[LARTC] Wonder Shaper problem?

[LARTC] Wonder Shaper problem?

[Jason A. Pattie]

I think I have an issue with the Wonder Shaper script.  I setup my 
firewall to use the Wonder Shaper script with HTB (instead of CBQ).  My 
firewall has Squid running in transparent proxy mode, but I setup my 
browser to point to port 3128 (default Squid port).  I ran a ping 
session to www.yahoo.com and did an SSH at the same time that I 
downloaded the Linux kernel (~20MB).  It appears that most (if not all) 
of the traffic is being placed into the high priority class (queue? 
don't really know the difference yet) 10:.  Isn't it supposed to go to 
20: if it's not SSH or ICMP or ACK packets?  Here are the ping times 
from Yahoo! while doing the kernel download:

sh-2.05# ping www.yahoo.com
PING www.yahoo.akadns.net (64.58.76.227): 56 data bytes
64 bytes from 64.58.76.227: icmp_seq=0 ttl$1 time\x1959.8 ms
64 bytes from 64.58.76.227: icmp_seq=1 ttl$1 time\x1993.4 ms
64 bytes from 64.58.76.227: icmp_seq=2 ttl$1 time 18.8 ms
64 bytes from 64.58.76.227: icmp_seq=3 ttl$1 time\x1872.8 ms
64 bytes from 64.58.76.227: icmp_seq=4 ttl$1 time\x1895.7 ms
64 bytes from 64.58.76.227: icmp_seq=5 ttl$1 time 03.9 ms
64 bytes from 64.58.76.227: icmp_seq=6 ttl$1 time 26.3 ms
64 bytes from 64.58.76.227: icmp_seq=7 ttl$1 time 49.0 ms
64 bytes from 64.58.76.227: icmp_seq=8 ttl$1 time 75.7 ms
 
--- www.yahoo.akadns.net ping statistics ---
11 packets transmitted, 9 packets received, 18% packet loss
round-trip min/avg/max = 1872.8/1988.3/2075.7 ms

As you can see, they are very high, on the order of 2 seconds!!!??

When I stopped the kernel download, the ping results dropped to:

sh-2.05# ping www.yahoo.com
PING www.yahoo.akadns.net (64.58.76.176): 56 data bytes
64 bytes from 64.58.76.176: icmp_seq=0 ttl$1 time\x178.1 ms
64 bytes from 64.58.76.176: icmp_seq=1 ttl$1 time\x179.1 ms
64 bytes from 64.58.76.176: icmp_seq=2 ttl$1 time\x179.1 ms
64 bytes from 64.58.76.176: icmp_seq=3 ttl$1 time\x179.3 ms
64 bytes from 64.58.76.176: icmp_seq=4 ttl$1 time\x179.6 ms
64 bytes from 64.58.76.176: icmp_seq=5 ttl$1 time\x179.2 ms
 
--- www.yahoo.akadns.net ping statistics ---
6 packets transmitted, 6 packets received, 0% packet loss
round-trip min/avg/max = 178.1/179.0/179.6 ms

Here is the output of 'tc -s qdisc list':

sh-2.05# tc -s qdisc list
qdisc ingress ffff: dev eth0
 Sent 0 bytes 0 pkts (dropped 0, overlimits 0)
 
 qdisc sfq 20: dev eth0 quantum 1514b perturb 10sec
 Sent 44775 bytes 401 pkts (dropped 0, overlimits 0)
 
 qdisc sfq 10: dev eth0 quantum 1514b perturb 10sec
 Sent 166751 bytes 2494 pkts (dropped 0, overlimits 0)
 
 qdisc htb 1: dev eth0 r2q 10 default 20 dcache 0
 deq_util 1/1000000 deq_rate 0 trials_per_deq 0
 dcache_hits 0 direct_packets 0
 Sent 211526 bytes 2895 pkts (dropped 0, overlimits 0)

During the download and the ping, the SSH session is extremely sluggish. 
 But once both are stopped, the SSH session is very usable.

I'm using the 2.4.16 kernel patched with the HTB patch.

-- 
Jason A. Pattie
pattieja@pcxperience.com



_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://ds9a.nl/lartc/

Re: [LARTC] Wonder Shaper problem?

