* Re: [LARTC] ingress and egress
2002-05-21 1:31 [LARTC] ingress and egress hanhbnetfilter
@ 2002-05-21 5:27 ` Stef Coene
2002-05-21 5:44 ` Alexey Talikov
` (3 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: Stef Coene @ 2002-05-21 5:27 UTC (permalink / raw)
To: lartc
On Tuesday 21 May 2002 03:31, hanhbnetfilter wrote:
> ingress can be used to control the incoming packet,
> such as:
> tc qdisc add dev eth0 handle ffff: ingress
> tc filter add dev eth0 parent ffff: protocol ip prio 5
> u32 match ip src 172.16.1.11 police rate 10kbit burst
> 10k drop flowid :1
> tc filter add dev eth0 parent ffff: protocol ip prio 5
>
> u32 match ip src 172.16.1.22 police rate 10kbit burst
> 10k drop flowid :2
> first ,I do not sure these method can use class(could
> it do? I tested it can not do). if it can do it
> ,please give me a example.
Ingress qdisc is classless.
> second, rate can not be shared, if i want to control
> the incoming packet rate not throug egress qdisc, and
> the rate can be shared, please tell me how can i do.
You can use use the imq device. You can redirect packets (incoming and
outgoing) to this device. And you can attach CBQ or HTB to this device. A
link can be found on www.docum.org under faq.
Stef
--
stef.coene@docum.org
"Using Linux as bandwidth manager"
http://www.docum.org/
#lartc @ irc.openprojects.net
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [LARTC] ingress and egress
2002-05-21 1:31 [LARTC] ingress and egress hanhbnetfilter
2002-05-21 5:27 ` Stef Coene
@ 2002-05-21 5:44 ` Alexey Talikov
2002-05-22 2:29 ` hanhbnetfilter
` (2 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: Alexey Talikov @ 2002-05-21 5:44 UTC (permalink / raw)
To: lartc
You can't shared bandwidth in ingress and you can't add classes (ingress classless)
tc qdisc add dev eth0 handle ffff:fff1 ingress
tc filter add dev eth0 parent ffff:fff1 protocol ip prio 49 u32 match ip dport 22 0xffff \
police rate 1mbps burst 100k drop flowid :1
tc filter add dev eth0 parent ffff:fff1 protocol ip prio 50 u32 match ip src 0.0.0.0/0 \
police rate 2mbps burst 100k drop flowid :1
it's allocate 1 mbps for ssh and 2 mbps for other even you upload at the same time
(hardware speed more then 3 mbps) i.e. prio don't help you :((
But you may use imq see: http://luxik.cdi.cz/~patrick/imq/ patch kernel iptables and redirect
with iptables (in mangle table) packets to imq0 and furthure use tbf htb and other\
Some notes:
Instances by queuing disciplines are identified by 32 bit numbers, which are split into
major and minor number (16 bit each)Major number assigned by the user should be in range
1...0x7fff, 0x8000...0xffff automatically allocated by the kernel for qdisc with unspecified
major number. Major number ffff:fff0 to ffff:ffff are reserved or have special meaning ffff:fff1
for ingress ffff:ffff selects top-level egress queuing discipline of an interface (special values
are defined in include/linux/pkt_sched.h and have names begining with TC_H_)
For detail see: Linux Network Traffic Control - Implementation Overview
Werner Almesberger Feb 4 2001
21.05.2002 6:31:25, hanhbnetfilter <hanhbnetfilter@yahoo.com.cn> wrote:
>ingress can be used to control the incoming packet,
>such as:
>tc qdisc add dev eth0 handle ffff: ingress
>tc filter add dev eth0 parent ffff: protocol ip prio 5
>u32 match ip src 172.16.1.11 police rate 10kbit burst
>10k drop flowid :1
>tc filter add dev eth0 parent ffff: protocol ip prio 5
>
>u32 match ip src 172.16.1.22 police rate 10kbit burst
>10k drop flowid :2
>first ,I do not sure these method can use class(could
>it do? I tested it can not do). if it can do it
>,please give me a example.
>second, rate can not be shared, if i want to control
>the incoming packet rate not throug egress qdisc, and
>the rate can be shared, please tell me how can i do.
>
>
>
>
>
>
>_________________________________________________________
>Do You Yahoo!?
>摊开你的掌心 让我看看你
>http://sweepstakes.yahoo.com/2002cnuser
>_______________________________________________
>LARTC mailing list / LARTC@mailman.ds9a.nl
>http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
>
-----------------------------------
mailto:alexey_talikov@texlab.com.uz
BR
Alexey Talikov
FORTEK
-----------------------------------
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [LARTC] ingress and egress
2002-05-21 1:31 [LARTC] ingress and egress hanhbnetfilter
2002-05-21 5:27 ` Stef Coene
2002-05-21 5:44 ` Alexey Talikov
@ 2002-05-22 2:29 ` hanhbnetfilter
2002-05-22 3:22 ` Patrick McHardy
2002-05-22 6:15 ` Alexey Talikov
4 siblings, 0 replies; 6+ messages in thread
From: hanhbnetfilter @ 2002-05-22 2:29 UTC (permalink / raw)
To: lartc
thanks for your help
I look at IMQ howto,if there is only two IMQ
devices(imq0 imq1),I have three NIC on my computer, I
want to
control all three NIC incoming rate,how can i do?
