All of lore.kernel.org
 help / color / mirror / Atom feed
From: Lutz Pressler <Lutz.Pressler@SerNet.DE>
To: lartc@vger.kernel.org
Subject: Re: [LARTC] tc: u32 match in nexthdr not working?
Date: Fri, 14 Dec 2001 07:36:17 +0000	[thread overview]
Message-ID: <marc-lartc-100831545027810@msgid-missing> (raw)
In-Reply-To: <marc-lartc-100827285418750@msgid-missing>

On Fri, 14 Dec 2001, bert hubert wrote:

> On Thu, Dec 13, 2001 at 08:46:57PM +0100, Lutz Pressler wrote:
>
> > The following has no effect on 2.4.16 or older (even 2.2) kernels:
> >
> > # tc filter add dev eth0 parent ffff: protocol ip prio 50 u32 match tcp
> > dst 3128 0xffff police rate 40kbit burst 10k drop flowid :1
>
> Double check what this means! This limits speed of data *coming in to* your
> proxy from a client (browser). That is not a lot - most data will flow he
> other way, and will indeed not be matched.
>
Sorry, that was a typo (I forget that I tried the other way too, to be
complete, before doing the cut&paste). Of course "src 3128"!
> Data being received BY your proxy from the internet is not matched by this
> proxy.
>
> > Even if
> > # tc filter ls dev eth0 parent ffff:
> > filter protocol ip pref 50 u32
> > filter protocol ip pref 50 u32 fh 800: ht divisor 1
>
> > filter protocol ip pref 50 u32 fh 800::800 order 2048 key ht 800 bkt 0
> > flowid :1 police 4 action drop rate 40Kbit burst 10Kb mtu 2Kb
> >   match 00000c38/0000ffff at nexthdr+0
and "match 0c380000/ffff0000" here.
>
> You supply a lot of redundant information. I'm not sure what the '4' means
> in this rule.
Neither do I, haven't set it explicitly. Seems to increase with every
change in policing rules.
>
> > looks reasonable, TCP connections to port 3128 are not policed.
> >
> > If I use "match ip dst <ip-address>" instead, the policing works.
>
> Your proxy does no necessarily download FROM port 3128!
I did that - as a test, real situation is not about 3128 - on the client,
not the proxy.

Lutz

-- 
  _              |  Lutz Pressler          |  Tel: ++49-551-3700002
 |_     |\ |     |  Service Network GmbH   |  FAX: ++49-551-3700009
 ._|ER  | \|ET   |  Bahnhofsallee 1b       |   mailto:lp@SerNet.DE
Service Network  |  D-37081 Goettingen     |  http://www.SerNet.DE/


_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://ds9a.nl/lartc/

  parent reply	other threads:[~2001-12-14  7:36 UTC|newest]

Thread overview: 12+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2001-12-13 19:46 [LARTC] tc: u32 match in nexthdr not working? Lutz Pressler
2001-12-14  0:13 ` bert hubert
2001-12-14  7:36 ` Lutz Pressler [this message]
2001-12-14 12:10 ` Lutz Pressler
2001-12-14 12:56 ` Julian Anastasov
2001-12-14 12:58 ` bert hubert
2001-12-14 13:15 ` Julian Anastasov
2001-12-14 13:32 ` bert hubert
2001-12-14 13:54 ` Julian Anastasov
2001-12-14 15:16 ` Henrik Nordstrom
2001-12-14 19:59 ` Michael T. Babcock
2001-12-14 23:00 ` bert hubert

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=marc-lartc-100831545027810@msgid-missing \
    --to=lutz.pressler@sernet.de \
    --cc=lartc@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.