Re: iproute2 action/policer question

[Jarek Poplawski <jarkao2@gmail.com>]

On Mon, Jun 15, 2009 at 09:32:08AM -0400, jamal wrote:
> On Mon, 2009-06-15 at 11:19 +0000, Jarek Poplawski wrote:
> 
> > > This is only a sample but is not working
> 
> It does seem to be working!
> How did you reach conclusion it wasnt working?
> 
> > >         Action statistics:
> > >         Sent 42351 bytes 110 pkt (dropped 0, overlimits 32 requeues 0)
> > >         rate 0bit 0pps backlog 0b 0p requeues 0
> 
> 32 packets hit the policer - double check your parameters please to make
> sure they are correct.

Actually, I wonder if these "dropped 0" are OK here if we expect
dropping.

> 
> > According to iproute2/doc/actions/actions_general mangle targets
> > should work; and you could also try (if it doesn't work then probably
> > it can't be used...;-)
> 
> They should all be usable. If something crashes, there is a bug
> somewhere.
> 
> > But... I'm neither able to configure/compile it with the current
> > iproute2/iptables, nor test it with distro's builds (Debian testing).
> > After some checking I found iproute2 needs updating, because iptables
> > changes API (xtables.h) virtually with every new version, so I don't
> > even blame the ipt author or distro maintainer.
> > 
> 
> We are hopefully getting stable there. Anything on debian lenny
> should be working with iptables 1.4.3; i expect at most "one last
> change" (famous last words) to break backward compat as iptables 
> moves from version 1.4.3.

I've tried debian squeeze (testing) with: iptables v1.4.3.2, iproute2
-ss090324, and action ipt -j MARK doesn't work. AFAIK debian lenny
(stable) uses 1.4.2. I've also tried debian rescue probably based on
lenny (with iptables 1.4.2), and it seemed it didn't work yet (I'll
re-check this). When you have something new I'd be glad for Cc.

Thanks more than always Jamal,
Jarek P.