[LARTC] Re: how flexible is ingress traffic policing to bandwidth limit?

[Damion de Soto <damion@snapgear.com>]

Greg,
> For some reason that hadn't occurred to me. That should work just fine. I
> guess I should mark the packets in iptables to avoid throttling traffic from
> gateway itself, or does match see the external ip?
The only (common) time you need to use iptables to mark traffic, is when you're using 
  egress qdiscs on your outbound (WAN) interface (to shape upload speeds) and want to 
filter based on private (LAN) IP address.

> IMQ does seem like a handy tool, but why is there a distinction at all between
> egress and ingress qdiscs at all? Why not just allow people to attach HTB as
> an ingress qdisc directly?
because you can't shape inbound traffic.  Shaping works by delaying the transmission, and
you can't delay packets that haven't arrived yet. Ingress policing just drops 
packets, and hopes the sender will slow down.

> I suppose in an ideal world the best thing would be to receive the packets,
> hand them to user-space, but not mark them as received, ie, not ack them. That
> avoids introducing any loss from the user point of view but still slows the
> flow down. But that seems fiddly and would only work for TCP I guess.
That's an interesting idea, but yeah... i think it might be a bit hard to implement, 
and violate far too many RFCs...

regards,

-- 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Damion de Soto - Software Engineer  email:     damion@snapgear.com
SnapGear - A CyberGuard Company ---    ph:         +61 7 3435 2809
  | Custom Embedded Solutions          fax:         +61 7 3891 3630
  | and Security Appliances            web: http://www.snapgear.com
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  ---  Free Embedded Linux Distro at   http://www.snapgear.org  ---
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/