* statistic match support in iptables snapshots @ 2006-08-31 13:21 Marco Berizzi 2006-08-31 13:26 ` Patrick McHardy 0 siblings, 1 reply; 8+ messages in thread From: Marco Berizzi @ 2006-08-31 13:21 UTC (permalink / raw) To: netfilter-devel I would like to test the new statistic match before linux 2.6.18 final. May be possible to include the support library in an iptables daily snapshots? TIA ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: statistic match support in iptables snapshots 2006-08-31 13:21 statistic match support in iptables snapshots Marco Berizzi @ 2006-08-31 13:26 ` Patrick McHardy 2006-08-31 14:11 ` Marco Berizzi 0 siblings, 1 reply; 8+ messages in thread From: Patrick McHardy @ 2006-08-31 13:26 UTC (permalink / raw) To: Marco Berizzi; +Cc: netfilter-devel Marco Berizzi wrote: > I would like to test the new statistic match > before linux 2.6.18 final. May be possible > to include the support library in an iptables > daily snapshots? I've just added it SVN, it should appear in the next snapshot. ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: statistic match support in iptables snapshots 2006-08-31 13:26 ` Patrick McHardy @ 2006-08-31 14:11 ` Marco Berizzi 2006-08-31 14:31 ` Patrick McHardy 0 siblings, 1 reply; 8+ messages in thread From: Marco Berizzi @ 2006-08-31 14:11 UTC (permalink / raw) To: kaber; +Cc: netfilter-devel Patrick McHardy wrote: >Marco Berizzi wrote: > > I would like to test the new statistic match > > before linux 2.6.18 final. May be possible > > to include the support library in an iptables > > daily snapshots? > >I've just added it SVN, it should appear in the next snapshot. oohh thanks a lot for the quick response. Sorry for breaking you again: is not possible having multiple counters with 'nth mode'? I have taken a look at the source code: "statistic match v%s options:\n" " --mode mode Match mode (random, nth)\n" " random mode:\n" " --probability p Probability\n" " nth mode:\n" " --every n Match every nth packet\n" " --packet p Initial counter value (0 <= p <= n-1, default 0)\n" "\n", ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: statistic match support in iptables snapshots 2006-08-31 14:11 ` Marco Berizzi @ 2006-08-31 14:31 ` Patrick McHardy 2006-08-31 15:08 ` Marco Berizzi 2006-09-04 13:05 ` Marco Berizzi 0 siblings, 2 replies; 8+ messages in thread From: Patrick McHardy @ 2006-08-31 14:31 UTC (permalink / raw) To: Marco Berizzi; +Cc: netfilter-devel Marco Berizzi wrote: > Sorry for breaking you again: is not possible > having multiple counters with 'nth mode'? No, why is that useful? You can just use multiple matches. ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: statistic match support in iptables snapshots 2006-08-31 14:31 ` Patrick McHardy @ 2006-08-31 15:08 ` Marco Berizzi 2006-08-31 15:38 ` Patrick McHardy 2006-09-04 13:05 ` Marco Berizzi 1 sibling, 1 reply; 8+ messages in thread From: Marco Berizzi @ 2006-08-31 15:08 UTC (permalink / raw) To: kaber; +Cc: netfilter-devel Patrick McHardy wrote: >Marco Berizzi wrote: > > Sorry for breaking you again: is not possible > > having multiple counters with 'nth mode'? > >No, why is that useful? You can just use multiple matches. ok, it's clear. Just the last question. I have tried to insert a couple of rules with an out of range packet number and