[LARTC] Traffic control and logging?

[LARTC] Traffic control and logging?

[Justin Schoeman]

Hi all, I am new to tc on Linux, and am having some problems.  The basic 
set-up and use works wonderfully, but now I have run into a slight 
problem...

I am using tc qdiscs and filters to do my traffic shaping.  Now, I have 
a whole bunch of filters to classify the data, and they work well, 
however, after all my classifications are done, I still have data 
reaching the default flow. ALL of the data should have been classified - 
so I would really like to look at the data that is still not classified. 
  Is there any way to log these packets? Can any of the qdiscs log 
queued traffic in a sane way? Can I forward the traffic back to iptables 
in some way?

Any help would be greatly appreciated.

Thanks,
Justin
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

Re: [LARTC] Traffic control and logging?

[Justin Schoeman]

[-- Attachment #1: Type: text/plain, Size: 1723 bytes --]

OK - judging by the lack of response, I am assuming this is not possible?

I have started hacking on a simple patch to add support to qdiscs to dup 
their traffic to a dummy interface.

Simple test code for the prio qdisc, hardcoded for device id 5 as the 
dummy qdisc is attached.

The eventual idea is to add an optional argument 'dupdev' to all qdiscs. 
  If the qdisc has this argument set, then the packet is duplicated to 
that device, if not, nothing is altered.

The only real overhead is one NULL check in each enqueue function, so 
this should not really affect performance.

Is it worth while doing up this solution as a proper kernel patch (does 
it have any chance of being accepted, or should I just do it 
'quick-and-dirty' for my personal use?

Thanks,
Justin


Justin Schoeman wrote:
> Hi all, I am new to tc on Linux, and am having some problems.  The basic 
> set-up and use works wonderfully, but now I have run into a slight 
> problem...
> 
> I am using tc qdiscs and filters to do my traffic shaping.  Now, I have 
> a whole bunch of filters to classify the data, and they work well, 
> however, after all my classifications are done, I still have data 
> reaching the default flow. ALL of the data should have been classified - 
> so I would really like to look at the data that is still not classified. 
>  Is there any way to log these packets? Can any of the qdiscs log queued 
> traffic in a sane way? Can I forward the traffic back to iptables in 
> some way?
> 
> Any help would be greatly appreciated.
> 
> Thanks,
> Justin
> _______________________________________________
> LARTC mailing list / LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

[-- Attachment #2: dup.patch --]
[-- Type: text/plain, Size: 1463 bytes --]

--- sch_prio.c.old	2004-11-04 04:21:46.000000000 +0200
+++ sch_prio.c	2004-11-04 03:36:07.000000000 +0200
@@ -44,6 +44,7 @@
 	struct tcf_proto *filter_list;
 	u8  prio2band[TC_PRIO_MAX+1];
 	struct Qdisc *queues[TCQ_PRIO_BANDS];
+	struct net_device * dup_dev;
 };
 
 
@@ -99,7 +100,21 @@
 prio_enqueue(struct sk_buff *skb, struct Qdisc* sch)
 {
 	struct Qdisc *qdisc;
+	struct prio_sched_data *q = qdisc_priv(sch);
 	int ret = NET_XMIT_SUCCESS;
+	
+	if(q->dup_dev) {
+		struct sk_buff * dup_skb = skb_copy(skb, GFP_ATOMIC);
+		if(!dup_skb) {
+			printk(KERN_ERR "Error copying packet.\n");
+		} else {
+			dup_skb->dev = q->dup_dev;
+			if(dev_queue_xmit(dup_skb) < 0) {
+				printk(KERN_ERR "Error queueing duplicate packet on '%s'.\n", q->dup_dev->name);
+				kfree_skb(dup_skb);
+			}
+		}
+	}
 
 	qdisc = prio_classify(skb, sch, &ret);
 
@@ -210,6 +225,11 @@
 
 	for (prio=0; prio<q->bands; prio++)
 		qdisc_destroy(q->queues[prio]);
+	
+	if(q->dup_dev) {
+		dev_put(q->dup_dev);
+		q->dup_dev = NULL;
+	}
 }
 
 static int prio_tune(struct Qdisc *sch, struct rtattr *opt)
@@ -237,6 +257,13 @@
 		if (child != &noop_qdisc)
 			qdisc_destroy(child);
 	}
+
+	q->dup_dev = dev_get_by_index(5);
+	if(!q->dup_dev) {
+		printk(KERN_WARNING "PRIO: Network device 5 does not seem to exist?\n");
+		return -EINVAL;
+	}
+	printk(KERN_DEBUG "PRIO: Using device '%s' for dup'ing packets.\n", q->dup_dev->name);
 	sch_tree_unlock(sch);
 
 	for (i=0; i<=TC_PRIO_MAX; i++) {

Re: [LARTC] Traffic control and logging?

[Thomas Graf]

* Justin Schoeman <418A19E6.4040306@expertron.co.za> 2004-11-04 14:00
> OK - judging by the lack of response, I am assuming this is not possible?
> 
> I have started hacking on a simple patch to add support to qdiscs to dup 
> their traffic to a dummy interface.
> 
> Simple test code for the prio qdisc, hardcoded for device id 5 as the 
> dummy qdisc is attached.
> 
> The eventual idea is to add an optional argument 'dupdev' to all qdiscs. 
>  If the qdisc has this argument set, then the packet is duplicated to 
> that device, if not, nothing is altered.

Consider using the mirred action with a recent iproute2 binary. The
statistics won't be working properly yet though.
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/