[bert hubert]

On Wed, Jan 02, 2002 at 10:20:03AM -0600, Jason A. Pattie wrote:
> I think I have an issue with the Wonder Shaper script.  I setup my 
> firewall to use the Wonder Shaper script with HTB (instead of CBQ).  My 
> firewall has Squid running in transparent proxy mode, but I setup my 
> browser to point to port 3128 (default Squid port).  I ran a ping 
> session to www.yahoo.com and did an SSH at the same time that I 
> downloaded the Linux kernel (~20MB).  It appears that most (if not all) 
> of the traffic is being placed into the high priority class (queue? 
> don't really know the difference yet) 10:.  Isn't it supposed to go to 
> 20: if it's not SSH or ICMP or ACK packets?  Here are the ping times 
> from Yahoo! while doing the kernel download:

tcpdump a bit - it may be that squid is misbehaving and giving its traffic
'minimum delay' TOS!

tcpdump -n -v -v

Regards,

bert

-- 
http://www.PowerDNS.com          Versatile DNS Software & Services
http://www.tk                              the dot in .tk
Netherlabs BV / Rent-a-Nerd.nl           - Nerd Available -
Linux Advanced Routing & Traffic Control: http://ds9a.nl/lartc

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://ds9a.nl/lartc/

Re: [LARTC] Wonder Shaper problem?

[Jason A. Pattie]

Would that require tcpdump on the firewall? or could I run tcpdump 
somewhere else on the network?  I'm trying to keep as many tools off the 
firewall as possible.  But I'll put tcpdump into the distro for testing.

bert hubert wrote:

>On Wed, Jan 02, 2002 at 10:20:03AM -0600, Jason A. Pattie wrote:
>
>>I think I have an issue with the Wonder Shaper script.  I setup my 
>>firewall to use the Wonder Shaper script with HTB (instead of CBQ).  My 
>>firewall has Squid running in transparent proxy mode, but I setup my 
>>browser to point to port 3128 (default Squid port).  I ran a ping 
>>session to www.yahoo.com and did an SSH at the same time that I 
>>downloaded the Linux kernel (~20MB).  It appears that most (if not all) 
>>of the traffic is being placed into the high priority class (queue? 
>>don't really know the difference yet) 10:.  Isn't it supposed to go to 
>>20: if it's not SSH or ICMP or ACK packets?  Here are the ping times 
>>from Yahoo! while doing the kernel download:
>>
>
>tcpdump a bit - it may be that squid is misbehaving and giving its traffic
>'minimum delay' TOS!
>
>tcpdump -n -v -v
>
>Regards,
>
>bert
>

-- 
Jason A. Pattie
pattieja@pcxperience.com




_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://ds9a.nl/lartc/

Re: [LARTC] Wonder Shaper problem?

[Jason A. Pattie]

Where in the output of tcdump does the TOS field appear?  I did the 
'tcpdump -n -v -v' on the firewall and dumped the output to a file as I 
started the Linux kernel download.  Is it appropriate to attach the 
output (I stopped it after around 250 packets)?

bert hubert wrote:

>On Wed, Jan 02, 2002 at 10:20:03AM -0600, Jason A. Pattie wrote:
>
>>I think I have an issue with the Wonder Shaper script.  I setup my 
>>firewall to use the Wonder Shaper script with HTB (instead of CBQ).  My 
>>firewall has Squid running in transparent proxy mode, but I setup my 
>>browser to point to port 3128 (default Squid port).  I ran a ping 
>>session to www.yahoo.com and did an SSH at the same time that I 
>>downloaded the Linux kernel (~20MB).  It appears that most (if not all) 
>>of the traffic is being placed into the high priority class (queue? 
>>don't really know the difference yet) 10:.  Isn't it supposed to go to 
>>20: if it's not SSH or ICMP or ACK packets?  Here are the ping times 
>>from Yahoo! while doing the kernel download:
>>
>
>tcpdump a bit - it may be that squid is misbehaving and giving its traffic
>'minimum delay' TOS!
>
>tcpdump -n -v -v
>
>Regards,
>
>bert
>

-- 
Jason A. Pattie
pattieja@pcxperience.com




_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://ds9a.nl/lartc/

Re: [LARTC] Wonder Shaper problem?

[Michael T. Babcock]

On Wed, Jan 02, 2002 at 12:04:28PM -0600, Jason A. Pattie wrote:
> Where in the output of tcdump does the TOS field appear?  I did the 
> 'tcpdump -n -v -v' on the firewall and dumped the output to a file as I 
> started the Linux kernel download.  Is it appropriate to attach the 
> output (I stopped it after around 250 packets)?

In the version I have of tcpdump TOS only shows up when its set to
something special.
-- 
Michael T. Babcock
CTO, FibreSpeed Ltd.     (Hosting, Security, Consultation, Database, etc)
http://www.fibrespeed.net/~mbabcock/

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://ds9a.nl/lartc/

Re: [LARTC] Wonder Shaper problem?

[Jason A. Pattie]

Found the TOS field was being set to 0x10 for "ftp" traffic and 0x08 for 
"http" traffic.  What significance does that play?  And it is either 
being done by Squid or by Mozilla, don't know how to tell which, though.

