How does Linux implement POLICING?

How does Linux implement POLICING?

[dE]

I realized Linux does not have ingress queue. So does it drop packet to 
limit the incoming rate?

Linux's network queueing system is well implemented for servers, but for 
making the desktop Internet more responsive, it doesn't do much in my 
option and the reason is missing ingress queue.

On a desktop system, most of the packets sent are practically empty; the 
incoming packets are filled with data.

So the ISP either drops packets to limit the incoming rate, or queues 
them till a certain limit and sends then at the throttled rate.

Policing combined with ingress queue can effectively implement the queue 
on the local system rather than the queue being formed at the ISPs end 
giving the local user control over the priority of incoming packets.

By not sending the incoming packet to the destined application, it'll 
prevent the application from responding to it.

Re: How does Linux implement POLICING?

[Dave Taht]

I have basically come to the conclusion that conventional policing (a
fixed size buffer limit) cannot be made to work well in todays wide
range of speeds and RTTs.

Linux has the ifb and imq devices to which you can attach a rate
limiter like htb and an aqm/packet scheduler like fq_codel, and use
the action "mirred" to redirect incoming traffic through it.

Some results from doing things that way rather than using the "police" action.

http://pieknywidok.blogspot.com/2014/05/10g-1g.html

http://www.bufferbloat.net/projects/cerowrt/wiki/Wondershaper_Must_Die

http://snapon.lab.bufferbloat.net/~cero2/jimreisert/results.html


On Tue, May 27, 2014 at 10:10 AM, dE <de.techno@gmail.com> wrote:
> I realized Linux does not have ingress queue. So does it drop packet to
> limit the incoming rate?
>
> Linux's network queueing system is well implemented for servers, but for
> making the desktop Internet more responsive, it doesn't do much in my option
> and the reason is missing ingress queue.
>
> On a desktop system, most of the packets sent are practically empty; the
> incoming packets are filled with data.
>
> So the ISP either drops packets to limit the incoming rate, or queues them
> till a certain limit and sends then at the throttled rate.
>
> Policing combined with ingress queue can effectively implement the queue on
> the local system rather than the queue being formed at the ISPs end giving
> the local user control over the priority of incoming packets.
>
> By not sending the incoming packet to the destined application, it'll
> prevent the application from responding to it.
> --
> To unsubscribe from this list: send the line "unsubscribe lartc" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html



-- 
Dave Täht

NSFW: https://w2.eff.org/Censorship/Internet_censorship_bills/russell_0296_indecent.article