.55.244.106.1155900200.squirrel@www.arcoscom.com>

I use IMQ to incomming traffic shaping (using u32 to match the
source/destination MACs)

With IMQ I use:

iptables -t mangle -A PREROUTING -i $if_wan0 -j IMQ --to-dev 0

(for example)

To enqueue packets into IMQ device and then shapping.

With IMQ I can use modprobe to set the device count I need and so on.

I really only want to replace IMQ scripts code with IFB, but, at least for
now, I don't stand fine the packet flow using IFB.

I stand now how to initialice ifbX with your example, good!!

Now some aditional question about your example:
   With this line:

tc qdisc add dev ifb19 root tbf limit 2k rate 20kbit buffer 2k

   You are initializing the qdisc for ibf in the same manner you could do
with imq?

   With this lines:
tc qdisc add dev eth0 ingress
tc filter add dev eth0 parent ffff: protocol arp prio 1 u32 match u32 0
0 flowid 1:1 action mirred egress redirect dev ifb19

   Are those analogous as this (my imq0 device as your ifb19 device):
iptables -t mangle -A PREROUTING -i $if_wan0 -j IMQ --to-dev 0

?

   The last, Do I only need add clases and qdiscs to ifb19 as if it where
my imq0 device?


Thanks and sorry for my english.



El Vie, 18 de Agosto de 2006, 11:41, Andy Furniss escribi?:
> Samuel D?az Garc?a wrote:
>> Hi, I'm looking for info about IFB devices and how I can use it to
>> incomming traffic shapping.
>>
>> Has IFB any web about it?
>> Do any body known where I can find more info about it?
>>
>> I found this:
>> http://linux-net.osdl.org/index.php/IFB
>>
>> But I can't stand fine how to use it to allow many ifb's devices or how
>> to use it with "tc actions".
>>
>> Any help?
>>
>> Thanks
>>
>
> To use many you'll need to specify the number with modprobe -
>
> modprobe ifb numifbs=20
>
> ip link ls should show them all - you need to ip link set up dev ifbXX
> aswell.
>
> to send arp coming in on eth0 to ifb19 which has a tbf on it (just to
> see counters - would be silly to really limit arp)
>
> ip link set up ifb19
> tc qdisc add dev ifb19 root tbf limit 2k rate 20kbit buffer 2k
>
> tc qdisc add dev eth0 ingress
> tc filter add dev eth0 parent ffff: protocol arp prio 1 u32 match u32 0
> 0 flowid 1:1 action mirred egress redirect dev ifb19
>
> The flowid 1:1 is what the classification will be when the packet
> returns from the ifb - unless you are shaping again (on a real dev - you
> can't chain ifbs) it doesn't really matter what you put, but you do need
> one as wothout it the rule will be accepted, but won't work (apart from
> as a counter)
>
> look at counters with -
>
> tc -s qdisc ls dev ifb19
> tc -s filter ls dev eth0 parent ffff:
>
> If you want to do the same sort of thing on egress you need to put
> something classfull on the interface rather than the default pfifo_fast
>   prio will do.
>
> Some examples show using marks aswell, it's not needed as such and
> doesn't always work as the netfilter bits keep getting out of sync with
>   ifb.
>
> Andy.
>
>
> _______________________________________________
> LARTC mailing list
> LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
>


From =?koi8-r?Q?=F0=CF=CB=CF=D4=C9=CC=C5=CE=CB=CF_?=  Fri Aug 18 13:31:49 2006
From: =?koi8-r?Q?=F0=CF=CB=CF=D4=C9=CC=C5=CE=CB=CF_?= (=?koi8-r?Q?=F0=CF=CB=CF=D4=C9=CC=C5=CE=CB=CF_?=)
Date: Fri Aug 18 13:31:42 2006
Subject: [LARTC] iproute2, alternative tables,
	no default route: routing trouble for localhost
Message-ID: <1155900710.5745.34.camel@localhost.localdomain>

Hi.

The task:

1. There 3 servers and a router with 2 PPPoE connections (let call them:
ppp0, ppp1).
2. There are several groups of Inet-clients to be served (Servers,
Clients and Club).
3. The task is:
   - to route Club through the ppp1;
   - to Servers and Clients through ppp0;

(Next is reproduced from memory and may be slightly incorrect)

router # netstat -nr
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt
Iface
192.168.1.0     0.0.0.0         255.255.255.0   U         0 0          0
eth0
a1.a2.a3.a4     0.0.0.0         255.255.255.255 U         0 0          0
ppp0
b1.b2.b3.b4     0.0.0.0         255.255.255.255 U         0 0          0
ppp1

router # cat /etc/iproute2/rt_tables
#
# reserved values
#
255     local
254     main
253     default
0       unspec
#
# local
#
#1      inr.ruhep
200 Servers
201 Clients
202 Club

router # ip rule ls
0:      from all lookup local
32763:  from 10.10.100.101/24 lookup Club
32764:  from 10.10.100.100/24 lookup Clients
32765:  from 192.168.1.0/24 lookup Servers
32766:  from all lookup main
32767:  from all lookup default

router # ip route ls table Clients
default via a1.a2.a3.a4 dev ppp0

router # ip route ls table Servers
default via a1.a2.a3.a4 dev ppp0

router # ip route ls table Club
default via b1.b2.b3.b4 dev ppp1

========================================

So, to summarize, the is no default route in main routing table. Each
group of clients is to be routed through its respective connection, and,
when its connection is down it is not to be routed.

This scheme works almost fine, 10.10.100.100/24 addresses are really
being routed through ppp0, 10.10.100.101/24 through ppp1 and
192.168.1.0/24 (3 Servers) through ppp0. BUT the router itself
(192.168.1.4) has no route to any host. I get "network is unreachable"
to any connectiion attempt from 192.168.1.4. And I can't connect to this
router from outside, because the packets have no route to be sent back.

I thought that there is different routing politics for localhost and
added default route to "local" table. 192.168.1.4 has started to have
the route, but the rest of the scheme started to work incorrectly.

So, the question is: how does the routing of packets comming from
localhost is being accomplished?

As to me there is a kind of "vicious circle" situation, because to enter
alternative routing table there should already be "source address", but
for localhost which have many source addresses it should decide which
route it needs to have the corresponding "source address" be set.

-- 
??????????? ?????? <casper@meteor.dp.ua>

From lists at andyfurniss.entadsl.com  Fri Aug 18 14:42:45 2006
From: lists at andyfurniss.entadsl.com (Andy Furniss)
Date: Fri Aug 18 14:41:54 2006
Subject: [LARTC] Info about IFB
In-Reply-To: <43381.195.55.244.106.1155900200.squirrel@www.arcoscom.com>
References: <44D91973.2020805@arcoscom.com>
	<44E58B60.3040108@andyfurniss.entadsl.com>
	<43381.195.55.244.106.1155900200.squirrel@www.arcoscom.com>
Message-ID: <44E5B5C5.5090908@andyfurniss.entadsl.com>

ArcosCom Linux User wrote:
> I use IMQ to incomming traffic shaping (using u32 to match the
> source/destination MACs)
> 
> With IMQ I use:
> 
> iptables -t mangle -A PREROUTING -i $if_wan0 -j IMQ --to-dev 0
> 
> (for example)
> 
> To enqueue packets into IMQ device and then shapping.
> 
> With IMQ I can use modprobe to set the device count I need and so on.
> 
> I really only want to replace IMQ scripts code with IFB, but, at least for
> now, I don't stand fine the packet flow using IFB.

IFB on ingress will hook the packets before netfilter, so you can't use 
iptables to mark or get the denatted addresses like you can with IMQ - 
so it's not a total replacement. There may be a way to do it in the future.

> 
> I stand now how to initialice ifbX with your example, good!!
> 
> Now some aditional question about your example:
>    With this line:
> 
> tc qdisc add dev ifb19 root tbf limit 2k rate 20kbit buffer 2k
> 
>    You are initializing the qdisc for ibf in the same manner you could do
> with imq?

Yes, you set up queues/filters the same as on imq.

> 
>    With this lines:
> tc qdisc add dev eth0 ingress
> tc filter add dev eth0 parent ffff: protocol arp prio 1 u32 match u32 0
> 0 flowid 1:1 action mirred egress redirect dev ifb19
> 
>    Are those analogous as this (my imq0 device as your ifb19 device):
> iptables -t mangle -A PREROUTING -i $if_wan0 -j IMQ --to-dev 0

tc qdisc add dev  $if_wan0 ingress
tc filter add dev $if_wan0 parent ffff: protocol ip ...

would be the same - iptables only sees ip, with ingress filter you can 
do others aswell if you want - all, arp, 8021q or any ethertype protocol 
number (FWIW you need a different prio number for each different 
ethertype filter).

> 
> ?
> 
>    The last, Do I only need add clases and qdiscs to ifb19 as if it where
> my imq0 device?

You'll need to filter aswell - on egress you can use iptables + marks (I 
don't think classify will work). But on ingress you can't use iptables 
because ifb is before netfilter.

Andy.
From marek at piasta.pl  Fri Aug 18 14:52:35 2006
From: marek at piasta.pl (Marek Kierdelewicz)
Date: Fri Aug 18 14:46:43 2006
Subject: [LARTC] iproute2, alternative tables,	no default route: routing
	trouble for localhost
In-Reply-To: <1155900710.5745.34.camel@localhost.localdomain>
References: <1155900710.5745.34.camel@localhost.localdomain>
Message-ID: <20060818145235.0012d511@localhost.localdomain>


> Hi.

Hi

> router # cat /etc/iproute2/rt_tables
> #
> # reserved values
> #
> 255     local
> 254     main
> 253     default
> 0       unspec
> #

Add default route to the "default" table .. it gets hit after your
custom tables as you can see here:

router # ip rule ls
0:      from all lookup local
32763:  from 10.10.100.101/24 lookup Club
32764:  from 10.10.100.100/24 lookup Clients
32765:  from 192.168.1.0/24 lookup Servers
32766:  from all lookup main
32767:  from all lookup default

This should allow your router to connect out and receive connections.

cheers
-- 
Marek Kierdelewicz
Kierownik Dzia?u System?w Sieciowych, KoBa
Manager of Network Systems Department, KoBa
tel. (85) 7406466; fax. (85) 7406467
e-mail: admin@koba.pl
From =?koi8-r?Q?=F0=CF=CB=CF=D4=C9=CC=C5=CE=CB=CF_?=  Fri Aug 18 15:15:38 2006
From: =?koi8-r?Q?=F0=CF=CB=CF=D4=C9=CC=C5=CE=CB=CF_?= (=?koi8-r?Q?=F0=CF=CB=CF=D4=C9=CC=C5=CE=CB=CF_?=)
Date: Fri Aug 18 15:15:29 2006
Subject: [LARTC] iproute2, alternative tables,	no default route:
	routing trouble for localhost
In-Reply-To: <20060818145235.0012d511@localhost.localdomain>
References: <1155900710.5745.34.camel@localhost.localdomain>
	<20060818145235.0012d511@localhost.localdomain>
Message-ID: <1155906938.13440.37.camel@localhost.localdomain>

? ???, 18/08/2006 ? 14:52 +0200, Marek Kierdelewicz ?????:
> > Hi.
> 
> Hi
> 
> > router # cat /etc/iproute2/rt_tables
> > #
> > # reserved values
> > #
> > 255     local
> > 254     main
> > 253     default
> > 0       unspec
> > #
> 
> Add default route to the "default" table .. it gets hit after your
> custom tables as you can see here:
> 
> router # ip rule ls
> 0:      from all lookup local
> 32763:  from 10.10.100.101/24 lookup Club
> 32764:  from 10.10.100.100/24 lookup Clients
> 32765:  from 192.168.1.0/24 lookup Servers
> 32766:  from all lookup main
> 32767:  from all lookup default
> 
> This should allow your router to connect out and receive connections.

Would 10.10.100.101/24 and 10.10.100.100/24 hit that table too? That's
not desirable because 10.10.100.101/24 should have no route if there is
no one in Club table, and 10.10.100.100/24 should have no route if there
no one in Clients table.

-- 
??????????? ?????? <casper@meteor.dp.ua>

From raju at linux-delhi.org  Fri Aug 18 15:21:01 2006
From: raju at linux-delhi.org (Raj Mathur)
Date: Fri Aug 18 15:20:47 2006
Subject: [LARTC] Handle limit in filter
Message-ID: <17637.48829.494838.331967@mail.linux-delhi.org>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

I've written a minimal sort of Perl module that dynamically creates
and destroys traffic control rules for specific IPs.  I'm currently
using it for a user bandwidth control application at a client site.

The module essentially gets Ethernet device(s), IP address and in/out
speeds as input and dynamically creates classes, queues and filters
for controlling speeds on the incoming and outgoing interfaces.  It
calls /sbin/tc internally to make the rules.  Similarly, when the user
is logged out, the module deletes the rules that it made earlier.

There are two issues I'm facing:

1. Is there any way remove filter rules without knowing the handle?
I'd like to be able to remove the filter rule using the same set of
data that I used to create it, but there doesn't seem to be any way to
do that.  Currently I'm parsing the whole ``tc filter show'' output to
find out the handle of the rule I'm interested in, then using that
handle in the ``tc remove'' command to delete the rule.  Inelegant and
inefficient, to say the least.

2. Can one have filter rules with handles > 800:fff?  After the
program has run for a while, the filter handle hits 800:fff, and then
I can not delete any of the new rules at all.  I'd be interested in
knowing how to make tc reuse handles; failing that, increasing the
number of unique handles would at least prevent my client from having
to reboot the server every day.

I'll be releasing the module under GPL once I've cleaned up the code
and documented the methods a bit.  Help on doing that appreciated.

Regards,

- -- Raju
- -- 
Raj Mathur                raju@kandalaya.org      http://kandalaya.org/
       GPG: 78D4 FC67 367F 40E2 0DD5  0FEF C968 D0EF CC68 D17F
                      It is the mind that moves
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (GNU/Linux)
Comment: Processed by Mailcrypt 3.5.8 <http://mailcrypt.sourceforge.net/>

iD8DBQFE5b66yWjQ78xo0X8RAvNpAJ9kfvotl0Ife92qoyBPlqxC5G+cYACeNvAG
rJT3lU8kd46ymbYcJwhb7e0=
=oJKh
-----END PGP SIGNATURE-----
From hijacker at oldum.net  Fri Aug 18 15:52:30 2006
From: hijacker at oldum.net (Nikolay Kichukov)
Date: Fri Aug 18 15:52:23 2006
Subject: [LARTC] How to bypass traffic control for one IP
In-Reply-To: <23741-26129@sneakemail.com>
References: <28632-76882@sneakemail.com>
	<016d01c6c1e8$630f5340$0600a8c0@hpa>  <5056-98503@sneakemail.com>
	<1155896549.3702.4.camel@ccja.localhost> <23741-26129@sneakemail.com>
Message-ID: <1155909150.4496.10.camel@ccja.localhost>

Okay,
the following may or may not work:

on the interface of the router that is connected to the adsl add an
engress HTB qdisc.

Then add classes accordingly. The first one with highest priority will
be for the 4Mbit traffic.
The classes after this one will be dependent on your likely.

Add some tc filters. The first one will match if dst ip is $IP_OF_ADSL
or dst port is $THE_BROADCAST_PORT_OF_THE_ADSL and it will use htb class
with highest priority.

Packets not having destination the adsl will be matched in the filters
afterwords, thus shaped and so.

However, I am not sure, if all of the packets will not go under that htb
class, because in their destination header they all have the adsl IP(the
default gateway).

Maybe someone on the list will englight me on that topic.

-nik


On Fri, 2006-08-18 at 12:47 +0200, Yves BLUSSEAU wrote:
> The adsl modem has two functions: it give me access to internet (max 80ko/s 
> upload) et it is use to broadcast video stream at more than 4Mo/s.
> I can't manage the modem.
> My PC, the firewall and the modem are locally connected at 100Mbits Full 
> Duplex.
> Like I said i want to shape the upload to internet and only to internet.
> So do you know a good configuration to shape all but not the traffic 
> directly send to the modem (to it's IP) ?
> 
> Yves
> 
> ----- Original Message ----- 
> From: "Nikolay Kichukov hijacker-at-oldum.net |Linux Advanced Routing & 
> Traffic Control project/1.0-Allow|" <...>
> To: <..................>
> Sent: Friday, August 18, 2006 12:22 PM
> Subject: Re: [LARTC] How to bypass traffic control for one IP
> 
> 
> You surely do need to send the video stream at full speed, but what is
> the point of doing so if the adsl modem(router) will still shape the
> upload at the speed that your ISP gives to you?
> 
> That will only saturate the link.
> 
> -nik
> 
> On Thu, 2006-08-17 at 21:05 +0200, Yves ........ wrote:
> > Because my asl modem is also a router and it is used to send broadcast 
> > video
> > to another network and so i need to send video stream at full speed to the
> > modem.
> > ----- Original Message ----- 
> > From: "nikolay hijacker-at-oldum.net |Linux Advanced Routing & Traffic
> > Control project/1.0-Allow|" <...>
> > To: <..................>
> > Sent: Thursday, August 17, 2006 12:32 PM
> > Subject: Re: [LARTC] How to bypass traffic control for one IP
> >
> >
> > > why would you want to "access" the adsl modem at 100Mbps?
> > >
> > > What is the speed your ISP provides to the adsl modem?
> > >
> > > -nik
> > > ----- Original Message ----- 
> > > From: "Yves ........" <2z7mbt002@sneakemail.com>
> > > To: <lartc@mailman.ds9a.nl>
> > > Sent: Wednesday, August 16, 2006 6:16 PM
> > > Subject: [LARTC] How to bypass traffic control for one IP
> > >
> > >
> > > Hi all,
> > >
> > > i have a problem: i have an adsl modem that is connected to internet. I
> > > can't manage this modem.
> > > Between my PC and the modem i have a linux firewall that make the NAT 
> > > and
> > > the traffic shapping.
> > > I have create a script that limit the bandwidth of the "external"
> > > interface of the firewall so i can manage my bandwidth for my internet
> > > application.
> > > The problem is that i need to access the adsl modem at full bandwith
> > > (100mbits) from my PC (through the linux firewall).
> > > So i need a configuration where all the internet IP are limited by the
> > > traffic control and where the IP of the modem is not slowdown by traffic
> > > shapping.
> > >
> > > Who have an idea for such configuration ?
> > >
> > > Thanks in advance.
> > >
> > > Yves
> > >
> > >
> > > --------------------------------------------------------------------------------
> > >
> > >
> > >> _______________________________________________
> > >> LARTC mailing list
> > >> LARTC@mailman.ds9a.nl
> > >> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
> > >>
> > >
> > >
> >
-- 
?????? ??? ????????, ??? ?????.
?? ?????? ??? ?????, ?? ?????? ??? ????????...
-????? ?????

From marek at piasta.pl  Fri Aug 18 17:05:16 2006
From: marek at piasta.pl (Marek Kierdelewicz)
Date: Fri Aug 18 16:59:23 2006
Subject: [LARTC] Handle limit in filter
In-Reply-To: <17637.48829.494838.331967@mail.linux-delhi.org>
References: <17637.48829.494838.331967@mail.linux-delhi.org>
Message-ID: <20060818170516.02fcd467@localhost.localdomain>


> Hi,

Hi there!
> 
> I've written a minimal sort of Perl module that dynamically creates
> and destroys traffic control rules for specific IPs.  I'm currently
> using it for a user bandwidth control application at a client site.

Been there, done that...

Better regenerate whole tc config and load it using "tc -b". It's
faster then many calls to tc binary (no context switching overhead).

cheers
-- 
Marek Kierdelewicz
Kierownik Dzia?u System?w Sieciowych, KoBa
Manager of Network Systems Department, KoBa
tel. (85) 7406466; fax. (85) 7406467
e-mail: admin@koba.pl
From =?koi8-r?Q?=F0=CF=CB=CF=D4=C9=CC=C5=CE=CB=CF_?=  Fri Aug 18 18:51:16 2006
From: =?koi8-r?Q?=F0=CF=CB=CF=D4=C9=CC=C5=CE=CB=CF_?= (=?koi8-r?Q?=F0=CF=CB=CF=D4=C9=CC=C5=CE=CB=CF_?=)
Date: Fri Aug 18 18:51:02 2006
Subject: [LARTC] iproute2, alternative tables, no default route:
	routing trouble for localhost [SOLVED]
In-Reply-To: <1155900710.5745.34.camel@localhost.localdomain>
References: <1155900710.5745.34.camel@localhost.localdomain>
Message-ID: <1155919876.5745.62.camel@localhost.localdomain>

I've found the answer in debian-firewall@lists.debian.org.

First:

I'm sorry, there was a typo while writing message. The correct subnets
are 10.10.101.0/24 and 10.10.100.0/24, not 10.10.100.101/24 and
10.10.100.100/24.

The solution is:

# ip rule add dev lo table Servers

as Pascal Hambourg <pascal.mail@plouf.fr.eu.org> advised, I'll quote:

> > So, the question is: how does the routing of packets comming from
> > localhost is being accomplished?
> 
> In the same way as the routing of forwarded packets. From "ip rule" 
> point of view, locally generated traffic is selected with "iif
lo" (see 
> iproute manual). Be aware that when the local source address is not 
> explicitly specified by the sending application, none of your custom 
> rules will match, so the "main" table will be used. But it contains
no 
> default route.



? ???, 18/08/2006 ? 14:31 +0300, ??????????? ?????? ?????:
> Hi.
> 
> The task:
> 
> 1. There 3 servers and a router with 2 PPPoE connections (let call them:
> ppp0, ppp1).
> 2. There are several groups of Inet-clients to be served (Servers,
> Clients and Club).
> 3. The task is:
>    - to route Club through the ppp1;
>    - to Servers and Clients through ppp0;
> 
> (Next is reproduced from memory and may be slightly incorrect)
> 
> router # netstat -nr
> Kernel IP routing table
> Destination     Gateway         Genmask         Flags   MSS Window  irtt
> Iface
> 192.168.1.0     0.0.0.0         255.255.255.0   U         0 0          0
> eth0
> a1.a2.a3.a4     0.0.0.0         255.255.255.255 U         0 0          0
> ppp0
> b1.b2.b3.b4     0.0.0.0         255.255.255.255 U         0 0          0
> ppp1
> 
> router # cat /etc/iproute2/rt_tables
> #
> # reserved values
> #
> 255     local
> 254     main
> 253     default
> 0       unspec
> #
> # local
> #
> #1      inr.ruhep
> 200 Servers
> 201 Clients
> 202 Club
> 
> router # ip rule ls
> 0:      from all lookup local
> 32763:  from 10.10.100.101/24 lookup Club
> 32764:  from 10.10.100.100/24 lookup Clients
> 32765:  from 192.168.1.0/24 lookup Servers
> 32766:  from all lookup main
> 32767:  from all lookup default
> 
> router # ip route ls table Clients
> default via a1.a2.a3.a4 dev ppp0
> 
> router # ip route ls table Servers
> default via a1.a2.a3.a4 dev ppp0
> 
> router # ip route ls table Club
> default via b1.b2.b3.b4 dev ppp1
> 
> ========================================
> 
> So, to summarize, the is no default route in main routing table. Each
> group of clients is to be routed through its respective connection, and,
> when its connection is down it is not to be routed.
> 
> This scheme works almost fine, 10.10.100.100/24 addresses are really
> being routed through ppp0, 10.10.100.101/24 through ppp1 and
> 192.168.1.0/24 (3 Servers) through ppp0. BUT the router itself
> (192.168.1.4) has no route to any host. I get "network is unreachable"
> to any connectiion attempt from 192.168.1.4. And I can't connect to this
> router from outside, because the packets have no route to be sent back.
> 
> I thought that there is different routing politics for localhost and
> added default route to "local" table. 192.168.1.4 has started to have
> the route, but the rest of the scheme started to work incorrectly.
> 
> So, the question is: how does the routing of packets comming from
> localhost is being accomplished?
> 
> As to me there is a kind of "vicious circle" situation, because to enter
> alternative routing table there should already be "source address", but
> for localhost which have many source addresses it should decide which
> route it needs to have the corresponding "source address" be set.
> 
-- 
??????????? ?????? <casper@meteor.dp.ua>

From cy at microembed.cn  Fri Aug 18 18:14:56 2006
From: cy at microembed.cn (Richard Cai)
Date: Fri Aug 18 18:55:52 2006
Subject: [LARTC] how to implement 802.1p QoS on Linux
Message-ID: <44E5E780.8030802@microembed.cn>

Hello everyone:

How to implement 802.1p Qos on linux?

Thanks


From raju at linux-delhi.org  Fri Aug 18 21:16:42 2006
From: raju at linux-delhi.org (Raj Mathur)
Date: Fri Aug 18 21:16:28 2006
Subject: [LARTC] Handle limit in filter
In-Reply-To: <20060818170516.02fcd467@localhost.localdomain>
References: <17637.48829.494838.331967@mail.linux-delhi.org>
	<20060818170516.02fcd467@localhost.localdomain>
Message-ID: <17638.4634.37306.164818@mail.linux-delhi.org>

>>>>> "Marek" == Marek Kierdelewicz <marek@piasta.pl> writes:

    >> I've written a minimal sort of Perl module that dynamically
    >> creates and destroys traffic control rules for specific IPs.
    >> I'm currently using it for a user bandwidth control application
    >> at a client site.

    Marek> Been there, done that...

    Marek> Better regenerate whole tc config and load it using "tc
    Marek> -b". It's faster then many calls to tc binary (no context
    Marek> switching overhead).

I don't really know what effect resetting the tc configuration every
few seconds would have on logged in users.  What happens to the
existing connections when the whole thing is reloaded?  Will they
jitter?  Or roll over and die, or just continue behaving as they were?

Wouldn't writing out commands for a few hundred connections into a
file and loading that file take a significant amount of time?

On the whole I'd prefer to do each connection as it comes up, so if
that's possible at all.

Regards,

-- Raju
-- 
Raj Mathur                raju@kandalaya.org      http://kandalaya.org/
       GPG: 78D4 FC67 367F 40E2 0DD5  0FEF C968 D0EF CC68 D17F
                      It is the mind that moves
From spam_dumpster2 at cox.net  Sat Aug 19 00:45:28 2006
From: spam_dumpster2 at cox.net (Spam Dumpster)
Date: Sat Aug 19 00:45:00 2006
Subject: [LARTC] RTNETLINK answers: File exists .. Network is unreachable
Message-ID: <7.0.1.0.2.20060818153650.020f0340@cox.net>


I am a Linux novice.

I have set up a Linux Router that is running the 2.6.15-1.2054_FC5 
kernel.  I boot to an initial router state and then I experiment with 
various "tc" commands by executing them at the command prompt.  I 
reboot often to restore the initial state.  When I booted up the 
router today I got the following messages during the boot process:

	Bringing up interface eth0:
	    RTNETLINK answers: File exists
	    RTNETLINK answers: Network is unreachable


	Bringing up interface eth1:
	    RTNETLINK answers: File exists
	    RTNETLINK answers: Network is unreachable

Will someone please enlighten me as to what is kind of problem is 
being indicated by these messages?

Thanks,

Bob

From kajtek at biezanow.net  Sat Aug 19 10:33:19 2006
From: kajtek at biezanow.net (Kajetan Staszkiewicz)
Date: Sat Aug 19 10:33:03 2006
Subject: [LARTC] Handle limit in filter
In-Reply-To: <17638.4634.37306.164818@mail.linux-delhi.org>
References: <17637.48829.494838.331967@mail.linux-delhi.org>
	<20060818170516.02fcd467@localhost.localdomain>
	<17638.4634.37306.164818@mail.linux-delhi.org>
Message-ID: <200608191033.29485.kajtek@biezanow.net>

Dnia pi?tek, 18 sierpnia 2006 21:16, Raj Mathur napisa?(a): 
> >>>>> "Marek" == Marek Kierdelewicz <marek@piasta.pl> writes:
>     >> I've written a minimal sort of Perl module that dynamically
>     >> creates and destroys traffic control rules for specific IPs.
>     >> I'm currently using it for a user bandwidth control application
>     >> at a client site.
>
>     Marek> Been there, done that...
>
>     Marek> Better regenerate whole tc config and load it using "tc
>     Marek> -b". It's faster then many calls to tc binary (no context
>     Marek> switching overhead).
>
> I don't really know what effect resetting the tc configuration every
> few seconds would have on logged in users.  What happens to the
> existing connections when the whole thing is reloaded?  Will they
> jitter?  Or roll over and die, or just continue behaving as they were?
>
> Wouldn't writing out commands for a few hundred connections into a
> file and loading that file take a significant amount of time?

I'm generating huge tc setup from database and loading it (which takes 
significant amount of time) only on router startup or reloading whole router 
configuration. 

To change speed limit of single host in network I'm using `tc class change`, 
which goes fast.

-- 
| pozdrawiam / greetings | powered by Trustix, Gentoo and FreeBSD   |
|  Kajetan Staszkiewicz  | jabber,email,www: vegeta()tuxpowered net |
|        Vegeta          | IMQ devnames: http://www.tuxpowered.net  |
`------------------------^------------------------------------------'
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url : http://mailman.ds9a.nl/pipermail/lartc/attachments/20060819/d60264cc/attachment.pgp
From raju at linux-delhi.org  Sat Aug 19 11:19:21 2006
From: raju at linux-delhi.org (Raj Mathur)
Date: Sat Aug 19 11:19:10 2006
Subject: [LARTC] Handle limit in filter
In-Reply-To: <200608191033.29485.kajtek@biezanow.net>
References: <17637.48829.494838.331967@mail.linux-delhi.org>
	<20060818170516.02fcd467@localhost.localdomain>
	<17638.4634.37306.164818@mail.linux-delhi.org>
	<200608191033.29485.kajtek@biezanow.net>
Message-ID: <17638.55193.412912.664725@mail.linux-delhi.org>

>>>>> "Kajetan" == Kajetan Staszkiewicz <kajtek@biezanow.net> writes:

    Kajetan> Dnia pi?tek, 18 sierpnia 2006 21:16, Raj Mathur
    Kajetan> napisa?(a):
    >> >>>>> "Marek" == Marek Kierdelewicz <marek@piasta.pl> writes:
    >> >> I've written a minimal sort of Perl module that dynamically
    >> >> creates and destroys traffic control rules for specific IPs.
    >> >> I'm currently using it for a user bandwidth control
    >> application >> at a client site.
    >> 
    Marek> Been there, done that...
    >>
    Marek> Better regenerate whole tc config and load it using "tc
    Marek> -b". It's faster then many calls to tc binary (no context
    Marek> switching overhead).
    >> I don't really know what effect resetting the tc configuration
    >> every few seconds would have on logged in users.  What happens
    >> to the existing connections when the whole thing is reloaded?
    >> Will they jitter?  Or roll over and die, or just continue
    >> behaving as they were?
    >> 
    >> Wouldn't writing out commands for a few hundred connections
    >> into a file and loading that file take a significant amount of
    >> time?

    Kajetan> I'm generating huge tc setup from database and loading it
    Kajetan> (which takes significant amount of time) only on router
    Kajetan> startup or reloading whole router configuration.

As I suspected... I wonder if Marek's solution would work in a
significantly dynamic environment? Any thoughts Marek?

    Kajetan> To change speed limit of single host in network I'm using
    Kajetan> `tc class change`, which goes fast.

I have to keep adding and deleting classes as users login and logout.
I'm afraid change is not an option for me.

Regards,

-- Raju
-- 
Raj Mathur                raju@kandalaya.org      http://kandalaya.org/
       GPG: 78D4 FC67 367F 40E2 0DD5  0FEF C968 D0EF CC68 D17F
                      It is the mind that moves
From hijacker at oldum.net  Sat Aug 19 16:21:40 2006
From: hijacker at oldum.net (nikolay)
Date: Sat Aug 19 16:21:36 2006
Subject: [LARTC] How to bypass traffic control for one IP
References: <28632-76882@sneakemail.com> <016d01c6c1e8$630f5340$0600a8c0@hpa>
	<5056-98503@sneakemail.com>
	<1155896549.3702.4.camel@ccja.localhost>
	<23741-26129@sneakemail.com>
	<1155909150.4496.10.camel@ccja.localhost>
	<7344-83645@sneakemail.com>
Message-ID: <008b01c6c39a$cb8f8bc0$0600a8c0@hpa>

sure i write an example.
it is all dependent on the ceil parameter on the class.
so if the class for the internet is 80kbps, than you will have rate 80kb 
ceil 80kb thus this class will not be able to borrow bandwith from the class 
above it.

example:

tc qdisc add dev eth1 root handle 1: htb default 11
tc class add dev eth1 parent 1: classid 1:1 htb rate 48kb ceil 48kb
tc class add dev eth1 parent 1:1 classid 1:10 htb rate 40kb ceil 40kb prio 1
tc class add dev eth1 parent 1:1 classid 1:11 htb rate 8kb ceil 8kb prio 2

What's next is to match the right packets into the right classes using 
filters.

Let me know if that helps.

btw eth1 will be the interface that is connected to the adsl router.

and 48kbps is just an example, feel free to adjust those values.

-nik
----- Original Message ----- 
From: "Yves BLUSSEAU" <2z7mbt002@sneakemail.com>
To: <hijacker@oldum.net>
Sent: Friday, August 18, 2006 5:05 PM
Subject: Re: [LARTC] How to bypass traffic control for one IP


> Thx nik,
>
> but what i don't understand is if that there no traffic to the first class 
> (4Mbit traffic) other class can borrow capacity from the first one. So the 
> traffic to internet is not limited to 80ko/s ?
> If i'm wrong, can you write an example ?
>
> Thanks in advance,
> Yves
>
> ----- Original Message ----- 
> From: "Nikolay Kichukov hijacker-at-oldum.net |Linux Advanced Routing & 
> Traffic Control project/1.0-Allow|" <...>
> To: <..................>
> Cc: <lartc@mailman.ds9a.nl>
> Sent: Friday, August 18, 2006 3:52 PM
> Subject: Re: [LARTC] How to bypass traffic control for one IP
>
>
> Okay,
> the following may or may not work:
>
> on the interface of the router that is connected to the adsl add an
> engress HTB qdisc.
>
> Then add classes accordingly. The first one with highest priority will
> be for the 4Mbit traffic.
> The classes after this one will be dependent on your likely.
>
> Add some tc filters. The first one will match if dst ip is $IP_OF_ADSL
> or dst port is $THE_BROADCAST_PORT_OF_THE_ADSL and it will use htb class
> with highest priority.
>
> Packets not having destination the adsl will be matched in the filters
> afterwords, thus shaped and so.
>
> However, I am not sure, if all of the packets will not go under that htb
> class, because in their destination header they all have the adsl IP(the
> default gateway).
>
> Maybe someone on the list will englight me on that topic.
>
> -nik
>
>
> On Fri, 2006-08-18 at 12:47 +0200, Yves ........ wrote:
>> The adsl modem has two functions: it give me access to internet (max 
>> 80ko/s
>> upload) et it is use to broadcast video stream at more than 4Mo/s.
>> I can't manage the modem.
>> My PC, the firewall and the modem are locally connected at 100Mbits Full
>> Duplex.
>> Like I said i want to shape the upload to internet and only to internet.
>> So do you know a good configuration to shape all but not the traffic
>> directly send to the modem (to it's IP) ?
>>
>> Yves
>>
>> ----- Original Message ----- 
>> From: "Nikolay Kichukov hijacker-at-oldum.net |Linux Advanced Routing &
>> Traffic Control project/1.0-Allow|" <...>
>> To: <..................>
>> Sent: Friday, August 18, 2006 12:22 PM
>> Subject: Re: [LARTC] How to bypass traffic control for one IP
>>
>>
>> You surely do need to send the video stream at full speed, but what is
>> the point of doing so if the adsl modem(router) will still shape the
>> upload at the speed that your ISP gives to you?
>>
>> That will only saturate the link.
>>
>> -nik
>>
>> On Thu, 2006-08-17 at 21:05 +0200, Yves ........ wrote:
>> > Because my asl modem is also a router and it is used to send broadcast
>> > video
>> > to another network and so i need to send video stream at full speed to 
>> > the
>> > modem.
>> > ----- Original Message ----- 
>> > From: "nikolay hijacker-at-oldum.net |Linux Advanced Routing & Traffic
>> > Control project/1.0-Allow|" <...>
>> > To: <..................>
>> > Sent: Thursday, August 17, 2006 12:32 PM
>> > Subject: Re: [LARTC] How to bypass traffic control for one IP
>> >
>> >
>> > > why would you want to "access" the adsl modem at 100Mbps?
>> > >
>> > > What is the speed your ISP provides to the adsl modem?
>> > >
>> > > -nik
>> > > ----- Original Message ----- 
>> > > From: "Yves ........" <2z7mbt002@sneakemail.com>
>> > > To: <lartc@mailman.ds9a.nl>
>> > > Sent: Wednesday, August 16, 2006 6:16 PM
>> > > Subject: [LARTC] How to bypass traffic control for one IP
>> > >
>> > >
>> > > Hi all,
>> > >
>> > > i have a problem: i have an adsl modem that is connected to internet. 
>> > > I
>> > > can't manage this modem.
>> > > Between my PC and the modem i have a linux firewall that make the NAT
>> > > and
>> > > the traffic shapping.
>> > > I have create a script that limit the bandwidth of the "external"
>> > > interface of the firewall so i can manage my bandwidth for my 
>> > > internet
>> > > application.
>> > > The problem is that i need to access the adsl modem at full bandwith
>> > > (100mbits) from my PC (through the linux firewall).
>> > > So i need a configuration where all the internet IP are limited by 
>> > > the
>> > > traffic control and where the IP of the modem is not slowdown by 
>> > > traffic
>> > > shapping.
>> > >
>> > > Who have an idea for such configuration ?
>> > >
>> > > Thanks in advance.
>> > >
>> > > Yves
>> > >
>> > >
>> > > --------------------------------------------------------------------------------
>> > >
>> > >
>> > >> _______________________________________________
>> > >> LARTC mailing list
>> > >> LARTC@mailman.ds9a.nl
>> > >> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
>> > >>
>> > >
>> > >
>> >
> -- 
> ?????? ??? ????????, ??? ?????.
> ?? ?????? ??? ?????, ?? ?????? ??? ????????...
> -????? ?????
>
>
> 

From marek at piasta.pl  Sun Aug 20 11:23:16 2006
From: marek at piasta.pl (Marek Kierdelewicz)
Date: Sun Aug 20 11:17:21 2006
Subject: [LARTC] Handle limit in filter
In-Reply-To: <17638.55193.412912.664725@mail.linux-delhi.org>
References: <17637.48829.494838.331967@mail.linux-delhi.org>
	<20060818170516.02fcd467@localhost.localdomain>
	<17638.4634.37306.164818@mail.linux-delhi.org>
	<200608191033.29485.kajtek@biezanow.net>
	<17638.55193.412912.664725@mail.linux-delhi.org>
Message-ID: <20060820112316.2fa86329@localhost.localdomain>


>     Kajetan> I'm generating huge tc setup from database and loading it
>     Kajetan> (which takes significant amount of time) only on router
>     Kajetan> startup or reloading whole router configuration.
> 
> As I suspected... I wonder if Marek's solution would work in a
> significantly dynamic environment? Any thoughts Marek?

Just try it... Generating large file with tc classes and filters and
then loading it with "tc -b" takes less then 1s on most system.

If you're worried about active connections - don't be. Shaping restart
won't break them.

I use this solution on routers with thousands of filters and classess
and full restart intervals as low 1 min. It works well.

> 
>     Kajetan> To change speed limit of single host in network I'm using
>     Kajetan> `tc class change`, which goes fast.
> 
> I have to keep adding and deleting classes as users login and logout.
> I'm afraid change is not an option for me.

Whatever you do, change/add/delete you can always pack commands in one
file and load them with "tc -b". Again, it's faster.

> 
> Regards,
> 
> -- Raju

Regards,
-- 
Marek Kierdelewicz
Kierownik Dzia?u System?w Sieciowych, KoBa
Manager of Network Systems Department, KoBa
tel. (85) 7406466; fax. (85) 7406467
e-mail: admin@koba.pl
From jarkao2 at o2.pl  Mon Aug 21 09:56:26 2006
From: jarkao2 at o2.pl (Jarek Poplawski)
Date: Mon Aug 21 09:55:44 2006
Subject: [LARTC] Re: tc filter
In-Reply-To: <44E59640.9040207@andyfurniss.entadsl.com>
References: <81c11a560608030906t525d6232vf135053463ce6a8f@mail.gmail.com>	<ebfcs8$d3n$1@sea.gmane.org>	<ebur8t$hpn$1@sea.gmane.org>
	<44E59640.9040207@andyfurniss.entadsl.com>
Message-ID: <ecbou0$1nf$1@sea.gmane.org>

On 18-08-2006 12:28, Andy Furniss wrote:
> Jarek Poplawski wrote:
> 
>> Should be:
>> # tc filter add dev eth0 parent 1: proto ip pref 100 \
>> u32 match ip dst 192.168.1.222 flowid 1: police \              
>> conform-exceed drop/drop
> 
> Looks a bit iffy but I haven't tried it - I thought that would be drop 
> whether under or over - if it's valid at all without action/ a police rate.

Maybe I should have written:
"Should be with a fairly current iproute2 and kernel:".

It's so called "New syntax" ("Old syntax" didn't work for me),
to add exceed action for zero rate. According to help rate and 
burst should be included, but it works anyway.

Jarek P.

From tino.kriswanto at gmail.com  Mon Aug 21 12:24:55 2006
From: tino.kriswanto at gmail.com (tino)
Date: Mon Aug 21 12:24:48 2006
Subject: [LARTC] maximum number of class
Message-ID: <004701c6c50c$1074b040$7a0989ca@bmsby010128>

Hi,
I just implement htb&cbq successfully.
My question , How many number of class (at maximum) I can create ?
I need 1500 class at least (for all campuss client host), attached inside 800mhz cpu 
1,5G ram, 40G disk with linux 2.6 kernels



regards,
Tino
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060821/bb7d869d/attachment.htm
From kartheekpn at yahoo.co.in  Mon Aug 21 14:05:21 2006
From: kartheekpn at yahoo.co.in (KartheeK)
Date: Mon Aug 21 14:05:13 2006
Subject: [LARTC] Bonding + Shaping --> Is it Possible?
In-Reply-To: <20060818035640.39275.qmail@web8506.mail.in.yahoo.com>
Message-ID: <20060821120524.32825.qmail@web8512.mail.in.yahoo.com>

  Hello All

Any Body, Any Thoughts?
Any Kind of feedback or suggestion is a welcome...

KartheeK

KartheeK <kartheekpn@yahoo.co.in> wrote: Hello All,

Has Any body of you  worked on such a set up?

KartheeK

KartheeK <kartheekpn@yahoo.co.in> wrote: Date: Thu, 17 Aug 2006 07:31:25 +0100 (BST)
From: KartheeK <kartheekpn@yahoo.co.in>
To: lartc@mailman.ds9a.nl
Subject: [LARTC] Bonding + Shaping --> Is it Possible?

 Hello All,

I was curious to know if I can do traffic shaping on abonded Interface?
Ex: I have to interfaces eth1 and eth2 which i have bonded together as bond0 , now the question is can I do shaping on eth1 and eth2 ??

Thanks
KartheeK
         

---------------------------------
  Here's a new way to find what you're looking for - Yahoo! Answers 
 Send FREE SMS to your friend's mobile from Yahoo! Messenger Version 8. Get it NOW_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

         

---------------------------------
  Here's a new way to find what you're looking for - Yahoo! Answers 
  Send FREE SMS to your friend's mobile from Yahoo! Messenger Version 8. Get it NOW_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc


 				
---------------------------------
 Here's a new way to find what you're looking for - Yahoo! Answers 
 Send FREE SMS to your friend's mobile from Yahoo! Messenger Version 8. Get it NOW
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060821/f7ca385e/attachment.html
From rvokal at redhat.com  Mon Aug 21 14:07:04 2006
From: rvokal at redhat.com (Radek =?ISO-8859-1?Q?Vok=E1l?=)
Date: Mon Aug 21 14:08:55 2006
Subject: [LARTC] [PATCH] missing flags for ip link
Message-ID: <1156162024.2906.55.camel@localhost.localdomain>

There's a flag 10000 that is not recognized by iproute. The kernel uses

#define IFF_LOWER_UP    0x10000         /* driver signals L1 up         */
#define IFF_DORMANT     0x20000         /* driver signals dormant       */


-- 
Radek Vok?l <rvokal@redhat.com>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: iproute2-2.6.16-flags.patch
Type: text/x-patch
Size: 318 bytes
Desc: not available
Url : http://mailman.ds9a.nl/pipermail/lartc/attachments/20060821/dfb14d79/iproute2-2.6.16-flags.bin
From jrompen at gmail.com  Mon Aug 21 14:20:33 2006
From: jrompen at gmail.com (Jacques Rompen)
Date: Mon Aug 21 14:20:16 2006
Subject: [LARTC] Re: Routing packets over multiple links (NICS) all on the
	same ISP all with same gateway.
In-Reply-To: <200608171602.52232.luciano@lugmen.org.ar>
References: <10c138640608140842x66bdc222q1f444e6d25f59582@mail.gmail.com>
	<200608171411.17528.luciano@lugmen.org.ar>
	<10c138640608171048x7797d67bxcef05f3f1b64c0d8@mail.gmail.com>
	<200608171602.52232.luciano@lugmen.org.ar>
Message-ID: <10c138640608210520j783f930egff3ded309e391824@mail.gmail.com>

On 8/17/06, Luciano Ruete <luciano@lugmen.org.ar> wrote:
>
> >
> > I will try all this tommorow, don't have acces to the box right now.
> >
> > About turning of arp. If you turn them all of, wouldnt the nics (ip's)
> be
> > unfindable from the outside world? Or does the switch they connect to
> > respond to such an arp request aswell?
>
> what you're turning off is that the device answers arp(whohas) requests
> for
> ips that are not from that specific device itself. The ips assigned to the
> device will cotinue answer as normal.
>
> > But what you are saying is that if i had a box with 2 nics each
> connected
> > to a different ISP, so each nic with a different gateway and ip. That if
> > nic1 would recieve a arp request for the ip from nic2, it would respond
> > with mac-adres from nic1.
>
> exactly!
>
> > So that could mean that all packets would come in
> > over nic1, even if they have destination ip(nic2)?
>
> exactly, and will arrive destiny anyway, but they are incoming for the
> wrong
> iface.
>
> > Seems to me that this is
> > never realy desirable.
>
> It is a really cuestionable default, but for shure that there are reasons
> for
> this(maybe a thread in lkml archives could answer this cuestion), reasons
> that i do not know.
>
> > Especialy if nic2 would have an static ip and i
> > would unplug nic2 on purpose.
>
> well thats the other scenario where i face the same problem, first guess
> is
> obvious MAC cache, and you tend to think that is fucked up, and no, it is
> this crossed arp answer.
>
> --
> Luciano


Hi Luciano and Jarek,

Thanks for all your help so far.

Ive had some try on the box this weekend. Unfortunatly its not in the
student complex anymore, but it will be very soon. So for now ive simulated
the situation by connecting 2 nics to a switch and that switch to a router.
This is the script i used so far, no NAT rules yet because i have no extra
computer to connect to the box. Its Jareks script completed with some hints
from Luciano


ip route add default nexthop via x.x.x.x dev eth1 onlink\
   nexthop via x.x.x.x dev eth2 onlink

ip route add 192.168.0.0/24 dev eth0 table 101
ip route add default via x.x.x.x dev eth1 table 101

ip route add 192.168.0.0/24 dev eth0 table 102
ip route add default via x.x.x.x dev eth2 table 102

ip rule add fwmark 1 table 101
ip rule add fwmark 2 table 102

iptables -t mangle -A POSTROUTING -o eth1 -j MARK --set-mark 1
iptables -t mangle -A POSTROUTING -o eth2 -j MARK --set-mark 2

iptables -t mangle -A POSTROUTING -j CONNMARK --save-mark
iptables -t mangle -A PREROUTING -j CONNMARK --restore-mark

echo 0 > /proc/sys/net/ipv4/conf/all/rp_filter

echo 1 > /proc/sys/net/ipv4/conf/all/arp_ignore

I am thinking if it wouldn't be better to include a src = ipe1 to the "route
add default" entries.
ofcourse this would go wrong if i would recive a new ip from the isp on one
of the nics. So if its not needed then i would rather leave it out.
ive tested the script with

ip route get from IPE1 to 204.152.189.113
ip route get from IPE2 to 204.152.189.113

it does indeed answer wit eth1 for the first and eth2 for the seccond. It
didnt do this with my other attempts. Im not sure if this is a real vallid
tes though.

Regards,

Jacques
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060821/9c37a87d/attachment.html
From ntdabrain at yahoo.com  Mon Aug 21 15:07:05 2006
From: ntdabrain at yahoo.com (Ntanzi Carrilho)
Date: Mon Aug 21 15:06:52 2006
Subject: [LARTC] XML input
Message-ID: <20060821130705.44511.qmail@web35315.mail.mud.yahoo.com>

Hello!

Is the traffic controller able to receive input in XML
format?

Regards

Tanzi

__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com 
From =?koi8-r?Q?=F0=CF=CB=CF=D4=C9=CC=C5=CE=CB=CF_?=  Mon Aug 21 15:23:35 2006
From: =?koi8-r?Q?=F0=CF=CB=CF=D4=C9=CC=C5=CE=CB=CF_?= (=?koi8-r?Q?=F0=CF=CB=CF=D4=C9=CC=C5=CE=CB=CF_?=)
Date: Mon Aug 21 15:39:13 2006
Subject: [LARTC] Bonding + Shaping --> Is it Possible?
In-Reply-To: <20060821120524.32825.qmail@web8512.mail.in.yahoo.com>
References: <20060821120524.32825.qmail@web8512.mail.in.yahoo.com>
Message-ID: <1156166615.32116.15.camel@localhost.localdomain>

I tryed to do some iptables rules on bonded interfaces and that didn't
worked. I had to use "ebtables".

BTW, what kind of bonding do you use?

? ???, 21/08/2006 ? 13:05 +0100, KartheeK ?????:
> Hello All
> 
> Any Body, Any Thoughts?
> Any Kind of feedback or suggestion is a welcome...
> 
> KartheeK
> 
> KartheeK <kartheekpn@yahoo.co.in> wrote:
>         Hello All,
>         
>         Has Any body of you  worked on such a set up?
>         
>         KartheeK
>         
>         KartheeK <kartheekpn@yahoo.co.in> wrote:
>                 Date: Thu, 17 Aug 2006 07:31:25 +0100 (BST)
>                 From: KartheeK <kartheekpn@yahoo.co.in>
>                 To: lartc@mailman.ds9a.nl
>                 Subject: [LARTC] Bonding + Shaping --> Is it Possible?
>                 
>                 Hello All,
>                 
>                 I was curious to know if I can do traffic shaping on
>                 abonded Interface?
>                 Ex: I have to interfaces eth1 and eth2 which i have
>                 bonded together as bond0 , now the question is can I
>                 do shaping on eth1 and eth2 ??
>                 
>                 Thanks
>                 KartheeK
>                 
>                 
>                 ______________________________________________________
>                 Here's a new way to find what you're looking for -
>                 Yahoo! Answers 
>                 Send FREE SMS to your friend's mobile from Yahoo!
>                 Messenger Version 8. Get it
>                 NOW_______________________________________________
>                 LARTC mailing list
>                 LARTC@mailman.ds9a.nl
>                 http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
>         
>         
>         
>         ______________________________________________________________
>         Here's a new way to find what you're looking for - Yahoo!
>         Answers 
>         Send FREE SMS to your friend's mobile from Yahoo! Messenger
>         Version 8. Get it
>         NOW_______________________________________________
>         LARTC mailing list
>         LARTC@mailman.ds9a.nl
>         http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
>         _______________________________________________
>         LARTC mailing list
>         LARTC@mailman.ds9a.nl
>         http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
> 
> 
> 
> 
> ______________________________________________________________________
> Here's a new way to find what you're looking for - Yahoo! Answers 
> Send FREE SMS to your friend's mobile from Yahoo! Messenger Version 8.
> Get it NOW
> _______________________________________________
> LARTC mailing list
> LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
-- 
??????????? ?????? <casper@meteor.dp.ua>

From goran.raovic at gmail.com  Mon Aug 21 17:37:01 2006
From: goran.raovic at gmail.com (Goran Raovic)
Date: Mon Aug 21 17:36:45 2006
Subject: [LARTC] tc filter don't match packets
Message-ID: <732234b80608210837q143b7c5ai5c7bad9297623a17@mail.gmail.com>

Hi,

I have problem with this simple script:

#!/bin/bash
if [ "$1" == "del" ]; then
tc qdisc del dev eth0 root handle 1: htb default 10
exit
fi
tc qdisc add dev eth0 root handle 1: htb default 10
tc class add dev eth0 parent 1: classid 1:1 htb rate 800kbit ceil 900kbit
tc class add dev eth0 parent 1:1 classid 1:10 htb rate 300kbit ceil 600kbit
tc class add dev eth0 parent 1:1 classid 1:11 htb rate 100kbit ceil 800kbit
tc qdisc add dev eth0 parent 1:11 handle 11: pfifo limit 5
tc filter add dev eth0 parent 1:11 protocol ip prio 1 u32 match ip dport 80
0xffff flowid 1:11

unfortunaly when I start that scripts tc filter don't match packets with
dport 80!

Output of tc -s -d class show dev eth0 is:

class htb 1:11 parent 1:1 leaf 11: prio 0 quantum 1000 rate 10000bit ceil
100000bit burst 1605b/8 mpu 0b overhead 0b cburst 1650b/8 mpu 0b overhead 0b
level 0
 Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0)
 rate 0bit 0pps backlog 0b 0p requeues 0
 lended: 0 borrowed: 0 giants: 0
 tokens: 1284000 ctokens: 132000

class htb 1:1 root rate 800000bit ceil 900000bit burst 2000b/8 mpu 0b
overhead 0b cburst 2Kb/8 mpu 0b overhead 0b level 7
 Sent 320 bytes 5 pkt (dropped 0, overlimits 0 requeues 0)
 rate 0bit 0pps backlog 0b 0p requeues 0
 lended: 0 borrowed: 0 giants: 0
 tokens: 19360 ctokens: 17654

class htb 1:10 parent 1:1 prio 0 quantum 3750 rate 300000bit ceil 600000bit
burst 1749b/8 mpu 0b overhead 0b cburst 1899b/8 mpu 0b overhead 0b level 0
 Sent 320 bytes 5 pkt (dropped 0, overlimits 0 requeues 0)
 rate 0bit 0pps backlog 0b 0p requeues 0
 lended: 5 borrowed: 0 giants: 0
 tokens: 44960 ctokens: 24480

I use SuSE 10.1 with 2.6.16 .

Have you any sugestion?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060821/e763d9e8/attachment.htm
From jbold at inbox.lv  Mon Aug 21 17:46:18 2006
From: jbold at inbox.lv (Jurijs Petrovs)
Date: Mon Aug 21 17:46:02 2006
Subject: [LARTC] New hardware
Message-ID: <1156175178.44e9d54a18bd1@www.inbox.lv>

Hi! 

I want to upgrade hardware on my router (iptables, htb, >1000 users).
Now it is 
based on usual desktop PC (Intel Prescott P4 3.00 Ghz, 1 Gb RAM). The
reason of hardware upgrade is growing up number of users, also we are
planning to increase upstream link from 100 Mbit/s to 1 Gbit/s.
Iptables rules are now optimized with ipset tool, for tc I'm using
hash tables as well. So I didn't know how to increase performance of
my router without hardware upgrade... 

I&rsquo;d appreciate if someone gives me advice &ndash; what system
shows the best performance: 

1) Server based router (with dual core Xeon CPU) 
2) Desktop based router (with newest Intel Core 2 Duo CPU) 
3) what about AMD (I have no personal experience with them)? 

As I know, 64-bit architecture in router specific tasks doesn&rsquo;t
give any performance boost? Maybe there are some other nuances that I
need to know (kernel hacking, hardware hints)? 

I&rsquo;m going to use standard Intel E1000 NIC for 1 Gbit/s speed
line, is it a good choice? 

Thank in advance! 

Advertisement:

Es iesu uz mobilo festivalu "re:loud"!
14 grupas, 2 skatuves, DJ telts, atrakcijas
1.septembri Mezaparka estrade www.reloud.lv
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060821/6fce648f/attachment.html
From marek at piasta.pl  Mon Aug 21 18:16:12 2006
From: marek at piasta.pl (Marek Kierdelewicz)
Date: Mon Aug 21 18:10:18 2006
Subject: [LARTC] New hardware
In-Reply-To: <1156175178.44e9d54a18bd1@www.inbox.lv>
References: <1156175178.44e9d54a18bd1@www.inbox.lv>
Message-ID: <20060821181612.25e0d962@localhost.localdomain>

> Hi! 

Hi

> reason of hardware upgrade is growing up number of users, also we are
> planning to increase upstream link from 100 Mbit/s to 1 Gbit/s.

If you want to move around 1Gbit/s you need PCI-X or PCI-E network
interfaces (PCI bus would be a bottleneck).

> 1) Server based router (with dual core Xeon CPU) 

I've been using for some time now router with 2xsingle-core Xeon CPU
for servicing 2k+ users. It works well. 

> 2) Desktop based router (with newest Intel Core 2 Duo CPU) 

Did't have a pleasure. I'd like to hear some opinions on that one too.

> 3) what about AMD (I have no personal experience with them)? 

I'm trying to use unorthodox hardware setup for fast router:

Dual core AMD64
desktop motherboard with 2xPCIe x16 slots (SLI capable motherboard)
two PCIe x4 intel E1000 Server network adapters

Preliminary tests look promising. Network adapters mentioned above
should in theory do better then previous PCI-X network adapters.

> 
> As I know, 64-bit architecture in router specific tasks doesn&rsquo;t
> give any performance boost? Maybe there are some other nuances that I
> need to know (kernel hacking, hardware hints)? 

I think 64-bit architectures can do much better then 32-bit ones... at
least on 64-bit kernel.

> 
> I&rsquo;m going to use standard Intel E1000 NIC for 1 Gbit/s speed
> line, is it a good choice? 

Best choice as far as I know. Anyone would sugest something else?

Regards,
-- 
Marek Kierdelewicz
Kierownik Dzia?u System?w Sieciowych, KoBa
Manager of Network Systems Department, KoBa
tel. (85) 7406466; fax. (85) 7406467
e-mail: admin@koba.pl
From kartheekpn at yahoo.co.in  Mon Aug 21 18:30:20 2006
From: kartheekpn at yahoo.co.in (KartheeK)
Date: Mon Aug 21 18:30:11 2006
Subject: [LARTC] Bonding + Shaping --> Is it Possible?
In-Reply-To: <1156166615.32116.15.camel@localhost.localdomain>
Message-ID: <20060821163023.67172.qmail@web8510.mail.in.yahoo.com>

I have bonded two interfaces in mode 0 for load balancing and link sharing.
My understanding is that "traffic control" happens, below bonding and hence this should be possible. I am currently short of lab equipments and am planning to try this some time this week end...
I  am curious about similar implemantations and/or thoughts,,,,,,

??????????? ?????? <casper@meteor.dp.ua> wrote: I tryed to do some iptables rules on bonded interfaces and that didn't
worked. I had to use "ebtables".

BTW, what kind of bonding do you use?

? ???, 21/08/2006 ? 13:05 +0100, KartheeK ?????:
> Hello All
> 
> Any Body, Any Thoughts?
> Any Kind of feedback or suggestion is a welcome...
> 
> KartheeK
> 
> KartheeK  wrote:
>         Hello All,
>         
>         Has Any body of you  worked on such a set up?
>         
>         KartheeK
>         
>         KartheeK  wrote:
>                 Date: Thu, 17 Aug 2006 07:31:25 +0100 (BST)
>                 From: KartheeK 
>                 To: lartc@mailman.ds9a.nl
>                 Subject: [LARTC] Bonding + Shaping --> Is it Possible?
>                 
>                 Hello All,
>                 
>                 I was curious to know if I can do traffic shaping on
>                 abonded Interface?
>                 Ex: I have to interfaces eth1 and eth2 which i have
>                 bonded together as bond0 , now the question is can I
>                 do shaping on eth1 and eth2 ??
>                 
>                 Thanks
>                 KartheeK
>                 
>                 
>                 ______________________________________________________
>                 Here's a new way to find what you're looking for -
>                 Yahoo! Answers 
>                 Send FREE SMS to your friend's mobile from Yahoo!
>                 Messenger Version 8. Get it
>                 NOW_______________________________________________
>                 LARTC mailing list
>                 LARTC@mailman.ds9a.nl
>                 http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
>         
>         
>         
>         ______________________________________________________________
>         Here's a new way to find what you're looking for - Yahoo!
>         Answers 
>         Send FREE SMS to your friend's mobile from Yahoo! Messenger
>         Version 8. Get it
>         NOW_______________________________________________
>         LARTC mailing list
>         LARTC@mailman.ds9a.nl
>         http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
>         _______________________________________________
>         LARTC mailing list
>         LARTC@mailman.ds9a.nl
>         http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
> 
> 
> 
> 
> ______________________________________________________________________
> Here's a new way to find what you're looking for - Yahoo! Answers 
> Send FREE SMS to your friend's mobile from Yahoo! Messenger Version 8.
> Get it NOW
> _______________________________________________
> LARTC mailing list
> LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
-- 
??????????? ?????? 



 				
---------------------------------
 Here's a new way to find what you're looking for - Yahoo! Answers 
 Send FREE SMS to your friend's mobile from Yahoo! Messenger Version 8. Get it NOW
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060821/e4873f72/attachment.htm
From rdzil.sk.lartc at gmail.com  Mon Aug 21 20:37:36 2006
From: rdzil.sk.lartc at gmail.com (Robo R0b0)
Date: Mon Aug 21 20:37:19 2006
Subject: [LARTC] IFB - Download: 1xWAN (Internet) 2xLAN (local)
Message-ID: <3245374a0608211137j629e1f24t6f9ef6625c561319@mail.gmail.com>

hello, i have eth0 (Internet) + eth1,eth2 (local), how to i use IFB in real
for shaping Download, how to i redirect traffic from eth0 to ifb0 with
"mark".
I testing marking with iptables but any mark not working - always use
"default" mark...

thanks
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060821/4c1fe32a/attachment.html
From asle at dod.no  Mon Aug 21 22:39:48 2006
From: asle at dod.no (=?ISO-8859-1?Q?Asle_Fest=F8?=)
Date: Mon Aug 21 22:39:36 2006
Subject: [LARTC] QoS on a bridge+NAT
Message-ID: <dh5ke29jhi4pog2dnghshp92uer1qqu3fm@4ax.com>

I have a setup where I have three NIC in a Debian box. I have eth1
conected to internet and eth0 NAT'ed to 192.168.1.1. eth1 and eth2 are
bridged together, given ip 192.168.122.2. 

What I want to achieve is to perform traffic shaping on the bridge as
well as prioritizing the traffic from eth0 very low. (This is from
trental flat ...) However it seems that I am unable to perform thhe
traffic shaping from these two nets on eth1. Can somebody please help
me? I am very new to traffic shaping but determined to learn ...

Where should the root qdisc be attached to be able to prioritize
between the two NICs eth 0 and eth2?

