Building nth and random matches

Building nth and random matches

[Robie Basak]

Hi,

I can't seem to get the nth or random match extensions working. 
Ultimately I want to create custom installable Debian packages which 
give me them for deployment across our network.

Evidently they exist as the manpage for iptables in Ubuntu (version 
1.3.5.0debian1-1ubuntu2) as does the Netfilter Extensions HOWTO.

However, I can't find them in vanilla linux-2.6.21.5, in Debian linux 
2.6.18.dfsg.1 (current stable) nor in patch-o-matic-ng, and the original 
patch-o-matic is listed as obsolete and doesn't apply the patch ("2 
files missing")

Incidentally, the Extensions HOWTO is presumably outdated as it refers 
to CVS but you seem to have moved to Subversion at some point.

What do I need to do? In particular I could do with having the random 
match. Is it a case of porting it from the old p-o-m to ng?

I'm happy to attempt the port if this is what is needed. Is there 
anything in particular I need to change or does it just boil down to 
build system differences?

Thanks,
Robie.

Re: Building nth and random matches

[Jan Engelhardt]

On Jul 3 2007 11:26, Robie Basak wrote:
>Subject: Building nth and random matches

Because they are named statistic now...



>
> Hi,
>
> I can't seem to get the nth or random match extensions working. Ultimately I
> want to create custom installable Debian packages which give me them for
> deployment across our network.
>
> Evidently they exist as the manpage for iptables in Ubuntu (version
> 1.3.5.0debian1-1ubuntu2) as does the Netfilter Extensions HOWTO.
>
> However, I can't find them in vanilla linux-2.6.21.5, in Debian linux
> 2.6.18.dfsg.1 (current stable) nor in patch-o-matic-ng, and the original
> patch-o-matic is listed as obsolete and doesn't apply the patch ("2 files
> missing")
>
> Incidentally, the Extensions HOWTO is presumably outdated as it refers to CVS
> but you seem to have moved to Subversion at some point.
>
> What do I need to do? In particular I could do with having the random match. Is
> it a case of porting it from the old p-o-m to ng?
>
> I'm happy to attempt the port if this is what is needed. Is there anything in
> particular I need to change or does it just boil down to build system
> differences?
>
> Thanks,
> Robie.
>
>

	Jan
-- 

Re: [PATCH] Building nth and random matches

[Robie Basak]

On Tue, Jul 03, 2007 at 12:33:17PM +0200, Jan Engelhardt wrote:
> 
> On Jul 3 2007 11:26, Robie Basak wrote:
> >Subject: Building nth and random matches
> 
> Because they are named statistic now...

Aha - thanks!

Though in that case, have a patch to add some documentation :)

diff -urN iptables.orig/extensions/libipt_statistic.man iptables/extensions/libipt_statistic.man
--- iptables.orig/extensions/libipt_statistic.man	1970-01-01 01:00:00.000000000 +0100
+++ iptables/extensions/libipt_statistic.man	2007-07-04 10:46:32.000000000 +0100
@@ -0,0 +1,33 @@
+This module matches some statistical subset of packets.
+.TP
+.BI "--mode " "nth|random"
+Specify which statistical mode to use as follows:
+.RS
+.TP
+.BR "nth" :
+This option matches every `n'th packet
+.RS
+.TP
+.BI "--every " n
+Match every `n'th packet
+.TP
+.BI "--packet " p
+.I (optional)
+Initial counter value (0 <=
+.I p
+<=
+.I n
+- 1, default 0)
+.RE
+.RE
+.RS
+.TP
+.BR "random" :
+This option randomly matches a certain fraction of all packets.
+.RS
+.TP
+.BI "--probability " p
+.I p
+must be between 0 and 1
+.RE
+.RE