the kernel has eaten them: iptables -A FORWARD -m statistic --mode nth --every 2 --packet 0 -j ACCEPT iptables -A FORWARD -m statistic --mode nth --every 2 --packet 1 -j ACCEPT iptables -A FORWARD -m statistic --mode nth --every 2 --packet 2 -j ACCEPT iptables -A FORWARD -m statistic --mode nth --every 2 --packet 20 -j ACCEPT iptables -nvxL Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 0 0 ACCEPT 0 -- * * 0.0.0.0/0 0.0.0.0/0 statistic mode nth every 2 0 0 ACCEPT 0 -- * * 0.0.0.0/0 0.0.0.0/0 statistic mode nth every 2 packet 1 0 0 ACCEPT 0 -- * * 0.0.0.0/0 0.0.0.0/0 statistic mode nth every 2 packet 2 0 0 ACCEPT 0 -- * * 0.0.0.0/0 0.0.0.0/0 statistic mode nth every 2 packet 20 uname -a Linux Calimero 2.6.18-rc5 #1 PREEMPT Mon Aug 28 10:25:52 CEST 2006 i686 unknown unknown GNU/Linux ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: statistic match support in iptables snapshots 2006-08-31 15:08 ` Marco Berizzi @ 2006-08-31 15:38 ` Patrick McHardy 0 siblings, 0 replies; 8+ messages in thread From: Patrick McHardy @ 2006-08-31 15:38 UTC (permalink / raw) To: Marco Berizzi; +Cc: netfilter-devel Marco Berizzi wrote: > Patrick McHardy wrote: > >> Marco Berizzi wrote: >> > Sorry for breaking you again: is not possible >> > having multiple counters with 'nth mode'? >> >> No, why is that useful? You can just use multiple matches. > > > ok, it's clear. > > Just the last question. I have tried to insert a couple of > rules with an out of range packet number and the kernel has > eaten them: > > iptables -A FORWARD -m statistic --mode nth --every 2 --packet 0 -j ACCEPT > iptables -A FORWARD -m statistic --mode nth --every 2 --packet 1 -j ACCEPT > iptables -A FORWARD -m statistic --mode nth --every 2 --packet 2 -j ACCEPT > iptables -A FORWARD -m statistic --mode nth --every 2 --packet 20 -j ACCEPT Mhh thats more something for userspace to catch in my opinion, I'll add a check there. ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: statistic match support in iptables snapshots 2006-08-31 14:31 ` Patrick McHardy 2006-08-31 15:08 ` Marco Berizzi @ 2006-09-04 13:05 ` Marco Berizzi 2006-09-04 13:37 ` Patrick McHardy 1 sibling, 1 reply; 8+ messages in thread From: Marco Berizzi @ 2006-09-04 13:05 UTC (permalink / raw) To: kaber; +Cc: netfilter-devel Patrick McHardy wrote: >Marco Berizzi wrote: > > Sorry for breaking you again: is not possible > > having multiple counters with 'nth mode'? > >No, why is that useful? You can just use multiple matches. Hi Patrick, me again sorry. I'm testing 2.6.18-rc6 + iptables-1.3.5-20060902 I'm trying to do a simple load-balacing between two adsl lines. This is my postrouting chain in the nat table: 6455 387300 SNAT tcp -- * eth0 hdsl_ip !172.16.0.0/12 multiport dports 20,21,80,123,443,2080,8080,8201,10000,8102,1443 statistic mode nth every 2 to:adsl_b_ip 3227 193620 SNAT tcp -- * eth0 hdsl_ip !172.16.0.0/12 multiport dports 20,21,80,123,443,2080,8080,8201,10000,8102,1443 statistic mode nth every 2 packet 1 to:adsl_a_ip This is a tcpdump capture taken on the eth0 (external nic): 14:46:16.783465 IP (tos 0x0, ttl 64, id 28099, offset 0, flags [DF], proto: TCP (6), length: 60) adsl_ip_a.3808 > 217.199.3.51.80: S, 14:46:17.493837 IP (tos 0x0, ttl 64, id 1810, offset 0, flags [DF], proto: TCP (6), length: 60) adsl_ip_b.2130 > 217.199.3.51.80: