QoS on dynamic port allocation protocols

QoS on dynamic port allocation protocols

[Antonio Paulo Salgado Forster]

Hello all,

      I'm trying to apply QoS rules on protocols that use dynamic port
allocation on secondary connections such as ftp or H323 that have a
specific iptables helper to handle them, and the problem begins when the
secondary connections startup.  Would the connmark module mark also the
seconday connections if you tells it to mark the main flow?  Or, is there
any way to to match a packet using, at the same time, the -m state --state
RELATED match and check if the related connection belongs to a ftp session?

Any ideas are appreciated. Thanks in advance.

Forster

Re: QoS on dynamic port allocation protocols

[Raymond Leach]

[-- Attachment #1: Type: text/plain, Size: 867 bytes --]

On Thu, 2003-03-13 at 03:09, Antonio Paulo Salgado Forster wrote:
> Hello all,
> 
>       I'm trying to apply QoS rules on protocols that use dynamic port
> allocation on secondary connections such as ftp or H323 that have a
> specific iptables helper to handle them, and the problem begins when the
> secondary connections startup.  Would the connmark module mark also the
> seconday connections if you tells it to mark the main flow?  Or, is there
> any way to to match a packet using, at the same time, the -m state --state
> RELATED match and check if the related connection belongs to a ftp session?
> 
> Any ideas are appreciated. Thanks in advance.
> 
> Forster

Depending on your QoS setup, you could use the -m state --state RELATED
and the fwmark patch to mark the packets. Then your QoS filters could be
triggered by the fwmark values.


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: QoS on dynamic port allocation protocols

[alexb]

But how do I distinguish RELATED connection from ftp and H323 ?
If I only whant to limit bandwidht for ftp and not for H323, how could I tell
iptable to mark only the RELATED packets from ftp connections ?

Thanks,

Alex

Cópia Raymond Leach <raymondl@knowledgefactory.co.za>:

> On Thu, 2003-03-13 at 03:09, Antonio Paulo Salgado Forster wrote:
> > Hello all,
> > 
> >       I'm trying to apply QoS rules on protocols that use dynamic
> port
> > allocation on secondary connections such as ftp or H323 that have a
> > specific iptables helper to handle them, and the problem begins when
> the
> > secondary connections startup.  Would the connmark module mark also
> the
> > seconday connections if you tells it to mark the main flow?  Or, is
> there
> > any way to to match a packet using, at the same time, the -m state
> --state
> > RELATED match and check if the related connection belongs to a ftp
> session?
> > 
> > Any ideas are appreciated. Thanks in advance.
> > 
> > Forster
> 
> Depending on your QoS setup, you could use the -m state --state
> RELATED
> and the fwmark patch to mark the packets. Then your QoS filters could
> be
> triggered by the fwmark values.
> 
> 

Re: QoS on dynamic port allocation protocols

[Eric Leblond]

On Thu, 2003-03-13 at 14:40, alexb@atix.com.br wrote:
> But how do I distinguish RELATED connection from ftp and H323 ?
> If I only whant to limit bandwidht for ftp and not for H323, how could I tell
> iptable to mark only the RELATED packets from ftp connections ?

You better use the connmark target to suit your need. You can find a
little doc about it on :
	http://home.regit.org/connmark.html
The process is the following :
	you mark initial packet
	connmark restore a mark related to the connection.

BR
-- 
Eric Leblond <eleblond@init-sys.com>
Init-Sys

Re: QoS on dynamic port allocation protocols

[Jozsef Kadlecsik]

On Thu, 13 Mar 2003 alexb@atix.com.br wrote:

> But how do I distinguish RELATED connection from ftp and H323 ?
> If I only whant to limit bandwidht for ftp and not for H323, how could I tell
> iptable to mark only the RELATED packets from ftp connections ?

Use the helper match.

Regards,
Jozsef
-
E-mail  : kadlec@blackhole.kfki.hu, kadlec@sunserv.kfki.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : KFKI Research Institute for Particle and Nuclear Physics
          H-1525 Budapest 114, POB. 49, Hungary