Asle

My files:
/etc/network/interfaces:
# The loopback network interface
auto lo
iface lo inet loopback

auto br0
iface br0 inet static
        address 192.168.122.2
        netmask 255.255.255.0
        gateway 192.168.122.1
        network 192.168.122.0
        broadcast 192.168.122.255
        pre-up /sbin/ip link set eth2 up
        pre-up /sbin/ip link set eth1 up
        pre-up /usr/sbin/brctl addbr br0
        pre-up /usr/sbin/brctl addif br0 eth2
        pre-up /usr/sbin/brctl addif br0 eth1

iface eth0 inet static
        address 192.168.1.1
        netmask 255.255.255.0
        network 192.168.1.0
        broadcast 192.168.1.255

My shaper script:
#!/bin/bash

# Wonder Shaper
# please read the README before filling out these values
#
# Set the following values to somewhat less than your actual download
# and uplink speed. In kilobits. Also set the device that is to be
shaped.
DOWNLINK=3400
UPLINK=350
DEV=eth1

#Speed for eth0
DOWNLINK2=60
UPLINK2=600
DEV2=eth0

# low priority OUTGOING traffic - you can leave this blank if you want
# low priority source netmasks
NOPRIOHOSTSRC=192.168.1.0/24

# low priority destination netmasks
NOPRIOHOSTDST=192.168.1.0/24

#########################################################

if [ "$1" = "status" ]
then
        tc -s qdisc ls dev $DEV
        tc -s qdisc ls dev $DEV2
        tc -s class ls dev $DEV
        tc -s class ls dev $DEV2
        exit
fi


# clean existing down- and uplink qdiscs, hide errors
tc qdisc del dev $DEV root    2> /dev/null > /dev/null
tc qdisc del dev $DEV ingress 2> /dev/null > /dev/null
tc qdisc del dev $DEV2 root    2> /dev/null > /dev/null
tc qdisc del dev $DEV2 ingress 2> /dev/null > /dev/null

####Downlink/Uplink eth0 #######
#Rate limit single host
#Out of eth0
#tc qdisc add dev $DEV2 handle 2: root tbf rate ${DOWNLINK2}kbit
#latency 50ms burst 1540

#Into eth0
#tc qdisc add dev $DEV2 ingress

#tc filter add dev $DEV2 parent ffff: protocol ip prio 50 u32 match ip
#src \
#   192.168.1.0/24 police rate ${UPLINK2}kbit burst 5k drop flowid :1

###### uplink
# install root CBQ
tc qdisc add dev $DEV root handle 1: cbq avpkt 1000 bandwidth 10mbit
# shape everything at $UPLINK speed - this prevents huge queues in
your
# DSL modem which destroy latency:
# main class
tc class add dev $DEV parent 1: classid 1:1 cbq rate ${UPLINK}kbit \
allot 1500 prio 5 bounded isolated

# high prio class 1:10:
tc class add dev $DEV parent 1:1 classid 1:10 cbq rate ${UPLINK}kbit \
   allot 1600 prio 1 avpkt 1000

# bulk and default class 1:20 - gets slightly less traffic,
#  and a lower priority:
tc class add dev $DEV parent 1:1 classid 1:20 cbq rate
$[9*$UPLINK/10]kbit \
   allot 1600 prio 2 avpkt 1000

# 'traffic we hate'
tc class add dev $DEV parent 1:1 classid 1:30 cbq rate
$[8*$UPLINK/10]kbit \
   allot 1600 prio 2 avpkt 1000

# all get Stochastic Fairness:
tc qdisc add dev $DEV parent 1:10 handle 10: sfq perturb 10
tc qdisc add dev $DEV parent 1:20 handle 20: sfq perturb 10
tc qdisc add dev $DEV parent 1:30 handle 30: sfq perturb 10

# start filters
# TOS Minimum Delay (ssh, NOT scp) in 1:10:
tc filter add dev $DEV parent 1:0 protocol ip prio 10 u32 \
      match ip tos 0x10 0xff  flowid 1:10

# ICMP (ip protocol 1) in the interactive class 1:10 so we
# can do measurements & impress our friends:
tc filter add dev $DEV parent 1:0 protocol ip prio 11 u32 \
        match ip protocol 1 0xff flowid 1:10

# prioritize small packets (<64 bytes)
tc filter add dev $DEV parent 1: protocol ip prio 12 u32 \
   match ip protocol 6 0xff \
   match u8 0x05 0x0f at 0 \
   match u16 0x0000 0xffc0 at 2 \
   flowid 1:10

# Low prio for rental flat
        tc filter add dev $DEV parent 1: protocol ip prio 16 u32 \
           match ip src 192.168.1.0/24 flowid 1:30

        tc filter add dev $DEV parent 1: protocol ip prio 17 u32 \
           match ip dst 192.168.1.0/24 flowid 1:30


# rest is 'non-interactive' ie 'bulk' and ends up in 1:20

tc filter add dev $DEV parent 1: protocol ip prio 18 u32 \
   match ip dst 0.0.0.0/0 flowid 1:20


########## downlink main #############
# slow downloads down to somewhat less than the real speed  to prevent
# queuing at our ISP. Tune to see how high you can set it.
# ISPs tend to have *huge* queues to make sure big downloads are fast
#
# attach ingress policer:

tc qdisc add dev $DEV handle ffff: ingress

# filter *everything* to it (0.0.0.0/0), drop everything that's
# coming in too fast:

tc filter add dev $DEV parent ffff: protocol ip prio 50 u32 match ip
src \
   0.0.0.0/0 police rate ${DOWNLINK}kbit burst 10k drop flowid :1
From smohan at gmail.com  Tue Aug 22 04:09:24 2006
From: smohan at gmail.com (Mohan Sundaram)
Date: Tue Aug 22 04:09:49 2006
Subject: [LARTC] New hardware
In-Reply-To: <20060821181612.25e0d962@localhost.localdomain>
References: <1156175178.44e9d54a18bd1@www.inbox.lv>
	<20060821181612.25e0d962@localhost.localdomain>
Message-ID: <44EA6754.6000909@vsnl.com>

I used a SunFire x2100 which has 2 Ghz Opteron and PCI-Xpress slot into 
which I plugged in a dual port gigE Intel PCI-Xpress card.

Got a raw forwarding performance of 800Kpps for 64B packets. This beat a 
CISCO 3845 which gave 600Kpps.

Raw forwarding is one measure though it is not the end-all.

Mohan
Marek Kierdelewicz wrote:
>> Hi! 
> 
> Hi
> 
>> reason of hardware upgrade is growing up number of users, also we are
>> planning to increase upstream link from 100 Mbit/s to 1 Gbit/s.
> 
> If you want to move around 1Gbit/s you need PCI-X or PCI-E network
> interfaces (PCI bus would be a bottleneck).
> 
>> 1) Server based router (with dual core Xeon CPU) 
> 
> I've been using for some time now router with 2xsingle-core Xeon CPU
> for servicing 2k+ users. It works well. 
> 
>> 2) Desktop based router (with newest Intel Core 2 Duo CPU) 
> 
> Did't have a pleasure. I'd like to hear some opinions on that one too.
> 
>> 3) what about AMD (I have no personal experience with them)? 
> 
> I'm trying to use unorthodox hardware setup for fast router:
> 
> Dual core AMD64
> desktop motherboard with 2xPCIe x16 slots (SLI capable motherboard)
> two PCIe x4 intel E1000 Server network adapters
> 
> Preliminary tests look promising. Network adapters mentioned above
> should in theory do better then previous PCI-X network adapters.
> 
>> As I know, 64-bit architecture in router specific tasks doesn&rsquo;t
>> give any performance boost? Maybe there are some other nuances that I
>> need to know (kernel hacking, hardware hints)? 
> 
> I think 64-bit architectures can do much better then 32-bit ones... at
> least on 64-bit kernel.
> 
>> I&rsquo;m going to use standard Intel E1000 NIC for 1 Gbit/s speed
>> line, is it a good choice? 
> 
> Best choice as far as I know. Anyone would sugest something else?
> 
> Regards,

From araul at adonet.ro  Tue Aug 22 07:27:31 2006
From: araul at adonet.ro (Adorean Alexandru Raul)
Date: Tue Aug 22 07:20:59 2006
Subject: [LARTC] htb prioritise trafic
Message-ID: <44EA95C3.2090100@adonet.ro>

I have a router with about 300 clients connecting to it. It has htb with 
a class per client.

I wnat to create a script to prioritise www trafic and ssh trafic over 
p2p trafic....


this is a sample of what i have now:

/sbin/tc class add dev eth0 parent 1:5 classid 1:8012 htb rate 35Kbit 
ceil 281Kbit prio 6
/sbin/tc qdisc add dev eth0 parent 1:8012 handle 8012 sfq perturb 8
/sbin/tc filter add dev eth0 parent 1:0 protocol ip prio 1 u32 match ip 
src 81.181.180.21 classid 1:8012

/sbin/tc class add dev eth1 parent 1:5 classid 1:8012 htb rate 35Kbit 
ceil 281Kbit prio 6
/sbin/tc qdisc add dev eth1 parent 1:8012 handle 8012 sfq perturb 8
/sbin/tc filter add dev eth1 parent 1:0 protocol ip prio 1 u32 match ip 
dst 81.181.180.21 classid 1:8012

this is one client.

I found something on wiki.lug.ro but i could not adapt it to my neads.


Thank you for your time.
From =?koi8-r?Q?=F0=CF=CB=CF=D4=C9=CC=C5=CE=CB=CF_?=  Tue Aug 22 09:55:02 2006
From: =?koi8-r?Q?=F0=CF=CB=CF=D4=C9=CC=C5=CE=CB=CF_?= (=?koi8-r?Q?=F0=CF=CB=CF=D4=C9=CC=C5=CE=CB=CF_?=)
Date: Tue Aug 22 09:55:46 2006
Subject: [LARTC] Bonding + Shaping --> Is it Possible?
In-Reply-To: <20060821163023.67172.qmail@web8510.mail.in.yahoo.com>
References: <20060821163023.67172.qmail@web8510.mail.in.yahoo.com>
Message-ID: <1156233302.8448.2.camel@localhost.localdomain>

So there is no difference between bonded interfaces. I mean that the
same traffic goes on both. This case you can make shaping on your bond0
interface. This will work.

Well, if the interface that looks to Clients is bond0, and interface
that looks to Internet if eth0, then you make shaping of incoming
traffic on bond0 and shaping of outgoing traffic on eth0.

? ???, 21/08/2006 ? 17:30 +0100, KartheeK ?????:
> I have bonded two interfaces in mode 0 for load balancing and link
> sharing.
> My understanding is that "traffic control" happens, below bonding and
> hence this should be possible. I am currently short of lab equipments
> and am planning to try this some time this week end...
> I  am curious about similar implemantations and/or thoughts,,,,,,
> 
> ??????????? ?????? <casper@meteor.dp.ua> wrote:
>         I tryed to do some iptables rules on bonded interfaces and
>         that didn't
>         worked. I had to use "ebtables".
>         
>         BTW, what kind of bonding do you use?
>         
>         ? ???, 21/08/2006 ? 13:05 +0100, KartheeK ?????:
>         > Hello All
>         > 
>         > Any Body, Any Thoughts?
>         > Any Kind of feedback or suggestion is a welcome...
>         > 
>         > KartheeK
>         > 
>         > KartheeK  wrote:
>         > Hello All,
>         > 
>         > Has Any body of you worked on such a set up?
>         > 
>         > KartheeK
>         > 
>         > KartheeK  wrote:
>         > Date: Thu, 17 Aug 2006 07:31:25 +0100 (BST)
>         > From: KartheeK 
>         > To: lartc@mailman.ds9a.nl
>         > Subject: [LARTC] Bonding + Shaping --> Is it Possible?
>         > 
>         > Hello All,
>         > 
>         > I was curious to know if I can do traffic shaping on
>         > abonded Interface?
>         > Ex: I have to interfaces eth1 and eth2 which i have
>         > bonded together as bond0 , now the question is can I
>         > do shaping on eth1 and eth2 ??
>         > 
>         > Thanks
>         > KartheeK
>         > 
>         > 
>         > ______________________________________________________
>         > Here's a new way to find what you're looking for -
>         > Yahoo! Answers 
>         > Send FREE SMS to your friend's mobile from Yahoo!
>         > Messenger Version 8. Get it
>         > NOW_______________________________________________
>         > LARTC mailing list
>         > LARTC@mailman.ds9a.nl
>         > http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
>         > 
>         > 
>         > 
>         >
>         ______________________________________________________________
>         > Here's a new way to find what you're looking for - Yahoo!
>         > Answers 
>         > Send FREE SMS to your friend's mobile from Yahoo! Messenger
>         > Version 8. Get it
>         > NOW_______________________________________________
>         > LARTC mailing list
>         > LARTC@mailman.ds9a.nl
>         > http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
>         > _______________________________________________
>         > LARTC mailing list
>         > LARTC@mailman.ds9a.nl
>         > http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
>         > 
>         > 
>         > 
>         > 
>         >
>         ______________________________________________________________________
>         > Here's a new way to find what you're looking for - Yahoo!
>         Answers 
>         > Send FREE SMS to your friend's mobile from Yahoo! Messenger
>         Version 8.
>         > Get it NOW
>         > _______________________________________________
>         > LARTC mailing list
>         > LARTC@mailman.ds9a.nl
>         > http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
>         -- 
>         ??????????? ?????? 
>         
> 
> 
> 
> 
> ______________________________________________________________________
> Here's a new way to find what you're looking for - Yahoo! Answers 
> Send FREE SMS to your friend's mobile from Yahoo! Messenger Version 8.
> Get it NOW
-- 
??????????? ?????? <casper@meteor.dp.ua>

From e.janz at barceloviajes.com  Tue Aug 22 10:34:21 2006
From: e.janz at barceloviajes.com (e.janz@barceloviajes.com)
Date: Tue Aug 22 10:34:35 2006
Subject: [LARTC] tc filter don't match packets
In-Reply-To: <732234b80608210837q143b7c5ai5c7bad9297623a17@mail.gmail.com>
Message-ID: <OF464BE52B.0FB7599E-ONC12571D2.002DFD0A-C12571D2.002F065B@barcelo>

Hi,

in this simple case you must attach the filter to the root:

[...]
> tc qdisc add dev eth0 root handle 1: htb default 10 
[...]
> tc filter add dev eth0 parent 1:11 protocol ip prio 1 u32 match ip 
> dport 80 0xffff flowid 1:11
[...]

Should be:

tc filter add dev eth0 parent 1:0 protocol ip prio 1 u32 match ip dport 80 
0xffff flowid 1:11


The traffic gets enqueued traversing the filters attached to each node but 
starting at the root node. You must provide a way to arrive to a leaf.

In man tc-htb it says:

       "When enqueueing a packet, HTB starts at the root and uses various 
meth-
       ods to determine which class should receive the data.

       In the absence of uncommon configuration options, the process is 
rather
       easy.  At each node we look for an instruction,  and  then  go  to 
the
       class  the  instruction  refers  us  to. If the class found is a 
barren
       leaf-node (without children), we enqueue the packet there. If it is 
not
       yet  a  leaf  node, we do the whole thing over again starting from 
that
       node.

       The following actions are performed, in order at each  node  we 
visit,
       until one sends us to another node, or terminates the process.

       (i)    Consult filters attached to the class. If sent to a 
leafnode, we
              are done.  Otherwise, restart.

       (ii)   If none of the above returned with an  instruction,  enqueue 
 at
              this node.

       This  algorithm makes sure that a packet always ends up somewhere, 
even
       while you are busy building your configuration."


In your case, the packets arrive to the root node to get enqueed but due 
to that there is no filter attached it will get to the default 10.
I hope this helps,

Regards,
Eric Janz 

--

ADVERTENCIA LEGAL
El contenido de este correo es confidencial y dirigido unicamente a su destinatario. Para acceder a su clausula de privacidad consulte http://www.barceloviajes.com/privacy

LEGAL ADVISORY
This message is confidential and intended only for the person or entity to which it is addressed. In order to read its privacy policy consult it at http://www.barceloviajes.com/privacy
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060822/3470d9bd/attachment.htm
From luciano at lugmen.org.ar  Tue Aug 22 19:23:30 2006
From: luciano at lugmen.org.ar (Luciano Ruete)
Date: Tue Aug 22 22:58:56 2006
Subject: [LARTC] htb prioritise trafic
In-Reply-To: <44EA95C3.2090100@adonet.ro>
References: <44EA95C3.2090100@adonet.ro>
Message-ID: <200608221423.30358.luciano@lugmen.org.ar>

On Tuesday 22 August 2006 02:27, Adorean Alexandru Raul wrote:
> I have a router with about 300 clients connecting to it. It has htb with
> a class per client.
>
> I wnat to create a script to prioritise www trafic and ssh trafic over
> p2p trafic....
>
>
> this is a sample of what i have now:
>
> /sbin/tc class add dev eth0 parent 1:5 classid 1:8012 htb rate 35Kbit
> ceil 281Kbit prio 6
> /sbin/tc qdisc add dev eth0 parent 1:8012 handle 8012 sfq perturb 8
> /sbin/tc filter add dev eth0 parent 1:0 protocol ip prio 1 u32 match ip
> src 81.181.180.21 classid 1:8012
>
> /sbin/tc class add dev eth1 parent 1:5 classid 1:8012 htb rate 35Kbit
> ceil 281Kbit prio 6
> /sbin/tc qdisc add dev eth1 parent 1:8012 handle 8012 sfq perturb 8
> /sbin/tc filter add dev eth1 parent 1:0 protocol ip prio 1 u32 match ip
> dst 81.181.180.21 classid 1:8012
>
> this is one client.
>
> I found something on wiki.lug.ro but i could not adapt it to my neads.
>
>
> Thank you for your time.

htb-gen[1] does exactly that, in a per-client basis and you can customize what 
is prio and what is not. And of course all gets automated.


[1]http://freshmeat.net/projects/htb-gen/
PS: There is a new version comming(with lot of improbs)... but in a few weeks. 
--
Luciano
From hijacker at oldum.net  Tue Aug 22 21:27:22 2006
From: hijacker at oldum.net (Nikolay Kichukov)
Date: Tue Aug 22 22:59:10 2006
Subject: [LARTC] How to bypass traffic control for one IP
In-Reply-To: <5641-83855@sneakemail.com>
References: <28632-76882@sneakemail.com>
	<016d01c6c1e8$630f5340$0600a8c0@hpa>  <5056-98503@sneakemail.com>
	<1155896549.3702.4.camel@ccja.localhost> <23741-26129@sneakemail.com>
	<1155909150.4496.10.camel@ccja.localhost> <7344-83645@sneakemail.com>
	<008b01c6c39a$cb8f8bc0$0600a8c0@hpa>  <5641-83855@sneakemail.com>
Message-ID: <1156274843.3007.4.camel@ccja.localhost>

and you do not read my example at all.

tc qdisc add dev eth1 root handle 1: htb default 1
tc class add dev eth1 parent 1: classid 1:1 htb rate 4080kb ceil 4080kb
tc class add dev eth1 parent 1:1 classid 1:10 htb rate 4000kb ceil
4000kb prio 1
tc class add dev eth1 parent 1:1 classid 1:11 htb rate 80kb ceil 80kb
prio 2

and match the packets(with filters) with destination to the adsl to
class 1:10 and all the rest to class 1:11.

I do not know if that will work, butat least you can give it a try and
then confirm if it is actually working or not working so someone else on
the list can give you another hint...

-nik


On Mon, 2006-08-21 at 09:47 +0200, Yves BLUSSEAU wrote:
> Thanks nik
> 
> BUT, i know how the class and filter work and in your example you don't take 
> my problem in account because i need an unlimited class rate (or at least 
> 4Mbits) and a limited classe rate for internet (80kb for example).
> Can you rewrite your example with this parameter ?
> 
> Thanks in advance !
> 
> Yves
> ----- Original Message ----- 
> From: "nikolay hijacker-at-oldum.net |Linux Advanced Routing & Traffic 
> Control project/1.0-Allow|" <...>
> To: <..................>
> Cc: <lartc@mailman.ds9a.nl>
> Sent: Saturday, August 19, 2006 4:21 PM
> Subject: Re: [LARTC] How to bypass traffic control for one IP
> 
> 
> sure i write an example.
> it is all dependent on the ceil parameter on the class.
> so if the class for the internet is 80kbps, than you will have rate 80kb
> ceil 80kb thus this class will not be able to borrow bandwith from the class
> above it.
> 
> example:
> 
> tc qdisc add dev eth1 root handle 1: htb default 11
> tc class add dev eth1 parent 1: classid 1:1 htb rate 48kb ceil 48kb
> tc class add dev eth1 parent 1:1 classid 1:10 htb rate 40kb ceil 40kb prio 1
> tc class add dev eth1 parent 1:1 classid 1:11 htb rate 8kb ceil 8kb prio 2
> 
> What's next is to match the right packets into the right classes using
> filters.
> 
> Let me know if that helps.
> 
> btw eth1 will be the interface that is connected to the adsl router.
> 
> and 48kbps is just an example, feel free to adjust those values.
> 
> -nik
> ----- Original Message ----- 
> From: "Yves ........" <2z7mbt002@sneakemail.com>
> To: <hijacker@oldum.net>
> Sent: Friday, August 18, 2006 5:05 PM
> Subject: Re: [LARTC] How to bypass traffic control for one IP
> 
> 
> > Thx nik,
> >
> > but what i don't understand is if that there no traffic to the first class 
> > (4Mbit traffic) other class can borrow capacity from the first one. So the 
> > traffic to internet is not limited to 80ko/s ?
> > If i'm wrong, can you write an example ?
> >
> > Thanks in advance,
> > Yves
> >
> > ----- Original Message ----- 
> > From: "Nikolay Kichukov hijacker-at-oldum.net |Linux Advanced Routing & 
> > Traffic Control project/1.0-Allow|" <...>
> > To: <..................>
> > Cc: <lartc@mailman.ds9a.nl>
> > Sent: Friday, August 18, 2006 3:52 PM
> > Subject: Re: [LARTC] How to bypass traffic control for one IP
> >
> >
> > Okay,
> > the following may or may not work:
> >
> > on the interface of the router that is connected to the adsl add an
> > engress HTB qdisc.
> >
> > Then add classes accordingly. The first one with highest priority will
> > be for the 4Mbit traffic.
> > The classes after this one will be dependent on your likely.
> >
> > Add some tc filters. The first one will match if dst ip is $IP_OF_ADSL
> > or dst port is $THE_BROADCAST_PORT_OF_THE_ADSL and it will use htb class
> > with highest priority.
> >
> > Packets not having destination the adsl will be matched in the filters
> > afterwords, thus shaped and so.
> >
> > However, I am not sure, if all of the packets will not go under that htb
> > class, because in their destination header they all have the adsl IP(the
> > default gateway).
> >
> > Maybe someone on the list will englight me on that topic.
> >
> > -nik
> >
> >
> > On Fri, 2006-08-18 at 12:47 +0200, Yves ........ wrote:
> >> The adsl modem has two functions: it give me access to internet (max 
> >> 80ko/s
> >> upload) et it is use to broadcast video stream at more than 4Mo/s.
> >> I can't manage the modem.
> >> My PC, the firewall and the modem are locally connected at 100Mbits Full
> >> Duplex.
> >> Like I said i want to shape the upload to internet and only to internet.
> >> So do you know a good configuration to shape all but not the traffic
> >> directly send to the modem (to it's IP) ?
> >>
> >> Yves
> >>
> >> ----- Original Message ----- 
> >> From: "Nikolay Kichukov hijacker-at-oldum.net |Linux Advanced Routing &
> >> Traffic Control project/1.0-Allow|" <...>
> >> To: <..................>
> >> Sent: Friday, August 18, 2006 12:22 PM
> >> Subject: Re: [LARTC] How to bypass traffic control for one IP
> >>
> >>
> >> You surely do need to send the video stream at full speed, but what is
> >> the point of doing so if the adsl modem(router) will still shape the
> >> upload at the speed that your ISP gives to you?
> >>
> >> That will only saturate the link.
> >>
> >> -nik
> >>
> >> On Thu, 2006-08-17 at 21:05 +0200, Yves ........ wrote:
> >> > Because my asl modem is also a router and it is used to send broadcast
> >> > video
> >> > to another network and so i need to send video stream at full speed to 
> >> > the
> >> > modem.
> >> > ----- Original Message ----- 
> >> > From: "nikolay hijacker-at-oldum.net |Linux Advanced Routing & Traffic
> >> > Control project/1.0-Allow|" <...>
> >> > To: <..................>
> >> > Sent: Thursday, August 17, 2006 12:32 PM
> >> > Subject: Re: [LARTC] How to bypass traffic control for one IP
> >> >
> >> >
> >> > > why would you want to "access" the adsl modem at 100Mbps?
> >> > >
> >> > > What is the speed your ISP provides to the adsl modem?
> >> > >
> >> > > -nik
> >> > > ----- Original Message ----- 
> >> > > From: "Yves ........" <2z7mbt002@sneakemail.com>
> >> > > To: <lartc@mailman.ds9a.nl>
> >> > > Sent: Wednesday, August 16, 2006 6:16 PM
> >> > > Subject: [LARTC] How to bypass traffic control for one IP
> >> > >
> >> > >
> >> > > Hi all,
> >> > >
> >> > > i have a problem: i have an adsl modem that is connected to internet. 
> >> > > I
> >> > > can't manage this modem.
> >> > > Between my PC and the modem i have a linux firewall that make the NAT
> >> > > and
> >> > > the traffic shapping.
> >> > > I have create a script that limit the bandwidth of the "external"
> >> > > interface of the firewall so i can manage my bandwidth for my 
> >> > > internet
> >> > > application.
> >> > > The problem is that i need to access the adsl modem at full bandwith
> >> > > (100mbits) from my PC (through the linux firewall).
> >> > > So i need a configuration where all the internet IP are limited by 
> >> > > the
> >> > > traffic control and where the IP of the modem is not slowdown by 
> >> > > traffic
> >> > > shapping.
> >> > >
> >> > > Who have an idea for such configuration ?
> >> > >
> >> > > Thanks in advance.
> >> > >
> >> > > Yves
> >> > >
> >> > >
> >> > > --------------------------------------------------------------------------------
> >> > >
> >> > >
> >> > >> _______________________________________________
> >> > >> LARTC mailing list
> >> > >> LARTC@mailman.ds9a.nl
> >> > >> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
> >> > >>
> >> > >
> >> > >
> >> >
> > -- 
> > ?????? ??? ????????, ??? ?????.
> > ?? ?????? ??? ?????, ?? ?????? ??? ????????...
> > -????? ?????
> >
> >
> >
> 
> 
-- 
?????? ??? ????????, ??? ?????.
?? ?????? ??? ?????, ?? ?????? ??? ????????...
-????? ?????

From marek at piasta.pl  Wed Aug 23 09:51:41 2006
From: marek at piasta.pl (Marek Kierdelewicz)
Date: Wed Aug 23 09:45:37 2006
Subject: [LARTC] New hardware
In-Reply-To: <44EA6754.6000909@vsnl.com>
References: <1156175178.44e9d54a18bd1@www.inbox.lv>
	<20060821181612.25e0d962@localhost.localdomain>
	<44EA6754.6000909@vsnl.com>
Message-ID: <20060823095141.4eedcc80@localhost.localdomain>

Hi there,

> I used a SunFire x2100 which has 2 Ghz Opteron and PCI-Xpress slot
> into which I plugged in a dual port gigE Intel PCI-Xpress card.

What was the software configuration of this host? What kernel
have you used for the test (compiled for x86 or amd64; dual-core
aware sheduler or not).

Out of the curiosity ... dual port nic generates one interrupt or two
per port? I asume the first is more probable. This leads to another
question - has interrupt been balanced between cores? 

> Got a raw forwarding performance of 800Kpps for 64B packets. This
> beat a CISCO 3845 which gave 600Kpps.

Thanks for the input :).

Right now my production border router (BGP+some firewall rules+some QoS,
vlans @ P4 3GHz Linux 2.6, 2xBroadcom PCI-X, 1xIntel E1000 PCI-X) is 91%
saturated (CPU) at peek hours and during the time it forwards 344,8Kpps
with avg. packet sized 69 bytes.

I'll try to determine raw forwarding performance when box goes out
of production env, so we'll have a clear comparison picture.

regards,
-- 
Marek Kierdelewicz
Kierownik Dzia?u System?w Sieciowych, KoBa
Manager of Network Systems Department, KoBa
tel. (85) 7406466; fax. (85) 7406467
e-mail: admin@koba.pl
From smohan at gmail.com  Wed Aug 23 10:05:53 2006
From: smohan at gmail.com (Mohan Sundaram)
Date: Wed Aug 23 10:05:47 2006
Subject: [LARTC] New hardware
In-Reply-To: <20060823095141.4eedcc80@localhost.localdomain>
References: <1156175178.44e9d54a18bd1@www.inbox.lv> <44EA6754.6000909@vsnl.com>
	<20060823095141.4eedcc80@localhost.localdomain>
Message-ID: <44EC0C61.7010505@vsnl.com>

Marek Kierdelewicz wrote:
> Hi there,
> 
>> I used a SunFire x2100 which has 2 Ghz Opteron and PCI-Xpress slot
>> into which I plugged in a dual port gigE Intel PCI-Xpress card.
> 
> What was the software configuration of this host? What kernel
> have you used for the test (compiled for x86 or amd64; dual-core
> aware sheduler or not).
> 
stock x86 32 bit kernel 2.4.20. No dual core optimisations.
> Out of the curiosity ... dual port nic generates one interrupt or two
> per port? I asume the first is more probable. This leads to another
> question - has interrupt been balanced between cores? 
I'm unaware of how it was configured.
> 
>> Got a raw forwarding performance of 800Kpps for 64B packets. This
>> beat a CISCO 3845 which gave 600Kpps.
> 
> Thanks for the input :).
> 
> Right now my production border router (BGP+some firewall rules+some QoS,
> vlans @ P4 3GHz Linux 2.6, 2xBroadcom PCI-X, 1xIntel E1000 PCI-X) is 91%
> saturated (CPU) at peek hours and during the time it forwards 344,8Kpps
> with avg. packet sized 69 bytes.
> 
The Opteron was 100% utilised at 800Kpps for 64B pkts. I could do 
bi-directional line rate on gigE for 512/1500B pkts (approx 500/164Kpps) 
  with 65%/25% cpu utilisation
> I'll try to determine raw forwarding performance when box goes out
> of production env, so we'll have a clear comparison picture.
> 
> regards,

From smohan at gmail.com  Wed Aug 23 10:09:19 2006
From: smohan at gmail.com (Mohan Sundaram)
Date: Wed Aug 23 10:09:19 2006
Subject: [LARTC] New hardware
In-Reply-To: <20060823095141.4eedcc80@localhost.localdomain>
References: <1156175178.44e9d54a18bd1@www.inbox.lv> <44EA6754.6000909@vsnl.com>
	<20060823095141.4eedcc80@localhost.localdomain>
Message-ID: <44EC0D2F.7050306@vsnl.com>

Marek Kierdelewicz wrote:
> Hi there,
> 
>> I used a SunFire x2100 which has 2 Ghz Opteron and PCI-Xpress slot
>> into which I plugged in a dual port gigE Intel PCI-Xpress card.
> 
> What was the software configuration of this host? What kernel
> have you used for the test (compiled for x86 or amd64; dual-core
> aware sheduler or not).
> 
> Out of the curiosity ... dual port nic generates one interrupt or two
> per port? I asume the first is more probable. This leads to another
> question - has interrupt been balanced between cores? 
> 
>> Got a raw forwarding performance of 800Kpps for 64B packets. This
>> beat a CISCO 3845 which gave 600Kpps.
> 
> Thanks for the input :).
> 
> Right now my production border router (BGP+some firewall rules+some QoS,
> vlans @ P4 3GHz Linux 2.6, 2xBroadcom PCI-X, 1xIntel E1000 PCI-X) is 91%
> saturated (CPU) at peek hours and during the time it forwards 344,8Kpps
> with avg. packet sized 69 bytes.
> 
> I'll try to determine raw forwarding performance when box goes out
> of production env, so we'll have a clear comparison picture.
> 
> regards,

The beauty was the price. $725 for the SUN hardware and $200 for the NIC 
card. The CISCO 3845 would cost 9K street minimum.

Mohan
From sawar at interia.pl  Thu Aug 24 00:31:58 2006
From: sawar at interia.pl (Szymon Mroofka)
Date: Thu Aug 24 00:32:58 2006
Subject: [LARTC] How to select Skype traffic??
Message-ID: <200608240031.58999.sawar@interia.pl>

Hi,

I have simple question about Skype. What are the methods of selecting packets 
which belongs to Skype??
I know about 7layer but I don't belive that is only way.
Is 7layer realy good and stable solution for routers which must handle more 
than 1000 users ? 

Thanks in advance

Pozdrawiam
Szymon Turkiewicz
From nnn at vsu.by  Thu Aug 24 08:03:12 2006
From: nnn at vsu.by (Nikolay Nikolaev)
Date: Thu Aug 24 08:02:54 2006
Subject: [LARTC] Layer-7 don't work
In-Reply-To: <200608240031.58999.sawar@interia.pl>
References: <200608240031.58999.sawar@interia.pl>
Message-ID: <44ED4120.3040404@vsu.by>

Szymon Mroofka ?????:
> Hi,
> 
> I have simple question about Skype. What are the methods of selecting packets 
> which belongs to Skype??
> I know about 7layer but I don't belive that is only way.
> Is 7layer realy good and stable solution for routers which must handle more 
> than 1000 users ? 
> 
Hi everybody!
I use Layer-7 filter for hook packets like this :

$ipt -t mangle -N SKYPE
$ipt -t mangle -A SKYPE -j MARK --set-mark 41
$ipt -t mangle -A SKYPE -j LOG --log-prefix "IPT. SKYPE: " --log-ip-options
$ipt -t mangle -A SKYPE -j IMQ
....
....
....
$ipt -t mangle -A PREROUTING -m layer7 --l7dir /etc/l7-protocols 
--l7proto dns -j DNS
...
$ipt -t mangle -A PREROUTING -m layer7 --l7dir /etc/l7-protocols 
--l7proto skypetoskype -j SKYPE
...
$ipt -t mangle -A PREROUTING -j OTHER

the iptables -t mangle -L PREROUTING -n -v show it's correct,
but I see in LOG and see this:
Aug 23 10:57:16 gate kernel: IPT. SKYPE: IN=eth0 OUT= MAC=xx:xx:...xx 
SRC=10.10.0.114 DST=10.10.0.1 LEN=140 TOS=0x04 PREC=0x00 TTL=64 ID=0 
PROTO=UDP SPT=162 DPT=162 LEN=120
etc...

grep 162 /etc/services
snmp-trap       162/tcp         snmptrap        # Traps for SNMP
snmp-trap       162/udp         snmptrap        # Traps for SNMP

it's not SKYPE, i think .... it is normal?

my kernel 2.6.15, iptables v 1.3.5 all pathced, all modules is load.
thx.
From alijawad1 at gmail.com  Thu Aug 24 11:16:25 2006
From: alijawad1 at gmail.com (Ali Jawad)
Date: Thu Aug 24 11:16:21 2006
Subject: [LARTC] Help On Upload Limiting Using CBQ.init
Message-ID: <44ED6E69.3090503@gmail.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Hi Guys

Ive got an internet cafe on which I have a debian sarge box running.
The Debian box acts as a gateway and it has masquerading on. I have 40
client PC and i do not want to assign more than 64k per pc for upload
and the same is true for download too. Ive done alot of research and Ive
read tutorials about CBQ and HTB. I found that CBQ.init is the best
script to serve my needs. I was successfully able to limit download per
client using the script.
However I was not able to limit upload per client whatever method I used.

Please HELP ME LIMIT THE UPLOADS ON A PER CLIENT BASIS.

This is my Setup :

INTERNET ---- eth0 DEBIAN eth1 -- LAN SWITCH ---40 PCS

The working CBQ script that I use to limit download for a certain PC is:

DEVICE=eth1,100Mbit,10Mbit
RATE=64Kbit
WEIGHT=6Kbit
PRIO=5
RULE=192.168.1.166

The UPLOAD SCRIPT that I use to limit UPLOADS is "NOT WORKING" !!

Upload Script "NOT WORKING"

# --------------------------------------------------------------------------
DEVICE=eth0,10Mbit,1Mbit
RATE=64Kbit
WEIGHT=6Kbit
PRIO=5
RULE=192.168.1.166,
# --------------------------------------------------------------------------

As you can see I added the comma at the end of the Rule to indicate the
source of the packet..any suggestions or help on how to make this work
are welcome...!!
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFE7W5pkgA8mKGs24MRArpLAKC4qE/8ApbPDpjZHWegMWoxYnCfyQCgoenV
y7sg+bdQP0L/4Cxv1yg23/o=
=Vb6R
-----END PGP SIGNATURE-----
From nnn at vsu.by  Thu Aug 24 13:09:04 2006
From: nnn at vsu.by (Nikolay Nikolaev)
Date: Thu Aug 24 13:08:46 2006
Subject: [LARTC] Help On Upload Limiting Using CBQ.init
In-Reply-To: <44ED6E69.3090503@gmail.com>
References: <44ED6E69.3090503@gmail.com>
Message-ID: <44ED88D0.3010407@vsu.by>

Ali Jawad ?????:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> 
> Hi Guys
> 
> Ive got an internet cafe on which I have a debian sarge box running.
> The Debian box acts as a gateway and it has masquerading on. I have 40
> client PC and i do not want to assign more than 64k per pc for upload
> and the same is true for download too. Ive done alot of research and Ive
> read tutorials about CBQ and HTB. I found that CBQ.init is the best
> script to serve my needs. I was successfully able to limit download per
> client using the script.
> However I was not able to limit upload per client whatever method I used.
> 
> Please HELP ME LIMIT THE UPLOADS ON A PER CLIENT BASIS.
I  think you must use ESFQ qdisc for    ^^^^^^^^^^
From bill.blum at gmail.com  Thu Aug 24 15:32:24 2006
From: bill.blum at gmail.com (Bill Blum)
Date: Thu Aug 24 15:32:05 2006
Subject: [LARTC] Suggestions/Pointers on where to begin my search for a
	solution?
Message-ID: <6aa4d09a0608240632q47de4e83k89f6de0eb078bdd4@mail.gmail.com>

Hi-
I'm working in the IT department of a small liberal arts university-- we're
getting *massacred* by P2P traffic.

Informal testing/probing indicates that about 60% of our traffic from the
dorms was P2P-- we've taken the initial step of hardlimiting the dorms to no
more than 40% of outgoing university bandwidth.  Also, we've blocked the
'standard' ports for KaZaa, Gnutella, etc. in our firewall/switch setup
(Cisco Catalyst 6500 between us and the net at large)....

However, the Powers That Be want a better, more effective solution---
without a performance hit for the VOIP phones on campus.

Any suggestions on what part of the FM I should be reading/etc, so that I
can make a better informed decision about how to proceed?

Regards,
Bill Blum

-- 
Bill Blum
Bill.Blum@gmail.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060824/5d0a5683/attachment.html
From smohan at gmail.com  Thu Aug 24 16:09:00 2006
From: smohan at gmail.com (Mohan Sundaram)
Date: Thu Aug 24 16:08:57 2006
Subject: [LARTC] Suggestions/Pointers on where to begin my search for
	asolution?
In-Reply-To: <6aa4d09a0608240632q47de4e83k89f6de0eb078bdd4@mail.gmail.com>
References: <6aa4d09a0608240632q47de4e83k89f6de0eb078bdd4@mail.gmail.com>
Message-ID: <44EDB2FC.7080201@vsnl.com>

Bill Blum wrote:
> Hi-
> I'm working in the IT department of a small liberal arts university-- 
> we're getting *massacred* by P2P traffic.
> 
> Informal testing/probing indicates that about 60% of our traffic from 
> the dorms was P2P-- we've taken the initial step of hardlimiting the 
> dorms to no more than 40% of outgoing university bandwidth.  Also, we've 
> blocked the 'standard' ports for KaZaa, Gnutella, etc. in our 
> firewall/switch setup (Cisco Catalyst 6500 between us and the net at 
> large)....
> 
> However, the Powers That Be want a better, more effective solution---   
> without a performance hit for the VOIP phones on campus.  
> 
> Any suggestions on what part of the FM I should be reading/etc, so that 
> I can make a better informed decision about how to proceed?
> 
> Regards,
> Bill Blum
> 
> -- 
> Bill Blum
> Bill.Blum@gmail.com <mailto:Bill.Blum@gmail.com>
> 
Try a Linuc m/c in between with ipp2p patch on iptables. Have you tried 
using the NBAR facility on the CISCO. That should also help.

Mohan Sundaram
From jasonb at edseek.com  Thu Aug 24 18:34:18 2006
From: jasonb at edseek.com (Jason Boxman)
Date: Thu Aug 24 18:34:03 2006
Subject: [LARTC] Layer-7 don't work
In-Reply-To: <44ED4120.3040404@vsu.by>
References: <200608240031.58999.sawar@interia.pl> <44ED4120.3040404@vsu.by>
Message-ID: <46325.216.134.200.78.1156437258.squirrel@nebula.internal.foo>

Nikolay Nikolaev wrote:
<snip>
> it's not SKYPE, i think .... it is normal?

Yes.  L7 relies on packet heuristics, so it may not always match the packets
you're looking for.  Some patterns are easier to discover and match than
others.



From b42-ml at srck.net  Thu Aug 24 19:00:54 2006
From: b42-ml at srck.net (b42-ml@srck.net)
Date: Thu Aug 24 19:00:44 2006
Subject: [LARTC] u32 mark hashing
Message-ID: <1429.10.154.218.7.1156438854.squirrel@10.154.218.1>

Hi,

is it possible to use firewall mark as an u32 hash key? What i understood
from the source code is that only 32-bit number inside of the packet can
be used as a hash key, though fw mark can be matched using u32 match(with
2.6 kernel and recent iproute2 version).

Thanks,
 -b42

From pch at packetconsulting.pl  Thu Aug 24 21:15:26 2006
From: pch at packetconsulting.pl (Piotr Chytla)
Date: Thu Aug 24 21:20:30 2006
Subject: [LARTC] How to select Skype traffic??
In-Reply-To: <200608240031.58999.sawar@interia.pl>
References: <200608240031.58999.sawar@interia.pl>
Message-ID: <20060824191526.GA2053@packetconsulting.pl>

On Thu, Aug 24, 2006 at 12:31:58AM +0200, Szymon Mroofka wrote:
> Hi,
> 
> I have simple question about Skype. What are the methods of selecting packets 
> which belongs to Skype??
> I know about 7layer but I don't belive that is only way.
> Is 7layer realy good and stable solution for routers which must handle more 
> than 1000 users ? 
>
Check also this :

http://www.blackhat.com/presentations/bh-europe-06/bh-eu-06-biondi/bh-eu-06-biondi-up.pdf

Intresting paper about skype, there are some iptables rules to match
skype udp traffic .


/pch

-- 
Dyslexia bug unpatched since 1977 ...
exploit has been leaked to the underground.
From stanislav.nedelchev at gmail.com  Fri Aug 25 11:00:43 2006
From: stanislav.nedelchev at gmail.com (Stanislav Nedelchev)
Date: Fri Aug 25 11:00:31 2006
Subject: [LARTC] Now to make only Traffic Priority 
Message-ID: <44EEBC3B.3080708@gmail.com>

Hi to everybody.
I read some info and documentation but i still can't find how to make
this simple setup for example .


I just want to make priority of certain traffic without shaping the
traffic .
For example SSH and RDP first priority
Mail second priority
WEB and FTP third

And everything else last priority.

What will be the simple and best way to achieve this.

I will appreciate every help .
From sandu.andrei at gmail.com  Fri Aug 25 11:52:00 2006
From: sandu.andrei at gmail.com (Andrei Sandu)
Date: Fri Aug 25 11:51:42 2006
Subject: [LARTC] Help On Upload Limiting Using CBQ.init
In-Reply-To: <44ED6E69.3090503@gmail.com>
References: <44ED6E69.3090503@gmail.com>
Message-ID: <c0f5026d0608250252l4a867c0ckc3f23c9159704fa0@mail.gmail.com>

On 8/24/06, Ali Jawad <alijawad1@gmail.com> wrote:
>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
>
> Hi Guys
>
> Ive got an internet cafe on which I have a debian sarge box running.
> The Debian box acts as a gateway and it has masquerading on. I have 40
> client PC and i do not want to assign more than 64k per pc for upload
> and the same is true for download too. Ive done alot of research and Ive
> read tutorials about CBQ and HTB. I found that CBQ.init is the best
> script to serve my needs. I was successfully able to limit download per
> client using the script.
> However I was not able to limit upload per client whatever method I used.
>
> Please HELP ME LIMIT THE UPLOADS ON A PER CLIENT BASIS.
>
> This is my Setup :
>
> INTERNET ---- eth0 DEBIAN eth1 -- LAN SWITCH ---40 PCS
>
> The working CBQ script that I use to limit download for a certain PC is:
>
> DEVICE=eth1,100Mbit,10Mbit
> RATE=64Kbit
> WEIGHT=6Kbit
> PRIO=5
> RULE=192.168.1.166
>
> The UPLOAD SCRIPT that I use to limit UPLOADS is "NOT WORKING" !!
>
> Upload Script "NOT WORKING"
>
> #
> --------------------------------------------------------------------------
> DEVICE=eth0,10Mbit,1Mbit
> RATE=64Kbit
> WEIGHT=6Kbit
> PRIO=5
> RULE=192.168.1.166,
> #
> --------------------------------------------------------------------------
>
> As you can see I added the comma at the end of the Rule to indicate the
> source of the packet..any suggestions or help on how to make this work
> are welcome...!!
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.4 (MingW32)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
>
> iD8DBQFE7W5pkgA8mKGs24MRArpLAKC4qE/8ApbPDpjZHWegMWoxYnCfyQCgoenV
> y7sg+bdQP0L/4Cxv1yg23/o=
> =Vb6R
> -----END PGP SIGNATURE-----
>


You will not be able to shape the upload traffic for each client on eth0  (
after NAT all the packets have the same src address ). You can do policying
or better u can use IMQ ( http://www.linuximq.net ) .
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060825/5d9aeda5/attachment.html
From sandu.andrei at gmail.com  Fri Aug 25 15:55:25 2006
From: sandu.andrei at gmail.com (Andrei Sandu)
Date: Fri Aug 25 15:55:08 2006
Subject: [LARTC] Help On Upload Limiting Using CBQ.init
In-Reply-To: <44EEFE70.8070404@gmail.com>
References: <44ED6E69.3090503@gmail.com>
	<c0f5026d0608250252l4a867c0ckc3f23c9159704fa0@mail.gmail.com>
	<44EEFE70.8070404@gmail.com>
Message-ID: <c0f5026d0608250655i5173181cuf3152e4d9e2143ca@mail.gmail.com>

On 8/25/06, Ali Jawad <alijawad1@gmail.com> wrote:
>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Andrei Sandu wrote:
> > On 8/24/06, Ali Jawad <alijawad1@gmail.com> wrote:
> >>
> >
> > Hi Guys
> >
> > Ive got an internet cafe on which I have a debian sarge box running.
> > The Debian box acts as a gateway and it has masquerading on. I have 40
> > client PC and i do not want to assign more than 64k per pc for upload
> > and the same is true for download too. Ive done alot of research and Ive
> > read tutorials about CBQ and HTB. I found that CBQ.init is the best
> > script to serve my needs. I was successfully able to limit download per
> > client using the script.
> > However I was not able to limit upload per client whatever method I
> used.
> >
> > Please HELP ME LIMIT THE UPLOADS ON A PER CLIENT BASIS.
> >
> > This is my Setup :
> >
> > INTERNET ---- eth0 DEBIAN eth1 -- LAN SWITCH ---40 PCS
> >
> > The working CBQ script that I use to limit download for a certain PC is:
> >
> > DEVICE=eth1,100Mbit,10Mbit
> > RATE=64Kbit
> > WEIGHT=6Kbit
> > PRIO=5
> > RULE=192.168.1.166
> >
> > The UPLOAD SCRIPT that I use to limit UPLOADS is "NOT WORKING" !!
> >
> > Upload Script "NOT WORKING"
> >
> > #
> >
> --------------------------------------------------------------------------
> >
> > DEVICE=eth0,10Mbit,1Mbit
> > RATE=64Kbit
> > WEIGHT=6Kbit
> > PRIO=5
> > RULE=192.168.1.166,
> > #
> >
> --------------------------------------------------------------------------
> >
> >
> > As you can see I added the comma at the end of the Rule to indicate the
> > source of the packet..any suggestions or help on how to make this work
> > are welcome...!!
> >>
>
> > You will not be able to shape the upload traffic for each client on
> eth0  (
> > after NAT all the packets have the same src address ). You can do
> policying
> > or better u can use IMQ ( http://www.linuximq.net ) .
>
>
> > ------------------------------------------------------------------------
>
> > _______________________________________________
> > LARTC mailing list
> > LARTC@mailman.ds9a.nl
> > http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
>
> I might be wrong on this Andrei.."Iam Junior when it comes to traffic
> shaping"..but I think that is is quite possible to shape outgoing
> traffic that is being shaped without having to use CMQ .
>
> The idea is that masqueraded or SNATed traffic leaves the linux router
> having the same src address i.e. the public address of the router in my
> case. However IPTABLES or NETFILTER IN Linux has the following feature:
> The POSTROUTING chain is the last chain in the iptables ..and it is part
> of two tables the mangle table and the last table is the nat table. So
> you can match traffic outgoing on the POSTROUTING chain if you match it
> on the mangle table which precedes the nat table.
>
>
>
>         -FORWARD(mangle)-FORWARD(filter)-
>
> - -PRE-                                    -POST(mangle)-POST(nat)
>
>         -INPUT-LOCAL-OUTPUT(mangle->Filter->NAT)
>
> As A result the following setup should work "Indeed it worked "
>
>
> download section
>
> tc qdisc add dev eth1 root handle 11: cbq bandwidth 100Mbit avpkt \
> 1000 mpu 64
> tc class add dev eth1 parent 11:0 classid 11:1 cbq rate 50Kbit \
> weight 5Kbit allot 1514 prio 1 avpkt 1000 bounded
> tc filter add dev eth1 parent 11:0 protocol ip handle 4 fw flowid 11:1
>
>
>
> Upload Section
>
> tc qdisc add dev eth0 root handle 10: cbq bandwidth 10Mbit avpkt \
> 1000 mpu 64
> tc class add dev eth0 parent 10:0 classid 10:1 cbq rate 20Kbit \
> weight 2Kbit allot 1514 prio 1 avpkt 1000 bounded
> tc filter add dev eth0 parent 10:0 protocol ip handle 3 fw flowid 10:1
>
>
>
> Now the tricky part is to mark the packets so that they can be shaped
> ..the following only works for natted traffic and does not work for
> traffic generated on the router itself.
>
> For Download "Note that the mangle table precedes the nat table"
> iptables -t mangle -A POSTROUTING -s ! 192.168.1.0/24 -d \
> 192.168.1.0/24 -j MARK --set-mark 4
>
> For Upload
>
> iptables -t mangle -A FORWARD -s 192.168.1.0/24 -j MARK --set-mark 3
>
>
> I got the script idea from
>
> http://szabilinux.hu/bandwidth/
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.4 (MingW32)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
>
> iD8DBQFE7v5wkgA8mKGs24MRAoCSAKCI0igWp2Km3/tbdi13ux5gB22GPACgptV7
> //xFDzU5P1aPCg7QxwaHnso=
> =SWow
> -----END PGP SIGNATURE-----
>


Yes, Ali, it can be done that way too, using fwmark. But in my opinion using
IMQ it is much better and clean. IMQ was created specially for this kind of
situations, when you want to do ingress shaping.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060825/f80b8c34/attachment.htm
From nnn at vsu.by  Sat Aug 26 07:43:01 2006
From: nnn at vsu.by (Nikolay Nikolaev)
Date: Sat Aug 26 07:42:42 2006
Subject: [LARTC] IMQ action
Message-ID: <44EFDF65.3030709@vsu.by>

Hi.
-j IMQ is equal -j ACCEPT...? i mean it after -j IMQ packet don't return 
in parent chain??? cause -j ACCEPT action accept the packet in the child 
chain and don't return it to parent...
example:

ipt="iptables -t mangle"

$ipt -N HTTP
$ipt -A HTTP -j IMQ // after this packet packets go to -t nat 
tables? or 		    // it return to parent chain (PREROUTING) in mangle?

$ipt -N OTHER
$ipt -A OTHER -j IMQ

$ipt -A PREROUTING [expression] -j HTTP
$ipt -A PREROUTING -j OTHER

all this I do for ingress traffic.
thx.
From marek at piasta.pl  Sat Aug 26 09:31:21 2006
From: marek at piasta.pl (Marek Kierdelewicz)
Date: Sat Aug 26 09:25:16 2006
Subject: [LARTC] Now to make only Traffic Priority
In-Reply-To: <44EEBC3B.3080708@gmail.com>
References: <44EEBC3B.3080708@gmail.com>
Message-ID: <20060826093121.3a32f121@localhost.localdomain>

> Hi to everybody.

Hi

> I just want to make priority of certain traffic without shaping the
> traffic .
> For example SSH and RDP first priority
> Mail second priority
> WEB and FTP third

You can make something like that:
$TC qdisc add dev $IF1 root handle 1: htb default 40
$TC class add dev $IF1 parent 1: classid 1:1 htb rate 100mbit ceil \
100mbit burst 15k prio 1
$TC class add dev $IF1 parent 1:1 classid 1:10 htb rate 25mbit ceil \
100mbit burst 15k prio 1
$TC class add dev $IF1 parent 1:1 classid 1:20 htb rate 25mbit ceil \
100mbit burst 15k prio 2
$TC class add dev $IF1 parent 1:1 classid 1:30 htb rate 25mbit ceil \
100mbit burst 15k prio 3
$TC class add dev $IF1 parent 1:1 classid 1:40 htb rate 25mbit ceil \
100mbit burst 15k prio 4

Then you direct ssh and rdp with filters to the 1:10 class (prio 1
means highest prio), mail to 1:20, web+ftp to 1:30 and rest to 1:40.

It's shaping, but works the way you want it. 

Another solution is using prio qdisc, for what you need to:
- set up prio map (tos -> prio)
- rewrite tos field of packets in PREROUTING chain of mangle table.

I never used such solution, only read some theoretical stuff at
following site:
http://lartc.org/howto/lartc.qdisc.classless.html#AEN659

-- 
Marek Kierdelewicz
Kierownik Dzia?u System?w Sieciowych, KoBa
Manager of Network Systems Department, KoBa
tel. (85) 7406466; fax. (85) 7406467
e-mail: admin@koba.pl
From lsharpe at pacificwireless.com.au  Mon Aug 28 06:09:48 2006
From: lsharpe at pacificwireless.com.au (Leigh Sharpe)
Date: Mon Aug 28 06:09:40 2006
Subject: [LARTC] Applying the same class to multiple interfaces
Message-ID: <H00000690009e688.1156738187.mail.pacificwireless.net.au@MHS>

Hi All,
I'm trying to do some traffic shaping on an ethernet bridge. Currently,
I have the following setup working:
 
ifconfig eth0 down
brctl addbr br0
brctl addif br0 eth0
brctl addif br0 eth1
brctl stp br0 off
ifconfig eth0 0.0.0.0 up
ifconfig eth1 0.0.0.0 up
ifconfig br0 up

This creates a bridge consisting of eth0 and eth1. So far so good.
 
I now want to use tc to shape traffic through this bridge. By applying
the following, I am able to limit the given MAC address to 128K in each
direction:
 
tc qdisc add dev eth0 root handle 1:0 cbq bandwidth 100Mbit avpkt 1000
mpu 64
tc qdisc add dev eth1 root handle 1:0 cbq bandwidth 100Mbit avpkt 1000
mpu 64
tc class add dev eth0 parent 1:0 classid 1:1 cbq rate 128Kbit allot 1514
prio 1 avpkt 1000 bounded
tc class add dev eth1 parent 1:0 classid 1:1 cbq rate 128Kbit allot 1514
prio 1 avpkt 1000 bounded
tc filter add dev eth0 parent 1:0 protocol ip handle 1 fw flowid 1:1
tc filter add dev eth1 parent 1:0 protocol ip handle 1 fw flowid 1:1
ebtables -A FORWARD -s 00:10:A4:EC:65:E8 -j mark --set-mark 1
--mark-target ACCEPT
ebtables -A FORWARD -d 00:10:A4:EC:65:E8 -j mark --set-mark 1
--mark-target ACCEPT

This works OK, but it isn't quite what I want. I want to limit the
traffic to 128K total. ie, 128K in one direction or the other, or 64K in
each direction simultaneously, or 100K in one direction and 28K in the
other, etc...
 I can't see anything in the tc docs which indicates that I can apply
the same class and filter to multiple interfaces at once.
I'd be happy enough with applying the same rate limit to a single
interface, but measuring both ingress and egress traffic to come up with
the lmit.
 
Ultimately, of course, I'll be using different criteria to mark the
packets.
 
 
Regards,
             Leigh
 
Leigh Sharpe
Network Systems Engineer
Pacific Wireless
Ph +61 3 9584 8966
Mob 0408 009 502
email lsharpe@pacificwireless.com.au
web www.pacificwireless.com.au
 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060828/5ecc919f/attachment.html
From =?koi8-r?Q?=F0=CF=CB=CF=D4=C9=CC=C5=CE=CB=CF_?=  Mon Aug 28 08:26:09 2006
From: =?koi8-r?Q?=F0=CF=CB=CF=D4=C9=CC=C5=CE=CB=CF_?= (=?koi8-r?Q?=F0=CF=CB=CF=D4=C9=CC=C5=CE=CB=CF_?=)
Date: Mon Aug 28 08:25:52 2006
Subject: [LARTC] Applying the same class to multiple interfaces
In-Reply-To: <H00000690009e688.1156738187.mail.pacificwireless.net.au@MHS>
References: <H00000690009e688.1156738187.mail.pacificwireless.net.au@MHS>
Message-ID: <1156746369.3827.9.camel@localhost.localdomain>

As you probably red there is no good way to shape incoming traffic.
Shaping of incoming traffic is not recommended. This is no problem with
this because you can (this is recomended) shape outgoing traffice on
multiple interfaces.

For example if you have a client on eth0 and Internet on eth1, and you
want to shape client's traffic both direction:

- to shape client's incoming traffic you shape its outgoing traffic on
eth0

- to shape client's outgoing traffic you shape its outgoing traffic on
eth1

Also, for your needs you can MARK packets with iptables on br0
interface. ebtables are more suitable for implementation of "smart
switch".

? ???, 28/08/2006 ? 14:09 +1000, Leigh Sharpe ?????:
> Hi All,
> I'm trying to do some traffic shaping on an ethernet bridge.
> Currently, I have the following setup working:
>  
> ifconfig eth0 down
> brctl addbr br0
> brctl addif br0 eth0
> brctl addif br0 eth1
> brctl stp br0 off
> ifconfig eth0 0.0.0.0 up
> ifconfig eth1 0.0.0.0 up
> ifconfig br0 up
> 
> This creates a bridge consisting of eth0 and eth1. So far so good.
>  
> I now want to use tc to shape traffic through this bridge. By applying
> the following, I am able to limit the given MAC address to 128K in
> each direction:
>  
> tc qdisc add dev eth0 root handle 1:0 cbq bandwidth 100Mbit avpkt 1000
> mpu 64
> tc qdisc add dev eth1 root handle 1:0 cbq bandwidth 100Mbit avpkt 1000
> mpu 64
> tc class add dev eth0 parent 1:0 classid 1:1 cbq rate 128Kbit allot
> 1514 prio 1 avpkt 1000 bounded
> tc class add dev eth1 parent 1:0 classid 1:1 cbq rate 128Kbit allot
> 1514 prio 1 avpkt 1000 bounded
> tc filter add dev eth0 parent 1:0 protocol ip handle 1 fw flowid 1:1
> tc filter add dev eth1 parent 1:0 protocol ip handle 1 fw flowid 1:1
> ebtables -A FORWARD -s 00:10:A4:EC:65:E8 -j mark --set-mark 1
> --mark-target ACCEPT
> ebtables -A FORWARD -d 00:10:A4:EC:65:E8 -j mark --set-mark 1
> --mark-target ACCEPT
> 
> This works OK, but it isn't quite what I want. I want to limit the
> traffic to 128K total. ie, 128K in one direction or the other, or 64K
> in each direction simultaneously, or 100K in one direction and 28K in
> the other, etc...
>  I can't see anything in the tc docs which indicates that I can apply
> the same class and filter to multiple interfaces at once.
> I'd be happy enough with applying the same rate limit to a single
> interface, but measuring both ingress and egress traffic to come up
> with the lmit.
>  
> Ultimately, of course, I'll be using different criteria to mark the
> packets.
>  
>  
> Regards,
>              Leigh
>  
> Leigh Sharpe
> Network Systems Engineer
> Pacific Wireless
> Ph +61 3 9584 8966
> Mob 0408 009 502
> email lsharpe@pacificwireless.com.au
> web www.pacificwireless.com.au
>  
> _______________________________________________
> LARTC mailing list
> LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
-- 
??????????? ?????? <casper@meteor.dp.ua>

From lsharpe at pacificwireless.com.au  Mon Aug 28 09:41:43 2006
From: lsharpe at pacificwireless.com.au (Leigh Sharpe)
Date: Mon Aug 28 09:41:39 2006
Subject: [LARTC] Applying the same class to multiple interfaces
In-Reply-To: <1156746369.3827.9.camel@localhost.localdomain>
Message-ID: <H00000690009e901.1156750902.mail.pacificwireless.net.au@MHS>

I don't actually want to shape incoming traffic. I want to limit the bandwidth of the bridge, so that their total throughput doesn't exceed a particular rate.  To do this, I can?t limit on only one interface. I need to configure it so that eth0+eth1 never exceeds the bandwidth limit.



Regards,
             Leigh
 
Leigh Sharpe
Network Systems Engineer
Pacific Wireless
Ph +61 3 9584 8966
Mob 0408 009 502
email lsharpe@pacificwireless.com.au
web www.pacificwireless.com.au

-----Original Message-----
From: casper@meteor.dp.ua [mailto:casper@meteor.dp.ua] 
Sent: Monday, August 28, 2006 4:26 PM
To: Leigh Sharpe
Cc: lartc
Subject: Re: [LARTC] Applying the same class to multiple interfaces

As you probably red there is no good way to shape incoming traffic.
Shaping of incoming traffic is not recommended. This is no problem with
this because you can (this is recomended) shape outgoing traffice on
multiple interfaces.

For example if you have a client on eth0 and Internet on eth1, and you
want to shape client's traffic both direction:

- to shape client's incoming traffic you shape its outgoing traffic on
eth0

- to shape client's outgoing traffic you shape its outgoing traffic on
eth1

Also, for your needs you can MARK packets with iptables on br0
interface. ebtables are more suitable for implementation of "smart
switch".

? ???, 28/08/2006 ? 14:09 +1000, Leigh Sharpe ?????:
> Hi All,
> I'm trying to do some traffic shaping on an ethernet bridge.
> Currently, I have the following setup working:
>  
> ifconfig eth0 down
> brctl addbr br0
> brctl addif br0 eth0
> brctl addif br0 eth1
> brctl stp br0 off
> ifconfig eth0 0.0.0.0 up
> ifconfig eth1 0.0.0.0 up
> ifconfig br0 up
> 
> This creates a bridge consisting of eth0 and eth1. So far so good.
>  
> I now want to use tc to shape traffic through this bridge. By applying
> the following, I am able to limit the given MAC address to 128K in
> each direction:
>  
> tc qdisc add dev eth0 root handle 1:0 cbq bandwidth 100Mbit avpkt 1000
> mpu 64
> tc qdisc add dev eth1 root handle 1:0 cbq bandwidth 100Mbit avpkt 1000
> mpu 64
> tc class add dev eth0 parent 1:0 classid 1:1 cbq rate 128Kbit allot
> 1514 prio 1 avpkt 1000 bounded
> tc class add dev eth1 parent 1:0 classid 1:1 cbq rate 128Kbit allot
> 1514 prio 1 avpkt 1000 bounded
> tc filter add dev eth0 parent 1:0 protocol ip handle 1 fw flowid 1:1
> tc filter add dev eth1 parent 1:0 protocol ip handle 1 fw flowid 1:1
> ebtables -A FORWARD -s 00:10:A4:EC:65:E8 -j mark --set-mark 1
> --mark-target ACCEPT
> ebtables -A FORWARD -d 00:10:A4:EC:65:E8 -j mark --set-mark 1
> --mark-target ACCEPT
> 
> This works OK, but it isn't quite what I want. I want to limit the
> traffic to 128K total. ie, 128K in one direction or the other, or 64K
> in each direction simultaneously, or 100K in one direction and 28K in
> the other, etc...
>  I can't see anything in the tc docs which indicates that I can apply
> the same class and filter to multiple interfaces at once.
> I'd be happy enough with applying the same rate limit to a single
> interface, but measuring both ingress and egress traffic to come up
> with the lmit.
>  
> Ultimately, of course, I'll be using different criteria to mark the
> packets.
>  
>  
> Regards,
>              Leigh
>  
> Leigh Sharpe
> Network Systems Engineer
> Pacific Wireless
> Ph +61 3 9584 8966
> Mob 0408 009 502
> email lsharpe@pacificwireless.com.au
> web www.pacificwireless.com.au
>  
> _______________________________________________
> LARTC mailing list
> LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
-- 
??????????? ?????? <casper@meteor.dp.ua>


From =?koi8-r?Q?=F0=CF=CB=CF=D4=C9=CC=C5=CE=CB=CF_?=  Mon Aug 28 11:08:59 2006
From: =?koi8-r?Q?=F0=CF=CB=CF=D4=C9=CC=C5=CE=CB=CF_?= (=?koi8-r?Q?=F0=CF=CB=CF=D4=C9=CC=C5=CE=CB=CF_?=)
Date: Mon Aug 28 11:08:45 2006
Subject: [LARTC] Applying the same class to multiple interfaces
In-Reply-To: <H00000690009e901.1156750902.mail.pacificwireless.net.au@MHS>
References: <H00000690009e901.1156750902.mail.pacificwireless.net.au@MHS>
Message-ID: <1156756139.3847.12.camel@localhost.localdomain>

Then probably you was on correct way, mark packets with ebtables and
direct them to shaping classes you need.