S, 14:46:17.634456 IP (tos 0x0, ttl 64, id 59103, offset 0, flags [DF], proto: TCP (6), length: 60) hdsl_ip.3929 > 217.199.3.34.80: S, 14:46:17.672954 IP (tos 0x0, ttl 64, id 25522, offset 0, flags [DF], proto: TCP (6), length: 60) adsl_ip_b.1291 > 217.199.3.51.80: S, 14:46:19.316781 IP (tos 0x0, ttl 64, id 5334, offset 0, flags [DF], proto: TCP (6), length: 60) adsl_ip_a.3296 > 207.46.115.7.80: S, 14:46:20.231297 IP (tos 0x0, ttl 64, id 18663, offset 0, flags [DF], proto: TCP (6), length: 60) adsl_ip_b.3196 > 207.46.115.13.80: S, 14:46:21.186856 IP (tos 0x0, ttl 64, id 12641, offset 0, flags [DF], proto: TCP (6), length: 60) hdsl_ip.1196 > 216.120.228.12.80: S, 14:46:27.217423 IP (tos 0x0, ttl 64, id 54559, offset 0, flags [DF], proto: TCP (6), length: 60) adsl_ip_b.2128 > 207.46.115.14.80: S, 14:46:27.919826 IP (tos 0x0, ttl 64, id 25297, offset 0, flags [DF], proto: TCP (6), length: 60) adsl_ip_a.4349 > 207.46.115.3.80: S, 14:46:31.697147 IP (tos 0x0, ttl 64, id 21406, offset 0, flags [DF], proto: TCP (6), length: 60) adsl_ip_b.1545 > 207.46.115.6.80: S, 14:46:32.484631 IP (tos 0x0, ttl 64, id 2001, offset 0, flags [DF], proto: TCP (6), length: 60) hdsl_ip.4650 > 207.46.115.14.80: S, 14:46:34.996772 IP (tos 0x0, ttl 64, id 16676, offset 0, flags [DF], proto: TCP (6), length: 60) adsl_ip_b.2644 > 195.149.150.239.80: S, 14:46:35.726995 IP (tos 0x0, ttl 64, id 36671, offset 0, flags [DF], proto: TCP (6), length: 60) adsl_ip_a.3929 > 85.248.115.230.80: S, As you may see sometimes the hdsl_ip isn't nated, so I have modified the the rule: 421 25260 SNAT tcp -- * eth0 hdsl_ip !172.16.0.0/12 multiport dports 20,21,80,123,443,2080,8080,8201,10000,8102,1443 statistic mode nth every 2 to:adsl_b_ip 211 12660 SNAT tcp -- * eth0 hdsl_ip !172.16.0.0/12 multiport dports 20,21,80,123,443,2080,8080,8201,10000,8102,1443 statistic mode nth every 2 to:adsl_a_ip but results doesn't change... Am I missing anything? 14:55:39.524501 IP (tos 0x0, ttl 64, id 55823, offset 0, flags [DF], proto: TCP (6), length: 60) adsl_ip_a.2843 > 207.46.115.7.80: S, 14:55:39.535730 IP (tos 0x0, ttl 64, id 13613, offset 0, flags [DF], proto: TCP (6), length: 60) adsl_ip_b.3219 > 64.202.119.131.80: S, 14:55:40.468068 IP (tos 0x0, ttl 64, id 12719, offset 0, flags [DF], proto: TCP (6), length: 60) adsl_ip_b.2253 > 207.46.115.13.80: S, 14:55:40.779029 IP (tos 0x0, ttl 64, id 35299, offset 0, flags [DF], proto: TCP (6), length: 60) adsl_ip_a.3051 > 72.14.221.147.80: S, 14:55:45.413782 IP (tos 0x0, ttl 64, id 5390, offset 0, flags [DF], proto: TCP (6), length: 60) hdsl_ip.3908 > 194.20.158.101.80: S, 14:55:45.702878 IP (tos 0x0, ttl 64, id 9809, offset 0, flags [DF], proto: TCP (6), length: 60) adsl_ip_b.1443 > 195.110.122.162.80: S, 14:55:45.972760 IP (tos 0x0, ttl 64, id 31590, offset 0, flags [DF], proto: TCP (6), length: 60) adsl_ip_a.2182 > 195.110.122.162.80: S, 14:55:46.322893 IP (tos 0x0, ttl 64, id 4527, offset 0, flags [DF], proto: TCP (6), length: 60) adsl_ip_b.1222 > 195.110.122.162.80: S, 14:55:46.360383 IP (tos 0x0, ttl 64, id 64233, offset 0, flags [DF], proto: TCP (6), length: 60) hdsl_ip.4970 > 207.46.115.2.80: S, 14:55:46.456994 IP (tos 0x0, ttl 64, id 56844, offset 0, flags [DF], proto: TCP (6), length: 60) adsl_ip_b.4875 > 195.110.126.136.80: S, 14:55:46.564861 IP (tos 0x0, ttl 64, id 