Do IMQ support VPN?
--- Alexey Talikov <alexey_talikov@texlab.com.uz>
的正文：> You can't shared bandwidth in ingress and
you can't
> add classes (ingress classless)
> tc qdisc add dev eth0 handle ffff:fff1 ingress
> tc filter add dev eth0 parent ffff:fff1 protocol ip
> prio 49 u32 match ip dport 22 0xffff \
> police rate 1mbps burst 100k drop flowid :1
> tc filter add dev eth0 parent ffff:fff1 protocol ip
> prio 50 u32 match ip src 0.0.0.0/0 \
> police rate 2mbps burst 100k drop flowid :1
> it's allocate 1 mbps for ssh and 2 mbps for other
> even you upload at the same time
> (hardware speed more then 3 mbps) i.e. prio don't
> help you :((
> But you may use imq see:
> http://luxik.cdi.cz/~patrick/imq/ patch kernel
> iptables and redirect
> with iptables (in mangle table) packets to imq0 and
> furthure use tbf htb and other\
>
> Some notes:
> Instances by queuing disciplines are identified by
> 32 bit numbers, which are split into
> major and minor number (16 bit each)Major number
> assigned by the user should be in range
> 1...0x7fff, 0x8000...0xffff automatically allocated
> by the kernel for qdisc with unspecified
> major number. Major number ffff:fff0 to ffff:ffff
> are reserved or have special meaning ffff:fff1
> for ingress ffff:ffff selects top-level egress
> queuing discipline of an interface (special values
> are defined in include/linux/pkt_sched.h and have
> names begining with TC_H_)
> For detail see: Linux Network Traffic Control -
> Implementation Overview
> Werner Almesberger Feb 4 2001
>
> 21.05.2002 6:31:25, hanhbnetfilter
> <hanhbnetfilter@yahoo.com.cn> wrote:
>
> >ingress can be used to control the incoming packet,
> >such as:
> >tc qdisc add dev eth0 handle ffff: ingress
> >tc filter add dev eth0 parent ffff: protocol ip
> prio 5
> >u32 match ip src 172.16.1.11 police rate 10kbit
> burst
> >10k drop flowid :1
> >tc filter add dev eth0 parent ffff: protocol ip
> prio 5
> >
> >u32 match ip src 172.16.1.22 police rate 10kbit
> burst
> >10k drop flowid :2
> >first ,I do not sure these method can use
> class(could
> >it do? I tested it can not do). if it can do it
> >,please give me a example.
> >second, rate can not be shared, if i want to
> control
> >the incoming packet rate not throug egress qdisc,
> and
> >the rate can be shared, please tell me how can i
> do.
> >
> >
> >
> >
> >
> >
>
>_________________________________________________________
> >Do You Yahoo!?
> >摊开你的掌心 让我看看你
> >http://sweepstakes.yahoo.com/2002cnuser
> >_______________________________________________
> >LARTC mailing list / LARTC@mailman.ds9a.nl
> >http://mailman.ds9a.nl/mailman/listinfo/lartc
> HOWTO: http://lartc.org/
> >
>
> -----------------------------------
> mailto:alexey_talikov@texlab.com.uz
> BR
> Alexey Talikov
> FORTEK
> -----------------------------------
>
>
_________________________________________________________
Do You Yahoo!?
摊开你的掌心 让我看看你
http://sweepstakes.yahoo.com/2002cnuser
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [LARTC] ingress and egress
2002-05-21 1:31 [LARTC] ingress and egress hanhbnetfilter
` (2 preceding siblings ...)
2002-05-22 2:29 ` hanhbnetfilter
@ 2002-05-22 3:22 ` Patrick McHardy
2002-05-22 6:15 ` Alexey Talikov
4 siblings, 0 replies; 6+ messages in thread
From: Patrick McHardy @ 2002-05-22 3:22 UTC (permalink / raw)
To: lartc
Hi.
hanhbnetfilter wrote:
> thanks for your help
> I look at IMQ howto,if there is only two IMQ
> devices(imq0 imq1),I have three NIC on my computer, I
> want to
> control all three NIC incoming rate,how can i do?
> Do IMQ support VPN?
The number of devices can be specified as module option (numdevs).