? ???, 28/08/2006 ? 17:41 +1000, Leigh Sharpe ?????:
> I don't actually want to shape incoming traffic. I want to limit the bandwidth of the bridge, so that their total throughput doesn't exceed a particular rate.  To do this, I can?t limit on only one interface. I need to configure it so that eth0+eth1 never exceeds the bandwidth limit.
> 
> 
> 
> Regards,
>              Leigh
>  
> Leigh Sharpe
> Network Systems Engineer
> Pacific Wireless
> Ph +61 3 9584 8966
> Mob 0408 009 502
> email lsharpe@pacificwireless.com.au
> web www.pacificwireless.com.au
> 
> -----Original Message-----
> From: casper@meteor.dp.ua [mailto:casper@meteor.dp.ua] 
> Sent: Monday, August 28, 2006 4:26 PM
> To: Leigh Sharpe
> Cc: lartc
> Subject: Re: [LARTC] Applying the same class to multiple interfaces
> 
> As you probably red there is no good way to shape incoming traffic.
> Shaping of incoming traffic is not recommended. This is no problem with
> this because you can (this is recomended) shape outgoing traffice on
> multiple interfaces.
> 
> For example if you have a client on eth0 and Internet on eth1, and you
> want to shape client's traffic both direction:
> 
> - to shape client's incoming traffic you shape its outgoing traffic on
> eth0
> 
> - to shape client's outgoing traffic you shape its outgoing traffic on
> eth1
> 
> Also, for your needs you can MARK packets with iptables on br0
> interface. ebtables are more suitable for implementation of "smart
> switch".
> 
> ? ???, 28/08/2006 ? 14:09 +1000, Leigh Sharpe ?????:
> > Hi All,
> > I'm trying to do some traffic shaping on an ethernet bridge.
> > Currently, I have the following setup working:
> >  
> > ifconfig eth0 down
> > brctl addbr br0
> > brctl addif br0 eth0
> > brctl addif br0 eth1
> > brctl stp br0 off
> > ifconfig eth0 0.0.0.0 up
> > ifconfig eth1 0.0.0.0 up
> > ifconfig br0 up
> > 
> > This creates a bridge consisting of eth0 and eth1. So far so good.
> >  
> > I now want to use tc to shape traffic through this bridge. By applying
> > the following, I am able to limit the given MAC address to 128K in
> > each direction:
> >  
> > tc qdisc add dev eth0 root handle 1:0 cbq bandwidth 100Mbit avpkt 1000
> > mpu 64
> > tc qdisc add dev eth1 root handle 1:0 cbq bandwidth 100Mbit avpkt 1000
> > mpu 64
> > tc class add dev eth0 parent 1:0 classid 1:1 cbq rate 128Kbit allot
> > 1514 prio 1 avpkt 1000 bounded
> > tc class add dev eth1 parent 1:0 classid 1:1 cbq rate 128Kbit allot
> > 1514 prio 1 avpkt 1000 bounded
> > tc filter add dev eth0 parent 1:0 protocol ip handle 1 fw flowid 1:1
> > tc filter add dev eth1 parent 1:0 protocol ip handle 1 fw flowid 1:1
> > ebtables -A FORWARD -s 00:10:A4:EC:65:E8 -j mark --set-mark 1
> > --mark-target ACCEPT
> > ebtables -A FORWARD -d 00:10:A4:EC:65:E8 -j mark --set-mark 1
> > --mark-target ACCEPT
> > 
> > This works OK, but it isn't quite what I want. I want to limit the
> > traffic to 128K total. ie, 128K in one direction or the other, or 64K
> > in each direction simultaneously, or 100K in one direction and 28K in
> > the other, etc...
> >  I can't see anything in the tc docs which indicates that I can apply
> > the same class and filter to multiple interfaces at once.
> > I'd be happy enough with applying the same rate limit to a single
> > interface, but measuring both ingress and egress traffic to come up
> > with the lmit.
> >  
> > Ultimately, of course, I'll be using different criteria to mark the
> > packets.
> >  
> >  
> > Regards,
> >              Leigh
> >  
> > Leigh Sharpe
> > Network Systems Engineer
> > Pacific Wireless
> > Ph +61 3 9584 8966
> > Mob 0408 009 502
> > email lsharpe@pacificwireless.com.au
> > web www.pacificwireless.com.au
> >  
> > _______________________________________________
> > LARTC mailing list
> > LARTC@mailman.ds9a.nl
> > http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
-- 
??????????? ?????? <casper@meteor.dp.ua>

From gregoriandres at yahoo.com.ar  Mon Aug 28 15:03:15 2006
From: gregoriandres at yahoo.com.ar (LinuXKiD)
Date: Mon Aug 28 15:02:45 2006
Subject: [LARTC] Now to make only Traffic Priority
In-Reply-To: <20060826093121.3a32f121@localhost.localdomain>
Message-ID: <FPEELEMAJNGBAMLHHOBHKEPKGKAA.gregoriandres@yahoo.com.ar>

try IMQ

http://www.linuximq.net/

regards.

andres



-> -----Mensaje original-----
-> De: lartc-bounces@mailman.ds9a.nl
-> [mailto:lartc-bounces@mailman.ds9a.nl]En nombre de Marek Kierdelewicz
-> Enviado el: S?bado, 26 de Agosto de 2006 04:31 a.m.
-> Para: lartc@mailman.ds9a.nl
-> Asunto: Re: [LARTC] Now to make only Traffic Priority
->
->
-> > Hi to everybody.
->
-> Hi
->
-> > I just want to make priority of certain traffic without shaping the
-> > traffic .
-> > For example SSH and RDP first priority
-> > Mail second priority
-> > WEB and FTP third
->
-> You can make something like that:
-> $TC qdisc add dev $IF1 root handle 1: htb default 40
-> $TC class add dev $IF1 parent 1: classid 1:1 htb rate 100mbit ceil \
-> 100mbit burst 15k prio 1
-> $TC class add dev $IF1 parent 1:1 classid 1:10 htb rate 25mbit ceil \
-> 100mbit burst 15k prio 1
-> $TC class add dev $IF1 parent 1:1 classid 1:20 htb rate 25mbit ceil \
-> 100mbit burst 15k prio 2
-> $TC class add dev $IF1 parent 1:1 classid 1:30 htb rate 25mbit ceil \
-> 100mbit burst 15k prio 3
-> $TC class add dev $IF1 parent 1:1 classid 1:40 htb rate 25mbit ceil \
-> 100mbit burst 15k prio 4
->
-> Then you direct ssh and rdp with filters to the 1:10 class (prio 1
-> means highest prio), mail to 1:20, web+ftp to 1:30 and rest to 1:40.
->
-> It's shaping, but works the way you want it.
->
-> Another solution is using prio qdisc, for what you need to:
-> - set up prio map (tos -> prio)
-> - rewrite tos field of packets in PREROUTING chain of mangle table.
->
-> I never used such solution, only read some theoretical stuff at
-> following site:
-> http://lartc.org/howto/lartc.qdisc.classless.html#AEN659
->
-> --
-> Marek Kierdelewicz
-> Kierownik Dzia?u System?w Sieciowych, KoBa
-> Manager of Network Systems Department, KoBa
-> tel. (85) 7406466; fax. (85) 7406467
-> e-mail: admin@koba.pl
-> _______________________________________________
-> LARTC mailing list
-> LARTC@mailman.ds9a.nl
-> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc


	
	
		
__________________________________________________
Pregunt?. Respond?. Descubr?.
Todo lo que quer?as saber, y lo que ni imaginabas,
est? en Yahoo! Respuestas (Beta).
?Probalo ya! 
http://www.yahoo.com.ar/respuestas

From linux at arcoscom.com  Mon Aug 28 21:05:08 2006
From: linux at arcoscom.com (ArcosCom Linux User)
Date: Mon Aug 28 21:04:52 2006
Subject: [LARTC] Multiple WAN + Multiple LAN + linux-igd
Message-ID: <50182.80.32.64.202.1156791908.squirrel@www.arcoscom.com>

Hi, I'm implementing a linux router with this characteristics:
   - Multiple adsl with each public ip's
   - Multiple LAN ethernets (in a bridge).
   - Linux IGD

I have successfully implemented de 2 first steps, the adsl balanced fine
(multipath routing), and the clients bridge fine.

My problem is how to use that with linux-igd.

My LAN bridge has STP and is implemented for high availibility, its
working fine (and tested). I run upnpd with one wan iface as WAN iface and
the bridge one as LAN iface and is working fine over that iface.

All my public IPs are static, and I think I have only to put all my wan
ifaces in the same bridge, but I don't know if multipath routing will work
as now.

I have no problem in configure a "without IP" bridge with all the wan
ifaces, and put the public ips over the real iface, not the bridge (in the
LAN BRIDGE, all private ips where into the bridge iface). But I don't know
if this "theory" will work.

The idea is put redirected ports into ALL WAN IFACES at the same time and
allow upnpd works over all WAN IFACES at the same time.

Will it work? (putting public ips over wan ifaces and no using ip for wan
bridge iface).

If it worked: Shall I have problems with arp protocol or anything?

Any ideas? Anyone had implemented something as this?

To summarize, I don't want help about multipath routing or bridging, I
only need to know if "the theory" will work and if don't work any ideas on
how to have this working.

Many thanks!!

P.D.: Sorry for my english.

From lists at andyfurniss.entadsl.com  Tue Aug 29 14:42:01 2006
From: lists at andyfurniss.entadsl.com (Andy Furniss)
Date: Tue Aug 29 14:41:31 2006
Subject: [LARTC] Applying the same class to multiple interfaces
In-Reply-To: <H00000690009e688.1156738187.mail.pacificwireless.net.au@MHS>
References: <H00000690009e688.1156738187.mail.pacificwireless.net.au@MHS>
Message-ID: <44F43619.3040701@andyfurniss.entadsl.com>

Leigh Sharpe wrote:

> This works OK, but it isn't quite what I want. I want to limit the
> traffic to 128K total. ie, 128K in one direction or the other, or 64K in
> each direction simultaneously, or 100K in one direction and 28K in the
> other, etc...
>  I can't see anything in the tc docs which indicates that I can apply
> the same class and filter to multiple interfaces at once.
> I'd be happy enough with applying the same rate limit to a single
> interface, but measuring both ingress and egress traffic to come up with
> the lmit.
>  
> Ultimately, of course, I'll be using different criteria to mark the
> packets.

If there is no br traffic to be included you can do it by using one ifb 
redirecting packets from egress on eth0/1. If it's more complicated you 
may need to redirect from ingress aswell - but I don't think ingress on 
eths will not have gone through brtables to be marked.

Andy.
From lists at andyfurniss.entadsl.com  Tue Aug 29 14:54:58 2006
From: lists at andyfurniss.entadsl.com (Andy Furniss)
Date: Tue Aug 29 14:54:29 2006
Subject: [LARTC] IMQ action
In-Reply-To: <44EFDF65.3030709@vsu.by>
References: <44EFDF65.3030709@vsu.by>
Message-ID: <44F43922.7070201@andyfurniss.entadsl.com>

Nikolay Nikolaev wrote:
> Hi.
> -j IMQ is equal -j ACCEPT...? i mean it after -j IMQ packet don't return 
> in parent chain??? cause -j ACCEPT action accept the packet in the child 
> chain and don't return it to parent...
> example:
> 
> ipt="iptables -t mangle"
> 
> $ipt -N HTTP
> $ipt -A HTTP -j IMQ // after this packet packets go to -t nat tables? 
> or             // it return to parent chain (PREROUTING) in mangle?
> 
> $ipt -N OTHER
> $ipt -A OTHER -j IMQ
> 
> $ipt -A PREROUTING [expression] -j HTTP
> $ipt -A PREROUTING -j OTHER
> 
> all this I do for ingress traffic.
> thx.

I don't think -j IMQ is terminating as an iptables rule.

Whether it sees packets before / after (de)nat in prerouting depends on 
the kernel config options and gets logged for 2.6s. For 2.4s there is a 
patch to make it hook after nat.

Andy.
From lists at andyfurniss.entadsl.com  Tue Aug 29 15:54:15 2006
From: lists at andyfurniss.entadsl.com (Andy Furniss)
Date: Tue Aug 29 15:53:38 2006
Subject: [LARTC] IFB - Download: 1xWAN (Internet) 2xLAN (local)
In-Reply-To: <3245374a0608211137j629e1f24t6f9ef6625c561319@mail.gmail.com>
References: <3245374a0608211137j629e1f24t6f9ef6625c561319@mail.gmail.com>
Message-ID: <44F44707.5030505@andyfurniss.entadsl.com>

Robo R0b0 wrote:
> hello, i have eth0 (Internet) + eth1,eth2 (local), how to i use IFB in real
> for shaping Download, how to i redirect traffic from eth0 to ifb0 with
> "mark".
> I testing marking with iptables but any mark not working - always use
> "default" mark...

If there is no traffic from the internet to the shaping box then you can 
redirect from egress on eth1 and 2 to ifb0 and marks will work.

You need something classful on eth1/2 so if you are not shaping already 
put prio as root.

Andy.
From lists at andyfurniss.entadsl.com  Tue Aug 29 16:33:56 2006
From: lists at andyfurniss.entadsl.com (Andy Furniss)
Date: Tue Aug 29 16:33:17 2006
Subject: [LARTC] QoS on a bridge+NAT
In-Reply-To: <dh5ke29jhi4pog2dnghshp92uer1qqu3fm@4ax.com>
References: <dh5ke29jhi4pog2dnghshp92uer1qqu3fm@4ax.com>
Message-ID: <44F45054.6020104@andyfurniss.entadsl.com>

Asle Fest? wrote:
> I have a setup where I have three NIC in a Debian box. I have eth1
> conected to internet and eth0 NAT'ed to 192.168.1.1. eth1 and eth2 are
> bridged together, given ip 192.168.122.2. 
> 
> What I want to achieve is to perform traffic shaping on the bridge as
> well as prioritizing the traffic from eth0 very low. (This is from
> trental flat ...) However it seems that I am unable to perform thhe
> traffic shaping from these two nets on eth1. Can somebody please help
> me? I am very new to traffic shaping but determined to learn ...
> 
> Where should the root qdisc be attached to be able to prioritize
> between the two NICs eth 0 and eth2?


You should be able to do egress internet traffic on eth1 - you've just 
got to work out a way to classify it as from eth0/2. There are probably 
several depends what other traffic is about. You could mark -i eth0 -o 
br0 with iptables etc.

For ingress the policer eg. from lartc will not let you do prio. If the 
shaping box is just forwarding ingress internet traffic then you could 
use one ifb and redirect inbound internet traffic when it leaves eth0 
and eth2. Again you need a way to classify and ingress shaping is not 
totally possible like on egress, but if you sacrifice enough bandwidth 
and keep queues short then it's better than doing nothing.

I've never used cbq so haven't looked at the script.

Andy.
From daniel.mail at terra.com.br  Wed Aug 30 01:52:13 2006
From: daniel.mail at terra.com.br (daniel.mail)
Date: Wed Aug 30 01:51:59 2006
Subject: [LARTC] Range of ports
Message-ID: <J4SAB2$8E4919FA05D7E2D5337B48745E282ADE@terra.com.br>

Hello, 
         How can i set a range of ports on tc, and tc only works with tcp? or work with tcp and udp? 
           Tank You
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060829/940dfe8d/attachment.htm
From dor at ldc.net  Wed Aug 30 16:07:26 2006
From: dor at ldc.net (Dmytro O. Redchuk)
Date: Wed Aug 30 16:19:53 2006
Subject: [LARTC] pps limit ?
Message-ID: <20060830140726.GA24152@ldc.net>

Hello, list members,

  can i limit pps rate with linux? How?

  -m limit does not fit, as i understood: it can help with low rates only
  (is that true? any suggestions?)

Thank you,
-- 
  _,-=._              /|_/|
  `-.}   `=._,.-=-._.,  @ @._,
     `._ _,-.   )      _,.-'
        `    G.m-"^m`m'        Dmytro O. Redchuk


From kajtek at biezanow.net  Wed Aug 30 17:22:27 2006
From: kajtek at biezanow.net (Kajetan Staszkiewicz)
Date: Wed Aug 30 17:22:07 2006
Subject: [LARTC] pps limit ?
In-Reply-To: <20060830140726.GA24152@ldc.net>
References: <20060830140726.GA24152@ldc.net>
Message-ID: <200608301722.27174.kajtek@biezanow.net>

Dnia ?roda, 30 sierpnia 2006 16:07, Dmytro O. Redchuk napisa?(a): 
> Hello, list members,
>
>   can i limit pps rate with linux? How?
>
>   -m limit does not fit, as i understood: it can help with low rates only
>   (is that true? any suggestions?)

Maybe hashlimit? What do you exactly need to do?

Here's what I use to rate pps for every host in network. In fact this is on 
2.4 kernel with dstlimit (with some changes in source), but hashlimit works 
in the same way.

$IPT -t mangle -I FORWARD -i eth1 -j LIMITPAK

$IPT -t mangle -A LIMITPAK -i eth1 -s 192.168.0.0/24 -m dstlimit --dstlimit 
75 --dstlimit-burst 200 --dstlimit-mode srcip --dstlimit-name eth1_0.0  -j 
RETURN
$IPT -t mangle -A LIMITPAK -i eth1 -s 192.168.0.0/24 -j DROP
$IPT -t mangle -A LIMITPAK -j RETURN

-- 
| pozdrawiam / greetings | powered by Trustix, Gentoo and FreeBSD   |
|  Kajetan Staszkiewicz  | jabber,email,www: vegeta()tuxpowered net |
|        Vegeta          | IMQ devnames: http://www.tuxpowered.net  |
`------------------------^------------------------------------------'
From dor at ldc.net  Thu Aug 31 08:06:56 2006
From: dor at ldc.net (Dmytro O. Redchuk)
Date: Thu Aug 31 08:06:52 2006
Subject: [LARTC] pps limit ?
In-Reply-To: <200608301722.27174.kajtek@biezanow.net>
References: <20060830140726.GA24152@ldc.net>
	<200608301722.27174.kajtek@biezanow.net>
Message-ID: <20060831060656.GC24152@ldc.net>

On Wed, Aug 30, 2006 at 05:22:27PM +0200, Kajetan Staszkiewicz wrote:
> Dnia ?roda, 30 sierpnia 2006 16:07, Dmytro O. Redchuk napisa?(a): 
> > Hello, list members,
> >
> >   can i limit pps rate with linux? How?
> >
> >   -m limit does not fit, as i understood: it can help with low rates only
> >   (is that true? any suggestions?)
> 
> Maybe hashlimit?
May be. I should try. Thanks.

> What do you exactly need to do?
Limit a host's traffic to, let's say, 8.5kpps, drop any "exceeded" packet.

I guess, dstlimit will not help me too :-(

Limiting such a rates on firewalls seems to be too expensive and i don't
mention a firewall (iptables) as a tool for doing that.


No, surely, i am asking for help :-) Is there any tools, which can handle
and limit such pps rates?


-m limit, if i can remember, accepts limits up to 10k, but it seems to be
*terribly* wrong on limiting that... I wish i would be incorrect...


> $IPT -t mangle -I FORWARD -i eth1 -j LIMITPAK
[...]

Thanks, anyway.

> -- 
> | pozdrawiam / greetings | powered by Trustix, Gentoo and FreeBSD   |
> |  Kajetan Staszkiewicz  | jabber,email,www: vegeta()tuxpowered net |
> |        Vegeta          | IMQ devnames: http://www.tuxpowered.net  |
> `------------------------^------------------------------------------'
> _______________________________________________
> LARTC mailing list
> LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

-- 
  _,-=._              /|_/|
  `-.}   `=._,.-=-._.,  @ @._,
     `._ _,-.   )      _,.-'
        `    G.m-"^m`m'        Dmytro O. Redchuk


From toto at fortesys.ro  Thu Aug 31 10:22:36 2006
From: toto at fortesys.ro (Iosif Peterfi)
Date: Thu Aug 31 10:18:09 2006
Subject: [LARTC] Simple PHP Internet Traffic Shaping
Message-ID: <1157012557.22804.11.camel@wks-toto>

Project "Simple PHP Internet Traffic Shaping" ('spits-0.0.8b') has
released the new version of package 'spits'. You can download it from
SourceForge.net by following
this link:
<https://sourceforge.net/project/showfiles.php?group_id=176003&release_id=443657
>
or browse Release Notes and ChangeLog by visiting this link:
<https://sourceforge.net/project/shownotes.php?release_id=443657> 




From rmo at sunnmore.net  Thu Aug 31 12:35:32 2006
From: rmo at sunnmore.net (Roy-Magne Mo)
Date: Thu Aug 31 12:35:21 2006
Subject: [LARTC] pps limit ?
In-Reply-To: <20060830140726.GA24152@ldc.net>
References: <20060830140726.GA24152@ldc.net>
Message-ID: <44F6BB74.30307@sunnmore.net>

Dmytro O. Redchuk wrote:
> Hello, list members,
> 
>   can i limit pps rate with linux? How?
> 
>   -m limit does not fit, as i understood: it can help with low rates only
>   (is that true? any suggestions?)

This is probably better achieved at the switch level. If this is for 
stopping viruses and DoS-attacks, then it's better to stop the traffic 
as close to the source as possible.

-- 
Roy-Magne Mo

From dor at ldc.net  Thu Aug 31 13:03:58 2006
From: dor at ldc.net (Dmytro O. Redchuk)
Date: Thu Aug 31 13:04:55 2006
Subject: [LARTC] pps limit ?
In-Reply-To: <44F6BB74.30307@sunnmore.net>
References: <20060830140726.GA24152@ldc.net> <44F6BB74.30307@sunnmore.net>
Message-ID: <20060831110358.GF24152@ldc.net>

On Thu, Aug 31, 2006 at 12:35:32PM +0200, Roy-Magne Mo wrote:
> Dmytro O. Redchuk wrote:
> >Hello, list members,
> >
> >  can i limit pps rate with linux? How?
> >
> >  -m limit does not fit, as i understood: it can help with low rates only
> >  (is that true? any suggestions?)
> 
> This is probably better achieved at the switch level. If this is for 
> stopping viruses and DoS-attacks, then it's better to stop the traffic 
> as close to the source as possible.
Mmm, probably i mentioned linux box acting as a bridge [too]. And,
probably, not to stop, but to "prevent", by setting up some policy for pps
rates.

Probably, it's possible to set up some policing on Cisco Catalyst switch,
but if linux would have some tools to do "the same", it would be better,
as for me.

And i don't like "police [rate-bps] ..." here, i like htb in the same
situation :-)

I need a kind of "police [rate-*pps*] ...", and, preferably, for linux.

:-(



It's like it's not possible, so i should review my considerations
probably.


Thank you.
> 
> -- 
> Roy-Magne Mo

-- 
  _,-=._              /|_/|
  `-.}   `=._,.-=-._.,  @ @._,
     `._ _,-.   )      _,.-'
        `    G.m-"^m`m'        Dmytro O. Redchuk


From Alessandro.Vitale at elsag.it  Thu Aug 31 14:36:59 2006
From: Alessandro.Vitale at elsag.it (Vitale Alessandro)
Date: Thu Aug 31 14:36:45 2006
Subject: [LARTC] Problem with delay in htb class
Message-ID: <C103D39FF74DF4469EEAE6D38AA9E0B54A283B@els00wmx04.elsag.it>

Hi,
We've done a lots of tests on htb class to study behaviuor of delay.
We use this simple configuration:

tc qdisc add dev eth1 handle 1:0 root htb
tc class add dev eth1 parent 1:0 classid 1:1 htb rate 5000000 ceil 5000000 burst 30000 quantum 1600
tc class add dev eth1 parent 1:1 classid 1:10 htb prio 1 rate 1000000 ceil 1000000 quantum 1600
tc filter add dev eth1 parent 1:0 protocol ip prio 1 handle 1 fw classid 1:10
tc class add dev eth1 parent 1:1 classid 1:20 htb prio 1 rate 1500000 ceil 1500000 quantum 1600
tc filter add dev eth1 parent 1:0 protocol ip prio 1 handle 2 fw classid 1:20
tc class add dev eth1 parent 1:1 classid 1:100 htb prio 1 rate 2500000 ceil 2500000 quantum 1600
tc filter add dev eth1 parent 1:0 protocol ip prio 1 handle 10 fw classid 1:100

We create, with SmartBits device, 3 flows with this characteristics:
1? flows : lenght layer 2 64 - frame per second 1758 - bandwith total 900096
2? flows : lenght layer 2 1000 - frame per second 167 - bandwith total 1336000
3? flows : lenght layer 2 1500 - frame per second 187 - bandwith total 2244000

We are in conform traffic situation.
The results of tests show us that a lots of packet of 3? flow have a certain delay (between 5ms - 100ms) but we can understand the reason.
If we change the frame per second of 3? flows to 120 , we notice that the 2? flows have a certain delay too and nothing delay on the 3? flows!!!!!!
How it can be possible ?
How works qdisc pfifo_fast attached to each class ? 
Where can be generate this delayed ?
We use htb version 3.7 on Kernel 2.4.20.

Thank, thank, thank !!!!

Ale&Enrick.
From bmeier at infovia.com.ar  Thu Aug 31 21:46:39 2006
From: bmeier at infovia.com.ar (Beat Meier)
Date: Thu Aug 31 21:46:37 2006
Subject: [LARTC] How can I get min 64kbps max 128kbps bandwidth
Message-ID: <44F73C9F.8080206@infovia.com.ar>

Hi all

I have read the lartc manual, I have read the some faqs but still don't
know how to achive the following:

I have a 512kbps line which I share with 8 customers.
Now what I have is everyone gets max 64kbps. That's fine.

DEV=ath0
DEV_MAX_RATE=6mbit
DEV_RAT_LOW=64kbit
DEV_RATE_HIGH=128kbit

tc qdisc del dev $DEV root
tc qdisc add dev $DEV root handle 1: cbq avpkt 1000 bandwidth
$DEV_MAX_RATE cell 8 mpu 64
tc class add dev $DEV parent 1:0 classid 1:1 cbq bandwidth $DEV_MAX_RATE
rate $DEV_RATE_HIGH avpkt 1000 prio 5 bounded isolated \
allot 1514 weight 1 maxburst 21
tc filter add dev $DEV parent 1: protocol ip prio 5 u32 match ip dst
0.0.0.0/0 flowid 1:1

But what I want is if there is unused bandwith i.e. others are not
'working' I want to divide this
available bandwith euqal to the users who are working BUT only at a
maxmimum of 128kbps.
I.e. min 64kbps max 128kbps for every user.
I now from reading that you can do such things with borrow but how??

Any help very welcome

Thanks

Beat


From lsharpe at pacificwireless.com.au  Fri Sep  1 07:55:51 2006
From: lsharpe at pacificwireless.com.au (Leigh Sharpe)
Date: Fri Sep  1 07:55:50 2006
Subject: [LARTC] TC not recognising "mirred" argument
Message-ID: <H0000069000a1b16.1157090150.mail.pacificwireless.net.au@MHS>

Hi All,
 I'm trying to do some traffic shaping with IFB. I have installed Ubuntu
6.0.6 and upgraded to the 2.6.17.7 kernel. I have an ifb0 device.
However, I think I may have the wrong version of TC installed, because
it doesn't like the 'mirred' argument.
What version of iproute should I be using, and how can I upgrade it?
apt-get update iproute doesn't seem to help. (tc is a part of the
iproute package, isn't it?)
 
 
Regards,
             Leigh
 
Leigh Sharpe
Network Systems Engineer
Pacific Wireless
Ph +61 3 9584 8966
Mob 0408 009 502
email lsharpe@pacificwireless.com.au
web www.pacificwireless.com.au
 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060901/51330eab/attachment.html
From lsharpe at pacificwireless.com.au  Fri Sep  1 08:23:37 2006
From: lsharpe at pacificwireless.com.au (Leigh Sharpe)
Date: Fri Sep  1 08:23:30 2006
Subject: [LARTC] multiple IFBs
Message-ID: <H0000069000a1b91.1157091817.mail.pacificwireless.net.au@MHS>

Hi all,
Further to my previous questions, I need lots of IFBs on this thing.
 I have configured IFB as a module, and issuing a modprobe ifb loads it,
but only gives me 2 IFBs (ifb0 and ifb1). How can I get more? I'm
probably looking at needing about 20 on this project.
 
 
Regards,
             Leigh
 
Leigh Sharpe
Network Systems Engineer
Pacific Wireless
Ph +61 3 9584 8966
Mob 0408 009 502
email lsharpe@pacificwireless.com.au
web www.pacificwireless.com.au
 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060901/721f1867/attachment.htm
From doudouyam at gmail.com  Fri Sep  1 15:57:53 2006
From: doudouyam at gmail.com (doudouyam)
Date: Fri Sep  1 15:57:37 2006
Subject: [LARTC] HFSC help
Message-ID: <81c11a560609010657k74a1bc23mb304d5ae127fc7e@mail.gmail.com>

hi,
I would like to use the HFSC scheduler for my QoS.
I've 4 class and 2 of them need to control the bandwidth and the latencies
so I think I must use HFSC.
So I read some doc ( http://del.icio.us/tag/hfsc ) but its not very clear.
I make some tests with differents parameters but I'm not able to use
correctly this scheduler:

$TC qdisc add dev $dev root handle 1: hfsc default 40

$TC class add dev $dev parent 1: classid 1:1 hfsc sc rate 10mbit ul rate
10mbit

### VOIP
$TC class add dev $dev parent 1:1 classid 1:10 hfsc rt umax 1500b dmax 5ms
rate 200kbit ls umax 1500b dmax 60ms rate 200kbit ul rate 200kbits
### Video
$TC class add dev $dev parent 1:1 classid 1:20 hfsc rt umax 1500b dmax 10ms
rate 5mbit ls umax 1500b dmax 60ms rate 5Mbit ul rate 5Mbit
## Data
$TC class add dev $dev parent 1:1 classid 1:30 hfsc sc rate 1mbit ul rate
10mbit
$TC class add dev $dev parent 1:1 classid 1:40 hfsc sc rate 1mbit ul rate
10mbit

$TC qdisc add dev $dev parent 1:10 handle 10 sfq perturb 10
$TC qdisc add dev $dev parent 1:20 handle 20 sfq perturb 10
$TC qdisc add dev $dev parent 1:30 handle 30 sfq perturb 10
$TC qdisc add dev $dev parent 1:40 handle 40 sfq perturb 10

Can you help me ? i want a prioritize like this :
1 VOIP
2 VIDEO
3 Data1 (1:30)
4 Data2 (1:40)

Thanks.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060901/a760ccc1/attachment.html
From franco.daje at virgilio.it  Fri Sep  1 16:27:01 2006
From: franco.daje at virgilio.it (Franco)
Date: Fri Sep  1 16:26:48 2006
Subject: [LARTC] I not find in the kernel code the code of this command
Message-ID: <007701c6cdd2$b0c36720$0201a8c0@PCFranco>

Hi!,
My problem is this:
I'm searching, in kernel code, the code that implement thi command:

tc filter add dev eth2 parent ffff: protocol ip prio 1 u32 match ip src 0.0.0.0/0 police rate $1 burst $2 drop flowid :1

I thought that this code was police.c but seem that it isn't
i must implement a proc file in the code and recompiling the kernel.

Please send eventual response to my mail address (franco.daje@virgilio.it)

Thanks

Franco
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060901/09a1f25d/attachment.htm
From andreas at stapelspeicher.org  Fri Sep  1 20:01:53 2006
From: andreas at stapelspeicher.org (Andreas Mueller)
Date: Fri Sep  1 20:02:58 2006
Subject: [LARTC] I not find in the kernel code the code of this command
In-Reply-To: <007701c6cdd2$b0c36720$0201a8c0@PCFranco>
References: <007701c6cdd2$b0c36720$0201a8c0@PCFranco>
Message-ID: <20060901180153.GA6342@lintera>

Franco wrote:
> Hi!,
> My problem is this:
> I'm searching, in kernel code, the code that implement thi command:
> 
> tc filter add dev eth2 parent ffff: protocol ip prio 1 u32 match ip src 0.0.0.0/0 police rate $1 burst $2 drop flowid :1
> 
> I thought that this code was police.c but seem that it isn't
> i must implement a proc file in the code and recompiling the kernel.
> 
> Please send eventual response to my mail address (franco.daje@virgilio.it)
> 
> Thanks
> 
> Franco

> _______________________________________________
> LARTC mailing list
> LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

In 2.6.17.11 it should be in net/sched/act_police.c .

Andreas
From shemminger at osdl.org  Fri Sep  1 22:02:16 2006
From: shemminger at osdl.org (Stephen Hemminger)
Date: Fri Sep  1 22:02:03 2006
Subject: [LARTC] multiple IFBs
In-Reply-To: <H0000069000a1b91.1157091817.mail.pacificwireless.net.au@MHS>
References: <H0000069000a1b91.1157091817.mail.pacificwireless.net.au@MHS>
Message-ID: <20060901130216.590b1fea@localhost.localdomain>

On Fri, 1 Sep 2006 16:23:37 +1000
"Leigh Sharpe" <lsharpe@pacificwireless.com.au> wrote:

> Hi all,
> Further to my previous questions, I need lots of IFBs on this thing.
>  I have configured IFB as a module, and issuing a modprobe ifb loads it,
> but only gives me 2 IFBs (ifb0 and ifb1). How can I get more? I'm
> probably looking at needing about 20 on this project.
>  

"Read the source Leigh"
	
	modprobe ifb numifbs=20


-- 
Stephen Hemminger <shemminger@osdl.org>
From shemminger at osdl.org  Fri Sep  1 22:03:59 2006
From: shemminger at osdl.org (Stephen Hemminger)
Date: Fri Sep  1 22:03:49 2006
Subject: [LARTC] TC not recognising "mirred" argument
In-Reply-To: <H0000069000a1b16.1157090150.mail.pacificwireless.net.au@MHS>
References: <H0000069000a1b16.1157090150.mail.pacificwireless.net.au@MHS>
Message-ID: <20060901130359.5d634cc9@localhost.localdomain>

On Fri, 1 Sep 2006 15:55:51 +1000
"Leigh Sharpe" <lsharpe@pacificwireless.com.au> wrote:

> Hi All,
>  I'm trying to do some traffic shaping with IFB. I have installed Ubuntu
> 6.0.6 and upgraded to the 2.6.17.7 kernel. I have an ifb0 device.
> However, I think I may have the wrong version of TC installed, because
> it doesn't like the 'mirred' argument.
> What version of iproute should I be using, and how can I upgrade it?
> apt-get update iproute doesn't seem to help. (tc is a part of the
> iproute package, isn't it?)
>  
>  
> Regards,
>              Leigh
>  
> Leigh Sharpe
> Network Systems Engineer
> Pacific Wireless
> Ph +61 3 9584 8966
> Mob 0408 009 502
> email lsharpe@pacificwireless.com.au
> web www.pacificwireless.com.au
>  
> 
Current information:
	http://linux-net.osdl.org/index.php/iproute2


-- 
Stephen Hemminger <shemminger@osdl.org>
From franco.daje at virgilio.it  Fri Sep  1 22:09:16 2006
From: franco.daje at virgilio.it (Franco)
Date: Fri Sep  1 22:08:56 2006
Subject: [LARTC] I not find in the kernel code the code of this command
References: <007701c6cdd2$b0c36720$0201a8c0@PCFranco>
	<20060901180153.GA6342@lintera>
Message-ID: <000a01c6ce02$80adfb60$0201a8c0@PCFranco>

very thanks for the help!
But i'm using linux-2.6.11-6MDK and in net/sched there isn't act_police.c



> Franco wrote:
>> Hi!,
>> My problem is this:
>> I'm searching, in kernel code, the code that implement thi command:
>>
>> tc filter add dev eth2 parent ffff: protocol ip prio 1 u32 match ip src 
>> 0.0.0.0/0 police rate $1 burst $2 drop flowid :1
>>
>> I thought that this code was police.c but seem that it isn't
>> i must implement a proc file in the code and recompiling the kernel.
>>
>> Please send eventual response to my mail address 
>> (franco.daje@virgilio.it)
>>
>> Thanks
>>
>> Franco
>
>> _______________________________________________
>> LARTC mailing list
>> LARTC@mailman.ds9a.nl
>> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
>
> In 2.6.17.11 it should be in net/sched/act_police.c .
>
> Andreas
> _______________________________________________
> LARTC mailing list
> LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
>
> __________ Informazione NOD32 1.1607 (20060619) __________
>
> Questo messaggio  ? stato controllato dal Sistema Antivirus NOD32
> http://www.nod32.it
>
> 

From gypsy at iswest.com  Sat Sep  2 06:07:35 2006
From: gypsy at iswest.com (gypsy)
Date: Sat Sep  2 06:07:26 2006
Subject: [LARTC] HFSC help
References: <81c11a560609010657k74a1bc23mb304d5ae127fc7e@mail.gmail.com>
Message-ID: <44F90387.A3C76D79@iswest.com>

doudouyam wrote:
> So I read some doc ( http://del.icio.us/tag/hfsc ) but its not very
> clear.

http://linux-ip.net/tc/hfsc.en/
From tino.kriswanto at gmail.com  Sat Sep  2 14:59:55 2006
From: tino.kriswanto at gmail.com (tino)
Date: Sat Sep  2 14:59:45 2006
Subject: [LARTC] maximum class
Message-ID: <00c001c6ce8f$b3d5b450$7a0989ca@bmsby010128>

Hi, 
currently I'm using 48 class with htb & very stable
Is there any  maximum number of class I can create  in a single linux box ? 
I need 500 or even 1000 class for campuss network.

Any help appreciated

thanks & regards
Tino
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060902/efae00df/attachment.html
From vit at icebrains-soft.com  Sat Sep  2 18:23:23 2006
From: vit at icebrains-soft.com (vit@icebrains-soft.com)
Date: Sat Sep  2 18:21:31 2006
Subject: [LARTC] Traffic shaper based on UIDs
In-Reply-To: <mailman.337.1157212802.16610.lartc@mailman.ds9a.nl>
References: <mailman.337.1157212802.16610.lartc@mailman.ds9a.nl>
Message-ID: <20060902162323.GA2123@swdevel.local>

Hello!

I need assistance to solve my problem related to traffic shaping based on 
the user ids.

The problem: each unix user (of the linux host) has to be limited with 
incoming channel (internet) bandwidth.  I need this to implement
internet access solution based on ltsp (http://www.ltsp.org).

As far as I know the best way to shape traffic in linux is CBQ.
But there is no filter based on unix user id (the reason is clear for 
everybody -- ip packet doesn't contain this information).

I've found the very interesting netfilter patches at the patch-o-matic: 

http://www.netfilter.org/patch-o-matic/pom-extra.html#pom-extra-owner-socketlookup
http://www.netfilter.org/patch-o-matic/pom-extra.html#pom-extra-owner-supgids
http://www.netfilter.org/patch-o-matic/pom-extra.html#pom-extra-ip_queue_vwmark

Am I on the right way?  How can I combine the power of netfilter and 
traffic control systems to solve my problem?

I am new in this topic, so excuse me if my questions are too simple or "dummy" ::-)

Thank you beforehand!
-- 
Sincerely yours, Vitaly Repin
Ice Brains Software, ltd
From linux at arcoscom.com  Sun Sep  3 22:24:32 2006
From: linux at arcoscom.com (ArcosCom Linux User)
Date: Sun Sep  3 22:24:19 2006
Subject: [LARTC] Re: [Linux-igd-help] Multiple WAN + Multiple LAN + linux-igd
In-Reply-To: <50182.80.32.64.202.1156791908.squirrel@www.arcoscom.com>
References: <50182.80.32.64.202.1156791908.squirrel@www.arcoscom.com>
Message-ID: <40005.212.122.126.26.1157315072.squirrel@www.arcoscom.com>

Anyone can help me?

El Lun, 28 de Agosto de 2006, 21:05, ArcosCom Linux User escribi?:
> Hi, I'm implementing a linux router with this characteristics:
>    - Multiple adsl with each public ip's
>    - Multiple LAN ethernets (in a bridge).
>    - Linux IGD
>
> I have successfully implemented de 2 first steps, the adsl balanced fine
> (multipath routing), and the clients bridge fine.
>
> My problem is how to use that with linux-igd.
>
> My LAN bridge has STP and is implemented for high availibility, its
> working fine (and tested). I run upnpd with one wan iface as WAN iface and
> the bridge one as LAN iface and is working fine over that iface.
>
> All my public IPs are static, and I think I have only to put all my wan
> ifaces in the same bridge, but I don't know if multipath routing will work
> as now.
>
> I have no problem in configure a "without IP" bridge with all the wan
> ifaces, and put the public ips over the real iface, not the bridge (in the
> LAN BRIDGE, all private ips where into the bridge iface). But I don't know
> if this "theory" will work.
>
> The idea is put redirected ports into ALL WAN IFACES at the same time and
> allow upnpd works over all WAN IFACES at the same time.
>
> Will it work? (putting public ips over wan ifaces and no using ip for wan
> bridge iface).
>
> If it worked: Shall I have problems with arp protocol or anything?
>
> Any ideas? Anyone had implemented something as this?
>
> To summarize, I don't want help about multipath routing or bridging, I
> only need to know if "the theory" will work and if don't work any ideas on
> how to have this working.
>
> Many thanks!!
>
> P.D.: Sorry for my english.
>
>
> -------------------------------------------------------------------------
> Using Tomcat but need to do more? Need to support web services, security?
> Get stuff done quickly with pre-integrated technology to make your job
> easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
> _______________________________________________
> Linux-igd-help mailing list
> Linux-igd-help@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/linux-igd-help
>


From dor at ldc.net  Mon Sep  4 09:20:13 2006
From: dor at ldc.net (Dmytro O. Redchuk)
Date: Mon Sep  4 09:20:04 2006
Subject: [LARTC] maximum class
In-Reply-To: <00c001c6ce8f$b3d5b450$7a0989ca@bmsby010128>
References: <00c001c6ce8f$b3d5b450$7a0989ca@bmsby010128>
Message-ID: <20060904072013.GA28517@ldc.net>

On Sat, Sep 02, 2006 at 07:59:55PM +0700, tino wrote:
> Hi, 
> currently I'm using 48 class with htb & very stable
> Is there any  maximum number of class I can create  in a single linux box ? 
> I need 500 or even 1000 class for campuss network.
Up to 0xffff. Per device per qdisc.

(Every classid you are using is in hex, too: i.e. "classid 1:48" is
1:[0x0048] actually)



Am I right, by the way?-)
Is the
	max_number = number_of_qdiscs_at_device *
			number_of_classes_at_qdisc = 0xffff * 0xffff ?

Or there is some DEFINE'd limitation (in kernel's header files, let's
say)?

> Any help appreciated
> 
> thanks & regards
> Tino

-- 
  _,-=._              /|_/|
  `-.}   `=._,.-=-._.,  @ @._,
     `._ _,-.   )      _,.-'
        `    G.m-"^m`m'        Dmytro O. Redchuk


From tino.kriswanto at gmail.com  Mon Sep  4 09:28:26 2006
From: tino.kriswanto at gmail.com (tino)
Date: Mon Sep  4 09:28:17 2006
Subject: [LARTC] maximum class
References: <00c001c6ce8f$b3d5b450$7a0989ca@bmsby010128>
	<20060904072013.GA28517@ldc.net>
Message-ID: <007001c6cff3$bb4cc150$7a0989ca@bmsby010128>

ffff equal to 65535 class
Yes, I need to know if there was any limitation or how to set in maximum 
desired in singel linux box

Any  user experience with 1000 class or above ?
regards,
Tino

----- Original Message ----- 
From: "Dmytro O. Redchuk" <dor@ldc.net>
To: "tino" <tino.kriswanto@gmail.com>
Cc: <lartc@mailman.ds9a.nl>
Sent: Monday, September 04, 2006 2:20 PM
Subject: Re: [LARTC] maximum class


> On Sat, Sep 02, 2006 at 07:59:55PM +0700, tino wrote:
>> Hi,
>> currently I'm using 48 class with htb & very stable
>> Is there any  maximum number of class I can create  in a single linux box 
>> ?
>> I need 500 or even 1000 class for campuss network.
> Up to 0xffff. Per device per qdisc.
>
> (Every classid you are using is in hex, too: i.e. "classid 1:48" is
> 1:[0x0048] actually)
>
>
>
> Am I right, by the way?-)
> Is the
> max_number = number_of_qdiscs_at_device *
> number_of_classes_at_qdisc = 0xffff * 0xffff ?
>
> Or there is some DEFINE'd limitation (in kernel's header files, let's
> say)?
>
>> Any help appreciated
>>
>> thanks & regards
>> Tino
>
> -- 
>  _,-=._              /|_/|
>  `-.}   `=._,.-=-._.,  @ @._,
>     `._ _,-.   )      _,.-'
>        `    G.m-"^m`m'        Dmytro O. Redchuk
>
> 

From marek at piasta.pl  Mon Sep  4 11:40:13 2006
From: marek at piasta.pl (Marek Kierdelewicz)
Date: Mon Sep  4 11:34:00 2006
Subject: [LARTC] maximum class
In-Reply-To: <007001c6cff3$bb4cc150$7a0989ca@bmsby010128>
References: <00c001c6ce8f$b3d5b450$7a0989ca@bmsby010128>
	<20060904072013.GA28517@ldc.net>
	<007001c6cff3$bb4cc150$7a0989ca@bmsby010128>
Message-ID: <20060904114013.095ec483@localhost.localdomain>

Hi

> Any  user experience with 1000 class or above ?

I've got 6634 classess on one host. Everything works the way it should.

regards,
-- 
Marek Kierdelewicz
Kierownik Dzia?u System?w Sieciowych, KoBa
Manager of Network Systems Department, KoBa
tel. (85) 7406466; fax. (85) 7406467
e-mail: admin@koba.pl
From iosif.peterfi at fortesys.ro  Mon Sep  4 17:13:51 2006
From: iosif.peterfi at fortesys.ro (Iosif Peterfi)
Date: Mon Sep  4 17:13:36 2006
Subject: [LARTC] SPITS 0.0.9b
Message-ID: <1157382831.4441.23.camel@wks-toto>

	Hello list,

	I've been using linux and open source software for over 5 years now and
I want to give something back to the community.
	I'm working on a PHP-based project (SPITS). The aim of this project is
to easly create a shaping script, using a web interface, without needing
to know tc and iptables command line options.
	As the project is now in beta stage, soon a CSS stylesheet will be
made, but i'm more interested in the easyness of the interface.
	Cosidering some of you have enoungh knowledge about tc qdisc/classes
and iptables, i want you people to give it a try to SPITS.
	Only few qdisc types are available now, and 2 ip tables matches.
        I intend to make SPITS able to import qdisc types and iptables
matches via xml, with documantation and information regarding command
line options, kernel options and iptables libs needed by the system in
order for the xml module(qdisc/match) to work propertly.
        Now the project is not documented at all. Only the few steps
needed in order to setup a database and the config file.


        I'm really interested in your feedback, suggestions and bug
reports.

        Version 0.0.9b can be downloaded at: http://spits.sf.net/

	Next release will include a CSS stylesheet and the possibility to
import/export via xml the shaping configuration made.

Best regards,
Iosif


	


From bertrand.lupart at linkeo.com  Mon Sep  4 18:13:10 2006
From: bertrand.lupart at linkeo.com (Bertrand LUPART)
Date: Mon Sep  4 18:24:48 2006
Subject: [LARTC] Source policy routing in the HOWTO
Message-ID: <1hl5j8p.z2dz18u2x1l9N%bertrand.lupart@linkeo.com>

Hello,

[I hope i'm on the lartc mailing list - i'm posting using gmane]

I used the "Linux Advanced Routing & Traffic Control HOWTO" for doing
source routing using iproute2.

The documentation would be perfect if the source routing page
<url:http://lartc.org/howto/lartc.rpdb.html> mentionned you may have to
turn off spoofing protection on ppp2:

----8<----8<----8<----8<----
echo 0 > /proc/sys/net/ipv4/conf/ppp2/rp_filter
---->8---->8---->8---->8----


I was stuck for quite some time with no net and my logs full of:
----8<----8<----8<----8<----
kernel: martian source 42424242 for 42424242, dev ppp0
---->8---->8---->8---->8----


It's a usefull HOWTO. Thanx.

-- 
Bertrand

From oliver at samera.com.py  Mon Sep  4 21:02:07 2006
From: oliver at samera.com.py (Oliver Schulze L.)
Date: Mon Sep  4 21:01:52 2006
Subject: [LARTC] SPITS 0.0.9b
In-Reply-To: <1157382831.4441.23.camel@wks-toto>
References: <1157382831.4441.23.camel@wks-toto>
Message-ID: <44FC782F.5040903@samera.com.py>

Looks nice, do you have a demo page?

Oliver

-- 
Oliver Schulze L.
Get my e-mail after a captcha test in: http://tinymailto.com/oliver

From tino.kriswanto at gmail.com  Tue Sep  5 02:19:30 2006
From: tino.kriswanto at gmail.com (tino)
Date: Tue Sep  5 02:19:26 2006
Subject: [LARTC] maximum class
References: <00c001c6ce8f$b3d5b450$7a0989ca@bmsby010128>
	<20060904072013.GA28517@ldc.net>
Message-ID: <002701c6d080$faf79a40$7a0989ca@bmsby010128>

Hi,Marek Kierdelewicz

with 6634 class you have, could you share to us about your current box cpu 
load, memory utilization, cbq or  htb

If it was reasonable low usage,  I will start to build perl script to write 
large class.


many thanks,
Tino

Date: Mon, 4 Sep 2006 11:40:13 +0200
From: Marek Kierdelewicz <marek@piasta.pl>
Subject: Re: [LARTC] maximum class
To: lartc@mailman.ds9a.nl
Message-ID: <20060904114013.095ec483@localhost.localdomain>
Content-Type: text/plain; charset=ISO-8859-2

Hi

> Any  user experience with 1000 class or above ?

I've got 6634 classess on one host. Everything works the way it should.

regards,
-- 
Marek Kierdelewicz
Kierownik Dzia?u Systemow Sieciowych, KoBa
Manager of Network Systems Department, KoBa
tel. (85) 7406466; fax. (85) 7406467
e-mail: admin@koba.pl
----- Original Message ----- 
From: "Dmytro O. Redchuk" <dor@ldc.net>
To: "tino" <tino.kriswanto@gmail.com>
Cc: <lartc@mailman.ds9a.nl>
Sent: Monday, September 04, 2006 2:20 PM
Subject: Re: [LARTC] maximum class


> On Sat, Sep 02, 2006 at 07:59:55PM +0700, tino wrote:
>> Hi,
>> currently I'm using 48 class with htb & very stable
>> Is there any  maximum number of class I can create  in a single linux box 
>> ?
>> I need 500 or even 1000 class for campuss network.
> Up to 0xffff. Per device per qdisc.
>
> (Every classid you are using is in hex, too: i.e. "classid 1:48" is
> 1:[0x0048] actually)
>
>
>
> Am I right, by the way?-)
> Is the
> max_number = number_of_qdiscs_at_device *
> number_of_classes_at_qdisc = 0xffff * 0xffff ?
>
> Or there is some DEFINE'd limitation (in kernel's header files, let's
> say)?
>
>> Any help appreciated
>>
>> thanks & regards
>> Tino
>
> -- 
>  _,-=._              /|_/|
>  `-.}   `=._,.-=-._.,  @ @._,
>     `._ _,-.   )      _,.-'
>        `    G.m-"^m`m'        Dmytro O. Redchuk
>
> 

From ltlbeaver at gmail.com  Tue Sep  5 08:24:09 2006
From: ltlbeaver at gmail.com (ltlbeaver)
Date: Tue Sep  5 08:24:04 2006
Subject: [LARTC] SPITS 0.0.9b
In-Reply-To: <1157382831.4441.23.camel@wks-toto>
References: <1157382831.4441.23.camel@wks-toto>
Message-ID: <44FD1809.5090104@gmail.com>

Please include some screenshots!
From iosif.peterfi at fortesys.ro  Tue Sep  5 15:52:04 2006
From: iosif.peterfi at fortesys.ro (Iosif Peterfi)
Date: Tue Sep  5 15:51:29 2006
Subject: [LARTC] SPITS 0.0.9b
In-Reply-To: <44FC782F.5040903@samera.com.py>
References: <1157382831.4441.23.camel@wks-toto>
	<44FC782F.5040903@samera.com.py>
Message-ID: <1157464325.6266.3.camel@wks-toto>

On Mon, 2006-09-04 at 15:02 -0400, Oliver Schulze L. wrote:
> Looks nice, do you have a demo page?

http://193.111.161.6/SPITS/site/index.php - is the management page
http://193.111.161.6/SPITS/site/crontabs/spits.php - is the output
generated by the script which should run as root, which actually runs as
apache user now. Debuging output and executed commands can be seen in
the output.



> 
> Oliver
> 


From iosif.peterfi at fortesys.ro  Tue Sep  5 16:03:14 2006
From: iosif.peterfi at fortesys.ro (Iosif Peterfi)
Date: Tue Sep  5 16:02:43 2006
Subject: [LARTC] SPITS 0.0.9b
In-Reply-To: <1157464325.6266.3.camel@wks-toto>
References: <1157382831.4441.23.camel@wks-toto>
	<44FC782F.5040903@samera.com.py>  <1157464325.6266.3.camel@wks-toto>
Message-ID: <1157464994.6266.11.camel@wks-toto>

On Tue, 2006-09-05 at 16:52 +0300, Iosif Peterfi wrote:
> On Mon, 2006-09-04 at 15:02 -0400, Oliver Schulze L. wrote:
> > Looks nice, do you have a demo page?
> 
> http://193.111.161.6/SPITS/site/index.php - is the management page
  SQL Injections is likely to be possible, also interfaces added cannot
be deleted at this time, so, i suggest everyone to create a fake
interface and play with his interface and the few qdiscs available :p

> http://193.111.161.6/SPITS/site/crontabs/spits.php - is the output
> generated by the script which should run as root, which actually runs as
> apache user now. Debuging output and executed commands can be seen in
> the output.
  
  View source in the browser as the output is plain text, not HTML :)

> 
> 
> 
> > 
> > Oliver
> > 
> 
> 
> _______________________________________________
> LARTC mailing list
> LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
> 


From oliver at samera.com.py  Tue Sep  5 20:54:06 2006
From: oliver at samera.com.py (Oliver Schulze L.)
Date: Tue Sep  5 20:53:51 2006
Subject: [LARTC] SPITS 0.0.9b
In-Reply-To: <1157464994.6266.11.camel@wks-toto>
References: <1157382831.4441.23.camel@wks-toto>	<44FC782F.5040903@samera.com.py>
	<1157464325.6266.3.camel@wks-toto>
	<1157464994.6266.11.camel@wks-toto>
Message-ID: <44FDC7CE.1050705@samera.com.py>

Iosif Peterfi wrote:
>   
>   View source in the browser as the output is plain text, not HTML :)
>   
tks

Oliver

-- 
Oliver Schulze L.
Get my e-mail after a captcha test in: http://tinymailto.com/oliver

From jfulton at arctic.net  Tue Sep  5 21:08:17 2006
From: jfulton at arctic.net (John Fulton)
Date: Tue Sep  5 21:09:47 2006
Subject: [LARTC] Routing question
In-Reply-To: <1157464325.6266.3.camel@wks-toto>
References: <1157382831.4441.23.camel@wks-toto>
	<44FC782F.5040903@samera.com.py> <1157464325.6266.3.camel@wks-toto>
Message-ID: <7.0.1.0.2.20060905105946.01227990@arctic.net>

I've always had to either have routing on, or off on a system.

For the first time this week I have a system on the internet but with 
one connection to a private network to manage a piece of network gear.

The situation is where I have a server on a 802.1q trunk with 4 VLAN 
interfaces on the internet and needs standard routing across the 
interfaces, eth0.3, eth0.7, eth0.10, and eth0.11 all with public 
address space and has standard routing.

I just turned up eth0.2 on a private network (192.168.x.x) that I 
need to prevent any traffic from the public interfaces from reaching.

After dipping into the iprouting documentation, it's only confused me 
more. I assume this is accomplished with a rule but sofar I have only 
been able to completely shut off access to the private network 
entirely including the server's access to that subnet.

Could someone point me to an example of how this can be done?

Thank you!

John Fulton
Anchorage, AK

From doudouyam at gmail.com  Wed Sep  6 14:32:48 2006
From: doudouyam at gmail.com (doudouyam)
Date: Wed Sep  6 14:32:37 2006
Subject: [LARTC] Can i attach another qdisc (htb) under HFSC classfull ?
Message-ID: <81c11a560609060532u8be1599ndc89b573ad48db9e@mail.gmail.com>

Hi,

Is it possible to attach another qdisq under a HFSC classfull ?

I try it and the configuraton works :

        $TC qdisc add dev $dev root handle 1: hfsc default 30

        $TC class add dev $dev parent 1: classid 1:1 hfsc sc rate
${RATE}mbit ul rate ${RATE}mbit

        $TC class add dev $dev parent 1:1 classid 1:10 hfsc rt umax 1500b
dmax 30ms rate 200kbit
        $TC class add dev $dev parent 1:1 classid 1:20 hfsc rt umax 1500b
dmax 1ms rate 5mbit
        $TC class add dev $dev parent 1:1 classid 1:40 hfsc sc rate
${RATE15}mbit ul rate ${RATE}mbit

        $TC qdisc add dev $dev parent 1:10 handle 10 sfq perturb 10
        $TC qdisc add dev $dev parent 1:20 handle 20 sfq perturb 10

        $TC qdisc add dev $dev parent 1:30 handle 30:0 htb default 302

        $TC class add dev $dev parent 30:0 classid 30:1 htb rate ${RATE}mbit
burst 15k quantum 60000

        $TC class add dev $dev parent 30:1 classid 30:10 htb rate
${RATE15}mbit ceil ${RATE}mbit burst 15k prio 1 quantum 60000
        $TC class add dev $dev parent 30:1 classid 30:20 htb rate
${RATE15}mbit ceil ${RATE}mbit burst 15k prio 2 quantum 60000

        $TC qdisc add dev $dev parent 30:10 handle 301:0 sfq perturb 10
        $TC qdisc add dev $dev parent 30:20 handle 302:0 sfq perturb 10


                    1:0 hfsc
                          |
                    1:1 hfsc
          /               |             \
      1:10         1:20        1:30
          |               |               |
    10 (sfq)    20(sfq)    30(htb)
                                           |
                                    30:1(htb)
                                      /           \
                                30:10    30:20
                                     |             |
                            310(sfq)    320(sfq)



but when I made a filter for put packets in one of the HTB classes (30:10)
it arrive at the principal HTB class (30) and it sent directly to the
interface.
It didn't pass by the htb class but the stream go out of the router.

qdisc hfsc 1: default 30
 Sent 81396094 bytes 59762 pkt (dropped 23, overlimits 34777 requeues 0)
 backlog 0b 3p requeues 0
qdisc sfq 10: parent 1:10 limit 128p quantum 1514b perturb 10sec
 Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0)
 backlog 0b 0p requeues 0
qdisc sfq 20: parent 1:20 limit 128p quantum 1514b perturb 10sec
 Sent 53186158 bytes 39167 pkt (dropped 0, overlimits 0 requeues 1)
 backlog 0b 0p requeues 1
qdisc htb 30: parent 1:30 r2q 10 default 302 direct_packets_stat 20575
 Sent 28182776 bytes 20575 pkt (dropped 0, overlimits 0 requeues 14527)
 backlog 0b 3p requeues 14527
qdisc sfq 301: parent 30:10 limit 128p quantum 1514b perturb 10sec
 Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0)
 backlog 0b 0p requeues 0
qdisc sfq 302: parent 30:20 limit 128p quantum 1514b perturb 10sec
 Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0)
 backlog 0b 0p requeues 0

Can you help me ?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060906/d1be51a6/attachment.htm
From lsharpe at pacificwireless.com.au  Thu Sep  7 08:26:33 2006
From: lsharpe at pacificwireless.com.au (Leigh Sharpe)
Date: Thu Sep  7 08:26:32 2006
Subject: [LARTC] Rate limits whithin rate limits
Message-ID: <H0000069000a5a21.1157610392.mail.pacificwireless.net.au@MHS>

Hi all,
I'm sure I'm soing something wrong here.
I am trying to set up a rate limit inside another rate limit.
eg. I have a 512K rate limit on a particular VLAN. I am using an IFB so
that packets passing through the bridge are counted at each port.(ie the
throughput is limited to 512K, not just the traffic in one direction.)
This part works OK, but I also want to limit a particular IP to much
less than that, say 100K. Therefore, overall the VLAN can pass no more
thatn 512K, and the particular host cannot exceed 100K of that 512K.
Using the config below, I'm able to limit the VLAN to 512K and the
nominated host to 100K, but the total (ie nominated host + all other
traffic) adds up to 612 K. The child classes are limiting approriately,
but not respecting the parent class. Anybody care to shed some light on
what I might be doing wrong?
 
 
Config as follows:
 
#!/bin/sh
# Load kernel modules
modprobe ifb numifbs=1000
modprobe act_mirred
# set up raw queuing discipline on ports.
tc qdisc add dev eth0.10 root handle 1:0 cbq bandwidth 100Mbit avpkt
1000 cell 8
tc qdisc add dev eth1.10 root handle 1:0 cbq bandwidth 100Mbit avpkt
1000 cell 8
# bring up IFB
ifconfig ifb10 up
# Add queuing disciplines to IFB
# Raw qdisc first.
tc qdisc add dev ifb10 root handle 1:0 cbq bandwidth 100Mbit avpkt 1000
cell 8
# Now add the rate limit
tc class add dev ifb10 parent 1:0 classid 1:1 cbq bandwidth 100Mbit rate
512Kbit weight 51Kbit prio 5 allot 1514 cell 8 maxburst 20 avpkt 1000
bounded isolated
# Now re-direct all ingress packets to the IFB
tc qdisc add dev eth0.10 ingress
tc qdisc add dev eth1.10 ingress
tc filter add dev eth0.10 parent ffff: protocol ip prio 10 u32 match u32
0 0 flowid 1:1 action mirred egress redirect dev ifb10
tc filter add dev eth1.10 parent ffff: protocol ip prio 10 u32 match u32
0 0 flowid 1:1 action mirred egress redirect dev ifb10
 
# Now add a 100K rate limit for packets to or from 172.16.1.117, plus
another 512K rate limit for the entire VLAN.
# Add an unlimited class for un-matched data.
tc class add dev ifb10 parent 1:1 classid 1:2 cbq bandwidth 100Mbit rate
512Kbit weight 51Kbit prio 5 allot 1514 cell 8 maxburst 20 avpkt 1000
bounded isolated

# Add the new class, limited to 100K
tc class add dev ifb10 parent 1:1 classid 1:3 cbq bandwidth 100Mbit rate
256Kbit weight 10KBit prio 5 allot 1514 cell 8 maxburst 20 avpkt 1000
bounded isolated

# Now add the filters to direct traffic to each of the above classes.
tc filter add dev ifb10 parent 1:0 protocol ip prio 1 u32 match ip src
172.16.1.117/32 flowid 1:3
tc filter add dev ifb10 parent 1:0 protocol ip prio 1 u32 match ip dst
172.16.1.117/32 flowid 1:3
tc filter add dev ifb10 parent 1:0 protocol ip prio 2 u32 match u32 0 0
flowid 1:2
 
 
 
Class 1:3 is a 100K rate limit.
1:2 is a 512K rate limit, for otherwise unmatched traffic.
 
1:2 and 1:3 are both children of 1:1, which is an overall 512K limit.
Should this not set an upper limit for all traffic through ifb10?
 