34169, offset 0, flags [DF], proto: TCP (6), length: 60) adsl_ip_a.4448 > 212.239.41.101.80: S, 14:55:48.146673 IP (tos 0x0, ttl 64, id 964, offset 0, flags [DF], proto: TCP (6), length: 60) adsl_ip_b.2207 > 207.46.115.3.80: S, 14:55:48.575692 IP (tos 0x0, ttl 64, id 62414, offset 0, flags [DF], proto: TCP (6), length: 60) hdsl_ip.1461 > 213.92.76.114.80: S, 14:55:48.710787 IP (tos 0x0, ttl 64, id 30414, offset 0, flags [DF], proto: TCP (6), length: 60) adsl_ip_b.3742 > 212.162.68.25.80: S, 14:55:49.454996 IP (tos 0x0, ttl 64, id 56845, offset 0, flags [DF], proto: TCP (6), length: 60) adsl_ip_b.4875 > 195.110.126.136.80: S, 14:55:50.086620 IP (tos 0x0, ttl 64, id 54523, offset 0, flags [DF], proto: TCP (6), length: 60) hdsl_ip.2023 > 213.92.76.114.80: S, 14:55:50.297110 IP (tos 0x0, ttl 64, id 49994, offset 0, flags [DF], proto: TCP (6), length: 60) adsl_ip_b.4284 > 207.46.115.8.80: S, 14:55:52.519131 IP (tos 0x0, ttl 64, id 919, offset 0, flags [DF], proto: TCP (6), length: 60) adsl_ip_a.1180 > 207.46.115.14.80: S, 14:55:52.569335 IP (tos 0x0, ttl 64, id 60555, offset 0, flags [DF], proto: TCP (6), length: 60) adsl_ip_b.4164 > 207.46.115.6.80: S, 14:55:53.318467 IP (tos 0x0, ttl 64, id 1412, offset 0, flags [DF], proto: TCP (6), length: 60) adsl_ip_b.1104 > 207.46.115.6.80: S, 14:55:53.952161 IP (tos 0x0, ttl 64, id 31980, offset 0, flags [DF], proto: TCP (6), length: 60) adsl_ip_a.4005 > 213.92.76.114.80: S, 14:55:54.102702 IP (tos 0x0, ttl 64, id 36293, offset 0, flags [DF], proto: TCP (6), length: 60) adsl_ip_b.3646 > 213.92.76.114.80: S, 14:55:55.914552 IP (tos 0x0, ttl 64, id 9611, offset 0, flags [DF], proto: TCP (6), length: 60) hdsl_ip.3636 > 194.20.158.101.80: S, 14:55:56.230173 IP (tos 0x0, ttl 64, id 57379, offset 0, flags [DF], proto: TCP (6), length: 60) adsl_ip_b.4272 > 195.110.122.162.80: S, 14:55:56.363610 IP (tos 0x0, ttl 64, id 25956, offset 0, flags [DF], proto: TCP (6), length: 60) adsl_ip_a.1527 > 207.46.115.2.80: S, 14:55:57.472111 IP (tos 0x0, ttl 64, id 9560, offset 0, flags [DF], proto: TCP (6), length: 60) adsl_ip_b.4967 > 72.14.221.99.80: S, 14:55:57.980268 IP (tos 0x0, ttl 64, id 9540, offset 0, flags [DF], proto: TCP (6), length: 60) hdsl_ip.4185 > 72.14.221.104.80: S, 14:55:59.532299 IP (tos 0x0, ttl 64, id 62589, offset 0, flags [DF], proto: TCP (6), length: 60) adsl_ip_b.1091 > 207.46.115.7.80: S, 14:56:00.471094 IP (tos 0x0, ttl 64, id 24450, offset 0, flags [DF], proto: TCP (6), length: 60) adsl_ip_a.3713 > 207.46.115.13.80: S, 14:56:00.636757 IP (tos 0x0, ttl 64, id 37289, offset 0, flags [DF], proto: TCP (6), length: 60) adsl_ip_b.2526 > 195.110.122.162.80: S, 14:56:01.101303 IP (tos 0x0, ttl 64, id 38086, offset 0, flags [DF], proto: TCP (6), length: 60) hdsl_ip.1506 > 195.110.126.136.80: S, 14:56:01.292540 IP (tos 0x0, ttl 64, id 3092, offset 0, flags [DF], proto: TCP (6), length: 60) adsl_ip_b.3287 > 217.212.240.172.80: S, ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: statistic match support in iptables snapshots 2006-09-04 13:05 ` Marco Berizzi @ 2006-09-04 13:37 ` Patrick McHardy 0 siblings, 0 replies; 8+ messages in thread From: Patrick McHardy @ 2006-09-04 13:37 UTC (permalink / raw) To: Marco Berizzi; +Cc: netfilter-devel Marco Berizzi wrote: > 6455 387300 SNAT tcp -- * eth0 hdsl_ip > !172.16.0.0/12 multiport