All of lore.kernel.org
 help / color / mirror / Atom feed
From: bert hubert <ahu@ds9a.nl>
To: lartc@vger.kernel.org
Subject: Re: [LARTC] tc: u32 match in nexthdr not working?
Date: Fri, 14 Dec 2001 00:13:56 +0000	[thread overview]
Message-ID: <marc-lartc-100828887524329@msgid-missing> (raw)
In-Reply-To: <marc-lartc-100827285418750@msgid-missing>

On Thu, Dec 13, 2001 at 08:46:57PM +0100, Lutz Pressler wrote:

> The following has no effect on 2.4.16 or older (even 2.2) kernels:
> 
> # tc filter add dev eth0 parent ffff: protocol ip prio 50 u32 match tcp
> dst 3128 0xffff police rate 40kbit burst 10k drop flowid :1

Double check what this means! This limits speed of data *coming in to* your
proxy from a client (browser). That is not a lot - most data will flow he
other way, and will indeed not be matched.

Data being received BY your proxy from the internet is not matched by this
proxy.

> Even if
> # tc filter ls dev eth0 parent ffff:
> filter protocol ip pref 50 u32
> filter protocol ip pref 50 u32 fh 800: ht divisor 1

> filter protocol ip pref 50 u32 fh 800::800 order 2048 key ht 800 bkt 0
> flowid :1 police 4 action drop rate 40Kbit burst 10Kb mtu 2Kb
>   match 00000c38/0000ffff at nexthdr+0

You supply a lot of redundant information. I'm not sure what the '4' means
in this rule.

> looks reasonable, TCP connections to port 3128 are not policed.
> 
> If I use "match ip dst <ip-address>" instead, the policing works.

Your proxy does no necessarily download FROM port 3128! 

Regards,

bert

-- 
http://www.PowerDNS.com          Versatile DNS Software & Services
Trilab                                 The Technology People
Netherlabs BV / Rent-a-Nerd.nl           - Nerd Available -
'SYN! .. SYN|ACK! .. ACK!' - the mating call of the internet

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://ds9a.nl/lartc/

  reply	other threads:[~2001-12-14  0:13 UTC|newest]

Thread overview: 12+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2001-12-13 19:46 [LARTC] tc: u32 match in nexthdr not working? Lutz Pressler
2001-12-14  0:13 ` bert hubert [this message]
2001-12-14  7:36 ` Lutz Pressler
2001-12-14 12:10 ` Lutz Pressler
2001-12-14 12:56 ` Julian Anastasov
2001-12-14 12:58 ` bert hubert
2001-12-14 13:15 ` Julian Anastasov
2001-12-14 13:32 ` bert hubert
2001-12-14 13:54 ` Julian Anastasov
2001-12-14 15:16 ` Henrik Nordstrom
2001-12-14 19:59 ` Michael T. Babcock
2001-12-14 23:00 ` bert hubert

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=marc-lartc-100828887524329@msgid-missing \
    --to=ahu@ds9a.nl \
    --cc=lartc@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.