 
Regards,
             Leigh
 
Leigh Sharpe
Network Systems Engineer
Pacific Wireless
Ph +61 3 9584 8966
Mob 0408 009 502
email lsharpe@pacificwireless.com.au
web www.pacificwireless.com.au
 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060907/17ec356d/attachment.html
From lsharpe at pacificwireless.com.au  Thu Sep  7 08:42:00 2006
From: lsharpe at pacificwireless.com.au (Leigh Sharpe)
Date: Thu Sep  7 08:41:54 2006
Subject: [LARTC] Routing question
In-Reply-To: <7.0.1.0.2.20060905105946.01227990@arctic.net>
Message-ID: <H0000069000a5a89.1157611319.mail.pacificwireless.net.au@MHS>

I'll try that on-list this time......



An iptables rule in the FORWARD chain to DROP all packets to/from that network? Using the FORWARD chain should allow access from the server's IP address, but not allowing any forwarded traffic. 
 


Regards,
             Leigh
 
Leigh Sharpe
Network Systems Engineer
Pacific Wireless
Ph +61 3 9584 8966
Mob 0408 009 502
email lsharpe@pacificwireless.com.au
web www.pacificwireless.com.au

-----Original Message-----
From: jfulton@arctic.net [mailto:jfulton@arctic.net] 
Sent: Wednesday, September 06, 2006 5:08 AM
To: lartc@mailman.ds9a.nl
Subject: [LARTC] Routing question

I've always had to either have routing on, or off on a system.

For the first time this week I have a system on the internet but with 
one connection to a private network to manage a piece of network gear.

The situation is where I have a server on a 802.1q trunk with 4 VLAN 
interfaces on the internet and needs standard routing across the 
interfaces, eth0.3, eth0.7, eth0.10, and eth0.11 all with public 
address space and has standard routing.

I just turned up eth0.2 on a private network (192.168.x.x) that I 
need to prevent any traffic from the public interfaces from reaching.

After dipping into the iprouting documentation, it's only confused me 
more. I assume this is accomplished with a rule but sofar I have only 
been able to completely shut off access to the private network 
entirely including the server's access to that subnet.

Could someone point me to an example of how this can be done?

Thank you!

John Fulton
Anchorage, AK

_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

From bugzilla at sysreset.com  Fri Sep  8 10:01:55 2006
From: bugzilla at sysreset.com (Bugzilla-Redirect)
Date: Fri Sep  8 10:01:36 2006
Subject: [LARTC] htb traffic shaping problem
Message-ID: <6.2.0.14.2.20060908020146.02e3f138@linux.sysreset.com>

Hello.
I have a linux server connected to a gigabit lan, and though that lan to a 
768kbps/768kbps DSL modem.

I'm trying to shape my webserver running on port 80/443 down to 512kbps, 
while leaving all other ports alone.  The current configuration script that 
I'm using is as follows:
tc qdisc del dev eth0 root
tc qdisc add dev eth0 root handle 1: htb default 99
tc class add dev eth0 parent 1: classid 1:1 htb rate 1000mbit ceil 1000mbit
tc class add dev eth0 parent 1:1 classid 1:10 htb rate 512kbit ceil 512kbit
tc qdisc add dev eth0 parent 1:10 handle 10: sfq
tc class add dev eth0 parent 1:1 classid 1:99 htb rate 900mbit ceil 1000mbit
tc qdisc add dev eth0 parent 1:99 handle 99: sfq
tc filter add dev eth0 protocol ip parent 1: u32 match ip sport 80 0xffff 
flowid 1:10
tc filter add dev eth0 protocol ip parent 1: u32 match ip sport 443 0xffff 
flowid 1:10

1:10 seems to be getting the correct traffic from port 80 and 443 while 
everything else is run to 1:99.  The problem is that, while 1:10 is slowing 
the connection down to a degree, it's nowhere near the set limit.  For 
example: the connection will start out around 50kBps, and then suddenly 
bounce to over 1MBps, far exceeding it's 64kBps setting.

Setting the parent down to 512kbits seems to work correctly, but it 
cripples the local network.

Can anyone point out what I've done incorrectly, or is this a bug?
Thank you.

-Ryan Power 

From e.janz at barceloviajes.com  Fri Sep  8 14:39:42 2006
From: e.janz at barceloviajes.com (e.janz@barceloviajes.com)
Date: Fri Sep  8 14:38:10 2006
Subject: [LARTC] htb traffic shaping problem
In-Reply-To: <6.2.0.14.2.20060908020146.02e3f138@linux.sysreset.com>
Message-ID: <OFE7A7075B.342D4E4C-ONC12571E3.0044F064-C12571E3.00457011@barcelo>

Good afternoon,

your configuration seems correct to me. Could you send us the output of 
"tc -s -d class show dev eth0" during your probes?
What kernel and tc versions are you using?


Regards,

Eric Janz 
Departamento de Sistemas
Grupo Barcel? Viajes

C\ 16 de Julio, 75
07009 Pol?gono Son Castell?
Palma de Mallorca - Baleares
Tel.: +34 971 448030
Fax.: +34 971 436986



Bugzilla-Redirect <bugzilla@sysreset.com> 
Enviado por: lartc-bounces@mailman.ds9a.nl
08/09/2006 10:02

Para
lartc@mailman.ds9a.nl
cc

Asunto
[LARTC] htb traffic shaping problem






Hello.
I have a linux server connected to a gigabit lan, and though that lan to a 

768kbps/768kbps DSL modem.

I'm trying to shape my webserver running on port 80/443 down to 512kbps, 
while leaving all other ports alone.  The current configuration script 
that 
I'm using is as follows:
tc qdisc del dev eth0 root
tc qdisc add dev eth0 root handle 1: htb default 99
tc class add dev eth0 parent 1: classid 1:1 htb rate 1000mbit ceil 
1000mbit
tc class add dev eth0 parent 1:1 classid 1:10 htb rate 512kbit ceil 
512kbit
tc qdisc add dev eth0 parent 1:10 handle 10: sfq
tc class add dev eth0 parent 1:1 classid 1:99 htb rate 900mbit ceil 
1000mbit
tc qdisc add dev eth0 parent 1:99 handle 99: sfq
tc filter add dev eth0 protocol ip parent 1: u32 match ip sport 80 0xffff 
flowid 1:10
tc filter add dev eth0 protocol ip parent 1: u32 match ip sport 443 0xffff 

flowid 1:10

1:10 seems to be getting the correct traffic from port 80 and 443 while 
everything else is run to 1:99.  The problem is that, while 1:10 is 
slowing 
the connection down to a degree, it's nowhere near the set limit.  For 
example: the connection will start out around 50kBps, and then suddenly 
bounce to over 1MBps, far exceeding it's 64kBps setting.

Setting the parent down to 512kbits seems to work correctly, but it 
cripples the local network.

Can anyone point out what I've done incorrectly, or is this a bug?
Thank you.

-Ryan Power 

_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc


--

ADVERTENCIA LEGAL
El contenido de este correo es confidencial y dirigido unicamente a su destinatario. Para acceder a su clausula de privacidad consulte http://www.barceloviajes.com/privacy

LEGAL ADVISORY
This message is confidential and intended only for the person or entity to which it is addressed. In order to read its privacy policy consult it at http://www.barceloviajes.com/privacy
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060908/d491ea9b/attachment.htm
From pio_mendez at hotmail.com  Fri Sep  8 17:11:24 2006
From: pio_mendez at hotmail.com (Pio Mendez)
Date: Fri Sep  8 17:11:11 2006
Subject: [LARTC] Only root qdisc's stats shows overlimits
Message-ID: <BAY117-F38A3E70B550901DB1A8B64FB370@phx.gbl>

An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060908/904b36bd/attachment.html
From cemeyer2 at uiuc.edu  Fri Sep  8 17:27:00 2006
From: cemeyer2 at uiuc.edu (Charlie Meyer)
Date: Fri Sep  8 17:26:55 2006
Subject: [LARTC] htb traffic shaping problem
In-Reply-To: <OFE7A7075B.342D4E4C-ONC12571E3.0044F064-C12571E3.00457011@barcelo>
Message-ID: <000701c6d35b$3eea1250$46fdae80@MURPHY>

Hi,

 

I have a similar setup here, and what I did was instead of shaping the
traffic with tc, I used mod_cband on apache2 to limit concurrent connections
and bandwidth. There is a very helpful reference on getting it up and
running here:
http://www.howtoforge.com/mod_cband_apache2_bandwidth_quota_throttling 

 

Hope that helps a bit

 

Charlie Meyer

University of Illinois at Urbana-Champaign

Department of Computer Science - Undergraduate

cemeyer2@uiuc.edu

  _____  

From: lartc-bounces@mailman.ds9a.nl [mailto:lartc-bounces@mailman.ds9a.nl]
On Behalf Of e.janz@barceloviajes.com
Sent: Friday, September 08, 2006 7:40 AM
To: lartc@mailman.ds9a.nl
Subject: Re: [LARTC] htb traffic shaping problem

 


Good afternoon,

your configuration seems correct to me. Could you send us the output of "tc
-s -d class show dev eth0" during your probes?
What kernel and tc versions are you using?


Regards,

Eric Janz 
Departamento de Sistemas
Grupo Barcel? Viajes

C\ 16 de Julio, 75
07009 Pol?gono Son Castell?
Palma de Mallorca - Baleares
Tel.: +34 971 448030
Fax.: +34 971 436986




Bugzilla-Redirect <bugzilla@sysreset.com>
Enviado por: lartc-bounces@mailman.ds9a.nl

08/09/2006 10:02


Para

lartc@mailman.ds9a.nl


cc

 


Asunto

[LARTC] htb traffic shaping problem

 


 

 




Hello.
I have a linux server connected to a gigabit lan, and though that lan to a 
768kbps/768kbps DSL modem.

I'm trying to shape my webserver running on port 80/443 down to 512kbps, 
while leaving all other ports alone.  The current configuration script that 
I'm using is as follows:
tc qdisc del dev eth0 root
tc qdisc add dev eth0 root handle 1: htb default 99
tc class add dev eth0 parent 1: classid 1:1 htb rate 1000mbit ceil 1000mbit
tc class add dev eth0 parent 1:1 classid 1:10 htb rate 512kbit ceil 512kbit
tc qdisc add dev eth0 parent 1:10 handle 10: sfq
tc class add dev eth0 parent 1:1 classid 1:99 htb rate 900mbit ceil 1000mbit
tc qdisc add dev eth0 parent 1:99 handle 99: sfq
tc filter add dev eth0 protocol ip parent 1: u32 match ip sport 80 0xffff 
flowid 1:10
tc filter add dev eth0 protocol ip parent 1: u32 match ip sport 443 0xffff 
flowid 1:10

1:10 seems to be getting the correct traffic from port 80 and 443 while 
everything else is run to 1:99.  The problem is that, while 1:10 is slowing 
the connection down to a degree, it's nowhere near the set limit.  For 
example: the connection will start out around 50kBps, and then suddenly 
bounce to over 1MBps, far exceeding it's 64kBps setting.

Setting the parent down to 512kbits seems to work correctly, but it 
cripples the local network.

Can anyone point out what I've done incorrectly, or is this a bug?
Thank you.

-Ryan Power 

_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

--

ADVERTENCIA LEGAL
El contenido de este correo es confidencial y dirigido unicamente a su
destinatario. Para acceder a su clausula de privacidad consulte
http://www.barceloviajes.com/privacy

LEGAL ADVISORY
This message is confidential and intended only for the person or entity to
which it is addressed. In order to read its privacy policy consult it at
http://www.barceloviajes.com/privacy

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060908/970b24cc/attachment-0001.htm
From vit at icebrains-soft.com  Fri Sep  8 21:13:23 2006
From: vit at icebrains-soft.com (vit@icebrains-soft.com)
Date: Fri Sep  8 21:11:11 2006
Subject: [LARTC] 
	UIDs, virtual network inside localhost, etc.  Pls, help, me.
In-Reply-To: <20060902162323.GA2123@swdevel.local>
References: <mailman.337.1157212802.16610.lartc@mailman.ds9a.nl>
	<20060902162323.GA2123@swdevel.local>
Message-ID: <20060908191323.GA11556@swdevel.local>

Hello!

I need assistance to solve my problem related to traffic shaping based on 
the user ids.

The problem: each unix user (of the linux host) has to be limited with 
incoming channel (internet) bandwidth.

Solution I want to implement:
                                  ____________ 
unix user1 <-> IP1 \             |            |
       ....          <---------> | gw IP, NAT |<-----> eth interface 
unix userN <-> IPN /     ^       |____________|
                         |
                         |_____ traffic shaper is here


Each unix user sents and receives network data through dedicated IP address (which belongs to 
one of the aliases of the localhost interface - lo:1, lo:2 etc).  All IP addresses are in the same network
(for example, 192.168.5.0).  One of localhost aliases acts as a gateway (192.168.5.1, for example).
And to send and receive data to the actual network, (S)NAT is required.

To shape the traffic, linux traffic shaper (CBQ) is used.

It seems to me, this scheme looks good and real (in my case, the quantity of simultaniously connected users is less than 50).  Am I right?

But can anybody give me an advice how to implement it ? :-)

Problems were appeared at my first step:

As first step, I've tried to construct the "virtual network" IP1..IPN and gw IP:

# ifconfig lo:1 inet 192.168.5.1 up

And immediately after executing this command it is possible to ping any 192.168.5.x IP address, not only 192.168.5.1 (as I've expected).
Why???  What is the problem?

Thank you beforehand!
-- 
Sincerely yours, Vitaly Repin
Ice Brains Software, ltd
From jclark at metricsystems.com  Fri Sep  8 21:24:57 2006
From: jclark at metricsystems.com (John Clark)
Date: Fri Sep  8 21:24:39 2006
Subject: [LARTC] Simple set up to shape traffic...
Message-ID: <4501C389.2030506@metricsystems.com>

I looked and found a 'very simple' command sequence to shape traffic to 
a specific
host. However, I 'cribbed' the command sequence from a online tutoral 
from 'somewhere'.

I now have lost the example, and my altered sequence.

the command I am getting an 'RTNETLINK' Invalid argument error from is:

tc qdisc add dev eth0 root handle 1: cbq avpkt 1000 bandwidth 3700kbit

I don't think I used this particular set of options previously. Somehow 
I think I
was using the sfq rather than the cbq.

The goal that I have at the moment is to limit the bandwidth of data 
sent to a
particular host. I had this working but seem to have lost a specific 
parameter sequence.

Thanks
John Clark

From andreas at stapelspeicher.org  Fri Sep  8 23:53:55 2006
From: andreas at stapelspeicher.org (Andreas Mueller)
Date: Fri Sep  8 23:54:53 2006
Subject: [LARTC] Traffic shaper based on UIDs
In-Reply-To: <20060902162323.GA2123@swdevel.local>
References: <mailman.337.1157212802.16610.lartc@mailman.ds9a.nl>
	<20060902162323.GA2123@swdevel.local>
Message-ID: <20060908215355.GA6760@lintera>

Hi,

vit@icebrains-soft.com wrote:
...
> But there is no filter based on unix user id (the reason is clear for 
> everybody -- ip packet doesn't contain this information).
> 
> I've found the very interesting netfilter patches at the patch-o-matic: 
...
There is no need for POM patches, you may use the "owner" match from
iptables. (see: man iptables)
> Am I on the right way?  How can I combine the power of netfilter and 
> traffic control systems to solve my problem?
...
You might match for each user and then set a mark or even classify directly
by iptables. (see man, too)

Howto mark: http://lartc.org/howto/lartc.qdisc.filters.html (9.6.2, fwmark)

Btw.. there is no best (classful) qdisc, this varies on your needs.
Nevertheless, I'd take htb because it's relativly simple to setup
(personally I like hfsc though).
You may just try them out. :)

Bye,
Andreas.

From vit at icebrains-soft.com  Sat Sep  9 00:09:53 2006
From: vit at icebrains-soft.com (vit@icebrains-soft.com)
Date: Sat Sep  9 00:07:40 2006
Subject: [LARTC] Traffic shaper based on UIDs
In-Reply-To: <20060908215355.GA6760@lintera>
References: <mailman.337.1157212802.16610.lartc@mailman.ds9a.nl>
	<20060902162323.GA2123@swdevel.local>
	<20060908215355.GA6760@lintera>
Message-ID: <20060908220953.GA17229@swdevel.local>

Hello, Andreas!

Yes, the owner match is great. But I can mark only outgoing packets
this way.  And as far as I know, traffic shaper needs to know who is
the owner of the incoming packets to do the shaper job. 

And that's why it is required to patch the kernel, it seems to me.
Have I misunderstood something?

But I've recently sent to this mailing list another letter related
to this problem.  It seems to me, if each unix user would use the
different IP address, it is not a problem to do the shaping.

Thank you for your response.

> Hi,
> 
> vit@icebrains-soft.com wrote:
> ...
> > But there is no filter based on unix user id (the reason is clear for 
> > everybody -- ip packet doesn't contain this information).
> > 
> > I've found the very interesting netfilter patches at the patch-o-matic: 
> ...
> There is no need for POM patches, you may use the "owner" match from
> iptables. (see: man iptables)
> > Am I on the right way?  How can I combine the power of netfilter and 
> > traffic control systems to solve my problem?
> ...
> You might match for each user and then set a mark or even classify directly
> by iptables. (see man, too)
> 
> Howto mark: http://lartc.org/howto/lartc.qdisc.filters.html (9.6.2, fwmark)
> 
> Btw.. there is no best (classful) qdisc, this varies on your needs.
> Nevertheless, I'd take htb because it's relativly simple to setup
> (personally I like hfsc though).
> You may just try them out. :)
> 
> Bye,
> Andreas.
> 
> _______________________________________________
> LARTC mailing list
> LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

-- 
Sincerely yours, Vitaly Repin
Ice Brains Software, ltd
From bugzilla at sysreset.com  Sat Sep  9 21:55:37 2006
From: bugzilla at sysreset.com (Bugzilla-Redirect)
Date: Sat Sep  9 21:55:19 2006
Subject: [LARTC] Re: htb traffic shaping problem (Charlie Meyer)
In-Reply-To: <20060908152712.4E52044F1@outpost.ds9a.nl>
References: <20060908152712.4E52044F1@outpost.ds9a.nl>
Message-ID: <6.2.0.14.2.20060909135043.02dd9d80@linux.sysreset.com>

Eric,
I've attached the output from the command you requested below.
I'm using kernel 2.6.17.12 and tc version ss060323.  I'm have a nforce4 
onboard giggabit controller using the forcedeth driver, if that makes a 
difference.

Charlie,
I'll take a look at the Apache model for throttling, thanks.  I was going 
for tc because was going to try to add additional shaping to non-apache 
traffic once I got it working correctly.

Thanks,
-Ryan Power

tc -s -d class show dev eth0
class htb 1:99 parent 1:1 leaf 99: prio 0 quantum 3000 rate 900000Kbit ceil 
1000Mbit burst 451350b/8 mpu 0b overhead 0b cburst 501375b/8 mpu 0b 
overhead 0b level 0
  Sent 48695 bytes 398 pkt (dropped 0, overlimits 0 requeues 0)
  rate 2704bit 2pps backlog 0b 0p requeues 0
  lended: 398 borrowed: 0 giants: 0
  tokens: 4326 ctokens: 4325

class htb 1:1 root rate 1000Mbit ceil 1000Mbit burst 501375b/8 mpu 0b 
overhead 0b cburst 501375b/8 mpu 0b overhead 0b level 7
  Sent 32821394 bytes 994 pkt (dropped 0, overlimits 0 requeues 0)
  rate 3556Kbit 10pps backlog 0b 0p requeues 0
  lended: 0 borrowed: 0 giants: 1128
  tokens: 4325 ctokens: 4325

class htb 1:10 parent 1:1 leaf 10: prio 0 quantum 3000 rate 512000bit ceil 
512000bit burst 1755b/8 mpu 0b overhead 0b cburst 1755b/8 mpu 0b overhead 
0b level 0
  Sent 34256069 bytes 701 pkt (dropped 0, overlimits 0 requeues 0)
  rate 3554Kbit 8pps backlog 0b 105p requeues 0
  lended: 596 borrowed: 0 giants: 1128
  tokens: -52724 ctokens: -52724

From spam-goes-to-dev-null at gmx.net  Sun Sep 10 17:28:00 2006
From: spam-goes-to-dev-null at gmx.net (Leo Wetz)
Date: Sun Sep 10 17:27:43 2006
Subject: [LARTC] HFSC traffic loss bug, kernel 2.6.16.24
Message-ID: <20060910152735.81EB3405C@outpost.ds9a.nl>

Hello,

I have finally managed to understand HFSC up to a level which allowed me to
create a QoS script which maintains low VoIP latency while running stuff
like eMule.

Unfortunately, HFSC seems to have a severe bug.
Why do I consider this as a bug defenitely?
Well, my script runs without any errors, then QoS works perfectly for some
hours, no error messages in kernel log.
Then randomly the kernel starts saying this:

Sep 10 17:14:51 router kernel: HFSC: Non-work-conserving qdisc ?
Sep 10 17:14:56 router kernel: printk: 266 messages suppressed.
Sep 10 17:14:56 router kernel: HFSC: Non-work-conserving qdisc ?
Sep 10 17:15:01 router kernel: printk: 259 messages suppressed.
Sep 10 17:15:01 router kernel: HFSC: Non-work-conserving qdisc ?
Sep 10 17:15:06 router kernel: printk: 294 messages suppressed.
Sep 10 17:15:06 router kernel: HFSC: Non-work-conserving qdisc ?

It floods the whole kernel log with this.
Traffic is also heavily affected by package loss when this happens, thus I
cannot ignore it.
I have to check my kernel log when I notice that I cannot access websites
anymore and then restart QoS manually.

My complete QoS script is attached to this mail.
If this is not the right location for the bug report please tell me whom I
should contact.

Thanks, Leo

-------------- next part --------------
A non-text attachment was scrubbed...
Name: qos
Type: application/octet-stream
Size: 2281 bytes
Desc: not available
Url : http://mailman.ds9a.nl/pipermail/lartc/attachments/20060910/385cf89c/qos.obj
From dexcript at yahoo.com.br  Sun Sep 10 21:16:50 2006
From: dexcript at yahoo.com.br (d3xcrIpt)
Date: Sun Sep 10 21:14:59 2006
Subject: [LARTC] HTB and tc filter
Message-ID: <450464A2.3080205@yahoo.com.br>

An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060910/f1edc538/attachment.htm
From dexcript at yahoo.com.br  Sun Sep 10 21:45:56 2006
From: dexcript at yahoo.com.br (d3xcrIpt)
Date: Sun Sep 10 21:44:02 2006
Subject: [LARTC] help with HTB and tc
Message-ID: <45046B74.4090007@yahoo.com.br>

An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060910/f8250768/attachment.html
From mlistz at gmail.com  Mon Sep 11 05:03:58 2006
From: mlistz at gmail.com (Zhuang Yuyao)
Date: Mon Sep 11 05:03:39 2006
Subject: [LARTC] [HELP] Mutlicast over GRE tunnel
Message-ID: <4504D21E.70800@gmail.com>

Hi,

I got a problem similar to this one 
(http://mailman.ds9a.nl/pipermail/lartc/2005q4/017614.html), GRE tunnel 
can forward normal IP packets such as ICMP but failed to tunnel 
multicast traffics.

Here's the setup:

                        192.168.20.0/24
 LAN-A--------------RtrA-------------RtrB--------------LAN-B
      192.168.50.0/24                     192.168.60.0/24

RtrA interfaces:
eth0 192.168.20.100
eth1 192.168.50.1

HOSTA in LAN-A
eth0 192.168.50.250

RtrB interfaces:
eth0 192.168.20.98
eth1 192.168.60.1

HOSTB in LAN-B
eth0 192.168.60.250

Here is the setup script on RtrB:

      1 #!/bin/sh
      2
      3 END_L=192.168.20.98
      4 END_R=192.168.20.100
      5 GRE_L=10.0.0.4
      6 GRE_R=10.0.0.3
      7 MGROUP=224.0.55.55
      8 SUBNET_R=192.168.50.0/24
      9
     10 /usr/sbin/iptables -F
     11 /usr/sbin/iptables -F -t nat
     12 /usr/sbin/iptables -P FORWARD ACCEPT
     13
     14 ip tunnel del gretun
     15 ip tunnel add gretun mode gre remote $END_R local $END_L ttl 255
     16 ip link set gretun up multicast on
     17 ip addr add $GRE_L peer $GRE_R/24 dev gretun
     18
     19 ip route del $SUBNET_R via $GRE_R
     20 ip route add $SUBNET_R via $GRE_R
     21
     22 /usr/sbin/smcroute -k
     23 /usr/sbin/smcroute -d
     24 sleep 3
     25 /usr/sbin/smcroute -a eth1 192.168.60.250 $MGROUP gretun
     26 /usr/sbin/smcroute -j gretun $MGROUP

and the setup script on RtrA:
      1 #!/bin/sh
      2
      3 END_L=192.168.20.100
      4 END_R=192.168.20.98
      5 GRE_L=10.0.0.3
      6 GRE_R=10.0.0.4
      7 MGROUP=224.0.55.55
      8 SUBNET_R=192.168.60.0/24
      9
     10 /usr/sbin/iptables -F
     11 /usr/sbin/iptables -F -t nat
     12 /usr/sbin/iptables -P FORWARD ACCEPT
     13
     14 ip tunnel del gretun
     15 ip tunnel add gretun mode gre remote $END_R local $END_L ttl 255
     16 ip link set gretun up multicast on
     17 ip addr add $GRE_L peer $GRE_R/24 dev gretun
     18
     19 ip route del $SUBNET_R via $GRE_R
     20 ip route add $SUBNET_R via $GRE_R
     21
     22 /usr/sbin/smcroute -k
     23 /usr/sbin/smcroute -d
     24 sleep 3
     25 /usr/sbin/smcroute -a eth1 192.168.60.250 $MGROUP gretun
     26 /usr/sbin/smcroute -j gretun $MGROUP

On RtrB (while running #ping 192.168.50.250 on HOSTB):
/usr/sbin/tcpdump -i eth0 -n
10:46:21.470623 IP 192.168.20.98 > 192.168.20.100: GREv0, length 88: IP 
192.168.60.250 > 192.168.50.250: ICMP echo request, id 44558, seq 1, 
length 64
10:46:21.476843 IP 192.168.20.100 > 192.168.20.98: GREv0, length 88: IP 
192.168.50.250 > 192.168.60.250: ICMP echo reply, id 44558, seq 1, length 64
10:46:22.487867 IP 192.168.20.98 > 192.168.20.100: GREv0, length 88: IP 
192.168.60.250 > 192.168.50.250: ICMP echo request, id 44558, seq 2, 
length 64
10:46:22.491629 IP 192.168.20.100 > 192.168.20.98: GREv0, length 88: IP 
192.168.50.250 > 192.168.60.250: ICMP echo reply, id 44558, seq 2, length 64
10:46:23.473064 IP 192.168.20.98 > 192.168.20.100: GREv0, length 88: IP 
192.168.60.250 > 192.168.50.250: ICMP echo request, id 44558, seq 3, 
length 64
10:46:23.473711 IP 192.168.20.100 > 192.168.20.98: GREv0, length 88: IP 
192.168.50.250 > 192.168.60.250: ICMP echo reply, id 44558, seq 3, length 64
10:46:24.452719 IP 192.168.20.98 > 192.168.20.100: GREv0, length 88: IP 
192.168.60.250 > 192.168.50.250: ICMP echo request, id 44558, seq 4, 
length 64
10:46:24.453209 IP 192.168.20.100 > 192.168.20.98: GREv0, length 88: IP 
192.168.50.250 > 192.168.60.250: ICMP echo reply, id 44558, seq 4, length 64
10:46:25.470861 IP 192.168.20.98 > 192.168.20.100: GREv0, length 88: IP 
192.168.60.250 > 192.168.50.250: ICMP echo request, id 44558, seq 5, 
length 64
10:46:25.478632 IP 192.168.20.100 > 192.168.20.98: GREv0, length 88: IP 
192.168.50.250 > 192.168.60.250: ICMP echo reply, id 44558, seq 5, length 64

As you can see, the ICMP packets are encapsulated by GRE tunnel.

Now I started to run multicast test by running "iperf -c 224.0.55.55 -u 
-T 32 -t 1000 -i 1" on HOSTB
On RtrB:
/usr/sbin/tcpdump -i eth0 -n
/usr/sbin/tcpdump -i gretun -n
both captured nothing !!!

I am really confused. Any help will be appreciated!

Thanks very much!

Best regards,

    Zhuang Yuyao


From mlistz at gmail.com  Mon Sep 11 05:16:29 2006
From: mlistz at gmail.com (Zhuang Yuyao)
Date: Mon Sep 11 05:16:10 2006
Subject: [LARTC] Re: [HELP] Mutlicast over GRE tunnel (some minor fix on
 RtrA setup script but the problem is still there)
In-Reply-To: <4504D21E.70800@gmail.com>
References: <4504D21E.70800@gmail.com>
Message-ID: <4504D50D.3070408@gmail.com>

Zhuang Yuyao wrote:
> Hi,
>
> I got a problem similar to this one 
> (http://mailman.ds9a.nl/pipermail/lartc/2005q4/017614.html), GRE 
> tunnel can forward normal IP packets such as ICMP but failed to tunnel 
> multicast traffics.
>
> Here's the setup:
>
>                        192.168.20.0/24
> LAN-A--------------RtrA-------------RtrB--------------LAN-B
>      192.168.50.0/24                     192.168.60.0/24
>
> RtrA interfaces:
> eth0 192.168.20.100
> eth1 192.168.50.1
>
> HOSTA in LAN-A
> eth0 192.168.50.250
>
> RtrB interfaces:
> eth0 192.168.20.98
> eth1 192.168.60.1
>
> HOSTB in LAN-B
> eth0 192.168.60.250
>
> Here is the setup script on RtrB:
>
>      1 #!/bin/sh
>      2
>      3 END_L=192.168.20.98
>      4 END_R=192.168.20.100
>      5 GRE_L=10.0.0.4
>      6 GRE_R=10.0.0.3
>      7 MGROUP=224.0.55.55
>      8 SUBNET_R=192.168.50.0/24
>      9
>     10 /usr/sbin/iptables -F
>     11 /usr/sbin/iptables -F -t nat
>     12 /usr/sbin/iptables -P FORWARD ACCEPT
>     13
>     14 ip tunnel del gretun
>     15 ip tunnel add gretun mode gre remote $END_R local $END_L ttl 255
>     16 ip link set gretun up multicast on
>     17 ip addr add $GRE_L peer $GRE_R/24 dev gretun
>     18
>     19 ip route del $SUBNET_R via $GRE_R
>     20 ip route add $SUBNET_R via $GRE_R
>     21
>     22 /usr/sbin/smcroute -k
>     23 /usr/sbin/smcroute -d
>     24 sleep 3
>     25 /usr/sbin/smcroute -a eth1 192.168.60.250 $MGROUP gretun
>     26 /usr/sbin/smcroute -j gretun $MGROUP
>
> and the setup script on RtrA:
>      1 #!/bin/sh
>      2
>      3 END_L=192.168.20.100
>      4 END_R=192.168.20.98
>      5 GRE_L=10.0.0.3
>      6 GRE_R=10.0.0.4
>      7 MGROUP=224.0.55.55
>      8 SUBNET_R=192.168.60.0/24
>      9
>     10 /usr/sbin/iptables -F
>     11 /usr/sbin/iptables -F -t nat
>     12 /usr/sbin/iptables -P FORWARD ACCEPT
>     13
>     14 ip tunnel del gretun
>     15 ip tunnel add gretun mode gre remote $END_R local $END_L ttl 255
>     16 ip link set gretun up multicast on
>     17 ip addr add $GRE_L peer $GRE_R/24 dev gretun
>     18
>     19 ip route del $SUBNET_R via $GRE_R
>     20 ip route add $SUBNET_R via $GRE_R
>     21
>     22 /usr/sbin/smcroute -k
>     23 /usr/sbin/smcroute -d
>     24 sleep 3
    25 /usr/sbin/smcroute -a gretun 192.168.60.250 $MGROUP eth0
    26 /usr/sbin/smcroute -j gretun $MGROUP
>
> On RtrB (while running #ping 192.168.50.250 on HOSTB):
> /usr/sbin/tcpdump -i eth0 -n
> 10:46:21.470623 IP 192.168.20.98 > 192.168.20.100: GREv0, length 88: 
> IP 192.168.60.250 > 192.168.50.250: ICMP echo request, id 44558, seq 
> 1, length 64
> 10:46:21.476843 IP 192.168.20.100 > 192.168.20.98: GREv0, length 88: 
> IP 192.168.50.250 > 192.168.60.250: ICMP echo reply, id 44558, seq 1, 
> length 64
> 10:46:22.487867 IP 192.168.20.98 > 192.168.20.100: GREv0, length 88: 
> IP 192.168.60.250 > 192.168.50.250: ICMP echo request, id 44558, seq 
> 2, length 64
> 10:46:22.491629 IP 192.168.20.100 > 192.168.20.98: GREv0, length 88: 
> IP 192.168.50.250 > 192.168.60.250: ICMP echo reply, id 44558, seq 2, 
> length 64
> 10:46:23.473064 IP 192.168.20.98 > 192.168.20.100: GREv0, length 88: 
> IP 192.168.60.250 > 192.168.50.250: ICMP echo request, id 44558, seq 
> 3, length 64
> 10:46:23.473711 IP 192.168.20.100 > 192.168.20.98: GREv0, length 88: 
> IP 192.168.50.250 > 192.168.60.250: ICMP echo reply, id 44558, seq 3, 
> length 64
> 10:46:24.452719 IP 192.168.20.98 > 192.168.20.100: GREv0, length 88: 
> IP 192.168.60.250 > 192.168.50.250: ICMP echo request, id 44558, seq 
> 4, length 64
> 10:46:24.453209 IP 192.168.20.100 > 192.168.20.98: GREv0, length 88: 
> IP 192.168.50.250 > 192.168.60.250: ICMP echo reply, id 44558, seq 4, 
> length 64
> 10:46:25.470861 IP 192.168.20.98 > 192.168.20.100: GREv0, length 88: 
> IP 192.168.60.250 > 192.168.50.250: ICMP echo request, id 44558, seq 
> 5, length 64
> 10:46:25.478632 IP 192.168.20.100 > 192.168.20.98: GREv0, length 88: 
> IP 192.168.50.250 > 192.168.60.250: ICMP echo reply, id 44558, seq 5, 
> length 64
>
> As you can see, the ICMP packets are encapsulated by GRE tunnel.
>
> Now I started to run multicast test by running "iperf -c 224.0.55.55 
> -u -T 32 -t 1000 -i 1" on HOSTB
> On RtrB:
> /usr/sbin/tcpdump -i eth0 -n
> /usr/sbin/tcpdump -i gretun -n
> both captured nothing !!!
>
> I am really confused. Any help will be appreciated!
>
> Thanks very much!
>
> Best regards,
>
>    Zhuang Yuyao
>
>
>


From exairetos at tele2.it  Mon Sep 11 13:47:27 2006
From: exairetos at tele2.it (Ferdinando Formica)
Date: Mon Sep 11 13:47:11 2006
Subject: [LARTC] simple question
Message-ID: <web-44849464@mailbe02.swip.net>

An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060911/dbd283fb/attachment.htm
From alex at zoomnet.ro  Mon Sep 11 13:55:16 2006
From: alex at zoomnet.ro (Alexandru Dragoi)
Date: Mon Sep 11 13:54:49 2006
Subject: [LARTC] help with HTB and tc
In-Reply-To: <45046B74.4090007@yahoo.com.br>
References: <45046B74.4090007@yahoo.com.br>
Message-ID: <45054EA4.50201@zoomnet.ro>

d3xcrIpt wrote:

> Help me  ...
>
> I try use the tc filter, but seems he doesn't work, I already 
> reconfigured my kernel ( 2.4.32 ) with all options related a QOS 
> enabled ( like modules ) and nothing happens. I get the tc tool from 
> HTB source package, well  this is my set :
>
> eth0 is my internal NIC.
>
> tc qdisc add dev eth0 root handle 1: htb default 12
>
> tc class add dev eth0 parent 1: classid 1:1 htb rate 100kbps ceil 100kbps
> tc class add dev eth0 parent 1:1 classid 1:10 htb rate 30kbps ceil 100kbps
> tc class add dev eth0 parent 1:1 classid 1:11 htb rate 10kbps ceil 100kbps
> tc class add dev eth0 parent 1:1 classid 1:12 htb rate 60kbps ceil 100kbps
>
> tc filter add dev eth0 protocol ip parent 1:0 prio 1 u32 match ip src 
> <my_ip> flowid 1:10
>
> tc qdisc add dev eth0 parent handle 20: pfifo limit 5
> tc qdisc add dev eth0 parent handle 30: pfifo limit 5
> tc qdisc add dev eth0 parent handle 40: sfq perturb 10
>
> OK. but ... when I look the qdiscs
>
> tc -s -d qdisc
> qdisc htb 1: r2q 10 default 12 direct_packets_stat 411 ver 3.17
>  Sent *181174* bytes 1324 pkts (dropped 0, overlimits 0)
>
>  *qdisc pfifo 20: parent 1:10 limit 5p
>  Sent 0 bytes 0 pkts (dropped 0, overlimits 0)*
>
>  qdisc pfifo 30: parent 1:11 limit 5p
>  Sent 0 bytes 0 pkts (dropped 0, overlimits 0)
>
>  qdisc sfq 40: parent 1:12 quantum 1514b limit 128p flows 128/1024 
> perturb 10sec
>  Sent *130091* bytes 866 pkts (dropped 0, overlimits 0)
>
> All traffic is going to default class ( 1:12 ),  I try many filters 
> with tc tool but nothing happens.
> I look the modules with lsmod and "cls_u32.o" and "sch_htb.o" is all 
> loaded.
>
> Thanks everyone.
>
>------------------------------------------------------------------------
>
>_______________________________________________
>LARTC mailing list
>LARTC@mailman.ds9a.nl
>http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
>  
>
You need to do this on external NIC. HTB is a queueing mecanism, which 
is done on outgoing traffic.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060911/72dbf89f/attachment.html
From jserink2004 at yahoo.com  Tue Sep 12 10:00:09 2006
From: jserink2004 at yahoo.com (John Serink)
Date: Tue Sep 12 09:59:58 2006
Subject: [LARTC] Tunnels within tunnels, IPSec and GRE
In-Reply-To: <web-44849464@mailbe02.swip.net>
Message-ID: <20060912080009.88290.qmail@web54502.mail.yahoo.com>

Hi All:

I have a GRE tunnel that I want to use tc on. This is simple and straight
forward.
I then want to use tc on the ppp1 interface and prioritize outgoing ESP
packets. The GRE tunnel is encapsulated inside the IPSec tunnel.

To do this, do I have two copmpeltely separate sets of traffic control rules
and filters? One for the GRE tunnel interface and one for the ppp1 interface?

Cheers,
John

__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com 
From e.janz at barceloviajes.com  Tue Sep 12 10:36:27 2006
From: e.janz at barceloviajes.com (e.janz@barceloviajes.com)
Date: Tue Sep 12 10:34:54 2006
Subject: [LARTC] Re: htb traffic shaping problem (Charlie Meyer)
In-Reply-To: <6.2.0.14.2.20060909135043.02dd9d80@linux.sysreset.com>
Message-ID: <OFC2DEF3FD.3B18AAD9-ONC12571E7.002DA37A-C12571E7.002F2ADF@barcelo>

Hi again,

sorry for my late response. Could you give us also the output of 

tc -s -d qdisc show dev eth0
tc filter show dev eth0

It is very strange that the rate and ceil from class 1:10 are set to 
512Kbit but the class's rate goes over 3,5Mbits!! ?Maybe it is a bug?
I'm preparing a similar setup (a linux wan router on a 100Mbit lan with 
5Mbps upload/dowload to the Internet. We will see if I run into the same 
issues...


Regards,
Eric Janz 




Bugzilla-Redirect <bugzilla@sysreset.com> 
Enviado por: lartc-bounces@mailman.ds9a.nl
09/09/2006 21:56

Para
lartc@mailman.ds9a.nl
cc

Asunto
[LARTC] Re: htb traffic shaping problem (Charlie Meyer)






Eric,
I've attached the output from the command you requested below.
I'm using kernel 2.6.17.12 and tc version ss060323.  I'm have a nforce4 
onboard giggabit controller using the forcedeth driver, if that makes a 
difference.

Charlie,
I'll take a look at the Apache model for throttling, thanks.  I was going 
for tc because was going to try to add additional shaping to non-apache 
traffic once I got it working correctly.

Thanks,
-Ryan Power

tc -s -d class show dev eth0
class htb 1:99 parent 1:1 leaf 99: prio 0 quantum 3000 rate 900000Kbit 
ceil 
1000Mbit burst 451350b/8 mpu 0b overhead 0b cburst 501375b/8 mpu 0b 
overhead 0b level 0
  Sent 48695 bytes 398 pkt (dropped 0, overlimits 0 requeues 0)
  rate 2704bit 2pps backlog 0b 0p requeues 0
  lended: 398 borrowed: 0 giants: 0
  tokens: 4326 ctokens: 4325

class htb 1:1 root rate 1000Mbit ceil 1000Mbit burst 501375b/8 mpu 0b 
overhead 0b cburst 501375b/8 mpu 0b overhead 0b level 7
  Sent 32821394 bytes 994 pkt (dropped 0, overlimits 0 requeues 0)
  rate 3556Kbit 10pps backlog 0b 0p requeues 0
  lended: 0 borrowed: 0 giants: 1128
  tokens: 4325 ctokens: 4325

class htb 1:10 parent 1:1 leaf 10: prio 0 quantum 3000 rate 512000bit ceil 

512000bit burst 1755b/8 mpu 0b overhead 0b cburst 1755b/8 mpu 0b overhead 
0b level 0
  Sent 34256069 bytes 701 pkt (dropped 0, overlimits 0 requeues 0)
  rate 3554Kbit 8pps backlog 0b 105p requeues 0
  lended: 596 borrowed: 0 giants: 1128
  tokens: -52724 ctokens: -52724

_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc


--

ADVERTENCIA LEGAL
El contenido de este correo es confidencial y dirigido unicamente a su destinatario. Para acceder a su clausula de privacidad consulte http://www.barceloviajes.com/privacy

LEGAL ADVISORY
This message is confidential and intended only for the person or entity to which it is addressed. In order to read its privacy policy consult it at http://www.barceloviajes.com/privacy
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060912/d9a3c3b5/attachment.htm
From venk25 at msn.com  Tue Sep 12 16:49:10 2006
From: venk25 at msn.com (K Venkat)
Date: Tue Sep 12 16:48:51 2006
Subject: [LARTC] Completely isolating P2P/BitTorrent traffic
Message-ID: <BAY105-W3F8CF3B31461CB0B3F5FFD42B0@phx.gbl>

Hi all,

I'm tring to isolate P2P traffic, specifically BitTorrent, for my QoS 
scripts.  I can't seem to completely isolate ALL BitTorrent traffic.

I identify & mark packets and then use tc filters to put them into 
appropriate classes. My firewall rules (below) do the markings.  My VoIP 
boxes'  and ICMP traffic get highest priority (mark 1). Then comes DNS, SSH, 
and Telnet (mark 2),  After this, I try to isolate BitTorrent traffic (mark 
4).  If the packet is none of the above, then mark with a default mark (mark 
3).

I ran my BitTorrent client (uTorrent) for a while, with no other big 
uploading application running on my network.  My firewall rules and 
statistics are below.  You can find that a large chunk got marked with 3 
(default mark), apart from marked BitTorrent traffic.  I put the LOG target 
just to see what traffic it is and SURPRISE !  It was BitTorrent traffic.

A snippet from my kernel log (from iptables) is below.  My PC's IP is 
192.168.1.105 and port 10305 is uTorrent's port.  And, other packets not 
going out of that port - I confirmed they are from uTorrent by doing this on 
a bunch of entries:

   D:\Junk>netstat -nb | grep -A1 1553
     TCP    192.168.1.105:1771     195.23.20.78:21488 ESTABLISHED     4080
     [utorrent.exe]

   D:\Junk>

I've tried using -m layer7 --l7proto bittorrent and IPP2P's -m 
ipp2p --ipp2p. Same effect.

Kernel version - 2.4.30
iptables version - v1.3.3
ipp2p version : v0.8.1_rc1
vlan1 is my WAN interface.

FWIW, I'm doing this on my WRT54G V3 router running OpenWRT WhiteRussian 
RC5.

I don't want to put all traffic on high-ports (>1024) into Bulk since I have 
a bunch of stuff running on high-ports outside that I access.  I just want 
to be able to completely isolate P2P/BitTorrent and mark it bulk.

Any help appreciated.

Thanks.

PS. I sent this on Sep 11, 2006 at 3:56 PM. It never showed up in the list archive. So, reposting. Apologize if this is a repeat.


Firewall:
---------
Chain POSTROUTING (policy ACCEPT 1404K packets, 600M bytes)
 pkts bytes target     prot opt in     out     source       destination
1024K  394M QOS_Chain  all  --  *      *       0.0.0.0/0    0.0.0.0/0

Chain QOS_Chain (1 references)
 pkts bytes target     prot opt in     out     source          destination
 6971 1418K MARK       all  --  *      vlan1   192.168.1.107   0.0.0.0/0           MARK set 0x1
40271 8118K MARK       all  --  *      vlan1   192.168.1.111   0.0.0.0/0           MARK set 0x1
    0     0 MARK       icmp --  *      vlan1   0.0.0.0/0       0.0.0.0/0           icmp type 8 MARK set 0x1
  281 20041 MARK       udp  --  *      vlan1   0.0.0.0/0       0.0.0.0/0           udp dpt:53 MARK set 0x2
    0     0 MARK       tcp  --  *      vlan1   0.0.0.0/0       0.0.0.0/0           tcp dpt:22 MARK set 0x2
    0     0 MARK       tcp  --  *      vlan1   0.0.0.0/0       0.0.0.0/0           tcp dpt:23 MARK set 0x2
47517 9555K RETURN     all  --  *      *       0.0.0.0/0       0.0.0.0/0           MARK match !0x0
 152K   72M CONNMARK   all  --  *      *       0.0.0.0/0       0.0.0.0/0           CONNMARK restore
 3849 2043K MARK       all  --  *      *       0.0.0.0/0       0.0.0.0/0           ipp2p v0.8.1_rc1 --bit MARK set 0x4
49411   28M CONNMARK   all  --  *      *       0.0.0.0/0       0.0.0.0/0           MARK match 0x4 CONNMARK save
24859   32M LOG        all  --  *      vlan1   0.0.0.0/0       0.0.0.0/0           length 100:65535 MARK match 0x0 LOG flags 0 level 4 prefix `UNMARKED Packet: '
29544   32M MARK       all  --  *      vlan1   0.0.0.0/0       0.0.0.0/0           MARK match 0x0 MARK set 0x3

Kernel log (snippet):
---------------------
Sep 11 14:31:01 (none) kern.warn kernel: UNMARKED Packet: IN= OUT=vlan1 
SRC=192.168.1.105 DST=87.11.229.118 LEN=1300 TOS=0x00 PREC=0x00 TTL=127 
ID=64569 DF PROTO=TCP SPT=10305 DPT=16224 WINDOW=64396 RES=0x00 ACK URGP=0
Sep 11 14:31:01 (none) kern.warn kernel: UNMARKED Packet: IN= OUT=vlan1 
SRC=192.168.1.105 DST=87.11.229.118 LEN=1300 TOS=0x00 PREC=0x00 TTL=127 
ID=64570 DF PROTO=TCP SPT=10305 DPT=16224 WINDOW=64396 RES=0x00 ACK PSH URGP=0
Sep 11 14:31:01 (none) kern.warn kernel: UNMARKED Packet: IN= OUT=vlan1 
SRC=192.168.1.105 DST=87.11.229.118 LEN=1300 TOS=0x00 PREC=0x00 TTL=127 
ID=64571 DF PROTO=TCP SPT=10305 DPT=16224 WINDOW=64396 RES=0x00 ACK URGP=0
Sep 11 14:31:01 (none) kern.warn kernel: UNMARKED Packet: IN= OUT=vlan1 
SRC=192.168.1.105 DST=24.176.137.55 LEN=1300 TOS=0x00 PREC=0x00 TTL=127 
ID=64572 DF PROTO=TCP SPT=1983 DPT=50001 WINDOW=65320 RES=0x00 ACK URGP=0
Sep 11 14:31:01 (none) kern.warn kernel: UNMARKED Packet: IN= OUT=vlan1 
SRC=192.168.1.105 DST=81.178.115.37 LEN=1300 TOS=0x00 PREC=0x00 TTL=127 
ID=64573 DF PROTO=TCP SPT=1553 DPT=60546 WINDOW=65269 RES=0x00 ACK URGP=0
Sep 11 14:31:01 (none) kern.warn kernel: UNMARKED Packet: IN= OUT=vlan1 
SRC=192.168.1.105 DST=195.23.20.78 LEN=1300 TOS=0x00 PREC=0x00 TTL=127 
ID=64576 DF PROTO=TCP SPT=1771 DPT=21488 WINDOW=64842 RES=0x00 ACK URGP=0
Sep 11 14:31:01 (none) kern.warn kernel: UNMARKED Packet: IN= OUT=vlan1 
SRC=192.168.1.105 DST=195.23.20.78 LEN=1300 TOS=0x00 PREC=0x00 TTL=127 
ID=64577 DF PROTO=TCP SPT=1771 DPT=21488 WINDOW=64842 RES=0x00 ACK URGP=0
Sep 11 14:31:01 (none) kern.warn kernel: UNMARKED Packet: IN= OUT=vlan1 
SRC=192.168.1.105 DST=172.158.155.236 LEN=1300 TOS=0x00 PREC=0x00 TTL=127 
ID=64578 DF PROTO=TCP SPT=1938 DPT=35714 WINDOW=64282 RES=0x00 ACK URGP=0
Sep 11 14:31:01 (none) kern.warn kernel: UNMARKED Packet: IN= OUT=vlan1 
SRC=192.168.1.105 DST=172.158.155.236 LEN=1300 TOS=0x00 PREC=0x00 TTL=127 
ID=64579 DF PROTO=TCP SPT=1938 DPT=35714 WINDOW=64282 RES=0x00 ACK URGP=0
Sep 11 14:31:01 (none) kern.warn kernel: UNMARKED Packet: IN= OUT=vlan1 
SRC=192.168.1.105 DST=195.23.20.78 LEN=1300 TOS=0x00 PREC=0x00 TTL=127 
ID=64580 DF PROTO=TCP SPT=1771 DPT=21488 WINDOW=64842 RES=0x00 ACK PSH URGP=0
Sep 11 14:31:01 (none) kern.warn kernel: UNMARKED Packet: IN= OUT=vlan1 
SRC=192.168.1.105 DST=195.23.20.78 LEN=1300 TOS=0x00 PREC=0x00 TTL=127 
ID=64581 DF PROTO=TCP SPT=1771 DPT=21488 WINDOW=64842 RES=0x00 ACK URGP=0
Sep 11 14:31:01 (none) kern.warn kernel: UNMARKED Packet: IN= OUT=vlan1 
SRC=192.168.1.105 DST=81.178.115.37 LEN=1300 TOS=0x00 PREC=0x00 TTL=127 
ID=64583 DF PROTO=TCP SPT=1553 DPT=60546 WINDOW=65269 RES=0x00 ACK URGP=0
Sep 11 14:31:01 (none) kern.warn kernel: UNMARKED Packet: IN= OUT=vlan1 
SRC=192.168.1.105 DST=87.11.229.118 LEN=1300 TOS=0x00 PREC=0x00 TTL=127 
ID=64584 DF PROTO=TCP SPT=10305 DPT=16224 WINDOW=64396 RES=0x00 ACK URGP=0
Sep 11 14:31:01 (none) kern.warn kernel: UNMARKED Packet: IN= OUT=vlan1 
SRC=192.168.1.105 DST=24.176.137.55 LEN=1300 TOS=0x00 PREC=0x00 TTL=127 
ID=64586 DF PROTO=TCP SPT=1983 DPT=50001 WINDOW=65520 RES=0x00 ACK URGP=0
Sep 11 14:31:01 (none) kern.warn kernel: UNMARKED Packet: IN= OUT=vlan1 
SRC=192.168.1.105 DST=24.176.137.55 LEN=1300 TOS=0x00 PREC=0x00 TTL=127 
ID=64587 DF PROTO=TCP SPT=1983 DPT=50001 WINDOW=65520 RES=0x00 ACK URGP=0
Sep 11 14:31:01 (none) kern.warn kernel: UNMARKED Packet: IN= OUT=vlan1 
SRC=192.168.1.105 DST=24.176.137.55 LEN=1300 TOS=0x00 PREC=0x00 TTL=127 
ID=64588 DF PROTO=TCP SPT=1983 DPT=50001 WINDOW=65520 RES=0x00 ACK URGP=0
Sep 11 14:31:01 (none) kern.warn kernel: UNMARKED Packet: IN= OUT=vlan1 
SRC=192.168.1.105 DST=201.66.191.158 LEN=1300 TOS=0x00 PREC=0x00 TTL=127 
ID=64611 DF PROTO=TCP SPT=1748 DPT=23845 WINDOW=65426 RES=0x00 ACK URGP=0
Sep 11 14:31:01 (none) kern.warn kernel: UNMARKED Packet: IN= OUT=vlan1 
SRC=192.168.1.105 DST=201.66.191.158 LEN=1300 TOS=0x00 PREC=0x00 TTL=127 
ID=64612 DF PROTO=TCP SPT=1748 DPT=23845 WINDOW=65426 RES=0x00 ACK URGP=0
Sep 11 14:31:01 (none) kern.warn kernel: UNMARKED Packet: IN= OUT=vlan1 
SRC=192.168.1.105 DST=172.158.155.236 LEN=1300 TOS=0x00 PREC=0x00 TTL=127 
ID=64613 DF PROTO=TCP SPT=1938 DPT=35714 WINDOW=64265 RES=0x00 ACK URGP=0 
From luciano at lugmen.org.ar  Wed Sep 13 02:53:43 2006
From: luciano at lugmen.org.ar (Luciano Ruete)
Date: Wed Sep 13 02:53:20 2006
Subject: [LARTC] Completely isolating P2P/BitTorrent traffic
In-Reply-To: <BAY105-W3F8CF3B31461CB0B3F5FFD42B0@phx.gbl>
References: <BAY105-W3F8CF3B31461CB0B3F5FFD42B0@phx.gbl>
Message-ID: <200609122153.43549.luciano@lugmen.org.ar>

El Tuesday 12 September 2006 11:49, K Venkat escribi?:
> Hi all,
>
> I'm tring to isolate P2P traffic, specifically BitTorrent, for my QoS
> scripts.  I can't seem to completely isolate ALL BitTorrent traffic.
>
> I identify & mark packets and then use tc filters to put them into
> appropriate classes. My firewall rules (below) do the markings.  My VoIP
> boxes'  and ICMP traffic get highest priority (mark 1). Then comes DNS,
> SSH, and Telnet (mark 2),  After this, I try to isolate BitTorrent traffic
> (mark 4).  If the packet is none of the above, then mark with a default
> mark (mark 3).
>
> I ran my BitTorrent client (uTorrent) for a while, with no other big
> uploading application running on my network.  My firewall rules and
> statistics are below.  You can find that a large chunk got marked with 3
> (default mark), apart from marked BitTorrent traffic.  I put the LOG target
> just to see what traffic it is and SURPRISE !  It was BitTorrent traffic.
>
> A snippet from my kernel log (from iptables) is below.  My PC's IP is
> 192.168.1.105 and port 10305 is uTorrent's port.  And, other packets not
> going out of that port - I confirmed they are from uTorrent by doing this
> on a bunch of entries:
>
>    D:\Junk>netstat -nb | grep -A1 1553
>      TCP    192.168.1.105:1771     195.23.20.78:21488 ESTABLISHED     4080
>      [utorrent.exe]
>
>    D:\Junk>
>
> I've tried using -m layer7 --l7proto bittorrent and IPP2P's -m
> ipp2p --ipp2p. Same effect.
>
> Kernel version - 2.4.30
> iptables version - v1.3.3
> ipp2p version : v0.8.1_rc1
> vlan1 is my WAN interface.
>
> FWIW, I'm doing this on my WRT54G V3 router running OpenWRT WhiteRussian
> RC5.
>
> I don't want to put all traffic on high-ports (>1024) into Bulk since I
> have a bunch of stuff running on high-ports outside that I access.  I just
> want to be able to completely isolate P2P/BitTorrent and mark it bulk.

In my experience, the most efective way to shape p2p is to spend some time 
learning what is NOT p2p, then all other trafic is p2p. 
If there is a new prio app with a new port, you can add it to the list of 
known ports, if there is a new p2p protocol that is killing out all isps you 
just enjoy and relax, cause it is already shaped.

-- 
Luciano
From ranmakun at arnet.com.ar  Wed Sep 13 03:16:02 2006
From: ranmakun at arnet.com.ar (Francisco)
Date: Wed Sep 13 03:13:57 2006
Subject: [LARTC] Completely isolating P2P/BitTorrent traffic
In-Reply-To: <BAY105-W3F8CF3B31461CB0B3F5FFD42B0@phx.gbl>
References: <BAY105-W3F8CF3B31461CB0B3F5FFD42B0@phx.gbl>
Message-ID: <200609122216.02895.ranmakun@arnet.com.ar>

I'll tell you what I did to completelly isolate MY bittorrent traffic. In 
azureus you can tell the program to use a specific IP, so I have two IP's per 
PC, one for p2p and the other one as the main IP. Then I simply shape traffic 
from the azureus IP in each PC. Obviously this only works for you, since you 
wont convince any user to do this, but I found it quite practical if that's 
what you need. aMule doesn't have the same option, but this traffic is easy 
to detect.