dports > 20,21,80,123,443,2080,8080,8201,10000,8102,1443 statistic mode nth every > 2 to:adsl_b_ip > 3227 193620 SNAT tcp -- * eth0 hdsl_ip > !172.16.0.0/12 multiport dports > 20,21,80,123,443,2080,8080,8201,10000,8102,1443 statistic mode nth every > 2 packet 1 to:adsl_a_ip > > This is a tcpdump capture taken on the eth0 (external nic): > > 14:46:16.783465 IP (tos 0x0, ttl 64, id 28099, offset 0, flags [DF], > proto: TCP (6), length: 60) adsl_ip_a.3808 > 217.199.3.51.80: S, > 14:46:17.493837 IP (tos 0x0, ttl 64, id 1810, offset 0, flags [DF], > proto: TCP (6), length: 60) adsl_ip_b.2130 > 217.199.3.51.80: S, > 14:46:17.634456 IP (tos 0x0, ttl 64, id 59103, offset 0, flags [DF], > proto: TCP (6), length: 60) hdsl_ip.3929 > 217.199.3.34.80: S, > 14:46:17.672954 IP (tos 0x0, ttl 64, id 25522, offset 0, flags [DF], > proto: TCP (6), length: 60) adsl_ip_b.1291 > 217.199.3.51.80: S, > 14:46:19.316781 IP (tos 0x0, ttl 64, id 5334, offset 0, flags [DF], > proto: TCP (6), length: 60) adsl_ip_a.3296 > 207.46.115.7.80: S, > 14:46:20.231297 IP (tos 0x0, ttl 64, id 18663, offset 0, flags [DF], > proto: TCP (6), length: 60) adsl_ip_b.3196 > 207.46.115.13.80: S, > 14:46:21.186856 IP (tos 0x0, ttl 64, id 12641, offset 0, flags [DF], > proto: TCP (6), length: 60) hdsl_ip.1196 > 216.120.228.12.80: S, > 14:46:27.217423 IP (tos 0x0, ttl 64, id 54559, offset 0, flags [DF], > proto: TCP (6), length: 60) adsl_ip_b.2128 > 207.46.115.14.80: S, > 14:46:27.919826 IP (tos 0x0, ttl 64, id 25297, offset 0, flags [DF], > proto: TCP (6), length: 60) adsl_ip_a.4349 > 207.46.115.3.80: S, > 14:46:31.697147 IP (tos 0x0, ttl 64, id 21406, offset 0, flags [DF], > proto: TCP (6), length: 60) adsl_ip_b.1545 > 207.46.115.6.80: S, > 14:46:32.484631 IP (tos 0x0, ttl 64, id 2001, offset 0, flags [DF], > proto: TCP (6), length: 60) hdsl_ip.4650 > 207.46.115.14.80: S, > 14:46:34.996772 IP (tos 0x0, ttl 64, id 16676, offset 0, flags [DF], > proto: TCP (6), length: 60) adsl_ip_b.2644 > 195.149.150.239.80: S, > 14:46:35.726995 IP (tos 0x0, ttl 64, id 36671, offset 0, flags [DF], > proto: TCP (6), length: 60) adsl_ip_a.3929 > 85.248.115.230.80: S, > > As you may see sometimes the hdsl_ip isn't nated, > so I have modified the the rule: > > 421 25260 SNAT tcp -- * eth0 hdsl_ip > !172.16.0.0/12 multiport dports > 20,21,80,123,443,2080,8080,8201,10000,8102,1443 statistic mode nth every > 2 to:adsl_b_ip > 211 12660 SNAT tcp -- * eth0 hdsl_ip > !172.16.0.0/12 multiport dports > 20,21,80,123,443,2080,8080,8201,10000,8102,1443 statistic mode nth every > 2 to:adsl_a_ip > > but results doesn't change... > Am I missing anything? All NAT targets are terminal, so the first rule already eats half the packets and the second one only matches on one half of the remaining half. Try without nth in the second line. ^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2006-09-04 13:37 UTC | newest] Thread overview: 8+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2006-08-31 13:21 statistic match support in iptables snapshots Marco Berizzi 2006-08-31 13:26 ` Patrick McHardy 2006-08-31 14:11 ` Marco Berizzi 2006-08-31 14:31 ` Patrick McHardy 2006-08-31 15:08 ` Marco Berizzi 2006-08-31 15:38 ` Patrick McHardy 2006-09-04 13:05 ` Marco Berizzi 2006-09-04 13:37 ` Patrick McHardy
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.