Michael T. Babcock wrote:

>On Wed, Jan 02, 2002 at 12:04:28PM -0600, Jason A. Pattie wrote:
>
>>Where in the output of tcdump does the TOS field appear?  I did the 
>>'tcpdump -n -v -v' on the firewall and dumped the output to a file as I 
>>started the Linux kernel download.  Is it appropriate to attach the 
>>output (I stopped it after around 250 packets)?
>>
>
>In the version I have of tcpdump TOS only shows up when its set to
>something special.
>

-- 
Jason A. Pattie
pattieja@pcxperience.com




_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://ds9a.nl/lartc/

Re: [LARTC] Wonder Shaper problem?

[Jason A. Pattie]

So then is there a way to modify the packet on the way out of squid to 
force it to be the TOS we want that will cause it to go to 20: instead 
of 10: ?  Maybe modification of squid is in order? to keep it from 
changing the TOS field?  (We have the source!  :) )

Or is there some other way to make it so that SSH traffic itself is 
bumped to higher priority than just the generic 0x10 TOS packets?  Maybe 
match on destination or source port 22?

Dhaval Patel wrote:

>i could be wrong its been some time since i did this but i think that 0x10 is
>for quick response time 0x08 is for high throughput  0x04 is for a more
>guranteed service or something like that. 
>
>hope this helps.
>
>"Jason A. Pattie" <pattieja@pcxperience.com> said:
>
>>Found the TOS field was being set to 0x10 for "ftp" traffic and 0x08 for 
>>"http" traffic.  What significance does that play?  And it is either 
>>being done by Squid or by Mozilla, don't know how to tell which, though.
>>
>>Michael T. Babcock wrote:
>>
>>>On Wed, Jan 02, 2002 at 12:04:28PM -0600, Jason A. Pattie wrote:
>>>
>>>>Where in the output of tcdump does the TOS field appear?  I did the 
>>>>'tcpdump -n -v -v' on the firewall and dumped the output to a file as I 
>>>>started the Linux kernel download.  Is it appropriate to attach the 
>>>>output (I stopped it after around 250 packets)?
>>>>
>>>In the version I have of tcpdump TOS only shows up when its set to
>>>something special.
>>>
>>-- 
>>Jason A. Pattie
>>pattieja@pcxperience.com
>>
>>
>>
>>
>>_______________________________________________
>>LARTC mailing list / LARTC@mailman.ds9a.nl
>>http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://ds9a.nl/lartc/
>>
>
>
>

-- 
Jason A. Pattie
pattieja@pcxperience.com




_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://ds9a.nl/lartc/

Re: [LARTC] Wonder Shaper problem?

[Dhaval Patel]

you can have your firewall set the tos for ftp to something like 0x08 and keep
only low bandwidth high priority things like ssh as 0x10.

"Jason A. Pattie" <pattieja@pcxperience.com> said:

> So then is there a way to modify the packet on the way out of squid to 
> force it to be the TOS we want that will cause it to go to 20: instead 
> of 10: ?  Maybe modification of squid is in order? to keep it from 
> changing the TOS field?  (We have the source!  :) )
> 
> Or is there some other way to make it so that SSH traffic itself is 
> bumped to higher priority than just the generic 0x10 TOS packets?  Maybe 
> match on destination or source port 22?
> 
> Dhaval Patel wrote:
> 
> >i could be wrong its been some time since i did this but i think that 0x10 is
> >for quick response time 0x08 is for high throughput  0x04 is for a more
> >guranteed service or something like that. 
> >
> >hope this helps.
> >
> >"Jason A. Pattie" <pattieja@pcxperience.com> said:
> >
> >>Found the TOS field was being set to 0x10 for "ftp" traffic and 0x08 for 
> >>"http" traffic.  What significance does that play?  And it is either 
> >>being done by Squid or by Mozilla, don't know how to tell which, though.
> >>
> >>Michael T. Babcock wrote:
> >>
> >>>On Wed, Jan 02, 2002 at 12:04:28PM -0600, Jason A. Pattie wrote:
> >>>
> >>>>Where in the output of tcdump does the TOS field appear?  I did the 
> >>>>'tcpdump -n -v -v' on the firewall and dumped the output to a file as I 
> >>>>started the Linux kernel download.  Is it appropriate to attach the 
> >>>>output (I stopped it after around 250 packets)?
> >>>>
> >>>In the version I have of tcpdump TOS only shows up when its set to
> >>>something special.
> >>>
> >>-- 
> >>Jason A. Pattie
> >>pattieja@pcxperience.com
> >>
> >>
> >>
> >>
> >>_______________________________________________
> >>LARTC mailing list / LARTC@mailman.ds9a.nl
> >>http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://ds9a.nl/lartc/
> >>
> >
> >
> >
> 
> -- 
> Jason A. Pattie
> pattieja@pcxperience.com
> 
> 
> 
> 
> _______________________________________________
> LARTC mailing list / LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://ds9a.nl/lartc/
> 



-- 




_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://ds9a.nl/lartc/