El Martes, 12 de Septiembre de 2006 11:49, K Venkat escribi?:
> Hi all,
>
> I'm tring to isolate P2P traffic, specifically BitTorrent, for my QoS
> scripts.  I can't seem to completely isolate ALL BitTorrent traffic.
>
> I identify & mark packets and then use tc filters to put them into
> appropriate classes. My firewall rules (below) do the markings.  My VoIP
> boxes'  and ICMP traffic get highest priority (mark 1). Then comes DNS,
> SSH, and Telnet (mark 2),  After this, I try to isolate BitTorrent traffic
> (mark 4).  If the packet is none of the above, then mark with a default
> mark (mark 3).
>
> I ran my BitTorrent client (uTorrent) for a while, with no other big
> uploading application running on my network.  My firewall rules and
> statistics are below.  You can find that a large chunk got marked with 3
> (default mark), apart from marked BitTorrent traffic.  I put the LOG target
> just to see what traffic it is and SURPRISE !  It was BitTorrent traffic.
>
> A snippet from my kernel log (from iptables) is below.  My PC's IP is
> 192.168.1.105 and port 10305 is uTorrent's port.  And, other packets not
> going out of that port - I confirmed they are from uTorrent by doing this
> on a bunch of entries:
>
>    D:\Junk>netstat -nb | grep -A1 1553
>      TCP    192.168.1.105:1771     195.23.20.78:21488 ESTABLISHED     4080
>      [utorrent.exe]
>
>    D:\Junk>
>
> I've tried using -m layer7 --l7proto bittorrent and IPP2P's -m
> ipp2p --ipp2p. Same effect.
>
> Kernel version - 2.4.30
> iptables version - v1.3.3
> ipp2p version : v0.8.1_rc1
> vlan1 is my WAN interface.
>
> FWIW, I'm doing this on my WRT54G V3 router running OpenWRT WhiteRussian
> RC5.
>
> I don't want to put all traffic on high-ports (>1024) into Bulk since I
> have a bunch of stuff running on high-ports outside that I access.  I just
> want to be able to completely isolate P2P/BitTorrent and mark it bulk.
>
> Any help appreciated.
>
> Thanks.
>
> PS. I sent this on Sep 11, 2006 at 3:56 PM. It never showed up in the list
> archive. So, reposting. Apologize if this is a repeat.
>
>
> Firewall:
> ---------
> Chain POSTROUTING (policy ACCEPT 1404K packets, 600M bytes)
>  pkts bytes target     prot opt in     out     source       destination
> 1024K  394M QOS_Chain  all  --  *      *       0.0.0.0/0    0.0.0.0/0
>
> Chain QOS_Chain (1 references)
>  pkts bytes target     prot opt in     out     source          destination
>  6971 1418K MARK       all  --  *      vlan1   192.168.1.107   0.0.0.0/0   
>        MARK set 0x1 40271 8118K MARK       all  --  *      vlan1  
> 192.168.1.111   0.0.0.0/0           MARK set 0x1 0     0 MARK       icmp --
>  *      vlan1   0.0.0.0/0       0.0.0.0/0           icmp type 8 MARK set
> 0x1 281 20041 MARK       udp  --  *      vlan1   0.0.0.0/0       0.0.0.0/0 
>          udp dpt:53 MARK set 0x2 0     0 MARK       tcp  --  *      vlan1  
> 0.0.0.0/0       0.0.0.0/0           tcp dpt:22 MARK set 0x2 0     0 MARK   
>    tcp  --  *      vlan1   0.0.0.0/0       0.0.0.0/0           tcp dpt:23
> MARK set 0x2 47517 9555K RETURN     all  --  *      *       0.0.0.0/0      
> 0.0.0.0/0           MARK match !0x0 152K   72M CONNMARK   all  --  *      *
>       0.0.0.0/0       0.0.0.0/0           CONNMARK restore 3849 2043K MARK 
>      all  --  *      *       0.0.0.0/0       0.0.0.0/0           ipp2p
> v0.8.1_rc1 --bit MARK set 0x4 49411   28M CONNMARK   all  --  *      *     
>  0.0.0.0/0       0.0.0.0/0           MARK match 0x4 CONNMARK save 24859  
> 32M LOG        all  --  *      vlan1   0.0.0.0/0       0.0.0.0/0          
> length 100:65535 MARK match 0x0 LOG flags 0 level 4 prefix `UNMARKED
> Packet: ' 29544   32M MARK       all  --  *      vlan1   0.0.0.0/0      
> 0.0.0.0/0           MARK match 0x0 MARK set 0x3
>
> Kernel log (snippet):
> ---------------------
> Sep 11 14:31:01 (none) kern.warn kernel: UNMARKED Packet: IN= OUT=vlan1
> SRC=192.168.1.105 DST=87.11.229.118 LEN=1300 TOS=0x00 PREC=0x00 TTL=127
> ID=64569 DF PROTO=TCP SPT=10305 DPT=16224 WINDOW=64396 RES=0x00 ACK URGP=0
> Sep 11 14:31:01 (none) kern.warn kernel: UNMARKED Packet: IN= OUT=vlan1
> SRC=192.168.1.105 DST=87.11.229.118 LEN=1300 TOS=0x00 PREC=0x00 TTL=127
> ID=64570 DF PROTO=TCP SPT=10305 DPT=16224 WINDOW=64396 RES=0x00 ACK PSH
> URGP=0 Sep 11 14:31:01 (none) kern.warn kernel: UNMARKED Packet: IN=
> OUT=vlan1 SRC=192.168.1.105 DST=87.11.229.118 LEN=1300 TOS=0x00 PREC=0x00
> TTL=127 ID=64571 DF PROTO=TCP SPT=10305 DPT=16224 WINDOW=64396 RES=0x00 ACK
> URGP=0 Sep 11 14:31:01 (none) kern.warn kernel: UNMARKED Packet: IN=
> OUT=vlan1 SRC=192.168.1.105 DST=24.176.137.55 LEN=1300 TOS=0x00 PREC=0x00
> TTL=127 ID=64572 DF PROTO=TCP SPT=1983 DPT=50001 WINDOW=65320 RES=0x00 ACK
> URGP=0 Sep 11 14:31:01 (none) kern.warn kernel: UNMARKED Packet: IN=
> OUT=vlan1 SRC=192.168.1.105 DST=81.178.115.37 LEN=1300 TOS=0x00 PREC=0x00
> TTL=127 ID=64573 DF PROTO=TCP SPT=1553 DPT=60546 WINDOW=65269 RES=0x00 ACK
> URGP=0 Sep 11 14:31:01 (none) kern.warn kernel: UNMARKED Packet: IN=
> OUT=vlan1 SRC=192.168.1.105 DST=195.23.20.78 LEN=1300 TOS=0x00 PREC=0x00
> TTL=127 ID=64576 DF PROTO=TCP SPT=1771 DPT=21488 WINDOW=64842 RES=0x00 ACK
> URGP=0 Sep 11 14:31:01 (none) kern.warn kernel: UNMARKED Packet: IN=
> OUT=vlan1 SRC=192.168.1.105 DST=195.23.20.78 LEN=1300 TOS=0x00 PREC=0x00
> TTL=127 ID=64577 DF PROTO=TCP SPT=1771 DPT=21488 WINDOW=64842 RES=0x00 ACK
> URGP=0 Sep 11 14:31:01 (none) kern.warn kernel: UNMARKED Packet: IN=
> OUT=vlan1 SRC=192.168.1.105 DST=172.158.155.236 LEN=1300 TOS=0x00 PREC=0x00
> TTL=127 ID=64578 DF PROTO=TCP SPT=1938 DPT=35714 WINDOW=64282 RES=0x00 ACK
> URGP=0 Sep 11 14:31:01 (none) kern.warn kernel: UNMARKED Packet: IN=
> OUT=vlan1 SRC=192.168.1.105 DST=172.158.155.236 LEN=1300 TOS=0x00 PREC=0x00
> TTL=127 ID=64579 DF PROTO=TCP SPT=1938 DPT=35714 WINDOW=64282 RES=0x00 ACK
> URGP=0 Sep 11 14:31:01 (none) kern.warn kernel: UNMARKED Packet: IN=
> OUT=vlan1 SRC=192.168.1.105 DST=195.23.20.78 LEN=1300 TOS=0x00 PREC=0x00
> TTL=127 ID=64580 DF PROTO=TCP SPT=1771 DPT=21488 WINDOW=64842 RES=0x00 ACK
> PSH URGP=0 Sep 11 14:31:01 (none) kern.warn kernel: UNMARKED Packet: IN=
> OUT=vlan1 SRC=192.168.1.105 DST=195.23.20.78 LEN=1300 TOS=0x00 PREC=0x00
> TTL=127 ID=64581 DF PROTO=TCP SPT=1771 DPT=21488 WINDOW=64842 RES=0x00 ACK
> URGP=0 Sep 11 14:31:01 (none) kern.warn kernel: UNMARKED Packet: IN=
> OUT=vlan1 SRC=192.168.1.105 DST=81.178.115.37 LEN=1300 TOS=0x00 PREC=0x00
> TTL=127 ID=64583 DF PROTO=TCP SPT=1553 DPT=60546 WINDOW=65269 RES=0x00 ACK
> URGP=0 Sep 11 14:31:01 (none) kern.warn kernel: UNMARKED Packet: IN=
> OUT=vlan1 SRC=192.168.1.105 DST=87.11.229.118 LEN=1300 TOS=0x00 PREC=0x00
> TTL=127 ID=64584 DF PROTO=TCP SPT=10305 DPT=16224 WINDOW=64396 RES=0x00 ACK
> URGP=0 Sep 11 14:31:01 (none) kern.warn kernel: UNMARKED Packet: IN=
> OUT=vlan1 SRC=192.168.1.105 DST=24.176.137.55 LEN=1300 TOS=0x00 PREC=0x00
> TTL=127 ID=64586 DF PROTO=TCP SPT=1983 DPT=50001 WINDOW=65520 RES=0x00 ACK
> URGP=0 Sep 11 14:31:01 (none) kern.warn kernel: UNMARKED Packet: IN=
> OUT=vlan1 SRC=192.168.1.105 DST=24.176.137.55 LEN=1300 TOS=0x00 PREC=0x00
> TTL=127 ID=64587 DF PROTO=TCP SPT=1983 DPT=50001 WINDOW=65520 RES=0x00 ACK
> URGP=0 Sep 11 14:31:01 (none) kern.warn kernel: UNMARKED Packet: IN=
> OUT=vlan1 SRC=192.168.1.105 DST=24.176.137.55 LEN=1300 TOS=0x00 PREC=0x00
> TTL=127 ID=64588 DF PROTO=TCP SPT=1983 DPT=50001 WINDOW=65520 RES=0x00 ACK
> URGP=0 Sep 11 14:31:01 (none) kern.warn kernel: UNMARKED Packet: IN=
> OUT=vlan1 SRC=192.168.1.105 DST=201.66.191.158 LEN=1300 TOS=0x00 PREC=0x00
> TTL=127 ID=64611 DF PROTO=TCP SPT=1748 DPT=23845 WINDOW=65426 RES=0x00 ACK
> URGP=0 Sep 11 14:31:01 (none) kern.warn kernel: UNMARKED Packet: IN=
> OUT=vlan1 SRC=192.168.1.105 DST=201.66.191.158 LEN=1300 TOS=0x00 PREC=0x00
> TTL=127 ID=64612 DF PROTO=TCP SPT=1748 DPT=23845 WINDOW=65426 RES=0x00 ACK
> URGP=0 Sep 11 14:31:01 (none) kern.warn kernel: UNMARKED Packet: IN=
> OUT=vlan1 SRC=192.168.1.105 DST=172.158.155.236 LEN=1300 TOS=0x00 PREC=0x00
> TTL=127 ID=64613 DF PROTO=TCP SPT=1938 DPT=35714 WINDOW=64265 RES=0x00 ACK
> URGP=0 _______________________________________________
> LARTC mailing list
> LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
From gypsy at iswest.com  Wed Sep 13 05:51:53 2006
From: gypsy at iswest.com (gypsy)
Date: Wed Sep 13 05:51:45 2006
Subject: [LARTC] Re: htb traffic shaping problem (Charlie Meyer)
References: <20060908152712.4E52044F1@outpost.ds9a.nl>
	<6.2.0.14.2.20060909135043.02dd9d80@linux.sysreset.com>
Message-ID: <45078059.BF499823@iswest.com>

Bugzilla-Redirect wrote:
> 
> Eric,
> I've attached the output from the command you requested below.
> I'm using kernel 2.6.17.12 and tc version ss060323.  I'm have a nforce4
> onboard giggabit controller using the forcedeth driver, if that makes a
> difference.
> 
> Charlie,
> I'll take a look at the Apache model for throttling, thanks.  I was going
> for tc because was going to try to add additional shaping to non-apache
> traffic once I got it working correctly.
> 
> Thanks,
> -Ryan Power
> 
> tc -s -d class show dev eth0
> class htb 1:99 parent 1:1 leaf 99: prio 0 quantum 3000 rate 900000Kbit ceil
> 1000Mbit burst 451350b/8 mpu 0b overhead 0b cburst 501375b/8 mpu 0b
> overhead 0b level 0
>   Sent 48695 bytes 398 pkt (dropped 0, overlimits 0 requeues 0)
>   rate 2704bit 2pps backlog 0b 0p requeues 0
>   lended: 398 borrowed: 0 giants: 0
>   tokens: 4326 ctokens: 4325
> 
> class htb 1:1 root rate 1000Mbit ceil 1000Mbit burst 501375b/8 mpu 0b
> overhead 0b cburst 501375b/8 mpu 0b overhead 0b level 7
>   Sent 32821394 bytes 994 pkt (dropped 0, overlimits 0 requeues 0)
>   rate 3556Kbit 10pps backlog 0b 0p requeues 0
>   lended: 0 borrowed: 0 giants: 1128
>   tokens: 4325 ctokens: 4325
> 
> class htb 1:10 parent 1:1 leaf 10: prio 0 quantum 3000 rate 512000bit ceil
> 512000bit burst 1755b/8 mpu 0b overhead 0b cburst 1755b/8 mpu 0b overhead
> 0b level 0
>   Sent 34256069 bytes 701 pkt (dropped 0, overlimits 0 requeues 0)
>   rate 3554Kbit 8pps backlog 0b 105p requeues 0
>   lended: 596 borrowed: 0 giants: 1128
>   tokens: -52724 ctokens: -52724

The giants indicate that your MPU (MTU) is wrong.  Set it specifically. 
Try 1500.  Search the archives for "giants" and "MPU" or "MTU".
--
gypsy
From gypsy at iswest.com  Wed Sep 13 06:06:50 2006
From: gypsy at iswest.com (gypsy)
Date: Wed Sep 13 06:06:31 2006
Subject: [LARTC] HTB and tc filter
References: <450464A2.3080205@yahoo.com.br>
Message-ID: <450783DA.E78E5537@iswest.com>

> d3xcrIpt wrote:
> 
> Help me  ...
> 
> I try use the tc filter, but seems he doesn't work, I already
> reconfigured my kernel ( 2.4.32 ) with all options related a QOS
> enabled ( like modules ) and nothing happens. I get the tc tool from
> HTB source package, well  this is my set :
> 
> eth0 is my internal NIC.
> 
> tc qdisc add dev eth0 root handle 1: htb default 12
> 
> tc class add dev eth0 parent 1: classid 1:1 htb rate 100kbps ceil
> 100kbps
> tc class add dev eth0 parent 1:1 classid 1:10 htb rate 30kbps ceil
> 100kbps
> tc class add dev eth0 parent 1:1 classid 1:11 htb rate 10kbps ceil
> 100kbps
> tc class add dev eth0 parent 1:1 classid 1:12 htb rate 60kbps ceil
> 100kbps
> 
> tc filter add dev eth0 protocol ip parent 1:0 prio 1 u32 match ip src
> <my_ip> flowid 1:10
> 
> tc qdisc add dev eth0 parent handle 20: pfifo limit 5
> tc qdisc add dev eth0 parent handle 30: pfifo limit 5
> tc qdisc add dev eth0 parent handle 40: sfq perturb 10
> 
> OK. but ... when I look the qdiscs
> 
> tc -s -d qdisc
> qdisc htb 1: r2q 10 default 12 direct_packets_stat 411 ver 3.17
>  Sent 181174 bytes 1324 pkts (dropped 0, overlimits 0)
> 
>  qdisc pfifo 20: parent 1:10 limit 5p
>  Sent 0 bytes 0 pkts (dropped 0, overlimits 0)
> 
>  qdisc pfifo 30: parent 1:11 limit 5p
>  Sent 0 bytes 0 pkts (dropped 0, overlimits 0)
> 
>  qdisc sfq 40: parent 1:12 quantum 1514b limit 128p flows 128/1024
> perturb 10sec
>  Sent 130091 bytes 866 pkts (dropped 0, overlimits 0)
> 
> All traffic is going to default class ( 1:12 ),  I try many filters
> with tc tool but nothing happens.
> I look the modules with lsmod and "cls_u32.o" and "sch_htb.o" is all
> loaded.
> 
> Thanks everyone.

"u32 match ip src <my_ip>"

Are you sure your IP isn't getting NATted somewhere?  You can't match
something that is changed!

Include a "prio" (non zero) in your filter line.

Direct packets are A Bad Thing too.  Read Devik's HTB documentation.
--
gypsy
From bugzilla at sysreset.com  Wed Sep 13 06:59:39 2006
From: bugzilla at sysreset.com (Bugzilla-Redirect)
Date: Wed Sep 13 06:59:22 2006
Subject: [LARTC] Re: htb traffic shaping problem
In-Reply-To: <20060912100010.9CAED4108@outpost.ds9a.nl>
References: <20060912100010.9CAED4108@outpost.ds9a.nl>
Message-ID: <6.2.0.14.2.20060912225307.02dd8f98@linux.sysreset.com>

Eric, here's the information you requested with the mtu set at 1500 (see 
further below):
-------------------------------------------------------------------------------------------------------------------------
root@sysreset:~# tc -s -d qdisc show dev eth0
qdisc htb 1: r2q 10 default 99 direct_packets_stat 335 ver 3.17
  Sent 10388909 bytes 763 pkt (dropped 0, overlimits 372 requeues 0)
  rate 0bit 0pps backlog 0b 11p requeues 0
qdisc sfq 10: parent 1:10 limit 128p quantum 1514b flows 128/1024
  Sent 10328092 bytes 190 pkt (dropped 0, overlimits 0 requeues 0)
  rate 0bit 0pps backlog 707234b 11p requeues 0
qdisc sfq 99: parent 1:99 limit 128p quantum 1514b flows 128/1024
  Sent 19927 bytes 188 pkt (dropped 0, overlimits 0 requeues 0)
  rate 0bit 0pps backlog 0b 0p requeues 0
root@sysreset:~# tc filter show dev eth0
filter parent 1: protocol ip pref 49151 u32
filter parent 1: protocol ip pref 49151 u32 fh 801: ht divisor 1
filter parent 1: protocol ip pref 49151 u32 fh 801::800 order 2048 key ht 
801 bkt 0 flowid 1:10
   match 01bb0000/ffff0000 at 20
filter parent 1: protocol ip pref 49152 u32
filter parent 1: protocol ip pref 49152 u32 fh 800: ht divisor 1
filter parent 1: protocol ip pref 49152 u32 fh 800::800 order 2048 key ht 
800 bkt 0 flowid 1:10
   match 00500000/ffff0000 at 20
root@sysreset:~#
-------------------------------------------------------------------------------------------------------------------------

Gypsy, I've been playing with the mtu settings.   I had initially set it to 
1500, which is what the card should be at as the switch I have does not 
support jumbo frames.  If I set the mtu to 40,000 for the class the giants 
go away and everything seems to fall back into place.  However, this seems 
waaaaay off what it should be, do you have any idea whats happening?  I 
cannot seem to adjust the mpu setting.

-------------------------------------------------------------------------------------------------------------------------
updated classes:
tc class add dev eth0 parent 1: classid 1:1 htb rate 1000mbit ceil 1000mbit 
mtu 40000
tc class add dev eth0 parent 1:1 classid 1:10 htb rate 512kbit ceil 512kbit 
quantum 3000 mtu 40000
tc class add dev eth0 parent 1:1 classid 1:99 htb rate 900mbit ceil 
1000mbit quantum 3000 mtu 40000

root@sysreset:~# tc -s -d class show dev eth0
class htb 1:99 parent 1:1 leaf 99: prio 0 quantum 3000 rate 900000Kbit ceil 
1000Mbit burst 489825b/256 mpu 0b overhead 0b cburst 539875b/256 mpu 0b 
overhead 0b level 0
  Sent 31203 bytes 282 pkt (dropped 0, overlimits 0 requeues 0)
  rate 7264bit 8pps backlog 0b 0p requeues 0
  lended: 282 borrowed: 0 giants: 0
  tokens: 4695 ctokens: 4657

class htb 1:1 root rate 1000Mbit ceil 1000Mbit burst 539875b/256 mpu 0b 
overhead 0b cburst 539875b/256 mpu 0b overhead 0b level 7
  Sent 1126563 bytes 654 pkt (dropped 0, overlimits 0 requeues 0)
  rate 254848bit 15pps backlog 0b 0p requeues 0
  lended: 0 borrowed: 0 giants: 0
  tokens: 4657 ctokens: 4657

class htb 1:10 parent 1:1 leaf 10: prio 0 quantum 3000 rate 512000bit ceil 
512000bit burst 40255b/256 mpu 0b overhead 0b cburst 40255b/256 mpu 0b 
overhead 0b level 0
  Sent 1104444 bytes 378 pkt (dropped 0, overlimits 0 requeues 0)
  rate 250464bit 10pps backlog 0b 6p requeues 0
  lended: 372 borrowed: 0 giants: 0
  tokens: -694028 ctokens: -694028

root@sysreset:~# tc -s -d qdisc show dev eth0
qdisc htb 1: r2q 10 default 99 direct_packets_stat 338 ver 3.17
  Sent 1609761 bytes 1180 pkt (dropped 0, overlimits 369 requeues 0)
  rate 0bit 0pps backlog 0b 3p requeues 0
qdisc sfq 10: parent 1:10 limit 128p quantum 1514b flows 128/1024
  Sent 1536378 bytes 509 pkt (dropped 0, overlimits 0 requeues 0)
  rate 0bit 0pps backlog 29362b 3p requeues 0
qdisc sfq 99: parent 1:99 limit 128p quantum 1514b flows 128/1024
  Sent 32175 bytes 283 pkt (dropped 0, overlimits 0 requeues 0)
  rate 0bit 0pps backlog 0b 0p requeues 0
root@sysreset:~# tc filter show dev eth0
filter parent 1: protocol ip pref 49151 u32
filter parent 1: protocol ip pref 49151 u32 fh 801: ht divisor 1
filter parent 1: protocol ip pref 49151 u32 fh 801::800 order 2048 key ht 
801 bkt 0 flowid 1:10
   match 01bb0000/ffff0000 at 20
filter parent 1: protocol ip pref 49152 u32
filter parent 1: protocol ip pref 49152 u32 fh 800: ht divisor 1
filter parent 1: protocol ip pref 49152 u32 fh 800::800 order 2048 key ht 
800 bkt 0 flowid 1:10
   match 00500000/ffff0000 at 20
root@sysreset:~#
-------------------------------------------------------------------------------------------------------------------------

Thanks.
-Ryan Power



At 04:00 AM 9/12/2006, you wrote:
>Message: 4
>Date: Tue, 12 Sep 2006 10:36:27 +0200
>From: e.janz@barceloviajes.com
>Subject: Re: [LARTC] Re: htb traffic shaping problem (Charlie Meyer)
>To: lartc@mailman.ds9a.nl
>Message-ID:
>         <OFC2DEF3FD.3B18AAD9-ONC12571E7.002DA37A-C12571E7.002F2ADF@barcelo>
>Content-Type: text/plain; charset="iso-8859-1"
>
>Hi again,
>
>sorry for my late response. Could you give us also the output of
>
>tc -s -d qdisc show dev eth0
>tc filter show dev eth0
>
>It is very strange that the rate and ceil from class 1:10 are set to
>512Kbit but the class's rate goes over 3,5Mbits!! ?Maybe it is a bug?
>I'm preparing a similar setup (a linux wan router on a 100Mbit lan with
>5Mbps upload/dowload to the Internet. We will see if I run into the same
>issues...
>
>
>Regards,
>Eric Janz


At 09:51 PM 9/12/2006, you wrote:

>The giants indicate that your MPU (MTU) is wrong.  Set it specifically.
>Try 1500.  Search the archives for "giants" and "MPU" or "MTU".
>--
>gypsy



From doudouyam at gmail.com  Wed Sep 13 16:47:21 2006
From: doudouyam at gmail.com (doudouyam)
Date: Wed Sep 13 16:47:05 2006
Subject: [LARTC] HTB question
Message-ID: <81c11a560609130747s40d009e2he96391bc2ceca897@mail.gmail.com>

Hi,

I try to configure 3 HTB class with a rate near to zero and the ceil equal
to the max of the bandwith. And I put prio parameter for each class.
In this configuration, HTB is equivalent with Weighted Round Robin
algorithm.

Is it more correct to put the good rate for each class or to play with the
prio parameter, knowing that it's more difficult to know the correct rate
for  each class ?

Do you know the min value possible to put for the rate parameter ?

Thanks,
doude.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060913/64b84bf7/attachment.html
From kaber at trash.net  Wed Sep 13 18:38:16 2006
From: kaber at trash.net (Patrick McHardy)
Date: Wed Sep 13 18:38:00 2006
Subject: [LARTC] HFSC traffic loss bug, kernel 2.6.16.24
In-Reply-To: <20060910152735.81EB3405C@outpost.ds9a.nl>
References: <20060910152735.81EB3405C@outpost.ds9a.nl>
Message-ID: <450833F8.30008@trash.net>

Leo Wetz wrote:
> Hello,
> 
> I have finally managed to understand HFSC up to a level which allowed me to
> create a QoS script which maintains low VoIP latency while running stuff
> like eMule.
> 
> Unfortunately, HFSC seems to have a severe bug.
> Why do I consider this as a bug defenitely?
> Well, my script runs without any errors, then QoS works perfectly for some
> hours, no error messages in kernel log.
> Then randomly the kernel starts saying this:
> 
> Sep 10 17:14:51 router kernel: HFSC: Non-work-conserving qdisc ?
> Sep 10 17:14:56 router kernel: printk: 266 messages suppressed.
> Sep 10 17:14:56 router kernel: HFSC: Non-work-conserving qdisc ?
> Sep 10 17:15:01 router kernel: printk: 259 messages suppressed.
> Sep 10 17:15:01 router kernel: HFSC: Non-work-conserving qdisc ?
> Sep 10 17:15:06 router kernel: printk: 294 messages suppressed.
> Sep 10 17:15:06 router kernel: HFSC: Non-work-conserving qdisc ?
> 
> It floods the whole kernel log with this.
> Traffic is also heavily affected by package loss when this happens, thus I
> cannot ignore it.
> I have to check my kernel log when I notice that I cannot access websites
> anymore and then restart QoS manually.
> 
> My complete QoS script is attached to this mail.
> If this is not the right location for the bug report please tell me whom I
> should contact.

This is not a bug. You can't attach non-work-conserving qdiscs to
HFSC (and it doesn't make any sense). Just use classes instead
of adding HTB qdiscs.


From footplus at gmail.com  Wed Sep 13 22:57:24 2006
From: footplus at gmail.com (f00ty)
Date: Wed Sep 13 22:57:05 2006
Subject: [LARTC] HTB shaping problem
Message-ID: <61e536f90609131357k3c74aabcw4cfaa7ae04bf126d@mail.gmail.com>

Hi all !

I'm building a network appliance whose goals are to enhance Voip
quality on 512/128k DSL links. But, i have a voice quality problem,
and i think i'm doing something wrong, but i can't find what. Please
excuse my terrible english, i'm french.

>From what i've read, tc is the tool i need. I read the documentations,
readmes and lartc.org howto, and came to the following setup:

NA = Linux-based network appliance (in fact a standard PC)

A--[Switch]--[eth1 NA eth0]--[DSL modem]

A = 1 pc and 1 ip phone on a 192.168.0.0/24 network
on the other side, the DSL modem is a bridge-type, thus i have my
internet ip on the NA  eth0 interface.
The DSL modem is actually a 15Mbit/1024Kbit ATM, but i want to limit
the upload to 128Kbit/s, to test the Voip thing.

My plan:

HTB qdisc with overall rate at 128kbit, and 2 classes, one with prio 1
(for VoIP) and one with prio 2 (For other data), each of them rated a
1kbit/s and ceiled at 128kbit/s. And, on top of this, SFQ qdiscs for
fairness.

So :

$TC qdisc add dev eth0 root handle 1: htb default 3
$TC class add dev eth0 parent 1: classid 1:1 htb rate 128kbit burst 6k
$TC class add dev eth0 parent 1:1 classid 1:2 htb quantum 1600 rate
1kbit ceil 128kbit  prio 1
$TC qdisc add dev eth0 parent 1:2 handle 2: sfq perturb 10
$TC class add dev eth0 parent 1:1 classid 1:3 htb quantum 1600 rate
1kbit ceil 128kbit  prio 2
$TC qdisc add dev eth0 parent 1:3 handle 3: sfq perturb 10

And my packets are classified by the following in the iptables mangle
table, forward chain: (my ip phone has 192.168.0.42, and pc
192.168.0.3)

Chain FORWARD (policy ACCEPT 3400K packets, 9214M bytes)
 pkts bytes target     prot opt in     out     source
destination
  284  118K CLASSIFY   udp  --  eth1   eth0    192.168.0.42
0.0.0.0/0           CLASSIFY set 1:2
  284  118K RETURN     udp  --  eth1   eth0    192.168.0.42
0.0.0.0/0
12679   19M CLASSIFY   tcp  --  eth1   eth0    0.0.0.0/0
0.0.0.0/0           CLASSIFY set 1:3
12679   19M RETURN     tcp  --  eth1   eth0    0.0.0.0/0
0.0.0.0/0

(here a thing that i don't understand, is why i'm not classifying the
packets with 2: or 3: ? when i do, the traffic is entirely stopped...i
surely miss something here.)

So, the packets get classified, and effectively, they are prioritized.
_But_ i do hear some cuts in the voice that's sent through the NA,
when i'm doing some uploads.
(like some lazy wget --post-file=/tmp/some-big-iso-file.iso - Yeah i
could use nc, but.. :) )

Shouldn't the voice be absolutely clean with this setup ? or am i
missing something important ?

For the sake of completeness:

# tc -s -d qdisc show dev eth0
qdisc htb 1: r2q 10 default 5 direct_packets_stat 871 ver 3.17
 Sent 25977039 bytes 18250 pkt (dropped 0, overlimits 28929 requeues 0)
 rate 0bit 0pps backlog 0b 28p requeues 0
qdisc sfq 2: parent 1:2 limit 128p quantum 1514b flows 128/1024 perturb 10sec
 Sent 162753 bytes 380 pkt (dropped 0, overlimits 0 requeues 0)
 rate 0bit 0pps backlog 0b 0p requeues 0
qdisc sfq 3: parent 1:3 limit 128p quantum 1514b flows 128/1024 perturb 10sec
 Sent 25678966 bytes 16999 pkt (dropped 0, overlimits 0 requeues 0)
 rate 0bit 0pps backlog 42392b 28p requeues 0


# tc -s -d class show dev eth0
class htb 1:1 root rate 128000bit ceil 128000bit burst 6Kb/8 mpu 0b
overhead 0b cburst 1664b/8 mpu 0b overhead 0b level 7
 Sent 26406423 bytes 17759 pkt (dropped 0, overlimits 0 requeues 0)
 rate 127968bit 10pps backlog 0b 0p requeues 0
 lended: 17232 borrowed: 0 giants: 0
 tokens: 92249 ctokens: -187751

class htb 1:2 parent 1:1 leaf 2: prio 1 quantum 1600 rate 1000bit ceil
128000bit burst 1600b/8 mpu 0b overhead 0b cburst 1664b/8 mpu 0b
overhead 0b level 0
 Sent 166201 bytes 388 pkt (dropped 0, overlimits 0 requeues 0)
 rate 856bit 0pps backlog 0b 0p requeues 0
 lended: 388 borrowed: 0 giants: 0
 tokens: 6986400 ctokens: 77500

class htb 1:3 parent 1:1 leaf 3: prio 3 quantum 1600 rate 1000bit ceil
128000bit burst 1600b/8 mpu 0b overhead 0b cburst 1664b/8 mpu 0b
overhead 0b level 0
 Sent 26278072 bytes 17396 pkt (dropped 0, overlimits 0 requeues 0)
 rate 127144bit 10pps backlog 0b 25p requeues 0
 lended: 139 borrowed: 17232 giants: 0
 tokens: -20775252 ctokens: -87749



Thank you all !
-- 
f00ty
"Tact is the art of making a point without making an enemy."
From namithajr at gmail.com  Thu Sep 14 10:55:14 2006
From: namithajr at gmail.com (Namitha Rao)
Date: Thu Sep 14 10:54:58 2006
Subject: [LARTC] HTB and per-connection bandwidth allocation
Message-ID: <c76c7bb70609140155n5f255993ydaad1d761d966c9b@mail.gmail.com>

Hi

http://mailman.ds9a.nl/pipermail/lartc/2002q3/004977.html

I have the same problem to discuss as in the above link. I want to allocate
say X MBit per individual connection regardless of  the number of connection
. KIndly could anyonen suggest me how to proceed.
I have tried with SFq but is doesnot yeild my requirement..

Thanks,
Namitha.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060914/5335bbfa/attachment.htm
From e.janz at barceloviajes.com  Thu Sep 14 12:53:13 2006
From: e.janz at barceloviajes.com (e.janz@barceloviajes.com)
Date: Thu Sep 14 12:52:06 2006
Subject: [LARTC] Re: htb traffic shaping problem
In-Reply-To: <6.2.0.14.2.20060912225307.02dd8f98@linux.sysreset.com>
Message-ID: <OF86238757.C94B3F9D-ONC12571E9.003B5A3F-C12571E9.003BB026@barcelo>

Hi,

could you check the mtu set on eth0 with an ifconfig?
I tried my own setup and it works fine...


Regards,

Eric Janz 
Departamento de Sistemas
Grupo Barcel? Viajes

C\ 16 de Julio, 75
07009 Pol?gono Son Castell?
Palma de Mallorca - Baleares
Tel.: +34 971 448030
Fax.: +34 971 436986



Bugzilla-Redirect <bugzilla@sysreset.com> 
Enviado por: lartc-bounces@mailman.ds9a.nl
13/09/2006 07:00

Para
lartc@mailman.ds9a.nl
cc

Asunto
[LARTC] Re: htb traffic shaping problem






Eric, here's the information you requested with the mtu set at 1500 (see 
further below):
-------------------------------------------------------------------------------------------------------------------------
root@sysreset:~# tc -s -d qdisc show dev eth0
qdisc htb 1: r2q 10 default 99 direct_packets_stat 335 ver 3.17
  Sent 10388909 bytes 763 pkt (dropped 0, overlimits 372 requeues 0)
  rate 0bit 0pps backlog 0b 11p requeues 0
qdisc sfq 10: parent 1:10 limit 128p quantum 1514b flows 128/1024
  Sent 10328092 bytes 190 pkt (dropped 0, overlimits 0 requeues 0)
  rate 0bit 0pps backlog 707234b 11p requeues 0
qdisc sfq 99: parent 1:99 limit 128p quantum 1514b flows 128/1024
  Sent 19927 bytes 188 pkt (dropped 0, overlimits 0 requeues 0)
  rate 0bit 0pps backlog 0b 0p requeues 0
root@sysreset:~# tc filter show dev eth0
filter parent 1: protocol ip pref 49151 u32
filter parent 1: protocol ip pref 49151 u32 fh 801: ht divisor 1
filter parent 1: protocol ip pref 49151 u32 fh 801::800 order 2048 key ht 
801 bkt 0 flowid 1:10
   match 01bb0000/ffff0000 at 20
filter parent 1: protocol ip pref 49152 u32
filter parent 1: protocol ip pref 49152 u32 fh 800: ht divisor 1
filter parent 1: protocol ip pref 49152 u32 fh 800::800 order 2048 key ht 
800 bkt 0 flowid 1:10
   match 00500000/ffff0000 at 20
root@sysreset:~#
-------------------------------------------------------------------------------------------------------------------------

Gypsy, I've been playing with the mtu settings.   I had initially set it 
to 
1500, which is what the card should be at as the switch I have does not 
support jumbo frames.  If I set the mtu to 40,000 for the class the giants 

go away and everything seems to fall back into place.  However, this seems 

waaaaay off what it should be, do you have any idea whats happening?  I 
cannot seem to adjust the mpu setting.

-------------------------------------------------------------------------------------------------------------------------
updated classes:
tc class add dev eth0 parent 1: classid 1:1 htb rate 1000mbit ceil 
1000mbit 
mtu 40000
tc class add dev eth0 parent 1:1 classid 1:10 htb rate 512kbit ceil 
512kbit 
quantum 3000 mtu 40000
tc class add dev eth0 parent 1:1 classid 1:99 htb rate 900mbit ceil 
1000mbit quantum 3000 mtu 40000

root@sysreset:~# tc -s -d class show dev eth0
class htb 1:99 parent 1:1 leaf 99: prio 0 quantum 3000 rate 900000Kbit 
ceil 
1000Mbit burst 489825b/256 mpu 0b overhead 0b cburst 539875b/256 mpu 0b 
overhead 0b level 0
  Sent 31203 bytes 282 pkt (dropped 0, overlimits 0 requeues 0)
  rate 7264bit 8pps backlog 0b 0p requeues 0
  lended: 282 borrowed: 0 giants: 0
  tokens: 4695 ctokens: 4657

class htb 1:1 root rate 1000Mbit ceil 1000Mbit burst 539875b/256 mpu 0b 
overhead 0b cburst 539875b/256 mpu 0b overhead 0b level 7
  Sent 1126563 bytes 654 pkt (dropped 0, overlimits 0 requeues 0)
  rate 254848bit 15pps backlog 0b 0p requeues 0
  lended: 0 borrowed: 0 giants: 0
  tokens: 4657 ctokens: 4657

class htb 1:10 parent 1:1 leaf 10: prio 0 quantum 3000 rate 512000bit ceil 

512000bit burst 40255b/256 mpu 0b overhead 0b cburst 40255b/256 mpu 0b 
overhead 0b level 0
  Sent 1104444 bytes 378 pkt (dropped 0, overlimits 0 requeues 0)
  rate 250464bit 10pps backlog 0b 6p requeues 0
  lended: 372 borrowed: 0 giants: 0
  tokens: -694028 ctokens: -694028

root@sysreset:~# tc -s -d qdisc show dev eth0
qdisc htb 1: r2q 10 default 99 direct_packets_stat 338 ver 3.17
  Sent 1609761 bytes 1180 pkt (dropped 0, overlimits 369 requeues 0)
  rate 0bit 0pps backlog 0b 3p requeues 0
qdisc sfq 10: parent 1:10 limit 128p quantum 1514b flows 128/1024
  Sent 1536378 bytes 509 pkt (dropped 0, overlimits 0 requeues 0)
  rate 0bit 0pps backlog 29362b 3p requeues 0
qdisc sfq 99: parent 1:99 limit 128p quantum 1514b flows 128/1024
  Sent 32175 bytes 283 pkt (dropped 0, overlimits 0 requeues 0)
  rate 0bit 0pps backlog 0b 0p requeues 0
root@sysreset:~# tc filter show dev eth0
filter parent 1: protocol ip pref 49151 u32
filter parent 1: protocol ip pref 49151 u32 fh 801: ht divisor 1
filter parent 1: protocol ip pref 49151 u32 fh 801::800 order 2048 key ht 
801 bkt 0 flowid 1:10
   match 01bb0000/ffff0000 at 20
filter parent 1: protocol ip pref 49152 u32
filter parent 1: protocol ip pref 49152 u32 fh 800: ht divisor 1
filter parent 1: protocol ip pref 49152 u32 fh 800::800 order 2048 key ht 
800 bkt 0 flowid 1:10
   match 00500000/ffff0000 at 20
root@sysreset:~#
-------------------------------------------------------------------------------------------------------------------------

Thanks.
-Ryan Power



At 04:00 AM 9/12/2006, you wrote:
>Message: 4
>Date: Tue, 12 Sep 2006 10:36:27 +0200
>From: e.janz@barceloviajes.com
>Subject: Re: [LARTC] Re: htb traffic shaping problem (Charlie Meyer)
>To: lartc@mailman.ds9a.nl
>Message-ID:
> <OFC2DEF3FD.3B18AAD9-ONC12571E7.002DA37A-C12571E7.002F2ADF@barcelo>
>Content-Type: text/plain; charset="iso-8859-1"
>
>Hi again,
>
>sorry for my late response. Could you give us also the output of
>
>tc -s -d qdisc show dev eth0
>tc filter show dev eth0
>
>It is very strange that the rate and ceil from class 1:10 are set to
>512Kbit but the class's rate goes over 3,5Mbits!! ?Maybe it is a bug?
>I'm preparing a similar setup (a linux wan router on a 100Mbit lan with
>5Mbps upload/dowload to the Internet. We will see if I run into the same
>issues...
>
>
>Regards,
>Eric Janz


At 09:51 PM 9/12/2006, you wrote:

>The giants indicate that your MPU (MTU) is wrong.  Set it specifically.
>Try 1500.  Search the archives for "giants" and "MPU" or "MTU".
>--
>gypsy



_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc


--

ADVERTENCIA LEGAL
El contenido de este correo es confidencial y dirigido unicamente a su destinatario. Para acceder a su clausula de privacidad consulte http://www.barceloviajes.com/privacy

LEGAL ADVISORY
This message is confidential and intended only for the person or entity to which it is addressed. In order to read its privacy policy consult it at http://www.barceloviajes.com/privacy
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060914/77a3da26/attachment.html
From geraldhuet at yahoo.fr  Thu Sep 14 13:52:35 2006
From: geraldhuet at yahoo.fr (gerald HUET)
Date: Thu Sep 14 13:52:41 2006
Subject: [LARTC] HFSC traffic loss bug, kernel 2.6.16.24
In-Reply-To: <450833F8.30008@trash.net>
Message-ID: <20060914115235.43060.qmail@web26515.mail.ukl.yahoo.com>

 hello,

Could you please explain what is a "non-work-conserving qdisc" and why it doesn't make sense ?

G?rald

----- Message d'origine ----
De : Patrick McHardy <kaber@trash.net>
? : Leo Wetz <spam-goes-to-dev-null@gmx.net>
Cc : lartc@mailman.ds9a.nl
Envoy? le : Mercredi, 13 Septembre 2006, 4h38mn 16s
Objet : Re: [LARTC] HFSC traffic loss bug, kernel 2.6.16.24

Leo Wetz wrote:
> Hello,
> 
> I have finally managed to understand HFSC up to a level which allowed me to
> create a QoS script which maintains low VoIP latency while running stuff
> like eMule.
> 
> Unfortunately, HFSC seems to have a severe bug.
> Why do I consider this as a bug defenitely?
> Well, my script runs without any errors, then QoS works perfectly for some
> hours, no error messages in kernel log.
> Then randomly the kernel starts saying this:
> 
> Sep 10 17:14:51 router kernel: HFSC: Non-work-conserving qdisc ?
> Sep 10 17:14:56 router kernel: printk: 266 messages suppressed.
> Sep 10 17:14:56 router kernel: HFSC: Non-work-conserving qdisc ?
> Sep 10 17:15:01 router kernel: printk: 259 messages suppressed.
> Sep 10 17:15:01 router kernel: HFSC: Non-work-conserving qdisc ?
> Sep 10 17:15:06 router kernel: printk: 294 messages suppressed.
> Sep 10 17:15:06 router kernel: HFSC: Non-work-conserving qdisc ?
> 
> It floods the whole kernel log with this.
> Traffic is also heavily affected by package loss when this happens, thus I
> cannot ignore it.
> I have to check my kernel log when I notice that I cannot access websites
> anymore and then restart QoS manually.
> 
> My complete QoS script is attached to this mail.
> If this is not the right location for the bug report please tell me whom I
> should contact.

This is not a bug. You can't attach non-work-conserving qdiscs to
HFSC (and it doesn't make any sense). Just use classes instead
of adding HTB qdiscs.


_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc



From fourcentsshy at velotech.net  Fri Sep 15 00:14:50 2006
From: fourcentsshy at velotech.net (fourcentsshy)
Date: Fri Sep 15 00:15:02 2006
Subject: [LARTC] tc is giving an error: RTNETLINK answers: File exists
Message-ID: <1158272090.7705.25.camel@glyph.velotech.net>

Hello,

I'm using tc to limit the bandwidth of our wireless customers. I have a
working script, but I'm not happy with it. I'm trying to write a more
sophisticated script, but when I run it, it give me this error:

RTNETLINK answers: File exists

I have no idea what this error means or how to fix it. Here is a portion
of the script (the whole script shapes several interfaces):

IDEV='eth5'
TC='/sbin/tc'
IPS='/etc/sysconfig/shaper/shape.ips'
# high priority destination ports - I'll fill these in later (when this
# thing works)
HIGHPORT=
# low priority destination ports
LOWPORT=

$TC qdisc add dev $IDEV root handle 1: cbq bandwidth 1600Kbit cell 8\
avpkt 1000 mpu 64 
$TC class add dev $IDEV parent 1: classid 1:1 est 1sec 8sec cbq\
 bandwidth 1600Kbit rate 1500kbit allot 1514 maxburst 20 avpkt 1000\
 prio 0 bounded isolated 

cat $IPS | sed -e 's/#.*$//; s/^ *$//;' | while read IP RATE STATUS; do
    if [ "x$IP" == "x" ]; then
	continue
    fi

# I use the last byte of the customer's IP's for the handle, which range
# from 76 to 135 ATM.

    HANDLE="${IP##*.}"

# I get the error from the next line. Because it fails to create the 
# qdisc all the rest fail too.

    $TC qdisc add dev $IDEV parent 1:1 handle 1:$HANDLE cbq\
 bandwidth 1600Kbit cell 8 avpkt 1000 mpu 64 

    $TC class add dev $IDEV parent 1:$HANDLE classid $HANDLE:\
 est 1sec 8sec cbq bandwidth 1600Kbit rate ${RATE}kbit allot 1514\
 maxburst 20 avpkt 1000 prio 1 bounded isolated 
    $TC class add dev $IDEV parent $HANDLE: classid $HANDLE:1\
 est 1sec 8sec cbq bandwidth 1600Kbit rate ${RATE}kbit allot 1514\
 maxburst 20 avpkt 1000 prio 2
    $TC class add dev $IDEV parent $HANDLE: classid $HANDLE:2 est 1sec\
 8sec cbq bandwidth 1600Kbit rate $[9*$RATE/10]kbit allot 1514\
 maxburst 20 avpkt 1000 prio 3
    $TC class add dev $IDEV parent $HANDLE: classid $HANDLE:3 est 1sec\
 8sec cbq bandwidth 1600Kbit rate $[8*$RATE/10]kbit allot 1514\
 maxburst 20 avpkt 1000 prio 4
    $TC qdisc add dev $IDEV parent $HANDLE:1 sfq quantum 1514b\
 perturb 15
    $TC qdisc add dev $IDEV parent $HANDLE:2 sfq quantum 1514b\
 perturb 15
    $TC qdisc add dev $IDEV parent $HANDLE:3 sfq quantum 1514b\
 perturb 15
    $TC filter add dev $IDEV parent 1: protocol ip prio 16\
 u32 match ip src $IP flowid $HANDLE:
    $TC filter add dev $IDEV parent $HANDLE: protocol ip prio 10\
 u32 match ip tos 0x10 0xff flowid $HANDLE:1
    $TC filter add dev $IDEV parent $HANDLE: protocol ip prio 11\
 u32 match ip protocol 1 0xff flowid $HANDLE:1
    $TC filter add dev $IDEV parent $HANDLE: protocol ip prio 12\
 u32 match ip protocol 6 0xff match u8 0x05 0x0f at 0 match u16\
 0x0000 0xffc0 at 2 flowid $HANDLE:1

    for a in $HIGHPORT; do
	$TC filter add dev $IDEV parent 1:0 protocol ip prio 14\
 u32 match ip dport $a 0xffff flowid $HANDLE:1
    done
    for a in $LOWPORT; do
	$TC filter add dev $IDEV parent 1:0 protocol ip prio 16\
 u32 match ip dport $a 0xffff flowid $HANDLE:3
    done
    $TC filter add dev $IDEV parent 1:0 protocol ip prio 15\
 u32 match ip dst 0.0.0.0/0 flowid $HANDLE:2
done

There are bound to other problems with this script, but until I can get
past the current one, I'm dead in the water. TIA

William Murphy
Network Administrator
Velocity Technologies, Inc.


From lsharpe at pacificwireless.com.au  Fri Sep 15 00:31:56 2006
From: lsharpe at pacificwireless.com.au (Leigh Sharpe)
Date: Fri Sep 15 00:32:10 2006
Subject: [LARTC] tc is giving an error: RTNETLINK answers: File exists
In-Reply-To: <1158272090.7705.25.camel@glyph.velotech.net>
Message-ID: <H0000069000aa684.1158273116.mail.pacificwireless.net.au@MHS>

This is usually because you are attempting to create a class ID or a Qdisc ID which already exists.
Check what value $HANDLE is on each iteration, perhaps using an echo on each pass to display it. I think you'll find it is trying to use the same value twice. 


Regards,
             Leigh
 
Leigh Sharpe
Network Systems Engineer
Pacific Wireless
Ph +61 3 9584 8966
Mob 0408 009 502
email lsharpe@pacificwireless.com.au
web www.pacificwireless.com.au

-----Original Message-----
From: fourcentsshy [mailto:fourcentsshy@velotech.net] 
Sent: Friday, September 15, 2006 8:15 AM
To: lartc@mailman.ds9a.nl
Subject: [LARTC] tc is giving an error: RTNETLINK answers: File exists

Hello,

I'm using tc to limit the bandwidth of our wireless customers. I have a
working script, but I'm not happy with it. I'm trying to write a more
sophisticated script, but when I run it, it give me this error:

RTNETLINK answers: File exists

I have no idea what this error means or how to fix it. Here is a portion
of the script (the whole script shapes several interfaces):

IDEV='eth5'
TC='/sbin/tc'
IPS='/etc/sysconfig/shaper/shape.ips'
# high priority destination ports - I'll fill these in later (when this
# thing works)
HIGHPORT=
# low priority destination ports
LOWPORT=

$TC qdisc add dev $IDEV root handle 1: cbq bandwidth 1600Kbit cell 8\
avpkt 1000 mpu 64 
$TC class add dev $IDEV parent 1: classid 1:1 est 1sec 8sec cbq\
 bandwidth 1600Kbit rate 1500kbit allot 1514 maxburst 20 avpkt 1000\
 prio 0 bounded isolated 

cat $IPS | sed -e 's/#.*$//; s/^ *$//;' | while read IP RATE STATUS; do
    if [ "x$IP" == "x" ]; then
	continue
    fi

# I use the last byte of the customer's IP's for the handle, which range
# from 76 to 135 ATM.

    HANDLE="${IP##*.}"

# I get the error from the next line. Because it fails to create the 
# qdisc all the rest fail too.

    $TC qdisc add dev $IDEV parent 1:1 handle 1:$HANDLE cbq\
 bandwidth 1600Kbit cell 8 avpkt 1000 mpu 64 

    $TC class add dev $IDEV parent 1:$HANDLE classid $HANDLE:\
 est 1sec 8sec cbq bandwidth 1600Kbit rate ${RATE}kbit allot 1514\
 maxburst 20 avpkt 1000 prio 1 bounded isolated 
    $TC class add dev $IDEV parent $HANDLE: classid $HANDLE:1\
 est 1sec 8sec cbq bandwidth 1600Kbit rate ${RATE}kbit allot 1514\
 maxburst 20 avpkt 1000 prio 2
    $TC class add dev $IDEV parent $HANDLE: classid $HANDLE:2 est 1sec\
 8sec cbq bandwidth 1600Kbit rate $[9*$RATE/10]kbit allot 1514\
 maxburst 20 avpkt 1000 prio 3
    $TC class add dev $IDEV parent $HANDLE: classid $HANDLE:3 est 1sec\
 8sec cbq bandwidth 1600Kbit rate $[8*$RATE/10]kbit allot 1514\
 maxburst 20 avpkt 1000 prio 4
    $TC qdisc add dev $IDEV parent $HANDLE:1 sfq quantum 1514b\
 perturb 15
    $TC qdisc add dev $IDEV parent $HANDLE:2 sfq quantum 1514b\
 perturb 15
    $TC qdisc add dev $IDEV parent $HANDLE:3 sfq quantum 1514b\
 perturb 15
    $TC filter add dev $IDEV parent 1: protocol ip prio 16\
 u32 match ip src $IP flowid $HANDLE:
    $TC filter add dev $IDEV parent $HANDLE: protocol ip prio 10\
 u32 match ip tos 0x10 0xff flowid $HANDLE:1
    $TC filter add dev $IDEV parent $HANDLE: protocol ip prio 11\
 u32 match ip protocol 1 0xff flowid $HANDLE:1
    $TC filter add dev $IDEV parent $HANDLE: protocol ip prio 12\
 u32 match ip protocol 6 0xff match u8 0x05 0x0f at 0 match u16\
 0x0000 0xffc0 at 2 flowid $HANDLE:1

    for a in $HIGHPORT; do
	$TC filter add dev $IDEV parent 1:0 protocol ip prio 14\
 u32 match ip dport $a 0xffff flowid $HANDLE:1
    done
    for a in $LOWPORT; do
	$TC filter add dev $IDEV parent 1:0 protocol ip prio 16\
 u32 match ip dport $a 0xffff flowid $HANDLE:3
    done
    $TC filter add dev $IDEV parent 1:0 protocol ip prio 15\
 u32 match ip dst 0.0.0.0/0 flowid $HANDLE:2
done

There are bound to other problems with this script, but until I can get
past the current one, I'm dead in the water. TIA

William Murphy
Network Administrator
Velocity Technologies, Inc.


_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

From fourcentsshy at velotech.net  Fri Sep 15 01:11:28 2006
From: fourcentsshy at velotech.net (fourcentsshy)
Date: Fri Sep 15 01:11:45 2006
Subject: [LARTC] tc is giving an error: RTNETLINK answers: File exists
Message-ID: <1158275488.7705.45.camel@glyph.velotech.net>

On Fri, 2006-09-15 at 08:31 +1000, Leigh Sharpe wrote:
> This is usually because you are attempting to create a class ID or a
Qdisc ID which already exists.
> Check what value $HANDLE is on each iteration, perhaps using an echo
on each pass to display it. I think you'll find it is trying to use the
same value twice. 
> 
> 
> Regards,
>              Leigh
>  
> Leigh Sharpe
> Network Systems Engineer
> Pacific Wireless
> Ph +61 3 9584 8966
> Mob 0408 009 502
> email lsharpe@pacificwireless.com.au
> web www.pacificwireless.com.au
> 

Thanks for the quick reply. Not only have I tried that, I inserted an
exit statement after the first iteration (to limit the info). The first
qdisc in the loop has the handle 1:76 and it's parent is 1:1. The only
other qdisc is the root qdisc that is created before the loop. The
script also does a reset, deleting any existing qdiscs, classes or
filters, before creating any new ones. Is there a limit to how large the
handle can be?

Cheers,

William Murphy
Network Administrator
Velocity Technologies, Inc.



From anakinv7 at hotmail.com  Fri Sep 15 04:24:48 2006
From: anakinv7 at hotmail.com (Vladimir Burciaga Aguilar)
Date: Fri Sep 15 04:25:00 2006
Subject: [LARTC] Problem with Load Balancing
Message-ID: <BAY116-F9C9A3D94EC858237F43188C2E0@phx.gbl>

Hi everybody!

I'm trying to implement the load balancing for a LAN with two ISPs. I've 
installed a Suse Linux Enterpise Server 9 with iproute2 for that porpouse.

The server have two NICs, one of them is for both the LAN and ISP 1. I've 
setup both NICs with YAST (if I use ip for this, then the whole thing 
doesn't work!) and execute the following commands to setup the routing 
tables:

ip route flush cache
ip route flush default
ip route flush table 1
ip route flush table 2

ip route add 10.1.254.0/24 dev eth0 src 10.1.254.251
ip route add 10.1.1.0/24 dev eth1 src 10.1.1.200

ip route show table main | while read ROUTE ; do ip route add table 1 $ROUTE 
; done
ip route show table main | while read ROUTE ; do ip route add table 2 $ROUTE 
; done

ip route add table 1 default via 10.1.254.254
ip route add table 2 default via 10.1.1.254

ip rule add from 10.1.254.251 table 1
ip rule add from 10.1.1.200 table 2

ip route add default equalize nexthop via 10.1.254.254 dev eth0 weight 1 \
nexthop via 10.1.1.254 dev eth1 weight 1


(All of this came from 
http://linux.lcampino.cl/wiki/index.php/Balanceo_de_Carga#Configurando_la_red 
(in Spanish)).

At this point, things seems to work fine. I browse in the server and watch 
with iptraf that both NICs have traffic, but not at 50%-50% rate.


Now I need to implement the following:

- Make load balancing the nearest to 50%-50% rate (Both Internet connections 
have equal bandwith).
- When one of the links goes down, all the traffic redirects to the other 
inmediately and automatically. Also, when the link is up again, the load 
balancing restart too.
- If posible, when downloading a single big file (i.e. *.exe, *.iso), the 
packets come from both connections.

I've read a lot about this, but I'm still confuse and very very lost...! 
:-)))

I'm not sure if I need to adjust some kernel paramters and rebuit it, 
execute another sequence of commands, apply a kernel patch, etc.

I really apreciate if someone could bring me some light in all this, or tell 
me what documentation, web page or patch do I need to use.


Thanks in advanced for all your time and recomendations!


P.D. Sorry for my English!

_________________________________________________________________
Platica con tus amigos en linea con MSN Messenger 
http://messenger.t1msn.com.mx/

From luciano at lugmen.org.ar  Fri Sep 15 04:55:34 2006
From: luciano at lugmen.org.ar (Luciano Ruete)
Date: Fri Sep 15 04:55:44 2006
Subject: [LARTC] HTB and per-connection bandwidth allocation
In-Reply-To: <c76c7bb70609140155n5f255993ydaad1d761d966c9b@mail.gmail.com>
References: <c76c7bb70609140155n5f255993ydaad1d761d966c9b@mail.gmail.com>
Message-ID: <200609142355.34568.luciano@lugmen.org.ar>

El Thursday 14 September 2006 05:55, Namitha Rao escribi?:
> Hi
>
> http://mailman.ds9a.nl/pipermail/lartc/2002q3/004977.html
>
> I have the same problem to discuss as in the above link. I want to allocate
> say X MBit per individual connection regardless of  the number of
> connection . KIndly could anyonen suggest me how to proceed.
> I have tried with SFq but is doesnot yeild my requirement..

With CONTRACK/CONNMARK you can get an individual mark per connection, then you 
will need to allocate dinamic qdisc/class/filter to match that mark.

Problems that i see:
-do not know if there is an easy way to know wath mark was assigned, but you 
can allways 'use the source'
-do not have experience adding and deleting qdisc/class/filter in milisecond 
basis.

Not shure at all, but i think that is possible.
-- 
Luciano
From wtm at harbec.com  Fri Sep 15 06:12:16 2006
From: wtm at harbec.com (William T Mullaney)
Date: Fri Sep 15 06:12:35 2006
Subject: [LARTC] Problem with Load Balancing
Message-ID: <4986F8D166F1E44CBA92A91C98ACAD5214CA0E@sql_server>

Vlad,

We have also set up a somewhat similar method of load balancing.  Our
traffic is never a 50-50 split (well 3:2 is how we have it set, but it
doesn't always get close to that), but as the load picks up, it tends to be
closer to the actual amount.

Dead gateway detection has never worked for us, and one day I'll probably
bother other members of the LARTC group to get some help, but the method
that we use is to check the output of the ip neighbor command.  Basically,
if our two ISPs are 10.1.1.254 and 10.2.2.254, we run a bash script via cron
every minute that does a call something like:

ETH1 = ip neigh 10.1.1.254 | egrep "REACHABLE|DELAY|PROBE|STALE" -c 
ETH2 = ip neigh 10.2.2.254 | egrep "REACHABLE|DELAY|PROBE|STALE" -c

The neighbor system basically monitors ARP and if it sees a message leave an
interface without a reply after something like 3-5 seconds, it moves the
interface to DELAY, after another few seconds it moves to PROBE and does an
active arp request, and if that fails to work in a few seconds, it becomes
INCOMPLETE or FAILED or just simply isn't listed.  If no data is sent either
way for a while, the entry can be marked STALE or removed.

With the above lines, we get a 1 in the ETH1 or ETH2 variables if the next
neighbor is up, and a 0 if not.  From there you can use some if scripts to
detect if both are up, or if only one is up, which one.  In our case, if
both are up we clear the default route and then make it something like

ip route add default nexthop via 10.1.1.254 dev eth1 weight 1 \
nexthop via 10.2.2.254 dev eth2 weight 1

and if only one is up we clear it and make it :

ip route add default nexthop via 10.1.1.254 dev eth1 
or 
ip route add default nexthop via 10.2.2.254 dev eth2 


With some additional scripting we can allow this to be overridden, we can
set the link to prefer using only one line, but switch to the other if the
preferred line fails, and to take input from programs like Nagios to
auto-prefer one line or another if ping times get high, etc.  In addition,
the script remembers the state it was in (so that it only changes the
routing table when needed), controls DNS, can flush the DNS cache, and
reports status back to Nagios.  Once I get all the bugs out and some
documentation, I'd be happy to post it to the news group, though you or
anyone else can send me an email if you would like to take a look at it
before then.

In practice, this method usually detects and adjusts outbound connections
quickly without user intervention; DNS changes with short TTLS take care of
inbound connections.  Just be careful... if you don't have something sending
traffic out to your upstream routers (and back) every few minutes, the entry
in your ARP table can potentially be removed and thus cause your system to
think an unused gateway has failed, or that a recovered gateway is still
down.  This could be checked with a quick "if ip neigh test fails, ping
neighbor 5 times, then test again before making decisions".  Running an
uptime monitor that pings or does something else to/through the gateway
(regardless of default route) also takes care of this.


-Will

-----Original Message-----
From: Vladimir Burciaga Aguilar [mailto:anakinv7@hotmail.com] 
Sent: Thursday, September 14, 2006 10:25 PM
To: lartc@mailman.ds9a.nl
Subject: [LARTC] Problem with Load Balancing

Hi everybody!

I'm trying to implement the load balancing for a LAN with two ISPs. I've 
installed a Suse Linux Enterpise Server 9 with iproute2 for that porpouse.

The server have two NICs, one of them is for both the LAN and ISP 1. I've 
setup both NICs with YAST (if I use ip for this, then the whole thing 
doesn't work!) and execute the following commands to setup the routing 
tables:

ip route flush cache
ip route flush default
ip route flush table 1
ip route flush table 2

[snip]
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060915/9cd14447/attachment.htm
From gypsy at iswest.com  Fri Sep 15 06:36:16 2006
From: gypsy at iswest.com (gypsy)
Date: Fri Sep 15 06:36:32 2006
Subject: [LARTC] tc is giving an error: RTNETLINK answers: File exists
References: <1158272090.7705.25.camel@glyph.velotech.net>
Message-ID: <450A2DC0.4ABC84FC@iswest.com>

fourcentsshy wrote:
> 
> Hello,
> 
> I'm using tc to limit the bandwidth of our wireless customers. I have a
> working script, but I'm not happy with it. I'm trying to write a more
> sophisticated script, but when I run it, it give me this error:
> 
> RTNETLINK answers: File exists
> 
> I have no idea what this error means or how to fix it.

It means pretty much what it says.  There is already a record matching
closely enough that it is duplicated.

> Here is a portion
> of the script (the whole script shapes several interfaces):
> 
> IDEV='eth5'
> TC='/sbin/tc'
> IPS='/etc/sysconfig/shaper/shape.ips'
> # high priority destination ports - I'll fill these in later (when this
> # thing works)
> HIGHPORT=
> # low priority destination ports
> LOWPORT=
> 
> $TC qdisc add dev $IDEV root handle 1: cbq bandwidth 1600Kbit cell 8\
> avpkt 1000 mpu 64
> $TC class add dev $IDEV parent 1: classid 1:1 est 1sec 8sec cbq\
>  bandwidth 1600Kbit rate 1500kbit allot 1514 maxburst 20 avpkt 1000\
>  prio 0 bounded isolated
> 
> cat $IPS | sed -e 's/#.*$//; s/^ *$//;' | while read IP RATE STATUS; do
>     if [ "x$IP" == "x" ]; then
>         continue
>     fi
> 
> # I use the last byte of the customer's IP's for the handle, which range
> # from 76 to 135 ATM.
> 
>     HANDLE="${IP##*.}"
> 
> # I get the error from the next line. Because it fails to create the
> # qdisc all the rest fail too.
> 
>     $TC qdisc add dev $IDEV parent 1:1 handle 1:$HANDLE cbq\
>  bandwidth 1600Kbit cell 8 avpkt 1000 mpu 64
> 
>     $TC class add dev $IDEV parent 1:$HANDLE classid $HANDLE:\
>  est 1sec 8sec cbq bandwidth 1600Kbit rate ${RATE}kbit allot 1514\
>  maxburst 20 avpkt 1000 prio 1 bounded isolated
>     $TC class add dev $IDEV parent $HANDLE: classid $HANDLE:1\
>  est 1sec 8sec cbq bandwidth 1600Kbit rate ${RATE}kbit allot 1514\
>  maxburst 20 avpkt 1000 prio 2
>     $TC class add dev $IDEV parent $HANDLE: classid $HANDLE:2 est 1sec\
>  8sec cbq bandwidth 1600Kbit rate $[9*$RATE/10]kbit allot 1514\
>  maxburst 20 avpkt 1000 prio 3
>     $TC class add dev $IDEV parent $HANDLE: classid $HANDLE:3 est 1sec\
>  8sec cbq bandwidth 1600Kbit rate $[8*$RATE/10]kbit allot 1514\
>  maxburst 20 avpkt 1000 prio 4
>     $TC qdisc add dev $IDEV parent $HANDLE:1 sfq quantum 1514b\
>  perturb 15
>     $TC qdisc add dev $IDEV parent $HANDLE:2 sfq quantum 1514b\
>  perturb 15
>     $TC qdisc add dev $IDEV parent $HANDLE:3 sfq quantum 1514b\
>  perturb 15
>     $TC filter add dev $IDEV parent 1: protocol ip prio 16\
>  u32 match ip src $IP flowid $HANDLE:
>     $TC filter add dev $IDEV parent $HANDLE: protocol ip prio 10\
>  u32 match ip tos 0x10 0xff flowid $HANDLE:1
>     $TC filter add dev $IDEV parent $HANDLE: protocol ip prio 11\
>  u32 match ip protocol 1 0xff flowid $HANDLE:1
>     $TC filter add dev $IDEV parent $HANDLE: protocol ip prio 12\
>  u32 match ip protocol 6 0xff match u8 0x05 0x0f at 0 match u16\
>  0x0000 0xffc0 at 2 flowid $HANDLE:1
> 
>     for a in $HIGHPORT; do
>         $TC filter add dev $IDEV parent 1:0 protocol ip prio 14\
>  u32 match ip dport $a 0xffff flowid $HANDLE:1
>     done
>     for a in $LOWPORT; do
>         $TC filter add dev $IDEV parent 1:0 protocol ip prio 16\
>  u32 match ip dport $a 0xffff flowid $HANDLE:3
>     done
>     $TC filter add dev $IDEV parent 1:0 protocol ip prio 15\
>  u32 match ip dst 0.0.0.0/0 flowid $HANDLE:2
> done
> 
> There are bound to other problems with this script, but until I can get
> past the current one, I'm dead in the water. TIA

You do not say which line or lines is causing the error so this is a
guess.

Run `tc -s filter show dev $IDEV' sending the output to a file because
there will be a lot of it.  I think you will find a ton of "duplicate"
filters.

Set prio to the same value (16 or 10 perhaps) for each and every line in
your `$TC filter' lines.
--
gypsy
From gypsy at iswest.com  Fri Sep 15 06:40:06 2006
From: gypsy at iswest.com (gypsy)
Date: Fri Sep 15 06:40:14 2006
Subject: [LARTC] tc is giving an error: RTNETLINK answers: File exists
References: <1158275488.7705.45.camel@glyph.velotech.net>
Message-ID: <450A2EA6.B25F7C@iswest.com>

fourcentsshy wrote:
> Is there a limit to how large the
> handle can be?

Yes.  The handle is in hex, so I _think_ the max is 255.  Maybe Stef
Coene's web site or a search of this mailing list will give you the
RIGHT answer.  I hate getting old; I should remember what the max here
is.
--
gypsy
From kaber at trash.net  Fri Sep 15 06:50:54 2006
From: kaber at trash.net (Patrick McHardy)
Date: Fri Sep 15 06:51:04 2006
Subject: [LARTC] HFSC traffic loss bug, kernel 2.6.16.24
In-Reply-To: <20060914115235.43060.qmail@web26515.mail.ukl.yahoo.com>
References: <20060914115235.43060.qmail@web26515.mail.ukl.yahoo.com>
Message-ID: <450A312E.8090900@trash.net>

gerald HUET wrote:
>  hello,
> 
> Could you please explain what is a "non-work-conserving qdisc" and why it doesn't make sense ?

A non-work-conserving qdisc is a qdisc that limits the total amount
of bandwidth by stopping to hand out packets when some limit is reached.
HFSC needs to know the length of the next packet to be sent to calculate
the deadline, to get it it dequeues the inner qdiscs, peeks at the
packet and requeues it again. When the inner qdisc is
non-work-conserving it might refuse to hand the packet to HFSC and
HFSC can not work properly. It does not make sense to do this since
HFSC can operate in non-work-conserving mode itself (using upper-limit
curves), so there is no need to attach further non-work-conserving
qdiscs as leaves.

> ----- Message d'origine ----
> De : Patrick McHardy <kaber@trash.net>
> ? : Leo Wetz <spam-goes-to-dev-null@gmx.net>
> Cc : lartc@mailman.ds9a.nl
> Envoy? le : Mercredi, 13 Septembre 2006, 4h38mn 16s
> Objet : Re: [LARTC] HFSC traffic loss bug, kernel 2.6.16.24
> 
> Leo Wetz wrote:
> 
>>Sep 10 17:14:51 router kernel: HFSC: Non-work-conserving qdisc ?
>>Sep 10 17:14:56 router kernel: printk: 266 messages suppressed.
>>Sep 10 17:14:56 router kernel: HFSC: Non-work-conserving qdisc ?
>>Sep 10 17:15:01 router kernel: printk: 259 messages suppressed.
>>Sep 10 17:15:01 router kernel: HFSC: Non-work-conserving qdisc ?
>>Sep 10 17:15:06 router kernel: printk: 294 messages suppressed.
>>Sep 10 17:15:06 router kernel: HFSC: Non-work-conserving qdisc ?
> 
> This is not a bug. You can't attach non-work-conserving qdiscs to
> HFSC (and it doesn't make any sense). Just use classes instead
> of adding HTB qdiscs.

From fourcentsshy at velotech.net  Fri Sep 15 21:47:53 2006
From: fourcentsshy at velotech.net (fourcentsshy)
Date: Fri Sep 15 21:48:23 2006
Subject: [LARTC] tc is giving an error: RTNETLINK answers: File exists
In-Reply-To: <450A2DC0.4ABC84FC@iswest.com>
References: <1158272090.7705.25.camel@glyph.velotech.net>
	<450A2DC0.4ABC84FC@iswest.com>
Message-ID: <1158349674.7896.34.camel@glyph.velotech.net>

On Thu, 2006-09-14 at 21:36 -0700, gypsy wrote:
> fourcentsshy wrote:
> > 
> > Hello,
> > 
> > I'm using tc to limit the bandwidth of our wireless customers. I have a
> > working script, but I'm not happy with it. I'm trying to write a more
> > sophisticated script, but when I run it, it give me this error:
> > 
> > RTNETLINK answers: File exists
> > 
> > I have no idea what this error means or how to fix it.
> 
> It means pretty much what it says.  There is already a record matching
> closely enough that it is duplicated.
> 

That is what puzzles me the most. If you look at the script, I create
the root qdisc, add a class to it and when I try to add a qdisc to that
class on the first iteration in the loop, I get the error right off. The
script also deletes all qdiscs, classes and filters before it creates
any new ones. On the first iteration of the loop, the handle is 1:76
with it's parent 1:1, which should be unique, since it's only the second
qdisc created.

As Leigh Sharpe suggested, I had already inserted echo statements into
the script so I could examine what was really going on. For this device,
the error takes place on the third command. the command sequence take
place like this:

/sbin/tc qdisc add dev eth5 root handle 1: cbq bandwidth 1600Kbit\
 cell 8 avpkt 1000 mpu 64 

/sbin/tc class add dev eth5 parent 1: classid 1:1 est 1sec 8sec cbq\
 bandwidth 1600Kbit rate 1500kbit allot 1514 maxburst 20 avpkt 1000\
 prio 0 bounded isolated 

/sbin/tc qdisc add dev eth5 parent 1:1 handle 1:76 cbq\
 bandwidth 1600Kbit cell 8 avpkt 1000 mpu 64
RTNETLINK answers: File exists

Like I said, I start by resetting all the devices on the machine, so
there is no possible way there can be any existing qdisc with a handle
of 1:76 for that device, yet I get the error anyway. The script is setup
as a service to be run at startup, so checking the status after running
the script for that device, I get this:

[qdisc - eth5]                  
qdisc cbq 1: rate 1600Kbit (bounded,isolated) prio no-transmit
 Sent 139719 bytes 181 pkt (dropped 0, overlimits 0 requeues 0) 
 rate 0bit 0pps backlog 0b 0p requeues 0 
  borrowed 0 overactions 0 avgidle 5120 undertime 0
------------------------        
                                
[class - eth5]                  
class cbq 1:11 parent 1:1 leaf 8236: rate 700000bit prio 2
 Sent 13814 bytes 42 pkt (dropped 0, overlimits 0 requeues 0) 
 rate 11792bit 4pps backlog 0b 0p requeues 0 
  borrowed 0 overactions 0 avgidle 306884 undertime 0
class cbq 1: root rate 100000Kbit (bounded,isolated) prio no-transmit
 Sent 60 bytes 1 pkt (dropped 0, overlimits 0 requeues 0) 
 rate 0bit 0pps backlog 0b 0p requeues 0 
  borrowed 0 overactions 0 avgidle 81 undertime 0
class cbq 1:10 parent 1:1 leaf 8235: rate 750000bit prio 1
 Sent 6712 bytes 48 pkt (dropped 0, overlimits 0 requeues 0) 
 rate 2008bit 2pps backlog 0b 0p requeues 0 
  borrowed 0 overactions 0 avgidle 148506 undertime 0
class cbq 1:1 parent 1: rate 800000bit (bounded,isolated) prio
no-transmit
 Sent 20526 bytes 90 pkt (dropped 0, overlimits 0 requeues 0) 
 rate 13800bit 7pps backlog 0b 0p requeues 0 
  borrowed 0 overactions 0 avgidle 57889 undertime 0
class cbq 1:12 parent 1:1 leaf 8237: rate 700000bit prio 3
 Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0) 
 rate 0bit 0pps backlog 0b 0p requeues 0 
  borrowed 0 overactions 0 avgidle 329838 undertime 0

Maybe I'm blind, but I don't see any qdisc or class with a handle of
1:76. Something else is wrong, but I don't see it.

> > Here is a portion
> > of the script (the whole script shapes several interfaces):
> > 
> > IDEV='eth5'
> > TC='/sbin/tc'
> > IPS='/etc/sysconfig/shaper/shape.ips'
> > # high priority destination ports - I'll fill these in later (when this
> > # thing works)
> > HIGHPORT=
> > # low priority destination ports
> > LOWPORT=
> > 
> > $TC qdisc add dev $IDEV root handle 1: cbq bandwidth 1600Kbit cell 8\
> > avpkt 1000 mpu 64
> > $TC class add dev $IDEV parent 1: classid 1:1 est 1sec 8sec cbq\
> >  bandwidth 1600Kbit rate 1500kbit allot 1514 maxburst 20 avpkt 1000\
> >  prio 0 bounded isolated
> > 
> > cat $IPS | sed -e 's/#.*$//; s/^ *$//;' | while read IP RATE STATUS; do
> >     if [ "x$IP" == "x" ]; then
> >         continue
> >     fi
> > 
> > # I use the last byte of the customer's IP's for the handle, which range
> > # from 76 to 135 ATM.
> > 
> >     HANDLE="${IP##*.}"
> > 
> > # I get the error from the next line. Because it fails to create the
> > # qdisc all the rest fail too.
> > 
> >     $TC qdisc add dev $IDEV parent 1:1 handle 1:$HANDLE cbq\
> >  bandwidth 1600Kbit cell 8 avpkt 1000 mpu 64
> > 
> >     $TC class add dev $IDEV parent 1:$HANDLE classid $HANDLE:\
> >  est 1sec 8sec cbq bandwidth 1600Kbit rate ${RATE}kbit allot 1514\
> >  maxburst 20 avpkt 1000 prio 1 bounded isolated
> >     $TC class add dev $IDEV parent $HANDLE: classid $HANDLE:1\
> >  est 1sec 8sec cbq bandwidth 1600Kbit rate ${RATE}kbit allot 1514\
> >  maxburst 20 avpkt 1000 prio 2
> >     $TC class add dev $IDEV parent $HANDLE: classid $HANDLE:2 est 1sec\
> >  8sec cbq bandwidth 1600Kbit rate $[9*$RATE/10]kbit allot 1514\
> >  maxburst 20 avpkt 1000 prio 3
> >     $TC class add dev $IDEV parent $HANDLE: classid $HANDLE:3 est 1sec\
> >  8sec cbq bandwidth 1600Kbit rate $[8*$RATE/10]kbit allot 1514\
> >  maxburst 20 avpkt 1000 prio 4
> >     $TC qdisc add dev $IDEV parent $HANDLE:1 sfq quantum 1514b\
> >  perturb 15
> >     $TC qdisc add dev $IDEV parent $HANDLE:2 sfq quantum 1514b\
> >  perturb 15
> >     $TC qdisc add dev $IDEV parent $HANDLE:3 sfq quantum 1514b\
> >  perturb 15
> >     $TC filter add dev $IDEV parent 1: protocol ip prio 16\
> >  u32 match ip src $IP flowid $HANDLE:
> >     $TC filter add dev $IDEV parent $HANDLE: protocol ip prio 10\
> >  u32 match ip tos 0x10 0xff flowid $HANDLE:1
> >     $TC filter add dev $IDEV parent $HANDLE: protocol ip prio 11\
> >  u32 match ip protocol 1 0xff flowid $HANDLE:1
> >     $TC filter add dev $IDEV parent $HANDLE: protocol ip prio 12\
> >  u32 match ip protocol 6 0xff match u8 0x05 0x0f at 0 match u16\
> >  0x0000 0xffc0 at 2 flowid $HANDLE:1
> > 
> >     for a in $HIGHPORT; do
> >         $TC filter add dev $IDEV parent 1:0 protocol ip prio 14\
> >  u32 match ip dport $a 0xffff flowid $HANDLE:1
> >     done
> >     for a in $LOWPORT; do
> >         $TC filter add dev $IDEV parent 1:0 protocol ip prio 16\
> >  u32 match ip dport $a 0xffff flowid $HANDLE:3
> >     done
> >     $TC filter add dev $IDEV parent 1:0 protocol ip prio 15\
> >  u32 match ip dst 0.0.0.0/0 flowid $HANDLE:2
> > done
> > 
> > There are bound to other problems with this script, but until I can get
> > past the current one, I'm dead in the water. TIA
> 
> You do not say which line or lines is causing the error so this is a
> guess.

I inserted a comment in the script that points out which command causes
the error. It's the first command inside the loop. 

> 
> Run `tc -s filter show dev $IDEV' sending the output to a file because
> there will be a lot of it.  I think you will find a ton of "duplicate"
> filters.

I inserted an exit statement right after the command that give the
error. The script never gets to the statements that creates the filters.
Checking the status of the service would display the filters along with
the qdiscs and classes, but there are none.

> 
> Set prio to the same value (16 or 10 perhaps) for each and every line in
> your `$TC filter' lines.

If I ever get this script working, I'll do that. ;-)


From bugzilla at sysreset.com  Sat Sep 16 03:38:36 2006
From: bugzilla at sysreset.com (Bugzilla-Redirect)
Date: Sat Sep 16 03:38:47 2006
Subject: [LARTC] Re: htb traffic shaping problem
In-Reply-To: <20060914223226.1183944E0@outpost.ds9a.nl>
References: <20060914223226.1183944E0@outpost.ds9a.nl>
Message-ID: <6.2.0.14.2.20060915193530.02eaf330@linux.sysreset.com>

Yes, the output is below:
eth0      Link encap:Ethernet  HWaddr 00:11:09:2A:A6:F6
           inet addr:10.0.0.50  Bcast:10.0.0.255  Mask:255.255.255.0
           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
           RX packets:4244867 errors:0 dropped:0 overruns:0 frame:0
           TX packets:1306632 errors:0 dropped:0 overruns:0 carrier:0
           collisions:0 txqueuelen:1000
           RX bytes:3898905509 (3.6 GiB)  TX bytes:1756030081 (1.6 GiB)
           Interrupt:19

And from ethtool:
Settings for eth0:
         Supported ports: [ MII ]
         Supported link modes:   10baseT/Half 10baseT/Full
                                 100baseT/Half 100baseT/Full
                                 1000baseT/Full
         Supports auto-negotiation: Yes
         Advertised link modes:  10baseT/Half 10baseT/Full
                                 100baseT/Half 100baseT/Full
                                 1000baseT/Full
         Advertised auto-negotiation: Yes
         Speed: 1000Mb/s
         Duplex: Full
         Port: MII
         PHYAD: 1
         Transceiver: external
         Auto-negotiation: on
         Supports Wake-on: g
         Wake-on: d
         Link detected: yes

Thanks.
-Ryan Power

At 04:32 PM 9/14/2006, you wrote:
>Hi,
>
>could you check the mtu set on eth0 with an ifconfig?
>I tried my own setup and it works fine...
>
>
>Regards,
>
>Eric Janz
>Departamento de Sistemas
>Grupo Barcel? Viajes

From mingching.tiew at redtone.com  Sat Sep 16 14:21:41 2006
From: mingching.tiew at redtone.com (Ming-Ching Tiew)
Date: Sat Sep 16 14:19:26 2006
Subject: [LARTC] Traffic Control in a bridge
Message-ID: <001601c6d98a$aa914840$02bca8c0@freelance>

Normally when we talk about traffic control, we are talking about
doing traffic control (tc) using a router, ie packets into an
interface and based on routing, they goes out to somewhere else.

However I have a box with two interfaces, eth0 and eth1 added to
a bridge br0 and I would like to perform traffic control via the
two interfaces. Is that supposed to work the same as the router 
counterpart, ie traffic control is transparent to routing and bridging ? 
 


From william.bohannan at spidersat.net  Sat Sep 16 15:38:41 2006
From: william.bohannan at spidersat.net (William Bohannan)
Date: Sat Sep 16 15:39:17 2006
Subject: [LARTC] process id with firewall and tc
Message-ID: <000e01c6d995$72bf4510$fa010a0a@william>

Not sure this is the correct place to post this but I am looking to have
status of the firewall and traffic control (active, disabled, stopped etc)
on a webpage controlled via something like pid as the machine has many
things running on it, like firewall, traffic control, data collection for
graphing the traffic flows, as well as other services like squid etc.  Any
ideas would be most helpful.

 

Kind Regards

 

William 

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060916/1daa944a/attachment.html
From simonl at parknet.dk  Sat Sep 16 16:17:17 2006
From: simonl at parknet.dk (Simon Lodal)
Date: Sat Sep 16 16:17:21 2006
Subject: [LARTC] process id with firewall and tc
In-Reply-To: <000e01c6d995$72bf4510$fa010a0a@william>
References: <000e01c6d995$72bf4510$fa010a0a@william>
Message-ID: <200609161617.17131.simonl@parknet.dk>


Routing, firewalling and shaping run in kernel and has no pid. Instead you can 
get/set /proc flags, and check for the presence of certain data structures.

/proc/sys/net/ipv4/ip_forward is the routing master switch. If 0, the machine 
forwards nothing. You can both set and get the value, should be relatively 
easy from a web page. Beware that setting it to 1 may reset other /proc keys 
to default values.

For iptables firewalling you probably need to check if your rules are loaded 
or not, a script parsing 'iptables -nL' output could do it. Or you could use 
a condition match "enabled" in the beginning of each table, and drop all 
traffic if the condition is false. The /proc/net/ipt_condition/enabled value 
can then be read and set as a master switch from the web page.

Shaping has no /proc files, and no way to create a master switch, so you need 
a script that parses 'tc qdisc show dev eth0' or 'tc class show dev eth0' 
output.


Regards,
Simon


On Saturday 16 September 2006 15:38, William Bohannan wrote:
> Not sure this is the correct place to post this but I am looking to have
> status of the firewall and traffic control (active, disabled, stopped etc)
> on a webpage controlled via something like pid as the machine has many
> things running on it, like firewall, traffic control, data collection for
> graphing the traffic flows, as well as other services like squid etc.  Any
> ideas would be most helpful.
>
>
>
> Kind Regards
>
>
>
> William
From smohan at gmail.com  Sat Sep 16 16:34:39 2006
From: smohan at gmail.com (Mohan Sundaram)
Date: Sat Sep 16 16:35:44 2006
Subject: [LARTC] Traffic Control in a bridge
In-Reply-To: <001601c6d98a$aa914840$02bca8c0@freelance>
References: <001601c6d98a$aa914840$02bca8c0@freelance>
Message-ID: <450C0B7F.1080108@vsnl.com>

Ming-Ching Tiew wrote:
> Normally when we talk about traffic control, we are talking about
> doing traffic control (tc) using a router, ie packets into an
> interface and based on routing, they goes out to somewhere else.
> 
> However I have a box with two interfaces, eth0 and eth1 added to
> a bridge br0 and I would like to perform traffic control via the
> two interfaces. Is that supposed to work the same as the router 
> counterpart, ie traffic control is transparent to routing and bridging ? 
>  
Eminently feasible. This link should help.
http://leaf.sourceforge.net/doc/guide/buhtb-qos.html

Mohan
From smohan at gmail.com  Sat Sep 16 16:39:17 2006
From: smohan at gmail.com (Mohan Sundaram)
Date: Sat Sep 16 16:39:53 2006
Subject: [LARTC] Traffic Control in a bridge
In-Reply-To: <450C0B7F.1080108@vsnl.com>
References: <001601c6d98a$aa914840$02bca8c0@freelance>
	<450C0B7F.1080108@vsnl.com>
Message-ID: <450C0C95.3070004@vsnl.com>

Mohan Sundaram wrote:
> Ming-Ching Tiew wrote:
>> Normally when we talk about traffic control, we are talking about
>> doing traffic control (tc) using a router, ie packets into an
>> interface and based on routing, they goes out to somewhere else.
>>
>> However I have a box with two interfaces, eth0 and eth1 added to
>> a bridge br0 and I would like to perform traffic control via the
>> two interfaces. Is that supposed to work the same as the router 
>> counterpart, ie traffic control is transparent to routing and bridging 
>> ?  
> Eminently feasible. This link should help.
> http://leaf.sourceforge.net/doc/guide/buhtb-qos.html
> 
> Mohan
> 
Looks like the page has moved to the link below
http://www.leaf-project.org/doc/bk04ch22.html

Mohan

From gypsy at iswest.com  Sat Sep 16 18:14:16 2006
From: gypsy at iswest.com (gypsy)
Date: Sat Sep 16 18:14:26 2006
Subject: [LARTC] tc is giving an error: RTNETLINK answers: File exists
References: <1158272090.7705.25.camel@glyph.velotech.net>
	<450A2DC0.4ABC84FC@iswest.com>
	<1158349674.7896.34.camel@glyph.velotech.net>
Message-ID: <450C22D8.BAABF53C@iswest.com>

fourcentsshy wrote:
> the script so I could examine what was really going on. For this device,
> the error takes place on the third command. the command sequence take
> place like this:
> 
> /sbin/tc qdisc add dev eth5 root handle 1: cbq bandwidth 1600Kbit\
>  cell 8 avpkt 1000 mpu 64
> 
> /sbin/tc class add dev eth5 parent 1: classid 1:1 est 1sec 8sec cbq\
>  bandwidth 1600Kbit rate 1500kbit allot 1514 maxburst 20 avpkt 1000\
>  prio 0 bounded isolated
> 
> /sbin/tc qdisc add dev eth5 parent 1:1 handle 1:76 cbq\
>  bandwidth 1600Kbit cell 8 avpkt 1000 mpu 64
This says to me "cell", not "ceil".  That's a mistake.

> RTNETLINK answers: File exists
> 
> Like I said, I start by resetting all the devices on the machine, so
> there is no possible way there can be any existing qdisc with a handle
> of 1:76 for that device, yet I get the error anyway. The script is setup
> as a service to be run at startup, so checking the status after running
> the script for that device, I get this:
==--snip--==
> error. The script never gets to the statements that creates the filters.
> Checking the status of the service would display the filters along with
> the qdiscs and classes, but there are none.
> 
> >
> > Set prio to the same value (16 or 10 perhaps) for each and every line in
> > your `$TC filter' lines.
> 
> If I ever get this script working, I'll do that. ;-)

One more thing.
You can send your commands to a database (mysql or whatever).  Once
disallowing duplicate records and again allowing dups.  The difference
is the Bad Boy.

I use HTB not CBQ but I still think the parameter is "ceil" not "cell"
and fixing that will help or solve.
--
gypsy
From gypsy at iswest.com  Sat Sep 16 18:20:48 2006
From: gypsy at iswest.com (gypsy)
Date: Sat Sep 16 18:20:56 2006
Subject: [LARTC] Re: htb traffic shaping problem
References: <20060914223226.1183944E0@outpost.ds9a.nl>
	<6.2.0.14.2.20060915193530.02eaf330@linux.sysreset.com>
Message-ID: <450C2460.44BAF0E5@iswest.com>

Bugzilla-Redirect wrote:
> 
> Yes, the output is below:
> eth0      Link encap:Ethernet  HWaddr 00:11:09:2A:A6:F6
>            inet addr:10.0.0.50  Bcast:10.0.0.255  Mask:255.255.255.0
>            UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
>            RX packets:4244867 errors:0 dropped:0 overruns:0 frame:0
>            TX packets:1306632 errors:0 dropped:0 overruns:0 carrier:0
>            collisions:0 txqueuelen:1000
>            RX bytes:3898905509 (3.6 GiB)  TX bytes:1756030081 (1.6 GiB)
>            Interrupt:19

Try a "quantum 1514" then; that is correct for an ethernet device with
an MTU of 1500.

Perhaps reading the source code will give a clue about MPU and MTU? 
Frankly, I'd set it to whatever works as long as the rest of the status
info looks right and not give a damn that it is huge.
--
gypsy
From william.bohannan at spidersat.net  Sat Sep 16 20:08:27 2006
From: william.bohannan at spidersat.net (William Bohannan)
Date: Sat Sep 16 20:09:02 2006
Subject: [LARTC] process id with firewall and tc
In-Reply-To: <200609161617.17131.simonl@parknet.dk>
Message-ID: <004101c6d9bb$233d4ed0$fa010a0a@william>

Thanks Simon.  That helps out heaps.  Going to use what you said and use
monit.

Kind Regards

William


-----Original Message-----
From: Simon Lodal [mailto:simonl@parknet.dk] 
Sent: 16 September 2006 14:17
To: lartc@mailman.ds9a.nl
Cc: William Bohannan
Subject: Re: [LARTC] process id with firewall and tc


Routing, firewalling and shaping run in kernel and has no pid. Instead you
can 
get/set /proc flags, and check for the presence of certain data structures.

/proc/sys/net/ipv4/ip_forward is the routing master switch. If 0, the
machine 
forwards nothing. You can both set and get the value, should be relatively 
easy from a web page. Beware that setting it to 1 may reset other /proc keys

to default values.

For iptables firewalling you probably need to check if your rules are loaded

or not, a script parsing 'iptables -nL' output could do it. Or you could use

a condition match "enabled" in the beginning of each table, and drop all 
traffic if the condition is false. The /proc/net/ipt_condition/enabled value

can then be read and set as a master switch from the web page.

Shaping has no /proc files, and no way to create a master switch, so you
need 
a script that parses 'tc qdisc show dev eth0' or 'tc class show dev eth0' 
output.


Regards,
Simon


On Saturday 16 September 2006 15:38, William Bohannan wrote:
> Not sure this is the correct place to post this but I am looking to have
> status of the firewall and traffic control (active, disabled, stopped etc)
> on a webpage controlled via something like pid as the machine has many
> things running on it, like firewall, traffic control, data collection for
> graphing the traffic flows, as well as other services like squid etc.  Any
> ideas would be most helpful.
>
>
>
> Kind Regards
>
>
>
> William

From alex at zoomnet.ro  Sat Sep 16 20:39:19 2006
From: alex at zoomnet.ro (Alexandru Dragoi)
Date: Sat Sep 16 20:39:25 2006
Subject: [LARTC] Performance problem on a linux bridge used for shaping.
Message-ID: <450C44D7.5090301@zoomnet.ro>

Hello,

Here is the situation. There is a machine with 3 intel gigabit card, 2
of them on PCI-X and in bridge, the 3rd is used only for management
access. The machine is a dual Xeon 2.8GHz with HT. With 2.6.8 kernel
from debian (testing) and htb with u32 on, i usually get about 30-40%
software interrupts on CPU0 and CPU2, and without htb and u32, 10% less.
Now, if I boot with 2.6.17.9 kernel, first all irqs are on same CPU. I
managed with smp_afinity to "move" irq of one card to a different CPU.
In these circumstances, I have about 20% or a little less soft
interrupts on each CPU without shaping, but about 60-70% os soft
interrupts with shapping, and sometimes there is packet loss, also
dropped packets are shown on ifconfig. The htb script is same. I have
u32 performance counters enabled on u32 in 2.6.17.9. I also have NAPI,
of course. I can't think on anything else that can cause the problem,
but seem to be something in the kernel. Here is the output of lspci:

# lspci
0000:00:00.0 Host bridge: Intel Corporation E7320 Memory Controller Hub
(rev 0a)
0000:00:00.1 ff00: Intel Corporation E7320 Error Reporting Registers
(rev 0a)
0000:00:02.0 PCI bridge: Intel Corporation E7525/E7520/E7320 PCI Express
Port A (rev 0a)
0000:00:03.0 PCI bridge: Intel Corporation E7525/E7520/E7320 PCI Express
Port A1 (rev 0a)
0000:00:1c.0 PCI bridge: Intel Corporation 6300ESB 64-bit PCI-X Bridge
(rev 02)
0000:00:1d.0 USB Controller: Intel Corporation 6300ESB USB Universal
Host Controller (rev 02)
0000:00:1d.1 USB Controller: Intel Corporation 6300ESB USB Universal
Host Controller (rev 02)
0000:00:1d.4 System peripheral: Intel Corporation 6300ESB Watchdog Timer
(rev 02)
0000:00:1d.5 PIC: Intel Corporation 6300ESB I/O Advanced Programmable
Interrupt Controller (rev 02)
0000:00:1d.7 USB Controller: Intel Corporation 6300ESB USB2 Enhanced
Host Controller (rev 02)
0000:00:1e.0 PCI bridge: Intel Corporation 82801 PCI Bridge (rev 0a)
0000:00:1f.0 ISA bridge: Intel Corporation 6300ESB LPC Interface
Controller (rev 02)
0000:00:1f.2 IDE interface: Intel Corporation 6300ESB SATA Storage
Controller (rev 02)
0000:00:1f.3 SMBus: Intel Corporation 6300ESB SMBus Controller (rev 02)
0000:03:02.0 Ethernet controller: Intel Corporation 82544EI Gigabit
Ethernet Controller (Copper) (rev 02)
0000:03:03.0 Ethernet controller: Intel Corporation 82544EI Gigabit
Ethernet Controller (Copper) (rev 02)
0000:04:02.0 VGA compatible controller: ATI Technologies Inc Rage XL
(rev 27)
0000:04:03.0 Ethernet controller: Intel Corporation 82541GI Gigabit
Ethernet Controller (rev 05)

The traffic is somewhere at 40kpps of traffic and 120mbit up,
120mbit/down. Suggestions about better hardware and kernel, or links
with docs about these are really welcomed.

Bye

From acid_burn at x-privat.org  Sat Sep 16 22:57:52 2006
From: acid_burn at x-privat.org (Gianluca "acid_burn" D'Andrea)
Date: Sat Sep 16 22:58:10 2006
Subject: [LARTC] Wondershaper Errors
Message-ID: <450C6550.2020101@x-privat.org>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi all!

when I activate wondershaper on my dsl connection (pppoa vc mux), i get
three errors:

# sh -x  /usr/sbin/wshaper ppp0
+ /usr/sbin/xmlstarter setenv tc_downlink
+ DOWNLINK=
+ /usr/sbin/xmlstarter setenv tc_uplink
+ UPLINK=
+ [ -z  ]
+ cat /proc/avalanche/avsar_modem_stats
+ grep Connection Rate
+ awk {printf("%d", $8)}
+ DOWNLINK=1504
+ [ -z  ]
+ cat /proc/avalanche/avsar_modem_stats
+ grep Connection Rate
+ awk {printf("%d", $4)}
+ UPLINK=320
+ DEV=ppp0
+ /usr/sbin/xmlstarter setenv tc_hipriohostsrc
+ HIPRIOHOSTSRC=
+ /usr/sbin/xmlstarter setenv tc_hipriohostdst
+ HIPRIOHOSTDST=
+ /usr/sbin/xmlstarter setenv tc_hiprioportsrc
+ HIPRIOPORTSRC=
+ /usr/sbin/xmlstarter setenv tc_hiprioportdst
+ HIPRIOPORTDST=
+ /usr/sbin/xmlstarter setenv tc_nopriohostsrc
+ NOPRIOHOSTSRC=
+ /usr/sbin/xmlstarter setenv tc_nopriohostdst
+ NOPRIOHOSTDST=
+ /usr/sbin/xmlstarter setenv tc_noprioportsrc
+ NOPRIOPORTSRC=
+ /usr/sbin/xmlstarter setenv tc_noprioportdst
+ NOPRIOPORTDST=
+ [ ppp0 = status ]
+ [ ppp0 = stop ]
+ tc qdisc del dev ppp0 root
+ tc qdisc del dev ppp0 ingress
+ tc qdisc add dev ppp0 root handle 1: htb default 20
+ tc class add dev ppp0 parent 1: classid 1:1 htb rate 320kbit burst 6k
+ tc class add dev ppp0 parent 1:1 classid 1:10 htb rate 320kbit burst
6k prio 1+ tc class add dev ppp0 parent 1:1 classid 1:20 htb rate
288kbit burst 6k prio 2+ tc class add dev ppp0 parent 1:1 classid 1:30
htb rate 256kbit burst 6k prio 2+ tc qdisc add dev ppp0 parent 1:10
handle 10: sfq perturb 10
RTNETLINK answers: Invalid argument             <----- 1'st error ------
+ tc qdisc add dev ppp0 parent 1:20 handle 20: sfq perturb 10
RTNETLINK answers: Invalid argument             <----- 2'nd error ------
+ tc qdisc add dev ppp0 parent 1:30 handle 30: sfq perturb 10
RTNETLINK answers: Invalid argument             <----- 3'rd error ------
+ tc filter add dev ppp0 parent 1:0 protocol ip prio 10 u32 match ip tos
0x10 0xff flowid 1:10
+ tc filter add dev ppp0 parent 1:0 protocol ip prio 10 u32 match ip
protocol 1 0xff flowid 1:10
+ tc filter add dev ppp0 parent 1: protocol ip prio 10 u32 match ip
protocol 6 0xff match u8 0x05 0x0f at 0 match u16 0x0000 0xffc0 at 2
match u8 0x10 0xff at 33 flowid 1:10
+ tc filter add dev ppp0 parent 1: protocol ip prio 18 u32 match ip dst
0.0.0.0/0 flowid 1:20
+ tc qdisc add dev ppp0 handle ffff: ingress
+ tc filter add dev ppp0 parent ffff: protocol ip prio 50 u32 match ip
src 0.0.0.0/0 police rate 1504kbit burst 10k drop flowid :1

why?
thanks in advance
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)

iD8DBQFFDGVPGiBkJr7gM94RAhcMAJ91kpFDlj8vGYtIauglJSoNDSq7YACfUGJ5
A82gL7g8xWxroSI2ohne4+g=
=J9nc
-----END PGP SIGNATURE-----


From simonl at parknet.dk  Sat Sep 16 23:17:41 2006
From: simonl at parknet.dk (Simon Lodal)
Date: Sat Sep 16 23:17:48 2006
Subject: [LARTC] Performance problem on a linux bridge used for shaping.
In-Reply-To: <450C44D7.5090301@zoomnet.ro>
References: <450C44D7.5090301@zoomnet.ro>
Message-ID: <200609162317.41872.simonl@parknet.dk>


I have similar hardware, load and trouble.

Interrupts are only sent to one cpu, instead of all of them, because that was 
only overhead. I think the default was changed somewhere around 2.6.10 
or .12, but I have forgotten the url.

There is a CONFIG_IRQBALANCE option in the kernel, but last time I checked 
(2.6.16) it did not work very well; almost never does anything. So I have 
turned it off. I use the userspace irqbalance daemon that periodically sets 
the smp_affinity's, with the effect that ingoing and outgoing traffic are 
handled by each their cpu (assuming that no other interrupts or processes are 
significant). That helps some. But we only shape in one direction, and it can 
not help spread the shaping load between the CPU's.

There is also an acpi_irq_balance kernel parameter (not related to the kernel 
irq balancer), which apparently uses the APIC to do interrupt round-robin. It 
worked surprisingly well (perfect, actually) on an old dual celeron that I 
tested; the network interrupts are spread nicely and evenly across the cpu's. 
It is probably very chipset dependent, and I have not yet tested it on the 
firewalls.

But as I understand from this:
http://vger.kernel.org/~davem/cgi-bin/blog.cgi/2006/09/14#netconf2006_day2
it might not even be an advantage, since the current shaping code would just 
make the cpu's step on each others toes.


Regards,
Simon


On Saturday 16 September 2006 20:39, Alexandru Dragoi wrote:
> Hello,
>
> Here is the situation. There is a machine with 3 intel gigabit card, 2
> of them on PCI-X and in bridge, the 3rd is used only for management
> access. The machine is a dual Xeon 2.8GHz with HT. With 2.6.8 kernel
> from debian (testing) and htb with u32 on, i usually get about 30-40%
> software interrupts on CPU0 and CPU2, and without htb and u32, 10% less.
> Now, if I boot with 2.6.17.9 kernel, first all irqs are on same CPU. I
> managed with smp_afinity to "move" irq of one card to a different CPU.
> In these circumstances, I have about 20% or a little less soft
> interrupts on each CPU without shaping, but about 60-70% os soft
> interrupts with shapping, and sometimes there is packet loss, also
> dropped packets are shown on ifconfig. The htb script is same. I have
> u32 performance counters enabled on u32 in 2.6.17.9. I also have NAPI,
> of course. I can't think on anything else that can cause the problem,
> but seem to be something in the kernel. Here is the output of lspci:
>
> # lspci
> 0000:00:00.0 Host bridge: Intel Corporation E7320 Memory Controller Hub
> (rev 0a)
> 0000:00:00.1 ff00: Intel Corporation E7320 Error Reporting Registers
> (rev 0a)
> 0000:00:02.0 PCI bridge: Intel Corporation E7525/E7520/E7320 PCI Express
> Port A (rev 0a)
> 0000:00:03.0 PCI bridge: Intel Corporation E7525/E7520/E7320 PCI Express
> Port A1 (rev 0a)
> 0000:00:1c.0 PCI bridge: Intel Corporation 6300ESB 64-bit PCI-X Bridge
> (rev 02)
> 0000:00:1d.0 USB Controller: Intel Corporation 6300ESB USB Universal
> Host Controller (rev 02)
> 0000:00:1d.1 USB Controller: Intel Corporation 6300ESB USB Universal
> Host Controller (rev 02)
> 0000:00:1d.4 System peripheral: Intel Corporation 6300ESB Watchdog Timer
> (rev 02)
> 0000:00:1d.5 PIC: Intel Corporation 6300ESB I/O Advanced Programmable
> Interrupt Controller (rev 02)
> 0000:00:1d.7 USB Controller: Intel Corporation 6300ESB USB2 Enhanced
> Host Controller (rev 02)
> 0000:00:1e.0 PCI bridge: Intel Corporation 82801 PCI Bridge (rev 0a)
> 0000:00:1f.0 ISA bridge: Intel Corporation 6300ESB LPC Interface
> Controller (rev 02)
> 0000:00:1f.2 IDE interface: Intel Corporation 6300ESB SATA Storage
> Controller (rev 02)
> 0000:00:1f.3 SMBus: Intel Corporation 6300ESB SMBus Controller (rev 02)
> 0000:03:02.0 Ethernet controller: Intel Corporation 82544EI Gigabit
> Ethernet Controller (Copper) (rev 02)
> 0000:03:03.0 Ethernet controller: Intel Corporation 82544EI Gigabit
> Ethernet Controller (Copper) (rev 02)
> 0000:04:02.0 VGA compatible controller: ATI Technologies Inc Rage XL
> (rev 27)
> 0000:04:03.0 Ethernet controller: Intel Corporation 82541GI Gigabit
> Ethernet Controller (rev 05)
>
> The traffic is somewhere at 40kpps of traffic and 120mbit up,
> 120mbit/down. Suggestions about better hardware and kernel, or links
> with docs about these are really welcomed.
>
> Bye
>
> _______________________________________________
> LARTC mailing list
> LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
From gypsy at iswest.com  Sun Sep 17 05:55:21 2006
From: gypsy at iswest.com (gypsy)
Date: Sun Sep 17 05:55:30 2006
Subject: [LARTC] Wondershaper Errors
References: <450C6550.2020101@x-privat.org>
Message-ID: <450CC729.E332C12F@iswest.com>

Gianluca \"acid_burn\" D'Andrea wrote:
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Hi all!
> 
> when I activate wondershaper on my dsl connection (pppoa vc mux), i get
> three errors:
> 
> # sh -x  /usr/sbin/wshaper ppp0
> + /usr/sbin/xmlstarter setenv tc_downlink
> + DOWNLINK=
> + /usr/sbin/xmlstarter setenv tc_uplink
> + UPLINK=
> + [ -z  ]
> + cat /proc/avalanche/avsar_modem_stats
> + grep Connection Rate
> + awk {printf("%d", $8)}
> + DOWNLINK=1504
> + [ -z  ]
> + cat /proc/avalanche/avsar_modem_stats
> + grep Connection Rate
> + awk {printf("%d", $4)}
> + UPLINK=320
> + DEV=ppp0
> + /usr/sbin/xmlstarter setenv tc_hipriohostsrc
> + HIPRIOHOSTSRC=
> + /usr/sbin/xmlstarter setenv tc_hipriohostdst
> + HIPRIOHOSTDST=
> + /usr/sbin/xmlstarter setenv tc_hiprioportsrc
> + HIPRIOPORTSRC=
> + /usr/sbin/xmlstarter setenv tc_hiprioportdst
> + HIPRIOPORTDST=
> + /usr/sbin/xmlstarter setenv tc_nopriohostsrc
> + NOPRIOHOSTSRC=
> + /usr/sbin/xmlstarter setenv tc_nopriohostdst
> + NOPRIOHOSTDST=
> + /usr/sbin/xmlstarter setenv tc_noprioportsrc
> + NOPRIOPORTSRC=
> + /usr/sbin/xmlstarter setenv tc_noprioportdst
> + NOPRIOPORTDST=
> + [ ppp0 = status ]
> + [ ppp0 = stop ]
> + tc qdisc del dev ppp0 root
> + tc qdisc del dev ppp0 ingress
> + tc qdisc add dev ppp0 root handle 1: htb default 20
> + tc class add dev ppp0 parent 1: classid 1:1 htb rate 320kbit burst 6k
> + tc class add dev ppp0 parent 1:1 classid 1:10 htb rate 320kbit burst
> 6k prio 1+ tc class add dev ppp0 parent 1:1 classid 1:20 htb rate
> 288kbit burst 6k prio 2+ tc class add dev ppp0 parent 1:1 classid 1:30
> htb rate 256kbit burst 6k prio 2+ tc qdisc add dev ppp0 parent 1:10
> handle 10: sfq perturb 10
> RTNETLINK answers: Invalid argument             <----- 1'st error ------
> + tc qdisc add dev ppp0 parent 1:20 handle 20: sfq perturb 10
> RTNETLINK answers: Invalid argument             <----- 2'nd error ------
> + tc qdisc add dev ppp0 parent 1:30 handle 30: sfq perturb 10
> RTNETLINK answers: Invalid argument             <----- 3'rd error ------

It looks like you don't have sfq.  Check your kernel config and
/lib/modules/$VERSION/net/sched/sch_sfq.o since sfq is normally built as
a module.

tc needs sfq too.
--
gypsy
From e1605project at hotmail.com  Sun Sep 17 11:56:14 2006
From: e1605project at hotmail.com (*~ r a K u ~ *)
Date: Sun Sep 17 11:56:26 2006
Subject: [LARTC] HTB and HFSC,declaration tc command question
Message-ID: <BAY123-F2465A136BB1435F6FCEB20DD2C0@phx.gbl>

An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060917/d149fd10/attachment.htm
From e1605project at hotmail.com  Sun Sep 17 13:22:26 2006
From: e1605project at hotmail.com (*~ r a K u ~ *)
Date: Sun Sep 17 13:22:36 2006
Subject: [LARTC] How to make burst traffic? such ICMP and real time traffic
Message-ID: <BAY123-F15590BC6FF4EED190A288FDD2C0@phx.gbl>

An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060917/e4fc07dc/attachment.html
From alex at zoomnet.ro  Sun Sep 17 18:33:53 2006
From: alex at zoomnet.ro (Alexandru Dragoi)
Date: Sun Sep 17 18:34:01 2006
Subject: [LARTC] Performance problem on a linux bridge used for shaping.
In-Reply-To: <200609162317.41872.simonl@parknet.dk>
References: <450C44D7.5090301@zoomnet.ro>
	<200609162317.41872.simonl@parknet.dk>
Message-ID: <450D78F1.4010608@zoomnet.ro>

Simon Lodal wrote:

>I have similar hardware, load and trouble.
>
>Interrupts are only sent to one cpu, instead of all of them, because that was 
>only overhead. I think the default was changed somewhere around 2.6.10 
>or .12, but I have forgotten the url.
>
>There is a CONFIG_IRQBALANCE option in the kernel, but last time I checked 
>(2.6.16) it did not work very well; almost never does anything. So I have 
>turned it off. I use the userspace irqbalance daemon that periodically sets 
>the smp_affinity's, with the effect that ingoing and outgoing traffic are 
>handled by each their cpu (assuming that no other interrupts or processes are 
>significant). That helps some. But we only shape in one direction, and it can 
>not help spread the shaping load between the CPU's.
>
>There is also an acpi_irq_balance kernel parameter (not related to the kernel 
>irq balancer), which apparently uses the APIC to do interrupt round-robin. It 
>worked surprisingly well (perfect, actually) on an old dual celeron that I 
>tested; the network interrupts are spread nicely and evenly across the cpu's. 
>It is probably very chipset dependent, and I have not yet tested it on the 
>firewalls.
>
>But as I understand from this:
>http://vger.kernel.org/~davem/cgi-bin/blog.cgi/2006/09/14#netconf2006_day2
>it might not even be an advantage, since the current shaping code would just 
>make the cpu's step on each others toes.
>
>
>Regards,
>Simon
>
>
>On Saturday 16 September 2006 20:39, Alexandru Dragoi wrote:
>  
>
>>Hello,
>>
>>Here is the situation. There is a machine with 3 intel gigabit card, 2
>>of them on PCI-X and in bridge, the 3rd is used only for management
>>access. The machine is a dual Xeon 2.8GHz with HT. With 2.6.8 kernel
>>from debian (testing) and htb with u32 on, i usually get about 30-40%
>>software interrupts on CPU0 and CPU2, and without htb and u32, 10% less.
>>Now, if I boot with 2.6.17.9 kernel, first all irqs are on same CPU. I
>>managed with smp_afinity to "move" irq of one card to a different CPU.
>>In these circumstances, I have about 20% or a little less soft
>>interrupts on each CPU without shaping, but about 60-70% os soft
>>interrupts with shapping, and sometimes there is packet loss, also
>>dropped packets are shown on ifconfig. The htb script is same. I have
>>u32 performance counters enabled on u32 in 2.6.17.9. I also have NAPI,
>>of course. I can't think on anything else that can cause the problem,
>>but seem to be something in the kernel. Here is the output of lspci:
>>
>># lspci
>>0000:00:00.0 Host bridge: Intel Corporation E7320 Memory Controller Hub
>>(rev 0a)
>>0000:00:00.1 ff00: Intel Corporation E7320 Error Reporting Registers
>>(rev 0a)
>>0000:00:02.0 PCI bridge: Intel Corporation E7525/E7520/E7320 PCI Express
>>Port A (rev 0a)
>>0000:00:03.0 PCI bridge: Intel Corporation E7525/E7520/E7320 PCI Express
>>Port A1 (rev 0a)
>>0000:00:1c.0 PCI bridge: Intel Corporation 6300ESB 64-bit PCI-X Bridge
>>(rev 02)
>>0000:00:1d.0 USB Controller: Intel Corporation 6300ESB USB Universal
>>Host Controller (rev 02)
>>0000:00:1d.1 USB Controller: Intel Corporation 6300ESB USB Universal
>>Host Controller (rev 02)
>>0000:00:1d.4 System peripheral: Intel Corporation 6300ESB Watchdog Timer
>>(rev 02)
>>0000:00:1d.5 PIC: Intel Corporation 6300ESB I/O Advanced Programmable
>>Interrupt Controller (rev 02)
>>0000:00:1d.7 USB Controller: Intel Corporation 6300ESB USB2 Enhanced
>>Host Controller (rev 02)
>>0000:00:1e.0 PCI bridge: Intel Corporation 82801 PCI Bridge (rev 0a)
>>0000:00:1f.0 ISA bridge: Intel Corporation 6300ESB LPC Interface
>>Controller (rev 02)
>>0000:00:1f.2 IDE interface: Intel Corporation 6300ESB SATA Storage
>>Controller (rev 02)
>>0000:00:1f.3 SMBus: Intel Corporation 6300ESB SMBus Controller (rev 02)
>>0000:03:02.0 Ethernet controller: Intel Corporation 82544EI Gigabit
>>Ethernet Controller (Copper) (rev 02)
>>0000:03:03.0 Ethernet controller: Intel Corporation 82544EI Gigabit
>>Ethernet Controller (Copper) (rev 02)
>>0000:04:02.0 VGA compatible controller: ATI Technologies Inc Rage XL
>>(rev 27)
>>0000:04:03.0 Ethernet controller: Intel Corporation 82541GI Gigabit
>>Ethernet Controller (rev 05)
>>
>>The traffic is somewhere at 40kpps of traffic and 120mbit up,
>>120mbit/down. Suggestions about better hardware and kernel, or links
>>with docs about these are really welcomed.
>>
>>Bye
>>
>>_______________________________________________
>>LARTC mailing list
>>LARTC@mailman.ds9a.nl
>>http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
>>    
>>
Somebody recomended me to use Gigabit Intel dual port and kernel 2.6.9,
because some distrubutions stopped at 2.6.9. Now, if things changed on
SMP since 2.6.10 or 2.6.12, I believe those distributions (perhaps some
Redhat and CentOS) know what are they doing.
From Yongle_Lai at pmc-sierra.com  Mon Sep 18 04:01:50 2006
From: Yongle_Lai at pmc-sierra.com (Yongle Lai)
Date: Mon Sep 18 04:03:50 2006
Subject: [LARTC] Re: tc is giving an error: RTNETLINK answers: File exists
Message-ID: <11276430CDF33142AE0DB4B33845FF76A0D636@sjc1exm06.pmc-sierra.bc.ca>

=20
Since handle xxxx:0000 represents QDISC, so in the handle 1:76, the =
QDISC ID is 1:0, that's the reason.

Yongle
=20
-----Original Message-----
From: lartc-bounces@mailman.ds9a.nl =
[mailto:lartc-bounces@mailman.ds9a.nl] On Behalf Of =
lartc-request@mailman.ds9a.nl
Sent: 2006=C4=EA9=D4=C216=C8=D5 18:00
To: lartc@mailman.ds9a.nl
Subject: LARTC Digest, Vol 19, Issue 19

Send LARTC mailing list submissions to
	lartc@mailman.ds9a.nl

To subscribe or unsubscribe via the World Wide Web, visit
	http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
or, via email, send a message with subject or body 'help' to
	lartc-request@mailman.ds9a.nl

You can reach the person managing the list at
	lartc-owner@mailman.ds9a.nl

When replying, please edit your Subject line so it is more specific =
than "Re: Contents of LARTC digest..."


Today's Topics:

   1. Re: tc is giving an error: RTNETLINK answers: File exists
      (fourcentsshy)
   2. Re: Re: htb traffic shaping problem (Bugzilla-Redirect)


----------------------------------------------------------------------

Message: 1
Date: Fri, 15 Sep 2006 12:47:53 -0700
From: fourcentsshy <fourcentsshy@velotech.net>
Subject: Re: [LARTC] tc is giving an error: RTNETLINK answers: File
	exists
To: gypsy <gypsy@iswest.com>, lartc <lartc@mailman.ds9a.nl>
Message-ID: <1158349674.7896.34.camel@glyph.velotech.net>
Content-Type: text/plain

On Thu, 2006-09-14 at 21:36 -0700, gypsy wrote:
> fourcentsshy wrote:
> >=20
> > Hello,
> >=20
> > I'm using tc to limit the bandwidth of our wireless customers. I=20
> > have a working script, but I'm not happy with it. I'm trying to=20
> > write a more sophisticated script, but when I run it, it give me =
this error:
> >=20
> > RTNETLINK answers: File exists
> >=20
> > I have no idea what this error means or how to fix it.
>=20
> It means pretty much what it says.  There is already a record =
matching=20
> closely enough that it is duplicated.
>=20

That is what puzzles me the most. If you look at the script, I create =
the root qdisc, add a class to it and when I try to add a qdisc to that =
class on the first iteration in the loop, I get the error right off. =
The script also deletes all qdiscs, classes and filters before it =
creates any new ones. On the first iteration of the loop, the handle is =
1:76 with it's parent 1:1, which should be unique, since it's only the =
second qdisc created.

As Leigh Sharpe suggested, I had already inserted echo statements into =
the script so I could examine what was really going on. For this =
device, the error takes place on the third command. the command =
sequence take place like this:

/sbin/tc qdisc add dev eth5 root handle 1: cbq bandwidth 1600Kbit\  =
cell 8 avpkt 1000 mpu 64=20

/sbin/tc class add dev eth5 parent 1: classid 1:1 est 1sec 8sec cbq\  =
bandwidth 1600Kbit rate 1500kbit allot 1514 maxburst 20 avpkt 1000\  =
prio 0 bounded isolated=20

/sbin/tc qdisc add dev eth5 parent 1:1 handle 1:76 cbq\  bandwidth =
1600Kbit cell 8 avpkt 1000 mpu 64 RTNETLINK answers: File exists

Like I said, I start by resetting all the devices on the machine, so =
there is no possible way there can be any existing qdisc with a handle =
of 1:76 for that device, yet I get the error anyway. The script is =
setup as a service to be run at startup, so checking the status after =
running the script for that device, I get this:

[qdisc - eth5]                 =20
qdisc cbq 1: rate 1600Kbit (bounded,isolated) prio no-transmit  Sent =
139719 bytes 181 pkt (dropped 0, overlimits 0 requeues 0)  rate 0bit =
0pps backlog 0b 0p requeues 0
  borrowed 0 overactions 0 avgidle 5120 undertime 0
------------------------       =20
                               =20
[class - eth5]                 =20
class cbq 1:11 parent 1:1 leaf 8236: rate 700000bit prio 2  Sent 13814 =
bytes 42 pkt (dropped 0, overlimits 0 requeues 0)  rate 11792bit 4pps =
backlog 0b 0p requeues 0
  borrowed 0 overactions 0 avgidle 306884 undertime 0 class cbq 1: root =
rate 100000Kbit (bounded,isolated) prio no-transmit  Sent 60 bytes 1 =
pkt (dropped 0, overlimits 0 requeues 0)  rate 0bit 0pps backlog 0b 0p =
requeues 0
  borrowed 0 overactions 0 avgidle 81 undertime 0 class cbq 1:10 parent =
1:1 leaf 8235: rate 750000bit prio 1  Sent 6712 bytes 48 pkt (dropped =
0, overlimits 0 requeues 0)  rate 2008bit 2pps backlog 0b 0p requeues 0
  borrowed 0 overactions 0 avgidle 148506 undertime 0 class cbq 1:1 =
parent 1: rate 800000bit (bounded,isolated) prio no-transmit  Sent =
20526 bytes 90 pkt (dropped 0, overlimits 0 requeues 0)  rate 13800bit =
7pps backlog 0b 0p requeues 0
  borrowed 0 overactions 0 avgidle 57889 undertime 0 class cbq 1:12 =
parent 1:1 leaf 8237: rate 700000bit prio 3  Sent 0 bytes 0 pkt =
(dropped 0, overlimits 0 requeues 0)  rate 0bit 0pps backlog 0b 0p =
requeues 0
  borrowed 0 overactions 0 avgidle 329838 undertime 0

Maybe I'm blind, but I don't see any qdisc or class with a handle of =
1:76. Something else is wrong, but I don't see it.

> > Here is a portion
> > of the script (the whole script shapes several interfaces):
> >=20
> > IDEV=3D'eth5'
> > TC=3D'/sbin/tc'
> > IPS=3D'/etc/sysconfig/shaper/shape.ips'
> > # high priority destination ports - I'll fill these in later (when=20
> > this # thing works) HIGHPORT=3D # low priority destination ports=20
> > LOWPORT=3D
> >=20
> > $TC qdisc add dev $IDEV root handle 1: cbq bandwidth 1600Kbit cell=20
> > 8\ avpkt 1000 mpu 64 $TC class add dev $IDEV parent 1: classid 1:1=20
> > est 1sec 8sec cbq\  bandwidth 1600Kbit rate 1500kbit allot 1514=20
> > maxburst 20 avpkt 1000\  prio 0 bounded isolated
> >=20
> > cat $IPS | sed -e 's/#.*$//; s/^ *$//;' | while read IP RATE =
STATUS; do
> >     if [ "x$IP" =3D=3D "x" ]; then
> >         continue
> >     fi
> >=20
> > # I use the last byte of the customer's IP's for the handle, which=20
> > range # from 76 to 135 ATM.
> >=20
> >     HANDLE=3D"${IP##*.}"
> >=20
> > # I get the error from the next line. Because it fails to create =
the=20
> > # qdisc all the rest fail too.
> >=20
> >     $TC qdisc add dev $IDEV parent 1:1 handle 1:$HANDLE cbq\ =20
> > bandwidth 1600Kbit cell 8 avpkt 1000 mpu 64
> >=20
> >     $TC class add dev $IDEV parent 1:$HANDLE classid $HANDLE:\  est =

> > 1sec 8sec cbq bandwidth 1600Kbit rate ${RATE}kbit allot 1514\ =20
> > maxburst 20 avpkt 1000 prio 1 bounded isolated
> >     $TC class add dev $IDEV parent $HANDLE: classid $HANDLE:1\  est =

> > 1sec 8sec cbq bandwidth 1600Kbit rate ${RATE}kbit allot 1514\ =20
> > maxburst 20 avpkt 1000 prio 2
> >     $TC class add dev $IDEV parent $HANDLE: classid $HANDLE:2 est=20
> > 1sec\  8sec cbq bandwidth 1600Kbit rate $[9*$RATE/10]kbit allot=20
> > 1514\  maxburst 20 avpkt 1000 prio 3
> >     $TC class add dev $IDEV parent $HANDLE: classid $HANDLE:3 est=20
> > 1sec\  8sec cbq bandwidth 1600Kbit rate $[8*$RATE/10]kbit allot=20
> > 1514\  maxburst 20 avpkt 1000 prio 4
> >     $TC qdisc add dev $IDEV parent $HANDLE:1 sfq quantum 1514b\ =20
> > perturb 15
> >     $TC qdisc add dev $IDEV parent $HANDLE:2 sfq quantum 1514b\ =20
> > perturb 15
> >     $TC qdisc add dev $IDEV parent $HANDLE:3 sfq quantum 1514b\ =20
> > perturb 15
> >     $TC filter add dev $IDEV parent 1: protocol ip prio 16\
> >  u32 match ip src $IP flowid $HANDLE:
> >     $TC filter add dev $IDEV parent $HANDLE: protocol ip prio 10\
> >  u32 match ip tos 0x10 0xff flowid $HANDLE:1
> >     $TC filter add dev $IDEV parent $HANDLE: protocol ip prio 11\
> >  u32 match ip protocol 1 0xff flowid $HANDLE:1
> >     $TC filter add dev $IDEV parent $HANDLE: protocol ip prio 12\
> >  u32 match ip protocol 6 0xff match u8 0x05 0x0f at 0 match u16\ =20
> > 0x0000 0xffc0 at 2 flowid $HANDLE:1
> >=20
> >     for a in $HIGHPORT; do
> >         $TC filter add dev $IDEV parent 1:0 protocol ip prio 14\
> >  u32 match ip dport $a 0xffff flowid $HANDLE:1
> >     done
> >     for a in $LOWPORT; do
> >         $TC filter add dev $IDEV parent 1:0 protocol ip prio 16\
> >  u32 match ip dport $a 0xffff flowid $HANDLE:3
> >     done
> >     $TC filter add dev $IDEV parent 1:0 protocol ip prio 15\
> >  u32 match ip dst 0.0.0.0/0 flowid $HANDLE:2 done
> >=20
> > There are bound to other problems with this script, but until I can =

> > get past the current one, I'm dead in the water. TIA
>=20
> You do not say which line or lines is causing the error so this is a=20
> guess.

I inserted a comment in the script that points out which command causes =
the error. It's the first command inside the loop.=20

>=20
> Run `tc -s filter show dev $IDEV' sending the output to a file =
because=20
> there will be a lot of it.  I think you will find a ton of =
"duplicate"
> filters.

I inserted an exit statement right after the command that give the =
error. The script never gets to the statements that creates the =
filters.
Checking the status of the service would display the filters along with =
the qdiscs and classes, but there are none.

>=20
> Set prio to the same value (16 or 10 perhaps) for each and every line =

> in your `$TC filter' lines.

If I ever get this script working, I'll do that. ;-)




------------------------------

Message: 2
Date: Fri, 15 Sep 2006 19:38:36 -0600
From: Bugzilla-Redirect <bugzilla@sysreset.com>
Subject: Re: [LARTC] Re: htb traffic shaping problem
To: lartc@mailman.ds9a.nl
Message-ID: <6.2.0.14.2.20060915193530.02eaf330@linux.sysreset.com>
Content-Type: text/plain; charset=3D"iso-8859-1"; format=3Dflowed

Yes, the output is below:
eth0      Link encap:Ethernet  HWaddr 00:11:09:2A:A6:F6
           inet addr:10.0.0.50  Bcast:10.0.0.255  Mask:255.255.255.0
           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
           RX packets:4244867 errors:0 dropped:0 overruns:0 frame:0
           TX packets:1306632 errors:0 dropped:0 overruns:0 carrier:0
           collisions:0 txqueuelen:1000
           RX bytes:3898905509 (3.6 GiB)  TX bytes:1756030081 (1.6 GiB)
           Interrupt:19

And from ethtool:
Settings for eth0:
         Supported ports: [ MII ]
         Supported link modes:   10baseT/Half 10baseT/Full
                                 100baseT/Half 100baseT/Full
                                 1000baseT/Full
         Supports auto-negotiation: Yes
         Advertised link modes:  10baseT/Half 10baseT/Full
                                 100baseT/Half 100baseT/Full
                                 1000baseT/Full
         Advertised auto-negotiation: Yes
         Speed: 1000Mb/s
         Duplex: Full
         Port: MII
         PHYAD: 1
         Transceiver: external
         Auto-negotiation: on
         Supports Wake-on: g
         Wake-on: d
         Link detected: yes

Thanks.
-Ryan Power

At 04:32 PM 9/14/2006, you wrote:
>Hi,
>
>could you check the mtu set on eth0 with an ifconfig?
>I tried my own setup and it works fine...
>
>
>Regards,
>
>Eric Janz
>Departamento de Sistemas
>Grupo Barcel=A8=AE Viajes



------------------------------

_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc


End of LARTC Digest, Vol 19, Issue 19
*************************************
From e1605project at hotmail.com  Mon Sep 18 06:40:28 2006
From: e1605project at hotmail.com (*~ r a K u ~ *)
Date: Mon Sep 18 06:40:36 2006
Subject: [LARTC] HTB and HFSC tc commandd syntax question
Message-ID: <BAY123-F283915DA9911F440CEDB8ADD2D0@phx.gbl>

An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060918/88be80f1/attachment.htm
From lists at andyfurniss.entadsl.com  Mon Sep 18 15:30:14 2006
From: lists at andyfurniss.entadsl.com (Andy Furniss)
Date: Mon Sep 18 15:30:16 2006
Subject: [LARTC] HTB shaping problem
In-Reply-To: <61e536f90609131357k3c74aabcw4cfaa7ae04bf126d@mail.gmail.com>
References: <61e536f90609131357k3c74aabcw4cfaa7ae04bf126d@mail.gmail.com>
Message-ID: <450E9F66.5090207@andyfurniss.entadsl.com>

f00ty wrote:
> Hi all !
> 
> I'm building a network appliance whose goals are to enhance Voip
> quality on 512/128k DSL links. But, i have a voice quality problem,
> and i think i'm doing something wrong, but i can't find what. Please
> excuse my terrible english, i'm french.
> 
>> From what i've read, tc is the tool i need. I read the documentations,
> 
> readmes and lartc.org howto, and came to the following setup:
> 
> NA = Linux-based network appliance (in fact a standard PC)
> 
> A--[Switch]--[eth1 NA eth0]--[DSL modem]
> 
> A = 1 pc and 1 ip phone on a 192.168.0.0/24 network
> on the other side, the DSL modem is a bridge-type, thus i have my
> internet ip on the NA  eth0 interface.
> The DSL modem is actually a 15Mbit/1024Kbit ATM, but i want to limit
> the upload to 128Kbit/s, to test the Voip thing.

You can patch for accurate atm rates - it may be in kernel/for hfsc 
aswell one day.

http://ace-host.stuart.id.au/russell/files/tc/tc-atm/

You can also make htb more accurate if you change a define in 
net/sched/sched_htb.c - HYSTERESIS 0.

If you don't patch you will need to set the sum of rates/ceils to well 
below 1024 (if that's showtime rate).

> 
> My plan:
> 
> HTB qdisc with overall rate at 128kbit, and 2 classes, one with prio 1
> (for VoIP) and one with prio 2 (For other data), each of them rated a
> 1kbit/s and ceiled at 128kbit/s. And, on top of this, SFQ qdiscs for
> fairness.
> 
> So :
> 
> $TC qdisc add dev eth0 root handle 1: htb default 3

It's best not to use default on eth when shaping for some other 
bottleneck, that way arp and other eth frames get let through unshaped 
by htb. You should use tc/iptables to send unmatched/classified IP to 
your own default class.

> $TC class add dev eth0 parent 1: classid 1:1 htb rate 128kbit burst 6k
> $TC class add dev eth0 parent 1:1 classid 1:2 htb quantum 1600 rate
> 1kbit ceil 128kbit  prio 1

It will be better to give rate 127kbit to the rt traffic.

> $TC qdisc add dev eth0 parent 1:2 handle 2: sfq perturb 10

I would use bfifo for rt and think about queue length, though an rt 
class usually shouldn't be backlogged.

Andy.
From acid_burn at x-privat.org  Mon Sep 18 15:36:59 2006
From: acid_burn at x-privat.org (acid_burn@x-privat.org)
Date: Mon Sep 18 15:37:18 2006
Subject: [LARTC] jdg-qos & DSL
Message-ID: <hfvp7svfmekaf0m.180920061536@mail.x-privat.org>

hi all!

i have a dsl connection with 1280 kbps for downstream and 256 kbps for upstream, and i want to manage the bandwidth to give high priority to voip traffic and low priority to p2p traffic. i found the script jdg-qos. i readed on this forum (i have a dsl-g604t router with MCMCC firmware)
http://www.dslreports.com/forum/remark,16250220
that the two parameters of the jdg-qos script (DWIFLIMIT and UPIFLIMIT) must be setted a few less than the theoric dsl's downstream and upstream values (1280/256). but, how much few less?
what are the values i must assign to DWIFLIMIT and UPIFLIMIT?

thanks in advance

From lists at andyfurniss.entadsl.com  Mon Sep 18 15:38:42 2006
From: lists at andyfurniss.entadsl.com (Andy Furniss)
Date: Mon Sep 18 15:38:32 2006
Subject: [LARTC] Suggestions/Pointers on where to begin my search for
	a	solution?
In-Reply-To: <6aa4d09a0608240632q47de4e83k89f6de0eb078bdd4@mail.gmail.com>
References: <6aa4d09a0608240632q47de4e83k89f6de0eb078bdd4@mail.gmail.com>
Message-ID: <450EA162.1060703@andyfurniss.entadsl.com>

Bill Blum wrote:
> Hi-
> I'm working in the IT department of a small liberal arts university-- we're
> getting *massacred* by P2P traffic.
> 
> Informal testing/probing indicates that about 60% of our traffic from the
> dorms was P2P-- we've taken the initial step of hardlimiting the dorms 
> to no
> more than 40% of outgoing university bandwidth.  Also, we've blocked the
> 'standard' ports for KaZaa, Gnutella, etc. in our firewall/switch setup
> (Cisco Catalyst 6500 between us and the net at large)....

Would be more liberal to try and allocate bandwidth per user - Do they 
have real IPs?

> 
> However, the Powers That Be want a better, more effective solution---
> without a performance hit for the VOIP phones on campus.
> 
> Any suggestions on what part of the FM I should be reading/etc, so that I
> can make a better informed decision about how to proceed?

Well I like to think Linux Qos could do it, but can't point you any 
manual as such. Classifying traffic can be hard and will need ongoing 
maintenance, but it's doable. I have no experience with the size of 
network you have - I guess the cisco can't do anything more for you.

What to do and what you can do also depends on how much bandwidth you 
have and how many users - you wan't prio for voip, do you know how many 
voip calls your link can sustain without any other traffic.

Andy.
From lists at andyfurniss.entadsl.com  Mon Sep 18 15:48:28 2006
From: lists at andyfurniss.entadsl.com (Andy Furniss)
Date: Mon Sep 18 15:48:15 2006
Subject: [LARTC] Re: htb traffic shaping problem
In-Reply-To: <450C2460.44BAF0E5@iswest.com>
References: <20060914223226.1183944E0@outpost.ds9a.nl>	<6.2.0.14.2.20060915193530.02eaf330@linux.sysreset.com>
	<450C2460.44BAF0E5@iswest.com>
Message-ID: <450EA3AC.2010100@andyfurniss.entadsl.com>

gypsy wrote:
> Bugzilla-Redirect wrote:
> 
>>Yes, the output is below:
>>eth0      Link encap:Ethernet  HWaddr 00:11:09:2A:A6:F6
>>           inet addr:10.0.0.50  Bcast:10.0.0.255  Mask:255.255.255.0
>>           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
>>           RX packets:4244867 errors:0 dropped:0 overruns:0 frame:0
>>           TX packets:1306632 errors:0 dropped:0 overruns:0 carrier:0
>>           collisions:0 txqueuelen:1000
>>           RX bytes:3898905509 (3.6 GiB)  TX bytes:1756030081 (1.6 GiB)
>>           Interrupt:19
> 
> 
> Try a "quantum 1514" then; that is correct for an ethernet device with
> an MTU of 1500.
> 
> Perhaps reading the source code will give a clue about MPU and MTU? 
> Frankly, I'd set it to whatever works as long as the rest of the status
> info looks right and not give a damn that it is huge.

Even if ifconfig says 1500 there have been posts that say you don't get 
it with gig cards that do segmentation offload unless you can turn it 
off with ethtool.

Apologies if this has already been said as I don't have all the thread.

Andy.
From lists at andyfurniss.entadsl.com  Mon Sep 18 16:11:04 2006
From: lists at andyfurniss.entadsl.com (Andy Furniss)
Date: Mon Sep 18 16:10:48 2006
Subject: [LARTC] Rate limits whithin rate limits
In-Reply-To: <H0000069000a5a21.1157610392.mail.pacificwireless.net.au@MHS>
References: <H0000069000a5a21.1157610392.mail.pacificwireless.net.au@MHS>
Message-ID: <450EA8F8.3070800@andyfurniss.entadsl.com>

Leigh Sharpe wrote:
> Hi all,
> I'm sure I'm soing something wrong here.
> I am trying to set up a rate limit inside another rate limit.
> eg. I have a 512K rate limit on a particular VLAN. I am using an IFB so
> that packets passing through the bridge are counted at each port.(ie the
> throughput is limited to 512K, not just the traffic in one direction.)

When I tested this ages ago, it was alot bettter (for useability) to 
still keep the traffic seperate - and on top of that make big tcp second 
class.

That was with htb - I don't kow cbq but with htb you could use ceil to 
further limit traffic classes, you would still need to make sure rates 
didn't add up to more than parent - it doesn't cap children for htb. I 
don't know how accurate cbq is or how it chooses queue lengths - you 
should really specify child queues so you get to decide on q length. 
HTB/HFSC will choose a really small default on ppp/vlan IIRC IFB is 32 
so not quite as bad.

Andy.

From dpsims at dpsims.com  Mon Sep 18 17:34:15 2006
From: dpsims at dpsims.com (David Sims)
Date: Mon Sep 18 17:34:24 2006
Subject: [LARTC] Suggestions/Pointers on where to begin my search for a
	solution?
In-Reply-To: <450EA162.1060703@andyfurniss.entadsl.com>
References: <6aa4d09a0608240632q47de4e83k89f6de0eb078bdd4@mail.gmail.com>
	<450EA162.1060703@andyfurniss.entadsl.com>
Message-ID: <Pine.LNX.4.58.0609180936490.12689@linux.dpsims.com>

Hi,

On Mon, 18 Sep 2006, Andy Furniss wrote:

> Bill Blum wrote:
> > Hi-
> > I'm working in the IT department of a small liberal arts university-- we're
> > getting *massacred* by P2P traffic.
> >
> > Informal testing/probing indicates that about 60% of our traffic from the
> > dorms was P2P-- we've taken the initial step of hardlimiting the dorms
> > to no
> > more than 40% of outgoing university bandwidth.  Also, we've blocked the
> > 'standard' ports for KaZaa, Gnutella, etc. in our firewall/switch setup
> > (Cisco Catalyst 6500 between us and the net at large)....
>
> Would be more liberal to try and allocate bandwidth per user - Do they
> have real IPs?
>
> >
> > However, the Powers That Be want a better, more effective solution---
> > without a performance hit for the VOIP phones on campus.
> >
> > Any suggestions on what part of the FM I should be reading/etc, so that I
> > can make a better informed decision about how to proceed?
>
> Well I like to think Linux Qos could do it, but can't point you any
> manual as such. Classifying traffic can be hard and will need ongoing
> maintenance, but it's doable. I have no experience with the size of
> network you have - I guess the cisco can't do anything more for you.
>
> What to do and what you can do also depends on how much bandwidth you
> have and how many users - you wan't prio for voip, do you know how many
> voip calls your link can sustain without any other traffic.
>
> Andy.
>

You don't mention your ISP situation, but an approach I have had good luck
with is the classification of traffic by source and then the distribution
of that traffic over more than a single ISP connection using LARTC in
order to achieve classes of service... This is a simple approach that
doesn't preclude doing traffic shaping on one or any of your ISP links.
It also provides redundant ISP connectivity for disaster
recovery/managment.

So, you might have one ISP connection for high priority traffic (like
VoIP) along with some VIP users and a second one (perhaps nearer capacity)
for the dorms... This gets you in a situation where you can tweak the
traffic to/from the dorms without potentially disrupting more business
oriented traffic....

I have been doing it this way for a local municipality with good result
for a couple of years now. City business goes out over a 3 meg link and
the library traffic (where there is lots of public access and P2P
activity) goes out over it's own T-1 but it all runs over a common
infrastructure and is routed by a Linux router using LARTC source routing
with some traffic shaping on the T-1....

Also, Tobi Oetiker's MRTG is your friend. I run MRTG on all outbound
traffic and make the resulting graphs fairly public so peer pressure can
have some effect without requiring never ending cat and mouse with the
main abusers.... There is also a package called 'darkstat' that will
aggregate traffic statistics by 'top 25' hosts and display it for you.
This provides a good mechanism for the old 'heart-to-heart' conversation
with your abusers.... ;) In any event, a good place to start your search
for solutions might be Policy Routing Using Linux, Matthew G. Marsh, ISBN
0-672-32052-5

Dave
From anakinv7 at hotmail.com  Mon Sep 18 18:09:29 2006
From: anakinv7 at hotmail.com (Vladimir Burciaga Aguilar)
Date: Mon Sep 18 18:09:36 2006
Subject: [LARTC] Problem with Load Balancing
In-Reply-To: <4986F8D166F1E44CBA92A91C98ACAD5214CA0E@sql_server>
Message-ID: <BAY116-F4CF6218F4B0B0EECCAD7B8C2D0@phx.gbl>

>We have also set up a somewhat similar method of load balancing.  Our
>traffic is never a 50-50 split (well 3:2 is how we have it set, but it
>doesn't always get close to that), but as the load picks up, it tends to be
>closer to the actual amount.

Well, then there is not much to do about this.

>Dead gateway detection has never worked for us, and one day I'll probably
>bother other members of the LARTC group to get some help, but the method
>that we use is to check the output of the ip neighbor command.  Basically,
>if our two ISPs are 10.1.1.254 and 10.2.2.254, we run a bash script via 
>cron
>every minute that does a call something like:
>
>ETH1 = ip neigh 10.1.1.254 | egrep "REACHABLE|DELAY|PROBE|STALE" -c
>ETH2 = ip neigh 10.2.2.254 | egrep "REACHABLE|DELAY|PROBE|STALE" -c
>
>The neighbor system basically monitors ARP and if it sees a message leave 
>an
>interface without a reply after something like 3-5 seconds, it moves the
>interface to DELAY, after another few seconds it moves to PROBE and does an
>active arp request, and if that fails to work in a few seconds, it becomes
>INCOMPLETE or FAILED or just simply isn't listed.  If no data is sent 
>either
>way for a while, the entry can be marked STALE or removed.
>
>With the above lines, we get a 1 in the ETH1 or ETH2 variables if the next
>neighbor is up, and a 0 if not.  From there you can use some if scripts to
>detect if both are up, or if only one is up, which one.  In our case, if
>both are up we clear the default route and then make it something like
>
>ip route add default nexthop via 10.1.1.254 dev eth1 weight 1 \
>nexthop via 10.2.2.254 dev eth2 weight 1
>
>and if only one is up we clear it and make it :
>
>ip route add default nexthop via 10.1.1.254 dev eth1
>or
>ip route add default nexthop via 10.2.2.254 dev eth2


Ok, William, this looks like what I'm looking for. I'm going to test it and 
tell you how it works for us. By the way, about the download of a single 
file between the two conections, do you know if there is a way to do it?

Thanks for your help and time and sorry for the delay!

_________________________________________________________________
Prodigy/MSN Spaces: Tu espacio en la red http://spaces.msn.com/

From fourcentsshy at velotech.net  Mon Sep 18 22:33:18 2006
From: fourcentsshy at velotech.net (fourcentsshy)
Date: Mon Sep 18 22:33:36 2006
Subject: [LARTC] tc is giving an error: RTNETLINK answers: File exists
In-Reply-To: <450C22D8.BAABF53C@iswest.com>
References: <1158272090.7705.25.camel@glyph.velotech.net>
	<450A2DC0.4ABC84FC@iswest.com>
	<1158349674.7896.34.camel@glyph.velotech.net>
	<450C22D8.BAABF53C@iswest.com>
Message-ID: <1158611598.7714.58.camel@glyph.velotech.net>

On Sat, 2006-09-16 at 09:14 -0700, gypsy wrote:
> fourcentsshy wrote:
> > the script so I could examine what was really going on. For this device,
> > the error takes place on the third command. the command sequence take
> > place like this:
> > 
> > /sbin/tc qdisc add dev eth5 root handle 1: cbq bandwidth 1600Kbit\
> >  cell 8 avpkt 1000 mpu 64
> > 
> > /sbin/tc class add dev eth5 parent 1: classid 1:1 est 1sec 8sec cbq\
> >  bandwidth 1600Kbit rate 1500kbit allot 1514 maxburst 20 avpkt 1000\
> >  prio 0 bounded isolated
> > 
> > /sbin/tc qdisc add dev eth5 parent 1:1 handle 1:76 cbq\
> >  bandwidth 1600Kbit cell 8 avpkt 1000 mpu 64
> This says to me "cell", not "ceil".  That's a mistake.

I wish that were true. It would make this problem so much easier to
solve. The HTB classes use the ceil parameter, but CBQ qdiscs use the
cell parameter for packet transmission time calculations. The manual
says it has a reasonable default, but the working script I have didn't
shape properly until I played with it.

ATM, since I'm debugging the script, its setup to exit after the 3rd tc
command I've listed above. tc doesn't seem to care what handle I give
the second qdisc. I've tried many different handles and every time I get
the same error: 

RTNETLINK answers: File exists. 

I've even tried running those very same lines on different machines,
with different Linux distros on them. I keep getting the same error on
them as well. It would be helpful if the device let me know which file
it's talking about. The working script only adds CBQ classes to CBQ
classes. Is it possible that its forbidden to add a CBQ qdisc to a CBQ
class?

> 
> ==--snip--==

> One more thing.
> You can send your commands to a database (mysql or whatever).  Once
> disallowing duplicate records and again allowing dups.  The difference
> is the Bad Boy.

I do love mysql and work with it almost daily (great fun). I thought
about writing a customer database for the very reason you mentioned, but
dups are not the problem. I do have a working script that uses the same
resource file with no problems. It limits customer bandwidth nicely and
even uses the same method of choosing handles, but there is a minor
problem with load balancing. I'd very much like to fix that.

> 
> I use HTB not CBQ but I still think the parameter is "ceil" not "cell"
> and fixing that will help or solve.

When I first started playing with tc, I tried using HTBs because they
looked easier to work with. I couldn't get them to work, so I tried the
CBQs. They didn't work either. It turned out that one of our technicians
has installed an older version of Fedora on the gateway server and that
version of tc was broken. I upgraded it to FC4 and the script came
alive. Since the script was working, I didn't bother to switch back to
the HTBs (but I'm strongly considering doing just that). 

Thanks for your time. I guess I'll keep trying different things. 

Cheers,
William Murphy
Velocity Technologies, Inc.

From smohan at gmail.com  Tue Sep 19 04:09:51 2006
From: smohan at gmail.com (Mohan Sundaram)
Date: Tue Sep 19 04:10:08 2006
Subject: [LARTC] Suggestions/Pointers on where to begin my search	for
	asolution?
In-Reply-To: <450EA162.1060703@andyfurniss.entadsl.com>
References: <6aa4d09a0608240632q47de4e83k89f6de0eb078bdd4@mail.gmail.com>
	<450EA162.1060703@andyfurniss.entadsl.com>
Message-ID: <450F516F.1030908@vsnl.com>

Andy Furniss wrote:
> Bill Blum wrote:
>> Hi-
>> I'm working in the IT department of a small liberal arts university-- 
>> we're
>> getting *massacred* by P2P traffic.
>>
>> Informal testing/probing indicates that about 60% of our traffic from the
>> dorms was P2P-- we've taken the initial step of hardlimiting the dorms 
>> to no
>> more than 40% of outgoing university bandwidth.  Also, we've blocked the
>> 'standard' ports for KaZaa, Gnutella, etc. in our firewall/switch setup
>> (Cisco Catalyst 6500 between us and the net at large)....
> 
One way of doing this is to use a Linux machine in between and use ipp2p
netfilter plugin to identify P2P traffic. Even if we shut out standard
ports, these apps work on commonly used ports like 80,110,25 etc. :-(

You can rate limit using ipp2p or mark packets using ipp2p and then
shape that traffic using tc.

Mohan

From bugzilla at sysreset.com  Tue Sep 19 04:42:07 2006
From: bugzilla at sysreset.com (Bugzilla-Redirect)
Date: Tue Sep 19 04:42:17 2006
Subject: [LARTC] Re: htb traffic shaping problem
In-Reply-To: <450EA3AC.2010100@andyfurniss.entadsl.com>
References: <20060914223226.1183944E0@outpost.ds9a.nl>
	<6.2.0.14.2.20060915193530.02eaf330@linux.sysreset.com>
	<450C2460.44BAF0E5@iswest.com>
	<450EA3AC.2010100@andyfurniss.entadsl.com>
Message-ID: <6.2.0.14.2.20060918204013.031a9e18@linux.sysreset.com>

I was not aware that segmentation offloading would cause a problem... and I 
do believe it's on.

I think I'll just stuck with the high mtu for the moment then, as I would 
rather have the CPU savings
then more accurate traffic controlling.

Thanks.
-Ryan Power

At 07:48 AM 9/18/2006, Andy Furniss wrote:
>gypsy wrote:
>>Bugzilla-Redirect wrote:
>>
>>>Yes, the output is below:
>>>eth0      Link encap:Ethernet  HWaddr 00:11:09:2A:A6:F6
>>>           inet addr:10.0.0.50  Bcast:10.0.0.255  Mask:255.255.255.0
>>>           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
>>>           RX packets:4244867 errors:0 dropped:0 overruns:0 frame:0
>>>           TX packets:1306632 errors:0 dropped:0 overruns:0 carrier:0
>>>           collisions:0 txqueuelen:1000
>>>           RX bytes:3898905509 (3.6 GiB)  TX bytes:1756030081 (1.6 GiB)
>>>           Interrupt:19
>>
>>Try a "quantum 1514" then; that is correct for an ethernet device with
>>an MTU of 1500.
>>Perhaps reading the source code will give a clue about MPU and MTU? 
>>Frankly, I'd set it to whatever works as long as the rest of the status
>>info looks right and not give a damn that it is huge.
>
>Even if ifconfig says 1500 there have been posts that say you don't get it 
>with gig cards that do segmentation offload unless you can turn it off 
>with ethtool.
>
>Apologies if this has already been said as I don't have all the thread.
>
>Andy.

From Yongle_Lai at pmc-sierra.com  Tue Sep 19 08:12:59 2006
From: Yongle_Lai at pmc-sierra.com (Yongle Lai)
Date: Tue Sep 19 08:13:17 2006
Subject: [LARTC] Re: tc is giving an error: RTNETLINK answers: File exists
Message-ID: <11276430CDF33142AE0DB4B33845FF76A0D63F@sjc1exm06.pmc-sierra.bc.ca>

 
Hi Fourcentsshy,

  1. After the 1st command is executed, there is a QDISC: 1:0
      After the 2nd command is executed, there is a CLASS: 1;1 (CLASS and QDISC have different namespace)
      After the 3td command is executed, request for creating QDISC: 1:0 failed since there is a QDISC with the handle 1:0 already.
              You could try handle 2:0 in the 3td command. You need care that handle 1:76 equal to 1:0, QDISC just uses the higher 2 bytes.

  2. I have tried the 3 commands which you gived. If I replace 1:76 with 2:0, the 3 commands could be executed successfully.

  3. The parameters ceil and cell are right for each QDISC. For HTB, tc would calculate the cell according to other parameters because PKT_SCHED need 
      cell. So for different QDISC, TC need different parameters.

Bests,
Yongle Lai
     
-----Original Message-----

Message: 8
Date: Mon, 18 Sep 2006 13:33:18 -0700
From: fourcentsshy <fourcentsshy@velotech.net>
Subject: Re: [LARTC] tc is giving an error: RTNETLINK answers: File
	exists
To: gypsy <gypsy@iswest.com>, lartc <lartc@mailman.ds9a.nl>
Message-ID: <1158611598.7714.58.camel@glyph.velotech.net>
Content-Type: text/plain

On Sat, 2006-09-16 at 09:14 -0700, gypsy wrote:
> fourcentsshy wrote:
> > the script so I could examine what was really going on. For this 
> > device, the error takes place on the third command. the command 
> > sequence take place like this:
> > 
> > /sbin/tc qdisc add dev eth5 root handle 1: cbq bandwidth 1600Kbit\  
> > cell 8 avpkt 1000 mpu 64
> > 
> > /sbin/tc class add dev eth5 parent 1: classid 1:1 est 1sec 8sec cbq\  
> > bandwidth 1600Kbit rate 1500kbit allot 1514 maxburst 20 avpkt 1000\  
> > prio 0 bounded isolated
> > 
> > /sbin/tc qdisc add dev eth5 parent 1:1 handle 1:76 cbq\  bandwidth 
> > 1600Kbit cell 8 avpkt 1000 mpu 64
> This says to me "cell", not "ceil".  That's a mistake.

I wish that were true. It would make this problem so much easier to solve. The HTB classes use the ceil parameter, but CBQ qdiscs use the cell parameter for packet transmission time calculations. The manual says it has a reasonable default, but the working script I have didn't shape properly until I played with it.

ATM, since I'm debugging the script, its setup to exit after the 3rd tc command I've listed above. tc doesn't seem to care what handle I give the second qdisc. I've tried many different handles and every time I get the same error: 

RTNETLINK answers: File exists. 

I've even tried running those very same lines on different machines, with different Linux distros on them. I keep getting the same error on them as well. It would be helpful if the device let me know which file it's talking about. The working script only adds CBQ classes to CBQ classes. Is it possible that its forbidden to add a CBQ qdisc to a CBQ class?

> 
> ==--snip--==

> One more thing.
> You can send your commands to a database (mysql or whatever).  Once 
> disallowing duplicate records and again allowing dups.  The difference 
> is the Bad Boy.

I do love mysql and work with it almost daily (great fun). I thought about writing a customer database for the very reason you mentioned, but dups are not the problem. I do have a working script that uses the same resource file with no problems. It limits customer bandwidth nicely and even uses the same method of choosing handles, but there is a minor problem with load balancing. I'd very much like to fix that.

> 
> I use HTB not CBQ but I still think the parameter is "ceil" not "cell"
> and fixing that will help or solve.

When I first started playing with tc, I tried using HTBs because they looked easier to work with. I couldn't get them to work, so I tried the CBQs. They didn't work either. It turned out that one of our technicians has installed an older version of Fedora on the gateway server and that version of tc was broken. I upgraded it to FC4 and the script came alive. Since the script was working, I didn't bother to switch back to the HTBs (but I'm strongly considering doing just that). 

Thanks for your time. I guess I'll keep trying different things. 

Cheers,
William Murphy
Velocity Technologies, Inc.
From rvokal at redhat.com  Tue Sep 19 13:00:03 2006
From: rvokal at redhat.com (Radek =?ISO-8859-1?Q?Vok=E1l?=)
Date: Tue Sep 19 13:04:04 2006
Subject: [LARTC] Hardcoded /usr/lib dir
Message-ID: <1158663603.3062.21.camel@localhost.localdomain>

tc.c has the following line
	
snprintf(buf, sizeof(buf), "/usr/lib/tc/q_%s.so", str);

the libdir should not be hardcoded but it should be detected at build
time.

Radek



-- 
Radek Vok?l <rvokal@redhat.com>
Base OS Engineering             

Office: +420 543 422 235
Red Hat Inc.                               http://www.redhat.com

From safin.timur at gmail.com  Tue Sep 19 13:42:18 2006
From: safin.timur at gmail.com (=?KOI8-R?B?9MnN1dIg88HGyc4=?=)
Date: Tue Sep 19 13:42:25 2006
Subject: [LARTC] how to setup massive traffic shaping? (2 class B nets)
Message-ID: <a460eff50609190442o46c1ef9ye4a911e33c97e4cf@mail.gmail.com>

Hello
I have 2 class-B networks (172.22.0.0/16 and 172.23.0.0/16, over 130k
of ip's) and need to setup
traffic tbf shapers  with 64kb/s for each ip from 172.22.0.0/16 and
128kb/s for each ip from 172.23.0.0/16
just read lartc and don't understand how to use u32 for decreasing
number of rules and hashing
From fourcentsshy at velotech.net  Tue Sep 19 20:47:27 2006
From: fourcentsshy at velotech.net (fourcentsshy)
Date: Tue Sep 19 20:47:47 2006
Subject: [LARTC] tc is giving an error: RTNETLINK answers: File exists
In-Reply-To: <1158611598.7714.58.camel@glyph.velotech.net>
References: <1158272090.7705.25.camel@glyph.velotech.net>
	<450A2DC0.4ABC84FC@iswest.com>
	<1158349674.7896.34.camel@glyph.velotech.net>
	<450C22D8.BAABF53C@iswest.com>
	<1158611598.7714.58.camel@glyph.velotech.net>
Message-ID: <1158691647.7707.18.camel@glyph.velotech.net>

I've solved the problem. It turns out tc didn't like the sequence the
commands were in. The script was set up to create a qdisc for each
customer and attach a rate limiting class to it. It looked like this:

               1:    root qdisk
                |
               1:1   child class
               /|\
              / | \
             /  |  \
            /   |   \
          1:76 1:77 1:78... customer qdiscs
            |    |    |
           76:  77:  78:  rate limiting classes
           /|\ ...
          / | \
         /  |  \
        /   |   \
      76:1 76:2 76:3  child classes to handle load balancing

My bad. It should have looked like this:

               1:    root qdisk
                |
               1:1   child class
               /|\
              / | \
             /  |  \
            /   |   \
          1:76 1:77 1:78... customer rate limiting classes
            |    |    |
           76:  77:  78:  customer qdiscs
           /|\ ...
          / | \
         /  |  \
        /   |   \
      76:1 76:2 76:3  child classes to handle load balancing

I had rewritten the script to use HTBs, yet the same error occured.
That's when I noticed the problem with the handles. switching the 2
commands fixed it. 

From e1605projecter at yahoo.com  Wed Sep 20 08:41:09 2006
From: e1605projecter at yahoo.com (Thossapron Apinyapanha)
Date: Wed Sep 20 08:41:19 2006
Subject: [LARTC] HTB and HFSC, tc command question
Message-ID: <20060920064109.69902.qmail@web35514.mail.mud.yahoo.com>


I have a lot question about tc-command because now i'm doing research to compare performance between HTB and 
HFSC so i'm doubt a lot thing and your reply are so very helpful me ... my question is 
  
1. I'm use opensource (Mastershaper) for help to config traffic control but when i'm try to config HTB,
I'm doubt about in each chain must identify fallback service level and If i'm don't specify it,it will
unable to contain pipe. Every traffic and if traffic not matched in chain's pipe can only use the fallback
service level
  Is it only true definition in HTB tc command?? or it's only a creative function from developer??
  ps. in Mastershaper represent interior class as pipe and leaf class as chain 
  In HFSC tc command 
  fter i read HFSC paper , i'm doubt in Service curve declaration like this
  > | SC := [ [ m1 BPS ] [ d SEC ] m2 BPS
> |  
> |  m1 : slope of first segment -> umax
> |  d  : x-coordinate of intersection -> dmax
> |  m2 : slope of second segment -> rate
   
  2. In all leaf class must specify rt (realtime service curve) ??? and Is it important to specify
sc (Service curve) in all leaf class ?? and in all leaf class must specify link-sharing (ls) too??
 because i think after read HFSC theory about by default All leaf class(Service class)
will use Link-sharing critirion for allocation bandwidth from Service curve (My assumtion think this 
calculation bandwidth is "m1" or "umax" ->total bandwidth that can send at ceil rate??) and when total 
delay are exceed to "demax" or "d" -> it mean it time for HFSC to manage QoS to guarantee bandwidth and delay
in each leaf class by use Real-time Criterion so bandwidth rate will change to "m2" or bandwidth rate
that guarantee QoS in eache leaf class
 Is it true??? i fear may be misunderstand in HFSC theory,
example in my test lab ,i have leaf class 3 type such real-time ,data ,default
Can i specify 
 - real-time leaf class -> rt (for guatantee delay and bw) ,ls (by default when not exceed max delay)
 - data lead class ->  ls (by default and not delay sensitive so delay are not important)
  
3. I'm doubt in How to declaration ls, and ul about .. in thoery it a type of service curve that not
relative with real-criterion, so Delay may be not important for consider ???? 
Is it true when declaration, parameter in each service curve may be link this?
 ls [ umax BPS, rate BPS]
 ul [ umax BPS, rate BPS]
 and Is it important to declaration all of three parameter (umax,demax,rate) If three parameter
are important to setting traffic control????
   
  4. I'm try to search HFSC command example, it have a lot case but i'm doubt in service curve (sc) declaration
sometime declaration in root class, interior class, in leaf class
 so I'm not sure to understand about ls ->calculate bandwidth for interior class,root class and 
rt -> calculate bandwidth for leaf class and what about service curve(sc)??? it's specify only in root class???
   
  5. Is it true?? 
In root class, or interior class will doing with only Link-sharing criterion, so can specify declaration
only link-sharing ->ls(umax, dmax, rate) and Upperlimit ->ls(umanx,dmax,rate) it's not important to 
declaration real-time curve (rt) because in HFSC theory will use real-time criterion only Leaf class
   
  6. In HFSC, upper limit are bandwidth rate that guarantee maximum bandwidth rate in each class as ceil in 
HTB???
  6. I'm doubt about priority in HFSC, in HFSC paper telling about in support priority but in HFSC tc-command
it not specify priority in each class, So In HFSC how to manage priority class link HTB????
  
Thank you for all reply, it's so very helpful to me alot.
which all will suggest or advise me about in something i'm misunderstand 
  raku
   

 		
---------------------------------
 All-new Yahoo! Mail - Fire up a more powerful email and get things done faster.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060919/ad55059f/attachment.html
From e1605projecter at yahoo.com  Wed Sep 20 08:58:51 2006
From: e1605projecter at yahoo.com (Thossapron Apinyapanha)
Date: Wed Sep 20 08:58:56 2006
Subject: [LARTC] how to create "burst traffic"
Message-ID: <20060920065851.52312.qmail@web35507.mail.mud.yahoo.com>

some body can advise me about 
  how to create burst traffic two type is
  1. ICMP burst traffic (i need to create general and normal data burst traffic but i don't have any idea to do it)
  2. Real time traffic (i think may create by open real-time streaming with a big file from real-time server but i don't sure it will work!)
   
  thank you
   
  raku

 		
---------------------------------
Talk is cheap. Use Yahoo! Messenger to make PC-to-Phone calls.  Great rates starting at 1?/min.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060919/4ff5f93f/attachment.htm
From dor at ldc.net  Wed Sep 20 09:12:42 2006
From: dor at ldc.net (Dmytro O. Redchuk)
Date: Wed Sep 20 09:12:49 2006
Subject: [LARTC] how to create "burst traffic"
In-Reply-To: <20060920065851.52312.qmail@web35507.mail.mud.yahoo.com>
References: <20060920065851.52312.qmail@web35507.mail.mud.yahoo.com>
Message-ID: <20060920071242.GF30122@ldc.net>

On Tue, Sep 19, 2006 at 11:58:51PM -0700, Thossapron Apinyapanha wrote:
> some body can advise me about 
>   how to create burst traffic two type is
>   1. ICMP burst traffic (i need to create general and normal data burst traffic but i don't have any idea to do it)
>   2. Real time traffic (i think may create by open real-time streaming with a big file from real-time server but i don't sure it will work!)
Try packETH

>    
>   thank you
>    
>   raku

-- 
  _,-=._              /|_/|
  `-.}   `=._,.-=-._.,  @ @._,
     `._ _,-.   )      _,.-'
        `    G.m-"^m`m'        Dmytro O. Redchuk


XMMS: Frederic Chopin - Ballade No. 4 in f minor, Op. 52

From alex at zoomnet.ro  Wed Sep 20 09:57:30 2006
From: alex at zoomnet.ro (Alexandru Dragoi)
Date: Wed Sep 20 09:57:41 2006
Subject: [LARTC] how to setup massive traffic shaping? (2 class B nets)
In-Reply-To: <a460eff50609190442o46c1ef9ye4a911e33c97e4cf@mail.gmail.com>
References: <a460eff50609190442o46c1ef9ye4a911e33c97e4cf@mail.gmail.com>
Message-ID: <4510F46A.5040304@zoomnet.ro>

????? ????? wrote:
> Hello
> I have 2 class-B networks (172.22.0.0/16 and 172.23.0.0/16, over 130k
> of ip's) and need to setup
> traffic tbf shapers with 64kb/s for each ip from 172.22.0.0/16 and
> 128kb/s for each ip from 172.23.0.0/16
> just read lartc and don't understand how to use u32 for decreasing
> number of rules and hashing
> _______________________________________________
> LARTC mailing list
> LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
First you need imq. This because you can't have more than 65536 classes. 
Having 8 imqs you will be able to use 4 for download and 4 for upload. 
However You will tell us if the machine will support everything :). So 
you will divide the big class /15 into 4 classes /17

iptables -t mangle -A POSTROUTING -o $clients_eth -d 172.22.0.0/17 -j 
IMQ --todev 0

and:

tc qdisc add dev imq0 root handle 1: htb #Or whatever you use
tc class add dev imq0 parent 1: classid 1:f000 htb rate 620mbit #or 
whatever ...


tc filter add dev imq0 parent 1: protocol ip prio 5 handle 0: u32 
divisor 128
tc filter add dev imq0 parent 1: prio 5 u32 ht 800:: match ip dst 
172.22.0.0/17 hashkey mask 0x00007f00 at 16 link 0:

for i in seq `0 127` ; do
div=`printf "%x" $i`
let j=$i+1
tc filter add dev imq0 parent 1: prio 5 u32 ht 0:$div: match ip dst 
172.22.$i.0/24 hashkey mask 0x000000ff at 16 link $j:
for q in seq `0 255`; do
d=`printf "%x" $q`
clsid=$[$i*256+$q]
tc class add dev imq0 parent 1: classid 1:$clsid htb rate 128kbit
tc filter add dev imq0 parent 1: prio 5 u32 ht $j:$d match ip dst 
172.22.$i.$q flowid 1:$clsid
done
done

I hope i'm not missing something. For 172.22.128.0/17, instead of 
172.22.$i you will have 172.22.$[$i+128]
On other imq of course. For upload you just change dst with src, and "at 
16" into "at 12"


I'm really curious how it will work :D and how much it will take to run it.


From alex at zoomnet.ro  Wed Sep 20 10:09:14 2006
From: alex at zoomnet.ro (Alexandru Dragoi)
Date: Wed Sep 20 10:09:20 2006
Subject: [LARTC] how to setup massive traffic shaping? (2 class B nets)
In-Reply-To: <4510F46A.5040304@zoomnet.ro>
References: <a460eff50609190442o46c1ef9ye4a911e33c97e4cf@mail.gmail.com>
	<4510F46A.5040304@zoomnet.ro>
Message-ID: <4510F72A.2090009@zoomnet.ro>

Instead of
tc class add dev imq0 parent 1: classid 1:$clsid htb rate 128kbit

Use

tc class add dev imq0 parent 1:f000 classid 1:$clsid htb rate 128kbit

From mlistz at gmail.com  Wed Sep 20 11:50:18 2006
From: mlistz at gmail.com (Zhuang Yuyao)
Date: Wed Sep 20 11:50:24 2006
Subject: [LARTC] [HELP] Mutlicast over GRE tunnel
In-Reply-To: <4504D21E.70800@gmail.com>
References: <4504D21E.70800@gmail.com>
Message-ID: <45110EDA.1040608@gmail.com>

Hi, I sent this mail to this list several days ago but got no answer.
Any help will be appreciated.

Zhuang Yuyao wrote:
> Hi,
>
> I got a problem similar to this one 
> (http://mailman.ds9a.nl/pipermail/lartc/2005q4/017614.html), GRE 
> tunnel can forward normal IP packets such as ICMP but failed to tunnel 
> multicast traffics.
>
> Here's the setup:
>
>                        192.168.20.0/24
> LAN-A--------------RtrA-------------RtrB--------------LAN-B
>      192.168.50.0/24                     192.168.60.0/24
>
> RtrA interfaces:
> eth0 192.168.20.100
> eth1 192.168.50.1
>
> HOSTA in LAN-A
> eth0 192.168.50.250
>
> RtrB interfaces:
> eth0 192.168.20.98
> eth1 192.168.60.1
>
> HOSTB in LAN-B
> eth0 192.168.60.250
>
> Here is the setup script on RtrB:
>
>      1 #!/bin/sh
>      2
>      3 END_L=192.168.20.98
>      4 END_R=192.168.20.100
>      5 GRE_L=10.0.0.4
>      6 GRE_R=10.0.0.3
>      7 MGROUP=224.0.55.55
>      8 SUBNET_R=192.168.50.0/24
>      9
>     10 /usr/sbin/iptables -F
>     11 /usr/sbin/iptables -F -t nat
>     12 /usr/sbin/iptables -P FORWARD ACCEPT
>     13
>     14 ip tunnel del gretun
>     15 ip tunnel add gretun mode gre remote $END_R local $END_L ttl 255
>     16 ip link set gretun up multicast on
>     17 ip addr add $GRE_L peer $GRE_R/24 dev gretun
>     18
>     19 ip route del $SUBNET_R via $GRE_R
>     20 ip route add $SUBNET_R via $GRE_R
>     21
>     22 /usr/sbin/smcroute -k
>     23 /usr/sbin/smcroute -d
>     24 sleep 3
>     25 /usr/sbin/smcroute -a eth1 192.168.60.250 $MGROUP gretun
>     26 /usr/sbin/smcroute -j gretun $MGROUP
>
> and the setup script on RtrA:
>      1 #!/bin/sh
>      2
>      3 END_L=192.168.20.100
>      4 END_R=192.168.20.98
>      5 GRE_L=10.0.0.3
>      6 GRE_R=10.0.0.4
>      7 MGROUP=224.0.55.55
>      8 SUBNET_R=192.168.60.0/24
>      9
>     10 /usr/sbin/iptables -F
>     11 /usr/sbin/iptables -F -t nat
>     12 /usr/sbin/iptables -P FORWARD ACCEPT
>     13
>     14 ip tunnel del gretun
>     15 ip tunnel add gretun mode gre remote $END_R local $END_L ttl 255
>     16 ip link set gretun up multicast on
>     17 ip addr add $GRE_L peer $GRE_R/24 dev gretun
>     18
>     19 ip route del $SUBNET_R via $GRE_R
>     20 ip route add $SUBNET_R via $GRE_R
>     21
>     22 /usr/sbin/smcroute -k
>     23 /usr/sbin/smcroute -d
>     24 sleep 3
    25 /usr/sbin/smcroute -a gretun 192.168.60.250 $MGROUP eth0
    26 /usr/sbin/smcroute -j gretun $MGROUP
>
> On RtrB (while running #ping 192.168.50.250 on HOSTB):
> /usr/sbin/tcpdump -i eth0 -n
> 10:46:21.470623 IP 192.168.20.98 > 192.168.20.100: GREv0, length 88: 
> IP 192.168.60.250 > 192.168.50.250: ICMP echo request, id 44558, seq 
> 1, length 64
> 10:46:21.476843 IP 192.168.20.100 > 192.168.20.98: GREv0, length 88: 
> IP 192.168.50.250 > 192.168.60.250: ICMP echo reply, id 44558, seq 1, 
> length 64
> 10:46:22.487867 IP 192.168.20.98 > 192.168.20.100: GREv0, length 88: 
> IP 192.168.60.250 > 192.168.50.250: ICMP echo request, id 44558, seq 
> 2, length 64
> 10:46:22.491629 IP 192.168.20.100 > 192.168.20.98: GREv0, length 88: 
> IP 192.168.50.250 > 192.168.60.250: ICMP echo reply, id 44558, seq 2, 
> length 64
> 10:46:23.473064 IP 192.168.20.98 > 192.168.20.100: GREv0, length 88: 
> IP 192.168.60.250 > 192.168.50.250: ICMP echo request, id 44558, seq 
> 3, length 64
> 10:46:23.473711 IP 192.168.20.100 > 192.168.20.98: GREv0, length 88: 
> IP 192.168.50.250 > 192.168.60.250: ICMP echo reply, id 44558, seq 3, 
> length 64
> 10:46:24.452719 IP 192.168.20.98 > 192.168.20.100: GREv0, length 88: 
> IP 192.168.60.250 > 192.168.50.250: ICMP echo request, id 44558, seq 
> 4, length 64
> 10:46:24.453209 IP 192.168.20.100 > 192.168.20.98: GREv0, length 88: 
> IP 192.168.50.250 > 192.168.60.250: ICMP echo reply, id 44558, seq 4, 
> length 64
> 10:46:25.470861 IP 192.168.20.98 > 192.168.20.100: GREv0, length 88: 
> IP 192.168.60.250 > 192.168.50.250: ICMP echo request, id 44558, seq 
> 5, length 64
> 10:46:25.478632 IP 192.168.20.100 > 192.168.20.98: GREv0, length 88: 
> IP 192.168.50.250 > 192.168.60.250: ICMP echo reply, id 44558, seq 5, 
> length 64
>
> As you can see, the ICMP packets are encapsulated by GRE tunnel.
>
> Now I started to run multicast test by running "iperf -c 224.0.55.55 
> -u -T 32 -t 1000 -i 1" on HOSTB
> On RtrB:
> /usr/sbin/tcpdump -i eth0 -n
> /usr/sbin/tcpdump -i gretun -n
> both captured nothing !!!
>
> I am really confused. Any help will be appreciated!
>
> Thanks very much!
>
> Best regards,
>
>    Zhuang Yuyao
>
>
>




From chaitanya at rocsys.com  Wed Sep 20 12:35:29 2006
From: chaitanya at rocsys.com (chaitanya)
Date: Wed Sep 20 12:20:35 2006
Subject: [LARTC] Doubts regarding classifiers available.
Message-ID: <1158748527.4559.9.camel@Krishna>

Hi,
  I am a newbie working on tc tool, i want to know whether we have the
following classifiers available 

(1) source MAC address.
(2) destination MAC address.
(3) IEEE 802.1D user priority.
(4) Ethertype (IEEE 802.3, 1998 Length/Type Field).

Can any one help me in finding the help for the above classifiers.
Thanks in advance


Krishna Chaitanya

From alex at zoomnet.ro  Wed Sep 20 14:03:15 2006
From: alex at zoomnet.ro (Alexandru Dragoi)
Date: Wed Sep 20 14:03:22 2006
Subject: [LARTC] how to setup massive traffic shaping? (2 class B nets)
In-Reply-To: <a460eff50609200449oda482d6teeec44fbe04cbf2e@mail.gmail.com>
References: <a460eff50609190442o46c1ef9ye4a911e33c97e4cf@mail.gmail.com>	
	<4510F46A.5040304@zoomnet.ro>
	<a460eff50609200449oda482d6teeec44fbe04cbf2e@mail.gmail.com>
Message-ID: <45112E03.7030209@zoomnet.ro>

????? ????? wrote:
> Hello!
> yes, I no about 65000 rules and just add third interface to server. )
> what about
> tc filter add dev imq0 parent 1: prio 5 u32 ht 800:: match ip dst
> 172.22.0.0/17 hashkey mask 0x00007f00 at 16 link 0: ?
> shouldnt hashkey mask be 0x00007fff instead of 0x00007f00 ?
> and if it should be 0x00007f00 how do you calculate it?
>
>
> 2006/9/20, Alexandru Dragoi <alex@zoomnet.ro>:
>> ????? ????? wrote:
>> > Hello
>> > I have 2 class-B networks (172.22.0.0/16 and 172.23.0.0/16, over 130k
>> > of ip's) and need to setup
>> > traffic tbf shapers with 64kb/s for each ip from 172.22.0.0/16 and
>> > 128kb/s for each ip from 172.23.0.0/16
>> > just read lartc and don't understand how to use u32 for decreasing
>> > number of rules and hashing
>> > _______________________________________________
>> > LARTC mailing list
>> > LARTC@mailman.ds9a.nl
>> > http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
>> First you need imq. This because you can't have more than 65536 classes.
>> Having 8 imqs you will be able to use 4 for download and 4 for upload.
>> However You will tell us if the machine will support everything :). So
>> you will divide the big class /15 into 4 classes /17
>>
>> iptables -t mangle -A POSTROUTING -o $clients_eth -d 172.22.0.0/17 -j
>> IMQ --todev 0
>>
>> and:
>>
>> tc qdisc add dev imq0 root handle 1: htb #Or whatever you use
>> tc class add dev imq0 parent 1: classid 1:f000 htb rate 620mbit #or
>> whatever ...
>>
>>
>> tc filter add dev imq0 parent 1: protocol ip prio 5 handle 0: u32
>> divisor 128
>> tc filter add dev imq0 parent 1: prio 5 u32 ht 800:: match ip dst
>> 172.22.0.0/17 hashkey mask 0x00007f00 at 16 link 0:
>>
>> for i in seq `0 127` ; do
>> div=`printf "%x" $i`
>> let j=$i+1
>> tc filter add dev imq0 parent 1: prio 5 u32 ht 0:$div: match ip dst
>> 172.22.$i.0/24 hashkey mask 0x000000ff at 16 link $j:
>> for q in seq `0 255`; do
>> d=`printf "%x" $q`
>> clsid=$[$i*256+$q]
>> tc class add dev imq0 parent 1: classid 1:$clsid htb rate 128kbit
>> tc filter add dev imq0 parent 1: prio 5 u32 ht $j:$d match ip dst
>> 172.22.$i.$q flowid 1:$clsid
>> done
>> done
>>
>> I hope i'm not missing something. For 172.22.128.0/17, instead of
>> 172.22.$i you will have 172.22.$[$i+128]
>> On other imq of course. For upload you just change dst with src, and "at
>> 16" into "at 12"
>>
>>
>> I'm really curious how it will work :D and how much it will take to 
>> run it.
>>
>>
>>
Also, before:

tc filter add dev imq0 parent 1: prio 5 u32 ht 0:$div: match ip dst 
172.22.$i.0/24 hashkey mask 0x000000ff at 16 link $j:

Add line:

tc filter add dev imq0 parent 1: protocol ip prio 5 handle $j: u32 
divisor 256

Now, you need both download and upload, so maybe upload goes via a 
single card. Also the maximum number of divisor is 256, so a mask should 
have only 8 bits set to 1. And 0x00007f00 will match only the last 7 
bits on 3rd number on an ip address. So ip 172.22.45.2 will go, 
considering the hashkey mask, to entry (45 & 0x7f), then represented in 
hex, which is 0x23. The & means bitwise and, just how hashkey algoritm 
works. Applying the that mask to ip 172.22.173.8 will also generate 
0x23. More about these you have to do some binary operations. Means you 
will run the for loop for i in `seq 128 255`.
From safin.timur at gmail.com  Wed Sep 20 14:52:24 2006
From: safin.timur at gmail.com (=?KOI8-R?B?9MnN1dIg88HGyc4=?=)
Date: Wed Sep 20 14:52:31 2006
Subject: [LARTC] how to setup massive traffic shaping? (2 class B nets)
In-Reply-To: <45112E03.7030209@zoomnet.ro>
References: <a460eff50609190442o46c1ef9ye4a911e33c97e4cf@mail.gmail.com>
	<4510F46A.5040304@zoomnet.ro>
	<a460eff50609200449oda482d6teeec44fbe04cbf2e@mail.gmail.com>
	<45112E03.7030209@zoomnet.ro>
Message-ID: <a460eff50609200552t1777df2eq8d9d2034870cc706@mail.gmail.com>

Hello, Alexandru
I just adopt your script for B class net
is it correct?

tc qdisc add dev eth0 root handle 1: htb
tc class add dev eth0 parent 1: classid 1:f000 htb rate 620mbit


tc filter add dev eth0 parent 1: protocol ip prio 5 handle 0: u32 divisor 256
tc filter add dev eth0 parent 1: prio 5 u32 ht 800:: match ip dst
172.26.0.0/16 hashkey mask 0x0000ff00 at 16 link 0:



for i in `seq 0 255` ; do
div=`printf "%x" $i`
let j=$i+1
tc filter add dev eth0 parent 1: protocol ip prio 5 handle $j: u32 divisor 256
tc filter add dev eth0 parent 1: prio 5 u32 ht 0:$div: match ip dst
172.26.$i.0/24 hashkey mask 0x000000ff at 16 link $j:

for q in `seq 0 255` ; do
d=`printf "%x" $q`
clsid=$[$i*256+$q]
tc class add dev eth0 parent 1:f000 classid 1:$clsid htb rate 64kbit
tc filter add dev eth0 parent 1: prio 5 u32 ht $j:$d match ip dst
172.26.$i.$q flowid 1:$clsid
done
done


2006/9/20, Alexandru Dragoi <alex@zoomnet.ro>:
> ????? ????? wrote:
> > Hello!
> > yes, I no about 65000 rules and just add third interface to server. )
> > what about
> > tc filter add dev imq0 parent 1: prio 5 u32 ht 800:: match ip dst
> > 172.22.0.0/17 hashkey mask 0x00007f00 at 16 link 0: ?
> > shouldnt hashkey mask be 0x00007fff instead of 0x00007f00 ?
> > and if it should be 0x00007f00 how do you calculate it?
> >
> >
> > 2006/9/20, Alexandru Dragoi <alex@zoomnet.ro>:
> >> ????? ????? wrote:
> >> > Hello
> >> > I have 2 class-B networks (172.22.0.0/16 and 172.23.0.0/16, over 130k
> >> > of ip's) and need to setup
> >> > traffic tbf shapers with 64kb/s for each ip from 172.22.0.0/16 and
> >> > 128kb/s for each ip from 172.23.0.0/16
> >> > just read lartc and don't understand how to use u32 for decreasing
> >> > number of rules and hashing
> >> > _______________________________________________
> >> > LARTC mailing list
> >> > LARTC@mailman.ds9a.nl
> >> > http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
> >> First you need imq. This because you can't have more than 65536 classes.
> >> Having 8 imqs you will be able to use 4 for download and 4 for upload.
> >> However You will tell us if the machine will support everything :). So
> >> you will divide the big class /15 into 4 classes /17
> >>
> >> iptables -t mangle -A POSTROUTING -o $clients_eth -d 172.22.0.0/17 -j
> >> IMQ --todev 0
> >>
> >> and:
> >>
> >> tc qdisc add dev imq0 root handle 1: htb #Or whatever you use
> >> tc class add dev imq0 parent 1: classid 1:f000 htb rate 620mbit #or
> >> whatever ...
> >>
> >>
> >> tc filter add dev imq0 parent 1: protocol ip prio 5 handle 0: u32
> >> divisor 128
> >> tc filter add dev imq0 parent 1: prio 5 u32 ht 800:: match ip dst
> >> 172.22.0.0/17 hashkey mask 0x00007f00 at 16 link 0:
> >>
> >> for i in seq `0 127` ; do
> >> div=`printf "%x" $i`
> >> let j=$i+1
> >> tc filter add dev imq0 parent 1: prio 5 u32 ht 0:$div: match ip dst
> >> 172.22.$i.0/24 hashkey mask 0x000000ff at 16 link $j:
> >> for q in seq `0 255`; do
> >> d=`printf "%x" $q`
> >> clsid=$[$i*256+$q]
> >> tc class add dev imq0 parent 1: classid 1:$clsid htb rate 128kbit
> >> tc filter add dev imq0 parent 1: prio 5 u32 ht $j:$d match ip dst
> >> 172.22.$i.$q flowid 1:$clsid
> >> done
> >> done
> >>
> >> I hope i'm not missing something. For 172.22.128.0/17, instead of
> >> 172.22.$i you will have 172.22.$[$i+128]
> >> On other imq of course. For upload you just change dst with src, and "at
> >> 16" into "at 12"
> >>
> >>
> >> I'm really curious how it will work :D and how much it will take to
> >> run it.
> >>
> >>
> >>
> Also, before:
>
> tc filter add dev imq0 parent 1: prio 5 u32 ht 0:$div: match ip dst
> 172.22.$i.0/24 hashkey mask 0x000000ff at 16 link $j:
>
> Add line:
>
> tc filter add dev imq0 parent 1: protocol ip prio 5 handle $j: u32
> divisor 256
>
> Now, you need both download and upload, so maybe upload goes via a
> single card. Also the maximum number of divisor is 256, so a mask should
> have only 8 bits set to 1. And 0x00007f00 will match only the last 7
> bits on 3rd number on an ip address. So ip 172.22.45.2 will go,
> considering the hashkey mask, to entry (45 & 0x7f), then represented in
> hex, which is 0x23. The & means bitwise and, just how hashkey algoritm
> works. Applying the that mask to ip 172.22.173.8 will also generate
> 0x23. More about these you have to do some binary operations. Means you
> will run the for loop for i in `seq 128 255`.
>
From alex at zoomnet.ro  Wed Sep 20 15:01:09 2006
From: alex at zoomnet.ro (Alexandru Dragoi)
Date: Wed Sep 20 15:01:16 2006
Subject: [Fwd: Re: [LARTC] how to setup massive traffic shaping? (2 class
	B nets)]
Message-ID: <45113B95.1080400@zoomnet.ro>


-------------- next part --------------
An embedded message was scrubbed...
From: Alexandru Dragoi <alex@zoomnet.ro>
Subject: Re: [LARTC] how to setup massive traffic shaping? (2 class B nets)
Date: Wed, 20 Sep 2006 16:00:29 +0300
Size: 5708
Url: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060920/5723a6fb/LARTChowtosetupmassivetrafficshaping2classBnets.mht
From nnn at vsu.by  Wed Sep 20 16:06:15 2006
From: nnn at vsu.by (Nikolay Nikolaev)
Date: Wed Sep 20 16:05:51 2006
Subject: [LARTC] interactive traffic
Message-ID: <45114AD7.4060605@vsu.by>

Hi all.

I configure my shaper with tc help, for it I use HTB, ESFQ and IMQ for 
ingress traffic. all users work through NAT, all traffic separate 
honestly between users, but I have one problem - interactive traffic 
(i.e. view HTML pages), when somebody download anything HTML pages 
opening very slowly... What can do I, to correct this problem???

P.S. all users (their http traffic) I mark with iptables, and put it all 
in one class with ESFQ qdisc with hash type fwmark (for egress) and dst 
(for ingress)

Thank you all.
From maurizio.gladioro at gmail.com  Wed Sep 20 16:08:10 2006
From: maurizio.gladioro at gmail.com (Maurizio Gladioro)
Date: Wed Sep 20 16:08:12 2006
Subject: [LARTC] Ipp2p with connmark
Message-ID: <4ad400c20609200708k30855090l6b77d03da0575fe4@mail.gmail.com>

Hi,
I want to classify with ipp2p packets that I've captured with tcpdump.
I send the packets with tcpreply.
I had to create a bridge interface in order to enable the listening
interface in promiscous mode
and to classify the traffic mirrored to that.
In this mode the traffic pass through the prerouting chain of the mangle
table (on bridge).
I want to used connmark for recognized flows, and I see the rules for
iptables in the site of ipp2p.
These are the four rules:

01# iptables -t mangle -A PREROUTING -p tcp -j CONNMARK --restore-mark
02# iptables -t mangle -A PREROUTING -p tcp -m mark ! --mark 0 -j ACCEPT
03# iptables -t mangle -A PREROUTING -p tcp -m ipp2p --ipp2p -j MARK
--set-mark 1
04# iptables -t mangle -A PREROUTING -p tcp -m mark --mark 1 -j CONNMARK
--save-mark

But the flows that pass throught bridge are not recognized, the packets are
mark in the third rule
but no packets are accepted by second rule.
Connmark can mark flow that cross a bridge ethernet port in promisc mode?

Thank you very much, regards,
Maurizio Gladioro.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060920/8af17abd/attachment.htm
From simonl at parknet.dk  Wed Sep 20 23:30:39 2006
From: simonl at parknet.dk (Simon Lodal)
Date: Wed Sep 20 23:30:47 2006
Subject: [LARTC] how to setup massive traffic shaping? (2 class B nets)
In-Reply-To: <a460eff50609190442o46c1ef9ye4a911e33c97e4cf@mail.gmail.com>
References: <a460eff50609190442o46c1ef9ye4a911e33c97e4cf@mail.gmail.com>
Message-ID: <200609202330.39190.simonl@parknet.dk>


If you use HTB, you need to compile it with HTB_HSIZE set to at least 256 (in 
sch_htb.c). Else your CPU will be fully loaded with even a few kpps traffic.

The problem is how HTB stores the classes, not very efficient when there are 
thousands of them. I do not know if other qdiscs have the same problem.

I am working on a better patch for that, but it is not ready yet.


Regards,
Simon


On Tuesday 19 September 2006 13:42, ????? ????? wrote:
> Hello
> I have 2 class-B networks (172.22.0.0/16 and 172.23.0.0/16, over 130k
> of ip's) and need to setup
> traffic tbf shapers  with 64kb/s for each ip from 172.22.0.0/16 and
> 128kb/s for each ip from 172.23.0.0/16
> just read lartc and don't understand how to use u32 for decreasing
> number of rules and hashing
> _______________________________________________
> LARTC mailing list
> LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
From Yongle_Lai at pmc-sierra.com  Thu Sep 21 03:31:17 2006
From: Yongle_Lai at pmc-sierra.com (Yongle Lai)
Date: Thu Sep 21 03:31:29 2006
Subject: [LARTC] RE: Doubts regarding classifiers available
Message-ID: <11276430CDF33142AE0DB4B33845FF76A0D644@sjc1exm06.pmc-sierra.bc.ca>

 
Hi Krishna,

  1) If you want to classify according to MAC address, you could use iptables to mark the packet (using MARK target), but just source MAC is available for now.
  2) Usually tc just could classify by fields of IP layer and its sublayer, so I think classify by ethertype is unavailable.
  3) VLAN tag belongs to MAC layer! I'm not sure how to QoS for VLAN, can anybody give some advice?

Bests,
Yongle Lai

Hi,
  I am a newbie working on tc tool, i want to know whether we have the following classifiers available 

(1) source MAC address.
(2) destination MAC address.
(3) IEEE 802.1D user priority.
(4) Ethertype (IEEE 802.3, 1998 Length/Type Field).

Can any one help me in finding the help for the above classifiers.
Thanks in advance


Krishna Chaitanya

From J.Kraaijeveld at Askesis.nl  Thu Sep 21 08:10:57 2006
From: J.Kraaijeveld at Askesis.nl (Joost Kraaijeveld)
Date: Thu Sep 21 08:11:06 2006
Subject: [LARTC] (simple?) iptables question
Message-ID: <1158819057.361.14.camel@panoramix>

Hi,

I have a router that should do routing between 2 networks for a network
*except* if the destination is a private network *and* the source is a
specific machine, in which case it has to NAT.

I thought that this would do the trick:

....
iptables -A POSTROUTING -s 10.20.1.0/24 -d 192.168.0.0/16 -j RETURN
iptables -A POSTROUTING -s 10.20.1.1   -o eth1 -j SNAT --to-source 172.16.0.1
....

But this does not seem to work: there is never any NAT: the packets are
just routed and not NAT-ed if I ping to a non 192.168.0.0/24 address.

How can I achieve what I want???

TIA

-- 
Groeten,

Joost Kraaijeveld
Askesis B.V.
Molukkenstraat 14
6524NB Nijmegen
tel: 024-3888063 / 06-51855277
fax: 024-3608416
web: www.askesis.nl
From J.Kraaijeveld at Askesis.nl  Thu Sep 21 08:18:43 2006
From: J.Kraaijeveld at Askesis.nl (Joost Kraaijeveld)
Date: Thu Sep 21 08:18:50 2006
Subject: [LARTC] (simple?) iptables question
In-Reply-To: <1158819057.361.14.camel@panoramix>
References: <1158819057.361.14.camel@panoramix>
Message-ID: <1158819523.361.17.camel@panoramix>

On Thu, 2006-09-21 at 08:10 +0200, Joost Kraaijeveld wrote:
> I thought that this would do the trick:
> 
> ....
> iptables -A POSTROUTING -s 10.20.1.0/24 -d 192.168.0.0/16 -j RETURN
> iptables -A POSTROUTING -s 10.20.1.1   -o eth1 -j SNAT --to-source 172.16.0.1

I forgot the -t nat in the commands above.

-- 
Groeten,

Joost Kraaijeveld
Askesis B.V.
Molukkenstraat 14
6524NB Nijmegen
tel: 024-3888063 / 06-51855277
fax: 024-3608416
web: www.askesis.nl
From indunil75 at gmail.com  Thu Sep 21 11:16:34 2006
From: indunil75 at gmail.com (Indunil Jayasooriya)
Date: Thu Sep 21 11:16:41 2006
Subject: [LARTC] Fwd: Is there a way to divide one link in to two ?
In-Reply-To: <7ed6b0aa0609200403o22edaf5cq426dc0fda8efd7a9@mail.gmail.com>
References: <7ed6b0aa0609200403o22edaf5cq426dc0fda8efd7a9@mail.gmail.com>
Message-ID: <7ed6b0aa0609210216u4e5fc1b9va9dc419812edee59@mail.gmail.com>

Hi,

I want to know is there a way to divide a link in to two?

Below is what I need?

I have a 64 k link. I want to reserve 32 k for mail and 32 k for web .

That means dividing 64 k link in to two for mail and web.

Is it possible in Linux?

Can iproute or iptables haddle this situation ?

or can any other pkg do it?


-- 
Thank you
Indunil Jayasooriya
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060921/f2c63f04/attachment.html
From geraldhuet at yahoo.fr  Thu Sep 21 15:22:33 2006
From: geraldhuet at yahoo.fr (gerald HUET)
Date: Thu Sep 21 15:22:52 2006
Subject: [LARTC] layer7 http
Message-ID: <20060921132233.18024.qmail@web26507.mail.ukl.yahoo.com>

hello,

I try to use layer7 filter to classify packets. I have a proble with http match. This protocol seems to work well with l7-filter (http://l7-filter.sourceforge.net/protocols) but for me nothing is filtering in http class. Someone can help me ?
Here is my script :

#!/bin/bash

IPT_BIN=/sbin/iptables
TC_BIN=/sbin/tc
INTER_OUT=ppp0
LINK_RATE_UP=1000Kbit
RATE_ACK=200Kbit
RATE_DEFAULT=100Kbit

RATE_12=12Kbit
RATE_13=13Kbit
RATE_14=14Kbit

NB_filtre_12=1
NB_filtre_13=2
NB_filtre_14=4

PROTO_12_1=http
PROTO_13_1=skypeout
PROTO_13_2=skypetoskype
PROTO_14_1=edonkey
PROTO_14_2=gnutella
PROTO_14_3=applejuice
PROTO_14_4=bittorrent


# Delete all qdisc on $INTER_IN and $INTER_OUT
$TC_BIN qdisc del dev $INTER_IN root 2> /dev/null > /dev/null
$TC_BIN qdisc del dev $INTER_IN ingress 2> /dev/null > /dev/null
$TC_BIN qdisc del dev $INTER_OUT root 2> /dev/null > /dev/null
$TC_BIN qdisc del dev $INTER_OUT ingress 2> /dev/null > /dev/null

# Delete magle's rules
$IPT_BIN -t mangle -F
$IPT_BIN -t mangle -X
$IPT_BIN -t mangle -Z

########################
# TC Rules
########################

# initRules
$TC_BIN qdisc add dev $INTER_OUT handle 1: root htb default 1
$TC_BIN class add dev $INTER_OUT parent 1: classid 1:1 htb rate $LINK_RATE_UP
$TC_BIN filter add dev $INTER_OUT parent 1:0 protocol all u32 match u32 0 0 classid 1:1
## BuildInChains
$TC_BIN class add dev $INTER_OUT parent 1:1 classid 1:11 htb rate $LINK_RATE_UP ceil $LINK_RATE_UP quantum 1532

NUM_file=12
NB_class=$NB_file
while [ $NB_class -ge 0 ]
do
    PRIO=$((5-$NB_class))
    
    case $NUM_file in 
    12)
        RATE_PIPE=$RATE_12
    ;;
    13)
        RATE_PIPE=$RATE_13
    ;;
    14)
        RATE_PIPE=$RATE_14
    ;;
    esac

    $TC_BIN class add dev $INTER_OUT parent 1:11 classid 1:$NUM_file htb rate $RATE_PIPE ceil $LINK_RATE_UP prio $PRIO quantum 1532
    $TC_BIN qdisc add dev $INTER_OUT handle $NUM_file: parent 1:$NUM_file sfq
    
    NUM_file=$(($NUM_file + 1))
    NB_class=$(($NB_class - 1))
done

## default pipe
$TC_BIN class add dev $INTER_OUT parent 1:11 classid 1:199 htb rate $RATE_DEFAULT ceil $LINK_RATE_UP prio 4 quantum 1532
$TC_BIN qdisc add dev $INTER_OUT handle 199: parent 1:199 sfq


####################
# iptables rules
####################
#
# initRules
$IPT_BIN -t mangle -N ms-all
$IPT_BIN -t mangle -N ms-all-chains
$IPT_BIN -t mangle -N ms-prerouting
$IPT_BIN -t mangle -A PREROUTING -j ms-prerouting
$IPT_BIN -t mangle -A ms-prerouting -j CONNMARK --restore-mark
$IPT_BIN -t mangle -A FORWARD -o $INTER_OUT -j ms-all
$IPT_BIN -t mangle -A POSTROUTING -o $INTER_OUT -j ms-all-chains

# buildInChains
$IPT_BIN -t mangle -N ms-chain-$INTER_OUT-1:11
$IPT_BIN -t mangle -A ms-all-chains -m connmark --mark 0xc0ed4017 -j ms-chain-$INTER_OUT-1:11
$IPT_BIN -t mangle -A ms-all -o $INTER_OUT -j ms-chain-$INTER_OUT-1:11

NUM_file=12
while [ $NB_file -ge 0 ]
do
    while [ $((NB_filtre_$NUM_file)) -ge 1 ]
    do
        case $NUM_file in
        12)
            case $NB_filtre_12 in
            1)
            $IPT_BIN -t mangle -A ms-chain-$INTER_OUT-1:11 -m layer7 --l7proto $PROTO_12_1 -j CLASSIFY --set-class 1:$NUM_file
            $IPT_BIN -t mangle -A ms-chain-$INTER_OUT-1:11 -m layer7 --l7proto $PROTO_12_1 -j RETURN
            ;;
            esac
            NB_filtre_12=$(($NB_filtre_12 - 1))
        ;;
        13)
            case $NB_filtre_13 in
            1)
            $IPT_BIN -t mangle -A ms-chain-$INTER_OUT-1:11 -m layer7 --l7proto $PROTO_13_1 -j CLASSIFY --set-class 1:$NUM_file
            $IPT_BIN -t mangle -A ms-chain-$INTER_OUT-1:11 -m layer7 --l7proto $PROTO_13_1 -j RETURN
            ;;
            2)
            $IPT_BIN -t mangle -A ms-chain-$INTER_OUT-1:11 -m layer7 --l7proto $PROTO_13_2 -j CLASSIFY --set-class 1:$NUM_file
            $IPT_BIN -t mangle -A ms-chain-$INTER_OUT-1:11 -m layer7 --l7proto $PROTO_13_2 -j RETURN
            ;;
            esac
            NB_filtre_13=$(($NB_filtre_13 - 1))
        ;;
        14)
            case $NB_filtre_14 in
            1)
            $IPT_BIN -t mangle -A ms-chain-$INTER_OUT-1:11 -m layer7 --l7proto $PROTO_14_1 -j CLASSIFY --set-class 1:$NUM_file
            $IPT_BIN -t mangle -A ms-chain-$INTER_OUT-1:11 -m layer7 --l7proto $PROTO_14_1 -j RETURN
            ;;
            2)
            $IPT_BIN -t mangle -A ms-chain-$INTER_OUT-1:11 -m layer7 --l7proto $PROTO_14_2 -j CLASSIFY --set-class 1:$NUM_file
            $IPT_BIN -t mangle -A ms-chain-$INTER_OUT-1:11 -m layer7 --l7proto $PROTO_14_2 -j RETURN
            ;;
            3)
            $IPT_BIN -t mangle -A ms-chain-$INTER_OUT-1:11 -m layer7 --l7proto $PROTO_14_3 -j CLASSIFY --set-class 1:$NUM_file
            $IPT_BIN -t mangle -A ms-chain-$INTER_OUT-1:11 -m layer7 --l7proto $PROTO_14_3 -j RETURN
            ;;
            4)
            $IPT_BIN -t mangle -A ms-chain-$INTER_OUT-1:11 -m layer7 --l7proto $PROTO_14_4 -j CLASSIFY --set-class 1:$NUM_file
            $IPT_BIN -t mangle -A ms-chain-$INTER_OUT-1:11 -m layer7 --l7proto $PROTO_14_4 -j RETURN
            ;;
            esac
            NB_filtre_14=$(($NB_filtre_14 - 1))
        ;;
        esac

    done
    NUM_file=$(($NUM_file + 1))
    NB_file=$(($NB_file - 1))
done

$IPT_BIN -t mangle -A ms-chain-$INTER_OUT-1:11 -j CLASSIFY --set-class 1:199
$IPT_BIN -t mangle -A ms-chain-$INTER_OUT-1:11 -j RETURN
$IPT_BIN -t mangle -A ms-prerouting -j CONNMARK --save-mark





From gypsy at iswest.com  Thu Sep 21 16:50:13 2006
From: gypsy at iswest.com (gypsy)
Date: Thu Sep 21 16:50:27 2006
Subject: [LARTC] Fwd: Is there a way to divide one link in to two ?
References: <7ed6b0aa0609200403o22edaf5cq426dc0fda8efd7a9@mail.gmail.com>
	<7ed6b0aa0609210216u4e5fc1b9va9dc419812edee59@mail.gmail.com>
Message-ID: <4512A6A5.8E33B862@iswest.com>

Indunil Jayasooriya wrote:
> 
> Hi,
> 
> I want to know is there a way to divide a link in to two?
> 
> Below is what I need?
> 
> I have a 64 k link. I want to reserve 32 k for mail and 32 k for web .
> 
> That means dividing 64 k link in to two for mail and web.
> 
> Is it possible in Linux?
> 
> Can iproute or iptables haddle this situation ?
> 
> or can any other pkg do it?
> 
> --
> Thank you
> Indunil Jayasooriya
Yes.  I'd use HTB and "filter match" port 80 and port 25.  You can't
divide exactly half because there will be unshaped ICMP, UDP and ARP,
but those don't usually require a lot of bandwidth so just create a
default class for those that has a small rate and ceil, then subtract
the default rate from your 64 k and allocate the remainder between mail
and web.  Don't forget that the sum of rates cannot exceed (about) 95 %
of 64 k.

Also look for "policy routing" because it discusses alternatives.  There
is lots of good information.
--
gypsy
From e1605projecter at yahoo.com  Thu Sep 21 20:40:33 2006
From: e1605projecter at yahoo.com (Thossapron Apinyapanha)
Date: Thu Sep 21 20:40:37 2006
Subject: [LARTC] HFSC statistic show question
Message-ID: <20060921184033.64492.qmail@web35502.mail.mud.yahoo.com>

after i use "tc -s -d class ls dev eth0" will show statistic data about HFSC ,like this
   
  root@ubuntu:/home/shaper# tc -s -d class ls dev eth2
  class hfsc 1: root
  Sent 0 bytes 0 pkts (dropped 0, overlimits 0)
  period 24 work 13844792199226589188 bytes rtwork 20937281664 bytes level 3461036864
  class hfsc 1:11 parent 1:1 sc m1 30720Kbit d 10.0ms m2 30000bit ul m1 0bit d 0us m2 300000bit
  Sent 332564 bytes 235 pkts (dropped 0, overlimits 0)
  period 24 work 13844792199226589188 bytes rtwork 20937281664 bytes level 3461036864
  class hfsc 1:1 parent 1: sc m1 0bit d 0us m2 10000bit ul m1 0bit d 0us m2 10000Kbit
  Sent 0 bytes 0 pkts (dropped 0, overlimits 0)
  period 24 work 13844792199226589188 bytes rtwork 20937281664 bytes level 3461036864
  class hfsc 1:13 parent 1:1 ls m1 0bit d 0us m2 350000bit ul m1 0bit d 0us m2 500000bit
  Sent 84 bytes 2 pkts (dropped 0, overlimits 0)
  period 24 work 13844792199226589188 bytes rtwork 20937281664 bytes level 3461036864
  class hfsc 1:12 parent 1:1 ls m1 0bit d 0us m2 100000bit ul m1 0bit d 0us m2 300000bit
  Sent 0 bytes 0 pkts (dropped 0, overlimits 0)
  period 24 work 13844792199226589188 bytes rtwork 20937281664 bytes level 3461036864
  root@ubuntu:/home/shaper# tc -s -d qdisc ls dev eth2
  qdisc hfsc 1: default 13
  Sent 332648 bytes 237 pkts (dropped 0, overlimits 382)
  root@ubuntu:/home/shaper#
   
  but i'm doubt what is each field mean ?? such period, work ,rtwork 
  and what field are same like "rate" in HTB statistic command 
   
  thank you
   
  raku

 		
---------------------------------
Do you Yahoo!?
 Get on board. You're invited to try the new Yahoo! Mail.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060921/8bae4269/attachment.htm
From cpeterson at portnetworks.com  Fri Sep 22 06:52:44 2006
From: cpeterson at portnetworks.com (Carl Peterson)
Date: Fri Sep 22 06:14:20 2006
Subject: [LARTC] Does each filter share bandwidth in a class?
Message-ID: <200609220052.44352.cpeterson@portnetworks.com>

I want to give each user 1M of bandwidth.  With the rules below, will they 
share one Mb or will each user get 1Mb? 
I want to give each user 1M of bandwidth.  With the rules below, will they 
share one Mb or will each user get 1Mb? 
In reality there are over a thousand users, and also outbound rules, but this 
should make it simple.

# eth2 inbound maclist
tc qdisc add dev eth2 root handle 1: cbq avpkt 1000 bandwidth 100mbit
tc class add dev eth2 parent 1: classid 1:1 cbq rate 1024kbit allot 1500 prio 
5 bounded isolated
# user1
tc filter add dev eth2 parent 1: protocol ip prio 10 u32 match u16 0x0016 
0xFFFF at -14 match u32 0xB629E4D6 0xFFFFFFFF at -12 flowid 1:1
# user 2
tc filter add dev eth2 parent 1: protocol ip prio 10 u32 match u16 0x0014 
0xFFFF at -14 match u32 0xA5457120 0xFFFFFFFF at -12 flowid 1:1

Thanks,
Carl
From kaber at trash.net  Fri Sep 22 14:08:20 2006
From: kaber at trash.net (Patrick McHardy)
Date: Fri Sep 22 14:08:27 2006
Subject: [LARTC] HFSC statistic show question
In-Reply-To: <20060921184033.64492.qmail@web35502.mail.mud.yahoo.com>
References: <20060921184033.64492.qmail@web35502.mail.mud.yahoo.com>
Message-ID: <4513D234.7090000@trash.net>

Thossapron Apinyapanha wrote:
> after i use "tc -s -d class ls dev eth0" will show statistic data about HFSC ,like this
>    
>   root@ubuntu:/home/shaper# tc -s -d class ls dev eth2
>   class hfsc 1: root
>   Sent 0 bytes 0 pkts (dropped 0, overlimits 0)
>   period 24 work 13844792199226589188 bytes rtwork 20937281664 bytes level 3461036864
>   class hfsc 1:11 parent 1:1 sc m1 30720Kbit d 10.0ms m2 30000bit ul m1 0bit d 0us m2 300000bit
>   Sent 332564 bytes 235 pkts (dropped 0, overlimits 0)
>   period 24 work 13844792199226589188 bytes rtwork 20937281664 bytes level 3461036864
>   class hfsc 1:1 parent 1: sc m1 0bit d 0us m2 10000bit ul m1 0bit d 0us m2 10000Kbit
>   Sent 0 bytes 0 pkts (dropped 0, overlimits 0)
>   period 24 work 13844792199226589188 bytes rtwork 20937281664 bytes level 3461036864
>   class hfsc 1:13 parent 1:1 ls m1 0bit d 0us m2 350000bit ul m1 0bit d 0us m2 500000bit
>   Sent 84 bytes 2 pkts (dropped 0, overlimits 0)
>   period 24 work 13844792199226589188 bytes rtwork 20937281664 bytes level 3461036864
>   class hfsc 1:12 parent 1:1 ls m1 0bit d 0us m2 100000bit ul m1 0bit d 0us m2 300000bit
>   Sent 0 bytes 0 pkts (dropped 0, overlimits 0)
>   period 24 work 13844792199226589188 bytes rtwork 20937281664 bytes level 3461036864
>   root@ubuntu:/home/shaper# tc -s -d qdisc ls dev eth2
>   qdisc hfsc 1: default 13
>   Sent 332648 bytes 237 pkts (dropped 0, overlimits 382)
>   root@ubuntu:/home/shaper#
>    
>   but i'm doubt what is each field mean ?? such period, work ,rtwork 
>   and what field are same like "rate" in HTB statistic command 

You're using a broken version of iproute (well, actually the kernel is
broken, but a new iproute fixes it).

The statistics mean:

period: number of times the class went to active state (no packets
queued -> packets queued)
work: number of bytes handled by real-time and link-sharing criteria
rtwork: number of bytes handled by real-time criterion
level: level in the class hierarchy

When using only linear service curves "m2" is the equivalent to rate.
From lists at andyfurniss.entadsl.com  Sat Sep 23 16:55:01 2006
From: lists at andyfurniss.entadsl.com (Andy Furniss)
Date: Sat Sep 23 16:51:51 2006
Subject: [LARTC] RE: Doubts regarding classifiers available
In-Reply-To: <11276430CDF33142AE0DB4B33845FF76A0D644@sjc1exm06.pmc-sierra.bc.ca>
References: <11276430CDF33142AE0DB4B33845FF76A0D644@sjc1exm06.pmc-sierra.bc.ca>
Message-ID: <45154AC5.4080404@andyfurniss.entadsl.com>

Yongle Lai wrote:
>  
> Hi Krishna,
> 
>   1) If you want to classify according to MAC address, you could use iptables to mark the packet (using MARK target), but just source MAC is available for now.
>   2) Usually tc just could classify by fields of IP layer and its sublayer, so I think classify by ethertype is unavailable.
>   3) VLAN tag belongs to MAC layer! I'm not sure how to QoS for VLAN, can anybody give some advice?
> 
> Bests,
> Yongle Lai
> 
> Hi,
>   I am a newbie working on tc tool, i want to know whether we have the following classifiers available 
> 
> (1) source MAC address.
> (2) destination MAC address.
> (3) IEEE 802.1D user priority.
> (4) Ethertype (IEEE 802.3, 1998 Length/Type Field).
> 
> Can any one help me in finding the help for the above classifiers.
> Thanks in advance

tc filter protocol is ethertype most examples use ip you can use number 
or all, arp etc.

You can also match protocol at -2 with u32/u16.
You do the same for macs with mac of target machine 00:C1:26:0F:04:AD.

tc filter add dev eth0 protocol ip parent 12: prio 1 u32 \
match u16 0x00c1 0xffff at -14 \
match u32 0x260f04ad 0xffffffff at -12 \
flowid X:Y

User priority - you'll need to tcpdump -eXX and work out what offsets work.

Andy.
From lists at andyfurniss.entadsl.com  Sat Sep 23 17:06:24 2006
From: lists at andyfurniss.entadsl.com (Andy Furniss)
Date: Sat Sep 23 17:03:03 2006
Subject: [LARTC] Doubts regarding classifiers available.
In-Reply-To: <1158748527.4559.9.camel@Krishna>
References: <1158748527.4559.9.camel@Krishna>
Message-ID: <45154D70.7000800@andyfurniss.entadsl.com>

chaitanya wrote:
> Hi,
>   I am a newbie working on tc tool, i want to know whether we have the
> following classifiers available 
> 
> (1) source MAC address.
> (2) destination MAC address.
> (3) IEEE 802.1D user priority.
> (4) Ethertype (IEEE 802.3, 1998 Length/Type Field).
> 
> Can any one help me in finding the help for the above classifiers.
> Thanks in advance

tc filter protocol is ethertype most examples use ip you can use a 
number or all, arp etc. You need a different prio for each type.

You can also match protocol at -2 with u32/u16.
You do the same for macs with mac of target machine 00:C1:26:0F:04:AD.

tc filter add dev eth0 protocol ip parent 12: prio 1 u32 \
match u16 0x00c1 0xffff at -14 \
match u32 0x260f04ad 0xffffffff at -12 \
flowid X:Y

User priority - you'll need to tcpdump -eXX and work out what offsets work.

Andy.




> 
> 
> Krishna Chaitanya
> 
> _______________________________________________
> LARTC mailing list
> LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
> 

From lists at andyfurniss.entadsl.com  Sat Sep 23 17:10:05 2006
From: lists at andyfurniss.entadsl.com (Andy Furniss)
Date: Sat Sep 23 17:06:43 2006
Subject: [LARTC] HTB and per-connection bandwidth allocation
In-Reply-To: <c76c7bb70609140155n5f255993ydaad1d761d966c9b@mail.gmail.com>
References: <c76c7bb70609140155n5f255993ydaad1d761d966c9b@mail.gmail.com>
Message-ID: <45154E4D.1030300@andyfurniss.entadsl.com>

Namitha Rao wrote:
> Hi
> 
> http://mailman.ds9a.nl/pipermail/lartc/2002q3/004977.html
> 
> I have the same problem to discuss as in the above link. I want to allocate
> say X MBit per individual connection regardless of  the number of 
> connection
> . KIndly could anyonen suggest me how to proceed.
> I have tried with SFq but is doesnot yeild my requirement..
> 
> Thanks,
> Namitha.

If you can't think of a way to turn a connection into a class then 
search the archive for perflow - someone once started a qdisc to do this.

Andy.
From e1605projecter at yahoo.com  Sun Sep 24 15:39:00 2006
From: e1605projecter at yahoo.com (Thossapron Apinyapanha)
Date: Sun Sep 24 15:39:07 2006
Subject: [LARTC] HFSC parameter
Message-ID: <20060924133900.42854.qmail@web35515.mail.mud.yahoo.com>

My problem with HFSC tc command is ... 
tc command's HFSC have a lot parameter with 4 curve type

SC curve -> umax dmax rate
LS curve -> umax dmax rate
RT curve -> umax dmax rate
UL curve -> umax dmax rate

so i'dont know which parameter are appropriate for my test case
such real time class which curve are appropriate and good working result.

my assumption about umax,dmax,rate ... this is true
first, HFSC will doing with "umax" rate but after delay exceed "dmax" rate,
HFSC will change rate to "rate" ????

Can everybody tell me all 12 parameter ,what does it mean????

thank you

raku
 		
---------------------------------
 All-new Yahoo! Mail - Fire up a more powerful email and get things done faster.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060924/53ce218f/attachment.html
From wtm at harbec.com  Sun Sep 24 20:18:30 2006
From: wtm at harbec.com (William T Mullaney)
Date: Sun Sep 24 20:18:43 2006
Subject: [LARTC] Problem with Load Balancing
Message-ID: <4986F8D166F1E44CBA92A91C98ACAD5214CDFB@sql_server>

To my knowledge, there is no way to download one file from two different
connections connected to two different ISPs at the same time.  If you are
running BGP then you might be able to load balance across the two links, but
that would require your upstream providers to allow you to use it, and
possibly the purchase of a public AS number an IP address space depending on
the setup.  If you are doing NAT past this link (IE both of your lines go
two the same ISP and same address blocks, but they want to give you 2x 10mb
links for 20mb total), then you can look at doing load balancing on layer 2
(Fast EtherChannel, bonding, Link Aggregate Groups, whatever), or creating 2
PPP style links between the computers and using a routing protocol like
OSPF, EIGRP (but not on Linux) or something.  I believe OSPF does equal cost
load balancing, BGP and EIGRP can, I think, do unequal cost load balancing.
But either way, I don't think that's the solution in your case.

The only other option I can think of would be some sort of software that
sends every other packet to a different IP or something, which would need to
run at the end you are downloading at or maybe at your ISPs, but I can't
think of anything like that.

-Will

-----Original Message-----
From: Vladimir Burciaga Aguilar [mailto:anakinv7@hotmail.com] 
Sent: Monday, September 18, 2006 12:09 PM
To: lartc@mailman.ds9a.nl
Subject: RE: [LARTC] Problem with Load Balancing

>We have also set up a somewhat similar method of load balancing.  Our
>traffic is never a 50-50 split (well 3:2 is how we have it set, but it
>doesn't always get close to that), but as the load picks up, it tends to be
>closer to the actual amount.

[snip]
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060924/e74d0151/attachment.htm
From raju at linux-delhi.org  Sun Sep 24 20:48:51 2006
From: raju at linux-delhi.org (Raj Mathur)
Date: Sun Sep 24 20:49:29 2006
Subject: [LARTC] Problem with Load Balancing
In-Reply-To: <4986F8D166F1E44CBA92A91C98ACAD5214CDFB@sql_server>
References: <4986F8D166F1E44CBA92A91C98ACAD5214CDFB@sql_server>
Message-ID: <17686.54035.541845.641604@mail.linux-delhi.org>

>>>>> "William" == William T Mullaney <William> writes:

    William> To my knowledge, there is no way to download one file
    William> from two different connections connected to two different
    William> ISPs at the same time.  If you are running BGP then you
    William> might be able to load balance across the two links, but
    William> that would require your upstream providers to allow you
    William> to use it, and possibly the purchase of a public AS
    William> number an IP address space depending on the setup.  If
    William> you are doing NAT past this link (IE both of your lines
    William> go two the same ISP and same address blocks, but they
    William> want to give you 2x 10mb links for 20mb total), then you
    William> can look at doing load balancing on layer 2 (Fast
    William> EtherChannel, bonding, Link Aggregate Groups, whatever),
    William> or creating 2 PPP style links between the computers and
    William> using a routing protocol like OSPF, EIGRP (but not on
    William> Linux) or something.  I believe OSPF does equal cost load
    William> balancing, BGP and EIGRP can, I think, do unequal cost
    William> load balancing.  But either way, I don't think that's the
    William> solution in your case.

    William> The only other option I can think of would be some sort
    William> of software that sends every other packet to a different
    William> IP or something, which would need to run at the end you
    William> are downloading at or maybe at your ISPs, but I can't
    William> think of anything like that.

Wouldn't some download manager software that splits the file up into
multiple simultaneous downloads do the trick?  Agreed, not a single
download across multiple ISPs, but definitely a single file across
multiple ISPs.

Regards,

-- Raju
-- 
Raj Mathur                raju@kandalaya.org      http://kandalaya.org/
       GPG: 78D4 FC67 367F 40E2 0DD5  0FEF C968 D0EF CC68 D17F
                      It is the mind that moves
From lists at andyfurniss.entadsl.com  Mon Sep 25 16:10:22 2006
From: lists at andyfurniss.entadsl.com (Andy Furniss)
Date: Mon Sep 25 16:10:13 2006
Subject: [LARTC] How to make burst traffic? such ICMP and real time traffic
In-Reply-To: <BAY123-F15590BC6FF4EED190A288FDD2C0@phx.gbl>
References: <BAY123-F15590BC6FF4EED190A288FDD2C0@phx.gbl>
Message-ID: <4517E34E.3070300@andyfurniss.entadsl.com>

*~ r a K u ~ * wrote:
> My test case must relative with burst traffic such data or real time traffic
> somebody can advise me how to generate traffic data like ICMP to be burst and about
> real time traffic too ,.. i don't have any idea to make burst traffic for test 
> HTB and HFSC which can manage that situation good.

You can use iputils ping to generate streams and bursts, but it's not 
perfect - still useful, but you need to check with rate estimators/ 
tcpdump timestamps on a different box what is happening.

ping -l 10 -i 0.02 ....... will burst 10 then do 50pps. For me it goes a 
few pps slow if I run 5 instances + 5 netperfs.

Andy.

From gaio at sv.lnf.it  Mon Sep 25 17:30:49 2006
From: gaio at sv.lnf.it (Marco Gaiarin)
Date: Mon Sep 25 17:30:54 2006
Subject: [LARTC] Same ip address assigned to two interfaces...
Message-ID: <20060925153049.GA10828@sv.lnf.it>


[i'm not clearly a network guru, but i've some knowledge... anyway i
think i've arrived to my ``end point'' here. Probably i've also done
some big mistake, so please sorry me.]


I've setup in a local branch of my office two servers, say radagast
(10.27.1.2) and olorin (10.27.1.3). They share the same UPS and the
same place, sitting at roughly 20 centimeters each other.
Network devices are in another room, not UPSes, and so if there's a
power loss, radagast compain about that UPS desappear.
Also this two servers share a samba domain, and the syncronize each
other (LDAP, some folders, some other nfs-mounted, ...).


So i've thinked to simply put a gigabit ethernet on each of the two
server and link them together with a simple switched cable.
Note that: i'm not interested in bonding nor in some sort of
``failover'' configuration , only to link together them.

The first, for me, simple solution was to fire up the interfaces with
the same IP and list an explicit link, so:

  on radagast (10.27.1.2 on eth0):
	ifconfig eth1 10.27.1.2 netmask 255.255.255.255 up
	route add -host 10.27.1.3 eth1

  on olorin (10.27.1.3 on eth0)
	ifconfig eth1 10.27.1.3 netmask 255.255.255.255 up
	route add -host 10.27.1.2 eth1

and with this simple solution all seems works. Seems.
After some ``hot calls'' i discovered that simply some services (i
tested squid and the openldap server) does not communicate
anymore; digging with tcpdump arise the problem: olorin acces the squid
proxy on radagast via the eth1 interfaces, but reply on eth0, so olorin
kernel drop the packet (i've not enabled log_martian, but i think was
interesting ;).

As try_out solution, i've enabled arp_proxy on eth0 and ip_forwarding,
resulting in a working envirionment, but resulting also in packets
directing to olorin that pass thru radagast and vice versa; also, a
solution similar to this tempted in another place got some very big
panic, probably an ``arp storm'' or something like this caused by the
apt_proxy (older, less ``intelligent'' switches?).
Clearly this is not the solution. ;)


Ok, but, what *is* the solution? ;)

There's no way to do whan i need, at least not assigning the same IPs
to both interfaces?
I have to simply disable the rp_filtering? Or setup some ip rule/ip
route scripts to route explicitly (but how? The only example have
different source IP, not the same source IP...)


Please, help me.

-- 
dott. Marco Gaiarin				    GNUPG Key ID: 240A3D66
  Associazione ``La Nostra Famiglia''                http://www.sv.lnf.it/
  Polo FVG  -  Via della Bont?, 7 - 33078  -  San Vito al Tagliamento (PN)
  marco.gaiarin(at)sv.lnf.it	  tel +39-0434-842711  fax +39-0434-842797
From kcem at tlen.pl  Mon Sep 25 20:17:43 2006
From: kcem at tlen.pl (Konrad Cempura)
Date: Mon Sep 25 20:17:50 2006
Subject: [LARTC] HFSC parameter
In-Reply-To: <20060924133900.42854.qmail@web35515.mail.mud.yahoo.com>
References: <20060924133900.42854.qmail@web35515.mail.mud.yahoo.com>
Message-ID: <45181D47.1040506@tlen.pl>

Thossapron Apinyapanha napisa?(a):
> Can everybody tell me all 12 parameter ,what does it mean????
Nobody knows:)

Is anybody here, who is using HFSC?


From jody.shumaker at gmail.com  Mon Sep 25 22:37:55 2006
From: jody.shumaker at gmail.com (Jody Shumaker)
Date: Mon Sep 25 22:37:59 2006
Subject: [LARTC] Completely isolating P2P/BitTorrent traffic
In-Reply-To: <200609122216.02895.ranmakun@arnet.com.ar>
References: <BAY105-W3F8CF3B31461CB0B3F5FFD42B0@phx.gbl>
	<200609122216.02895.ranmakun@arnet.com.ar>
Message-ID: <2af436490609251337m7d522425ubb8fa9e962ed14a7@mail.gmail.com>

On 9/12/06, Francisco <ranmakun@arnet.com.ar> wrote:
> I'll tell you what I did to completelly isolate MY bittorrent traffic. In
> azureus you can tell the program to use a specific IP, so I have two IP's per
> PC, one for p2p and the other one as the main IP. Then I simply shape traffic
> from the azureus IP in each PC. Obviously this only works for you, since you
> wont convince any user to do this, but I found it quite practical if that's
> what you need. aMule doesn't have the same option, but this traffic is easy
> to detect.
>

Some clients, like Azureus, let you bind the local port for outgoing
connections.  Then marking based on the source port will work for not
only incomming connected tcp streams but outgoing connected tcp
streams too.  All the data you're seeing as not marked correctly is
likely people your bittorrent client connected out to that are running
encryption.  ipp2p can't determine that those data streams are p2p
sessions as it actually should look similar to any ssl connection.
Seems the best options is to bind to a seperate ip, or if client has
the option bind to a specific local port and match on that.

- Jody
From kaber at trash.net  Tue Sep 26 17:14:10 2006
From: kaber at trash.net (Patrick McHardy)
Date: Tue Sep 26 17:17:47 2006
Subject: [LARTC] HFSC parameter
In-Reply-To: <20060924133900.42854.qmail@web35515.mail.mud.yahoo.com>
References: <20060924133900.42854.qmail@web35515.mail.mud.yahoo.com>
Message-ID: <451943C2.3010405@trash.net>

Thossapron Apinyapanha wrote:
> tc command's HFSC have a lot parameter with 4 curve type
> 
> SC curve -> umax dmax rate
> LS curve -> umax dmax rate
> RT curve -> umax dmax rate
> UL curve -> umax dmax rate
> 
> so i'dont know which parameter are appropriate for my test case
> such real time class which curve are appropriate and good working result.

LS = link-share service curve, defines relation of service between
sibling classes. Can be used for intermediate and leaf classes.

UL = upper-limit service curve, limits LS curve.

RS = real-time service curve, defines absolute service guarantees
for leaf classes. Can be used, but does nothing for intermediate
classes.

SC = service curve, sets LS and RS to the same curve. Should usually
be used for leaf-classes instead of RS.

> my assumption about umax,dmax,rate ... this is true
> first, HFSC will doing with "umax" rate but after delay exceed "dmax" rate,
> HFSC will change rate to "rate" ????

No, this is true for m1, d and m2 (use rate m1 for time d, then m2).
umax, dmax and rate are another way to specify the curve, m2 == rate
and m1 and d are calculated from umax and dmax.
From wtm at harbec.com  Tue Sep 26 20:47:26 2006
From: wtm at harbec.com (William T Mullaney)
Date: Tue Sep 26 20:47:52 2006
Subject: [LARTC] Problem with Load Balancing
Message-ID: <4986F8D166F1E44CBA92A91C98ACAD5214CF36@sql_server>

Well, if you had a download manager and the system at the other side allowed
you to start your transfers in the middle of the file (which isn't out of
the question) that could potentially work.  The problem is that as far as I
see, there's nothing to force the second connection onto the second line.
It's been kind of a crap shoot of what line gets more information.  In
theory you could start the first download stream (and it's routed to ISP A),
then perhaps your email client goes out to check your POP account, so that
goes over ISP B.  The next connection, the second stream, now goes out over
ISP B again.  Honestly I don't know exactly how the equalize command for ip
route works, though I would think it says to always use the "less used"
connection (perhaps on PPS, BPS, % use, whatever, on a per second, 30
second, minute average?), but in my experience that and the weight options
don't ever get you exactly 50/50 (or whatever you specify) traffic.  

Things like bit torrent would probably perform better because there are
(possibly) many streams for each file, as would having 50 people downloading
files vs one.  It seems to be just like rolling dice, if you only roll twice
you might get two evens or two odds, but if you roll tons of times, you
should tend to get a more even distribution. 

-Will

-----Original Message-----
From: Raj Mathur [mailto:raju@linux-delhi.org] 
Sent: Sunday, September 24, 2006 2:49 PM
To: lartc@mailman.ds9a.nl
Subject: RE: [LARTC] Problem with Load Balancing

>>>>> "William" == William T Mullaney <William> writes:

    William> To my knowledge, there is no way to download one file
    William> from two different connections connected to two different
    William> ISPs at the same time.  If you are running BGP then you
    William> might be able to load balance across the two links, but
    William> that would require your upstream providers to allow you
    William> to use it, and possibly the purchase of a public AS
    William> number an IP address space depending on the setup.  If
    William> you are doing NAT past this link (IE both of your lines
    William> go two the same ISP and same address blocks, but they
    William> want to give you 2x 10mb links for 20mb total), then you
    William> can look at doing load balancing on layer 2 (Fast
    William> EtherChannel, bonding, Link Aggregate Groups, whatever),
    William> or creating 2 PPP style links between the computers and
    William> using a routing protocol like OSPF, EIGRP (but not on
    William> Linux) or something.  I believe OSPF does equal cost load
    William> balancing, BGP and EIGRP can, I think, do unequal cost
    William> load balancing.  But either way, I don't think that's the
    William> solution in your case.

    William> The only other option I can think of would be some sort
    William> of software that sends every other packet to a different
    William> IP or something, which would need to run at the end you
    William> are downloading at or maybe at your ISPs, but I can't
    William> think of anything like that.

Wouldn't some download manager software that splits the file up into
multiple simultaneous downloads do the trick?  Agreed, not a single download
across multiple ISPs, but definitely a single file across multiple ISPs.

Regards,

-- Raju
-- 
Raj Mathur                raju@kandalaya.org      http://kandalaya.org/
       GPG: 78D4 FC67 367F 40E2 0DD5  0FEF C968 D0EF CC68 D17F
                      It is the mind that moves
_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

______________________________________________________________________
This email has been scanned by the MessageLabs Email Security System.
For more information please visit http://www.messagelabs.com/email
______________________________________________________________________
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060926/f9b6539c/attachment.html
From lists at andyfurniss.entadsl.com  Wed Sep 27 00:23:32 2006
From: lists at andyfurniss.entadsl.com (Andy Furniss)
Date: Wed Sep 27 00:21:33 2006
Subject: [LARTC] HTB and HFSC,declaration tc command question
In-Reply-To: <BAY123-F2465A136BB1435F6FCEB20DD2C0@phx.gbl>
References: <BAY123-F2465A136BB1435F6FCEB20DD2C0@phx.gbl>
Message-ID: <4519A864.7080802@andyfurniss.entadsl.com>

*~ r a K u ~ * wrote:
> I have a lot question about tc-command because now i'm doing research to compare
> performance between HTB and  HFSC
> so i'm doubt a lot thing and your reply are so very helpful to me ... My 
> question is
>  
> *In HTB tc command question*
> 1. I'm use opensource (Mastershaper) for help to config traffic control
> but when i'm try to config HTB,
> I'm doubt about in each chain must identify fallback service level
> and If i'm don't specify it,it will unable to contain pipe.
> Every traffic and if traffic not matched in chain's pipe can only use the 
> fallback service level
> (ps.  Mastershaper represent interior class as pipe and leaf class as chain)
>  
> Is it only true definition in HTB tc command?? or it's only a creative function 
> from developer??

Don't know what you mean really - mastershaper is OK but if you want to
test HTB and HFSC you should do it by hand so you can play with
different HTB settings.

quantum/burst/cburst can affect things at low rates there is also a
compile time define that makes HTB more accurate - HYSTERESIS 0 is more
accurate than the default 1. HTB accuracy is limited by Hz setting aswell.

Testing on low bandwidth links shows HTB to be sensitive to how you set
things up. Trying to have a class for each user, with prio for
interactive within that doesn't work well - your interactive needs to be
top level prio 0. I haven't tested doing per user within that.

At low rates I find hfsc is alot better, but then my tests may have been
flawed.

You won't see any results from ping output when simulating a low rate on
eth unless you make an artificial link with another queue. This can be
tricky - hfsc seems Ok - but it doesn't add bitrate latency quite like a
real link would. If you use hfsc to simulate a link then to be fair to
htb you need to choose packet sizes carefully, because htb uses rate
tables that are only right if (on eth) ip_len+14/8 is an integer. In
effect (on eth) this means setting mtu to 1498 and ping -s 54 rather
than default 56.

You could instead, just tcpdump on a remote box and look at time
deltas/packet lengths and deduce how much a real link would be backlogged.

>  
> *In HFSC tc command question *
> after i read HFSC paper , i'm doubt in Service curve declaration like this
>  > | SC := [ [ m1 BPS ] [ d SEC ] m2 BPS
>  > | 
>  > |  m1 : slope of first segment -> umax
>  > |  d  : x-coordinate of intersection -> dmax
>  > |  m2 : slope of second segment -> rate

You can specify curves two ways and you don't need m1/umax or d/dmax for 
a linear "curve". Whether you say m1 as a bitrate or umax bytes for 
packet length hfsc will convert to bitrate.

You need to think of the link you shape for as a linear curve and make 
sure all your rates do not exceed that.

>  
> 2. In all leaf class must specify rt (realtime service curve) ??? and Is it 
> important to
> specify sc (Service curve) in all leaf class ?? and in all leaf class must 
> specify link-sharing (ls) too??

I think you can have any type on leaf - inners can't be rt, though you 
can use sc rather than ls I suppose they are just ls. On a leaf sc is rt 
+ ls, ie. it can borrow and is capped by the first ul above/on it, rt 
alone will not get a share above its rate.

> because i think after read HFSC theory about by default All leaf class(Service 
> class)
> will use Link-sharing critirion for allocation bandwidth from Service curve
> (My assumtion think this calculation bandwidth is "m1" or "umax" ->total bandwidth
> that can send at ceil rate??) and when total  delay are exceed to "demax" or "d" 
> -> it mean

The way I see it may be wrong -

There is no ceil rate for rt as such , that's for ls - it is up to you 
to work out m1 and delay for every leaf (not sure if ls leaf matters but 
I still did in my test, just to make the curves add up) so that you 
don't go over the link curve. On a slow link if you assume big packets 
that makes for long delays. In practice it will be jitter - Patrick 
wrote he may make hfsc even more non work conserving one day (IIRC). 
Until then I don't think it's possible to get optimal behaviour for prio 
  between rt classes. The original hfsc algorithym assumes some device 
driver controls the queue - in practice that won't happen without alot 
of buffering to mess things up, the current hfsc rate limiting is good 
but doesn't quite simulate the perfect (non existant) driver that asks 
for a packet at a time.

> it's time for HFSC to manage QoS to guarantee bandwidth and delay
> in each leaf class by use Real-time Criterion so bandwidth rate will change to "m2"
> or bandwidth rate that guarantee QoS in eache leaf class
> Is it true??? i fear may be misunderstand in HFSC theory,
> example in my test lab ,i have leaf class 3 type such real-time ,data ,default
> Can i specify
>  - real-time leaf class -> rt (for guatantee delay and bw) ,ls (by default when 
> not exceed max delay)

It will get (max) delay according d upto m2 bandwidth if it needs to 
borrow more from ls those packets get no delay guarantee.

>  - data lead class ->  ls (by default and not delay sensitive so delay are not 
> important)

ls bandwidth is shared between siblings according to the relation of 
their rates. An rt class can be ls aswell - that's what sc is.

> 
> 3. I'm doubt in How to declaration ls, and ul about .. in thoery it a type of 
> service curve that not
> relative with real-criterion, so Delay may be not important for consider ????
> Is it true when declaration, parameter in each service curve may be link this?
>  ls [ umax BPS, rate BPS]
>  ul [ umax BPS, rate BPS]
> and
> Is it important to declaration all of three parameter (umax,demax,rate) If three 
> parameter
> are important to setting traffic control????

Not sure really - it seemes to make sense to make sibling curves add up 
even if ls, so  when I tested I made an ls m1 0 d Xms rate Xkbit because 
it had as a sibling, an rt that had m1 = parent rate for Xms.

>  
> 3. I'm try to search HFSC command example, it have a lot case but i'm doubt in 
> service curve (sc)
> declaration sometime declaration in root class, interior class, in leaf class
> so I'm not sure to understand about ls ->calculate bandwidth for interior 
> class,root class and
> rt -> calculate bandwidth for leaf class and what about service curve(sc)??? 
> it's specify only in root class???

I guess on leaf it means rt + ls, as a parent just ls.

>  
> 4. Is it true??
> In root class, or interior class will doing with only Link-sharing criterion, so 
> can specify declaration
> only link-sharing ->ls(umax, dmax, rate) and Upperlimit 
> ->ls(umanx,dmax,rate) it's not important
> to declaration real-time curve (rt) because in HFSC theory will use real-time 
> criterion only Leaf class

All my inners are linear only.

>  
> 5. In HFSC, upper limit are bandwidth rate that guarantee maximum bandwidth rate in
> each class as ceil in HTB???
>  
> 6. I'm doubt about priority in HFSC, in HFSC paper telling about in support 
> priority
> but in HFSC tc-command it not specify priority in each class,
> So In HFSC how to manage priority class link HTB????

In theory for rt priority is from the way you make the curves - in 
practice see above. For ls share of bandwidth is worked out between 
siblings at each level using their rates. If you give bulk class x:y 
rate 5 kbit and bulk class x:z 1kbit bandwidth will share 5:1.

Andy.




From lists at andyfurniss.entadsl.com  Wed Sep 27 02:08:52 2006
From: lists at andyfurniss.entadsl.com (Andy Furniss)
Date: Wed Sep 27 02:06:42 2006
Subject: [LARTC] jdg-qos & DSL
In-Reply-To: <hfvp7svfmekaf0m.180920061536@mail.x-privat.org>
References: <hfvp7svfmekaf0m.180920061536@mail.x-privat.org>
Message-ID: <4519C114.3060400@andyfurniss.entadsl.com>

acid_burn@x-privat.org wrote:
> hi all!
> 
> i have a dsl connection with 1280 kbps for downstream and 256 kbps for upstream, and i want to manage the bandwidth to give high priority to voip traffic and low priority to p2p traffic. i found the script jdg-qos. i readed on this forum (i have a dsl-g604t router with MCMCC firmware)
> http://www.dslreports.com/forum/remark,16250220
> that the two parameters of the jdg-qos script (DWIFLIMIT and UPIFLIMIT) must be setted a few less than the theoric dsl's downstream and upstream values (1280/256). but, how much few less?
> what are the values i must assign to DWIFLIMIT and UPIFLIMIT?

For upstream it's possible to patch for atm overheads so you can in 
theory go really close to the limit. If you can't get the overheads 
right how much you have to back off from rate depends on your traffic 
pattern wrt packet sizes. If you have lots of small packets you will 
need to back off more than if most traffic is bulk.

For ingress, it depends more on how much you care about latency. Shaping 
from the wrong end of the bottleneck is not nice. You may need to 
sacrifice 20 - 50 % depending on latency requirements and traffic type - 
lots of connections/bittorrent etc being harder to shape than a few.

Andy.

From abel.martin.ruiz at gmail.com  Wed Sep 27 11:27:48 2006
From: abel.martin.ruiz at gmail.com (=?ISO-8859-1?Q?Abel_Mart=EDn?=)
Date: Wed Sep 27 11:27:58 2006
Subject: [LARTC] Same ip address assigned to two interfaces...
In-Reply-To: <20060925153049.GA10828@sv.lnf.it>
References: <20060925153049.GA10828@sv.lnf.it>
Message-ID: <915136920609270227o7b75a937yd08cef2c08f62f20@mail.gmail.com>

On 9/25/06, Marco Gaiarin <xxx@xxxx.xxx> wrote:
>
>
> [i'm not clearly a network guru, but i've some knowledge... anyway i
> think i've arrived to my ``end point'' here. Probably i've also done
> some big mistake, so please sorry me.]
>
>
> I've setup in a local branch of my office two servers, say radagast
> (10.27.1.2) and olorin (10.27.1.3). They share the same UPS and the
> same place, sitting at roughly 20 centimeters each other.
> Network devices are in another room, not UPSes, and so if there's a
> power loss, radagast compain about that UPS desappear.
> Also this two servers share a samba domain, and the syncronize each
> other (LDAP, some folders, some other nfs-mounted, ...).
>
>
> So i've thinked to simply put a gigabit ethernet on each of the two
> server and link them together with a simple switched cable.
> Note that: i'm not interested in bonding nor in some sort of
> ``failover'' configuration , only to link together them.
>
> The first, for me, simple solution was to fire up the interfaces with
> the same IP and list an explicit link, so:
>
>   on radagast (10.27.1.2 on eth0):
>         ifconfig eth1 10.27.1.2 netmask 255.255.255.255 up
>         route add -host 10.27.1.3 eth1
>
>   on olorin (10.27.1.3 on eth0)
>         ifconfig eth1 10.27.1.3 netmask 255.255.255.255 up
>         route add -host 10.27.1.2 eth1
>
> and with this simple solution all seems works. Seems.
> After some ``hot calls'' i discovered that simply some services (i
> tested squid and the openldap server) does not communicate
> anymore; digging with tcpdump arise the problem: olorin acces the squid
> proxy on radagast via the eth1 interfaces, but reply on eth0, so olorin
> kernel drop the packet (i've not enabled log_martian, but i think was
> interesting ;).


Hi,

Did you try using ip from iproute tools, which is a much more advanced tool
than ifconfig and route?

I think your problem is at the link layer and may have to do with ARP
resolution. Check the neighbour object from  ip command. With this you can
bind an ip address to a MAC address which I think is your problem: some
times the ARP resolution that your hosts perform results in different MAC
addresses.

In any case I must tell I don't like this workaround. It makes no sense, to
be honest. Having a host with two nics whith the same IP seems a horrible
setup to me. Why don't you use a different network for the link between
these two hosts? Why do you need this link? You wouldn't have routing nor
ARP resolution problems. For your words I think you only want a direct link
between this two hosts.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060927/65825b58/attachment.htm
From nnn at vsu.by  Wed Sep 27 11:56:41 2006
From: nnn at vsu.by (Nikolay Nikolaev)
Date: Wed Sep 27 11:56:50 2006
Subject: [LARTC] broadcast forwarding
Message-ID: <451A4AD9.4020701@vsu.by>

Hi All.

How can I do the subj, from one subnet to another subnet?
I think ip route maybe must help me.... bu I not understand how?

thx.
From Jon.J.Flechsenhaar at boeing.com  Wed Sep 27 19:30:05 2006
From: Jon.J.Flechsenhaar at boeing.com (Flechsenhaar, Jon J)
Date: Wed Sep 27 19:30:15 2006
Subject: FW: [LARTC] 2.6.14 - HTB/SFQ QoS broken?
Message-ID: <0E24ED2A7F9AA349A8633E6A56A64BE0027A80C4@XCH-SW-2V1.sw.nos.boeing.com>

 Please see below


Jon Flechsenhaar
Boeing WNW Team
Network Services
(714)-762-1231
202-E7

-----Original Message-----
From: Flechsenhaar, Jon J 
Sent: Wednesday, September 27, 2006 9:35 AM
To: lartc@mailman.ds9a.nl
Subject: [LARTC] 2.6.14 - HTB/SFQ QoS broken?

Jody:

I don't know if you answer basic HTB questions but I'l try anyway.  I'm
implementing AF and EF with a root rate of 500 kbps (kilo bits per
second).  I am using DSMARK to classify packets.  I'm implementing this
on two different hardware sets PPC and x86 with the same kernel options
configured.  

Problem:

My root rate is going about 75 kbps over its 500kbps limit (ceil 500).
I believe this is because of burst and cburst settings.  I am using
default calculations now.   Is there a formula to use in tweaking these
values?  I would like my rates to follow the assigned rate more closely.


I am generating traffic with a hardware traffic generator.  Starting at
300 kbps stepping by 100 kbps up to 1mbps.  Each step lasts for 60 sec.


My config script is attached.  Thanks.  

Jon

 <<diffserv9-26-gred>> 

Jon Flechsenhaar
Boeing WNW Team
Network Services
(714)-762-1231
202-E7

-------------- next part --------------
A non-text attachment was scrubbed...
Name: diffserv9-26-gred
Type: application/octet-stream
Size: 8579 bytes
Desc: diffserv9-26-gred
Url : http://mailman.ds9a.nl/pipermail/lartc/attachments/20060927/9efeecb8/diffserv9-26-gred.obj
From Jon.J.Flechsenhaar at boeing.com  Wed Sep 27 19:39:13 2006
From: Jon.J.Flechsenhaar at boeing.com (Flechsenhaar, Jon J)
Date: Wed Sep 27 19:39:38 2006
Subject: [LARTC] HTB root rate allowing to much of a burst
Message-ID: <0E24ED2A7F9AA349A8633E6A56A64BE0027A80C5@XCH-SW-2V1.sw.nos.boeing.com>

 
Please see below

Jon Flechsenhaar
Boeing WNW Team
Network Services
(714)-762-1231
202-E7

-----Original Message-----
From: Flechsenhaar, Jon J 
Sent: Wednesday, September 27, 2006 10:30 AM
To: lartc@mailman.ds9a.nl
Subject: FW: [LARTC] 2.6.14 - HTB/SFQ QoS broken?

 Please see below


Jon Flechsenhaar
Boeing WNW Team
Network Services
(714)-762-1231
202-E7

-----Original Message-----
From: Flechsenhaar, Jon J
Sent: Wednesday, September 27, 2006 9:35 AM
To: lartc@mailman.ds9a.nl
Subject: [LARTC] 2.6.14 - HTB/SFQ QoS broken?

Jody:

I don't know if you answer basic HTB questions but I'l try anyway.  I'm
implementing AF and EF with a root rate of 500 kbps (kilo bits per
second).  I am using DSMARK to classify packets.  I'm implementing this
on two different hardware sets PPC and x86 with the same kernel options
configured.  

Problem:

My root rate is going about 75 kbps over its 500kbps limit (ceil 500).
I believe this is because of burst and cburst settings.  I am using
default calculations now, on all classes.   Is there a formula to use in
tweaking these
values?  I would like my rates to follow the assigned rate more closely.


I am generating traffic with a hardware traffic generator.  Starting at
300 kbps stepping by 100 kbps up to 1mbps.  Each step lasts for 60 sec.


My config script is attached.  Thanks.  

Jon

 <<diffserv9-26-gred>> 

Jon Flechsenhaar
Boeing WNW Team
Network Services
(714)-762-1231
202-E7

-------------- next part --------------
A non-text attachment was scrubbed...
Name: diffserv9-26-gred
Type: application/octet-stream
Size: 8579 bytes
Desc: diffserv9-26-gred
Url : http://mailman.ds9a.nl/pipermail/lartc/attachments/20060927/7650796e/diffserv9-26-gred-0001.obj
From kinema at gmail.com  Wed Sep 27 22:22:25 2006
From: kinema at gmail.com (Adam Hunt)
Date: Wed Sep 27 22:22:32 2006
Subject: [LARTC] multilink/multiprovider load balancing
Message-ID: <b476569a0609271322x49871a51s6fd43e3afebfdeb0@mail.gmail.com>

Lately I've been entertaining the idea of setting up a neighborhood
network (wireless and possibly some wired).  I have a few neighbors
who subscribe to your typical consumer grade broadband connection
(e.g. Comcast cable or Verizon DSL) and a number of neighbors with no
connectivity or are still stuck on dial-up.  Currently I'm sharing my
connection with my nearest neighbor but I'd like to expand the network
and incorporate the uplinks of the willing.  I'm no networking guru
but I'm pretty sure this is entirely possible with Linux's networking
capabilities.

I've taken a look at the LARTC HOWTO and found the "Routing for
multiple uplinks/providers" very helpful.  What I would like to know
is if this is still the best way to accomplished what is described.  I
know that state of Linux networking changes rapidly and I wasn't sure
how up to date this section is.  I know that there have been advances
in projects such as LVS where I can possibly see IPVS being useful (I
may be wrong, like I said I'm no guru).

So, assuming I have a Linux server (e.g. Linksys WRT54G) at each cable
or DSL uplink is the method described in the HOWTO still what I should
be looking at?

If this is the solution I should be looking at it would seem that I
would need to build tunnels from each one of the uplinks to a central
gateway as the documentation assumes that all the uplinks are local to
the gateway/router.  Is there any way around this?

Thank you for your help.  Assuming that I manage to get something like
this up and running I do plan on writing detailed documentation for
others who may be interested in setting up a similar headache.

--adam
From zealot0630 at gmail.com  Wed Sep 27 22:52:47 2006
From: zealot0630 at gmail.com (Zealot)
Date: Wed Sep 27 22:52:59 2006
Subject: [LARTC] How to use different path for INCOME and OUTGOING package ?
Message-ID: <451AE49F.4090602@gmail.com>

there are 3 computers.

A-------------B--------------C

I want the outgoing packages of B go to C.
And receive responding package from A.

As soon as insert the routing entry:
ip route add 10.0.0.0/8 via C src B dev BC

B seems stop receiving packages from A.
Use tcpdump on B, I can get the package.
But, it seems that kernel check the routing table, and found that the 
source address of the package coming form A is not in routing table of B 
to A, actually, it is in the table of B to C,
then the package is dropped.

How to configure the kernel not to drop the package ?
From zealot0630 at gmail.com  Wed Sep 27 23:04:07 2006
From: zealot0630 at gmail.com (Zealot)
Date: Wed Sep 27 23:04:21 2006
Subject: [LARTC] ipp2p patch for kernel 2.6.17.4
Message-ID: <451AE747.3080506@gmail.com>

get newest pom-ng.

then
./runme --download
./runme external

you will get the correct patch for 2.6.17
From zealot0630 at gmail.com  Wed Sep 27 23:07:14 2006
From: zealot0630 at gmail.com (Zealot)
Date: Wed Sep 27 23:07:23 2006
Subject: [LARTC] ipp2p patch for kernel 2.6.17.4
Message-ID: <451AE802.30706@gmail.com>

I'm sorry I have misunderstand you post :-(
From zealot0630 at gmail.com  Wed Sep 27 23:14:41 2006
From: zealot0630 at gmail.com (Zealot)
Date: Wed Sep 27 23:14:52 2006
Subject: [LARTC] How to use different path for INCOME and OUTGOING package
 ?
Message-ID: <451AE9C1.6000104@gmail.com>

I got it.
I have mistakenly enabled rp_filter.

From imthiyaz at peopletech.co.in  Thu Sep 28 07:49:45 2006
From: imthiyaz at peopletech.co.in (imthiyaz@peopletech.co.in)
Date: Thu Sep 28 07:51:21 2006
Subject: [LARTC] two isp issues
Message-ID: <380-22006942854945984@M2W022.mail2web.com>

I am usong three ehternet cards eth0 , eth1 , eth2 and  eth0 and eth2 is
connected to two diffrent ISP and eth1 is connected to local lan.

I am tring to route all the mail traffic to eth1 and I have followed the
lartc doc.

But it seems the solution does not work for me . is there a way I could
connect two diffrent ISP in one linux box with diffrent gateway address 
and dns.

Thanks
Imthiyaz





--------------------------------------------------------------------
mail2web - Check your email from the web at
http://mail2web.com/ .


From lists at andyfurniss.entadsl.com  Thu Sep 28 16:42:40 2006
From: lists at andyfurniss.entadsl.com (Andy Furniss)
Date: Thu Sep 28 16:42:21 2006
Subject: [LARTC] HTB root rate allowing to much of a burst
In-Reply-To: <0E24ED2A7F9AA349A8633E6A56A64BE0027A80C5@XCH-SW-2V1.sw.nos.boeing.com>
References: <0E24ED2A7F9AA349A8633E6A56A64BE0027A80C5@XCH-SW-2V1.sw.nos.boeing.com>
Message-ID: <451BDF60.5060706@andyfurniss.entadsl.com>

Flechsenhaar, Jon J wrote:

> 
> I don't know if you answer basic HTB questions but I'l try anyway.  I'm
> implementing AF and EF with a root rate of 500 kbps (kilo bits per
> second).  I am using DSMARK to classify packets.  I'm implementing this
> on two different hardware sets PPC and x86 with the same kernel options
> configured.  
> 
> Problem:
> 
> My root rate is going about 75 kbps over its 500kbps limit (ceil 500).

How are you measuring - htb and rate estimators see packets on eth an 
iplen + 14.

> I believe this is because of burst and cburst settings.  I am using
> default calculations now, on all classes.   Is there a formula to use in
> tweaking these
> values?  I would like my rates to follow the assigned rate more closely.

Hz and a compile time header change - HYSTERESIS 0 in 
net/sched/sched_htb.c also affect accuracy.

> 
> I am generating traffic with a hardware traffic generator.  Starting at
> 300 kbps stepping by 100 kbps up to 1mbps.  Each step lasts for 60 sec.

Could give different results to normal tcp I suppose.

> 
> 
> My config script is attached.  Thanks.  

tbf latency 0.01 on 256kbit is too short for a buffer IIRC it gets 
rounded up so at least mtu packets get through.

I get an error on your script with iproute2-ss060323 and 2.6.17.11/7

++ /usr/sbin/tc qdisc change dev eth0 parent 2:20 gred DP 3 limit 60kb 
min 10kb max 20kb avpkt 1500 burst 9 bandwidth 500kbit probability 0.06 
prio 4
RTNETLINK answers: Invalid argument

after each DP 3 on each gred.

Andy.
From e1605projecter at yahoo.com  Thu Sep 28 20:20:48 2006
From: e1605projecter at yahoo.com (Thossapron Apinyapanha)
Date: Thu Sep 28 20:20:56 2006
Subject: [LARTC] please reply as soon as you can about HFSC bandwidth
Message-ID: <20060928182048.74352.qmail@web35507.mail.mud.yahoo.com>

I have important question about bandwidth allocation statistic show when i'm use "tc -s -d class ls dev eth2" 
  At first, before testing I think "work" parameter from this command are real bandwidth in each class but when i'm calculate this parameter ... it's too big number ... like it's not a bandwidth rate and it's may be some number that i don't know what 's it?
   
  If "work" and "rtwork" are bandwidth in each class but it must have specific  method to calculate ... So how to do it??
   
  I'm doubt about "rtwork" value along my test. It have a same number ... i don't know what is it mean??? and why don't "work" value in each time when i'm use "tc -s -d class ls dev eth2" .. it have a same number in all class but next time that value are change to another number what is it mean???
   
  shaper@ubuntu:~$ tc -s -d class ls dev eth2
  class hfsc 1: root
  Sent 0 bytes 0 pkts (dropped 0, overlimits 0)
  period 3223398930 work 14505631817980074884 bytes rtwork 14544911558267371524 b ytes level 3377421952
  class hfsc 1:11 parent 1:1 leaf 11: rt m1 12000bit d 100.0ms m2 200000bit ls m1 0bit d 0us m2 200000bit ul m1 0bit d 0us m2 350000bit
  Sent 252678 bytes 3405 pkts (dropped 0, overlimits 0)
  period 3223398930 work 14505631817980074884 bytes rtwork 14544911558267371524 b ytes level 3377421952
   
  thank you
   
  raku
   
   
   

 		
---------------------------------
 All-new Yahoo! Mail - Fire up a more powerful email and get things done faster.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20060928/67b2fd8d/attachment.html
From nagisaliba at hotmail.com  Fri Sep 29 10:52:36 2006
From: nagisaliba at hotmail.com (nagi saliba)
Date: Fri Sep 29 10:52:51 2006
Subject: [LARTC] urgent probllem 
Message-ID: <BAY120-F6A834CF318D1CF97F26FEDA180@phx.gbl>

Hi all,
I am very new to traffic control.
I read the lartc how to and I am curently using the script in ch15 
(cookbook) with some restricion :
I excluded the ingress section and i implemented the rest on both interfaces 
of my firewall.(eth0 the internet interface and eth1 the LAN interface).find 
below the script use on eth1
(ssh priority one and all other 2)
##################################### Egress on eth1:the LAN interface 
#######################################

DEV=eth1

# install root HTB, point default traffic to 1:20
$TC qdisc add dev $DEV root handle 1: htb default 20
# shape everything at $UPLINK speed - this prevents huge queues in your DSL 
modem which destroy latency:
$TC class add dev $DEV parent 1: classid 1:1 htb rate ${UPLINK}kbit burst 6k
# high prio class 1:10:
$TC class add dev $DEV parent 1:1 classid 1:10 htb rate ${UPLINK}kbit burst 
6k prio 1
# bulk & default class 1:20 - gets slightly less traffic and a lower 
priority:
$TC class add dev $DEV parent 1:1 classid 1:20 htb rate 64kbit ceil 
${UPLINK}kbit burst 3k prio 2

# both get Stochastic Fairness:
$TC qdisc add dev $DEV parent 1:10 handle 10: sfq perturb 10
$TC qdisc add dev $DEV parent 1:20 handle 20: sfq perturb 10

# TOS Minimum Delay (ssh, NOT scp) in 1:10:
$TC filter add dev $DEV parent 1:0 protocol ip prio 10 u32 match ip tos 0x10 
0xff flowid 1:10
$TC filter add dev $DEV parent 1:0 protocol ip prio 1 u32 match ip dport 22 
0xffff flowid 1:10
$TC filter add dev $DEV parent 1:0 protocol ip prio 1 u32 match ip sport 22 
0xffff flowid 1:10

# ICMP (ip protocol 1) in the interactive class 1:10 so we can do 
measurements & impress our friends:
$TC filter add dev $DEV parent 1:0 protocol ip prio 10 u32 match ip protocol 
1 0xff flowid 1:10

# To speed up downloads while an upload is going on, put ACK packets of the 
download in the interactive class:
$TC filter add dev $DEV parent 1: protocol ip prio 10 u32 \
match ip protocol 6 0xff \
match u8 0x05 0x0f at 0 \
match u16 0x0000 0xffc0 at 2 \
match u8 0x10 0xff at 33 \
flowid 1:10

# rest is .non-interactive. ie .bulk. and ends up in 1:20
###################################################################################

the same on eth0 with DEV=eth0
I tried the script on my lab using one pc as firewall with 2 eth one 
connected to my lan and the athore to a pc simulated as internet and 
everything worked fine.
When implemented on my real fw connected to the internet I didn't get the 
desired result that i got in the test.(the ssh or scp doesn't get the 1rst 
priority ....)
I am somewhat confused .Please any help?

Regards


From alessandro.ren at opservices.com.br  Fri Sep 29 15:39:34 2006
From: alessandro.ren at opservices.com.br (Alessandro Ren)
Date: Fri Sep 29 15:39:49 2006
Subject: [LARTC] Problem with Load Balancing
In-Reply-To: <4986F8D166F1E44CBA92A91C98ACAD5214CF36@sql_server>
References: <4986F8D166F1E44CBA92A91C98ACAD5214CF36@sql_server>
Message-ID: <451D2216.6090804@opservices.com.br>


    The second connections will problably gets routed though the same 
link because of route cache I think.

    []s.

William T Mullaney wrote:
>
> Well, if you had a download manager and the system at the other side 
> allowed you to start your transfers in the middle of the file (which 
> isn't out of the question) that could potentially work.  The problem 
> is that as far as I see, there's nothing to force the second 
> connection onto the second line.  It's been kind of a crap shoot of 
> what line gets more information.  In theory you could start the first 
> download stream (and it's routed to ISP A), then perhaps your email 
> client goes out to check your POP account, so that goes over ISP B.  
> The next connection, the second stream, now goes out over ISP B 
> again.  Honestly I don't know exactly how the equalize command for ip 
> route works, though I would think it says to always use the "less 
> used" connection (perhaps on PPS, BPS, % use, whatever, on a per 
> second, 30 second, minute average?), but in my experience that and the 
> weight options don't ever get you exactly 50/50 (or whatever you 
> specify) traffic. 
>
> Things like bit torrent would probably perform better because there 
> are (possibly) many streams for each file, as would having 50 people 
> downloading files vs one.  It seems to be just like rolling dice, if 
> you only roll twice you might get two evens or two odds, but if you 
> roll tons of times, you should tend to get a more even distribution.
>
> -Will
>
> -----Original Message-----
> From: Raj Mathur [mailto:raju@linux-delhi.org]
> Sent: Sunday, September 24, 2006 2:49 PM
> To: lartc@mailman.ds9a.nl
> Subject: RE: [LARTC] Problem with Load Balancing
>
> >>>>> "William" == William T Mullaney <William> writes:
>
>     William> To my knowledge, there is no way to download one file
>     William> from two different connections connected to two different
>     William> ISPs at the same time.  If you are running BGP then you
>     William> might be able to load balance across the two links, but
>     William> that would require your upstream providers to allow you
>     William> to use it, and possibly the purchase of a public AS
>     William> number an IP address space depending on the setup.  If
>     William> you are doing NAT past this link (IE both of your lines
>     William> go two the same ISP and same address blocks, but they
>     William> want to give you 2x 10mb links for 20mb total), then you
>     William> can look at doing load balancing on layer 2 (Fast
>     William> EtherChannel, bonding, Link Aggregate Groups, whatever),
>     William> or creating 2 PPP style links between the computers and
>     William> using a routing protocol like OSPF, EIGRP (but not on
>     William> Linux) or something.  I believe OSPF does equal cost load
>     William> balancing, BGP and EIGRP can, I think, do unequal cost
>     William> load balancing.  But either way, I don't think that's the
>     William> solution in your case.
>
>     William> The only other option I can think of would be some sort
>     William> of software that sends every other packet to a different
>     William> IP or something, which would need to run at the end you
>     William> are downloading at or maybe at your ISPs, but I can't
>     William> think of anything like that.
>
> Wouldn't some download manager software that splits the file up into 
> multiple simultaneous downloads do the trick?  Agreed, not a single 
> download across multiple ISPs, but definitely a single file across 
> multiple ISPs.
>
> Regards,
>
> -- Raju
> -- 
> Raj Mathur                raju@kandalaya.org      http://kandalaya.org/
>        GPG: 78D4 FC67 367F 40E2 0DD5  0FEF C968 D0EF CC68 D17F
>                       It is the mind that moves 
> _______________________________________________
> LARTC mailing list
> LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
>
> ______________________________________________________________________
> This email has been scanned by the MessageLabs Email Security System.
> For more information please visit http://www.messagelabs.com/email 
> ______________________________________________________________________
>
> ------------------------------------------------------------------------
>
> _______________________________________________
> LARTC mailing list
> LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
>   
From J.Kraaijeveld at Askesis.nl  Sat Sep 30 22:30:26 2006
From: J.Kraaijeveld at Askesis.nl (Joost Kraaijeveld)
Date: Sat Sep 30 22:30:29 2006
Subject: [LARTC] Bandwidth management on intermediate router mac address
Message-ID: <A3D1526C98B7C1409A687E0943EAC410605FDF@obelix.askesis.nl>

Hi,

Is it possible to manage bandwidth based on a router macaddress that is between two machines?

E.g.

dest<-->bandwidth management <-->router<-->source

Groeten,

Joost Kraaijeveld
Askesis B.V.
Molukkenstraat 14
6524NB Nijmegen
tel: 024-3888063 / 06-51855277
fax: 024-3608416
e-mail: J.Kraaijeveld@Askesis.nl
web: www.askesis.nl