IMQ works with any ip/ip6 protocol, so if by VPN you mean ipsec there
should be no problem. A user reported a problem a short time ago with
gre tunnels when the real data and the encapsulated data went to the
same imq device, but i have no reports (positive or negative) for other
kinds of tunnels. If you choose to try for yourself please let me know
if it worked.
Bye,
Patrick
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [LARTC] ingress and egress
2002-05-21 1:31 [LARTC] ingress and egress hanhbnetfilter
` (3 preceding siblings ...)
2002-05-22 3:22 ` Patrick McHardy
@ 2002-05-22 6:15 ` Alexey Talikov
4 siblings, 0 replies; 6+ messages in thread
From: Alexey Talikov @ 2002-05-22 6:15 UTC (permalink / raw)
To: lartc
You may route traffic from all devices to one imq and furthure
control it by tc filter with mark or without it i.e. you may
control traffic on two or more network devices (such ethx) simultaneous
i.e. traffic traverse over eth0 and eth1 can't be more then 100kbps, for example
You may create more then two devices
modbrobe imq numdevs=3 (numdevs=1...16)
ip link set imq0 up
ip link set imq1 up
ip link set imq2 up
iptables -t mangle -A PREROUTING -i eth0 -j IMQ --todev 0 (to imq0)
iptables -t mangle -A PREROUTING -i eth1 -j IMQ --todev 1 (to imq1)
etc
also possible
iptables -t mangle -A POSTROUTING -o eth0 -j IMQ --todev 0 (to imq0)
iptables -t mangle -A POSTROUTING -o eth1 -j IMQ --todev 1 (to imq1)
traffic traverse to imq devices and furthure hit to the network devices
(sorry for my pure English)
22.05.2002 7:29:05, hanhbnetfilter <hanhbnetfilter@yahoo.com.cn> wrote:
>thanks for your help
>I look at IMQ howto,if there is only two IMQ
>devices(imq0 imq1),I have three NIC on my computer, I
>want to
>control all three NIC incoming rate,how can i do?
>Do IMQ support VPN?
>
>
>
>
>
>
>
>
>
> --- Alexey Talikov <alexey_talikov@texlab.com.uz>
>的正文：> You can't shared bandwidth in ingress and
>you can't
>> add classes (ingress classless)
>> tc qdisc add dev eth0 handle ffff:fff1 ingress
>> tc filter add dev eth0 parent ffff:fff1 protocol ip
>> prio 49 u32 match ip dport 22 0xffff \
>> police rate 1mbps burst 100k drop flowid :1
>> tc filter add dev eth0 parent ffff:fff1 protocol ip
>> prio 50 u32 match ip src 0.0.0.0/0 \
>> police rate 2mbps burst 100k drop flowid :1
>> it's allocate 1 mbps for ssh and 2 mbps for other
>> even you upload at the same time
>> (hardware speed more then 3 mbps) i.e. prio don't
>> help you :((
>> But you may use imq see:
>> http://luxik.cdi.cz/~patrick/imq/ patch kernel
>> iptables and redirect
>> with iptables (in mangle table) packets to imq0 and
>> furthure use tbf htb and other\
>>
>> Some notes:
>> Instances by queuing disciplines are identified by
>> 32 bit numbers, which are split into
>> major and minor number (16 bit each)Major number
>> assigned by the user should be in range
>> 1...0x7fff, 0x8000...0xffff automatically allocated
>> by the kernel for qdisc with unspecified
>> major number. Major number ffff:fff0 to ffff:ffff
>> are reserved or have special meaning ffff:fff1
>> for ingress ffff:ffff selects top-level egress
>> queuing discipline of an interface (special values
>> are defined in include/linux/pkt_sched.h and have
>> names begining with TC_H_)
>> For detail see: Linux Network Traffic Control -
>> Implementation Overview
>> Werner Almesberger Feb 4 2001
>>
>> 21.05.2002 6:31:25, hanhbnetfilter
>> <hanhbnetfilter@yahoo.com.cn> wrote:
>>
>> >ingress can be used to control the incoming packet,
>> >such as:
>> >tc qdisc add dev eth0 handle ffff: ingress
>> >tc filter add dev eth0 parent ffff: protocol ip
>> prio 5
>> >u32 match ip src 172.16.1.11 police rate 10kbit
>> burst
>> >10k drop flowid :1
>> >tc filter add dev eth0 parent ffff: protocol ip
>> prio 5
>> >
>> >u32 match ip src 172.16.1.22 police rate 10kbit
>> burst
>> >10k drop flowid :2
>> >first ,I do not sure these method can use
>> class(could
>> >it do? I tested it can not do). if it can do it
>> >,please give me a example.
>> >second, rate can not be shared, if i want to
>> control
>> >the incoming packet rate not throug egress qdisc,
>> and
>> >the rate can be shared, please tell me how can i
>> do.
>> >
>> >
>> >
>> >
>> >
>> >
>>
>>_________________________________________________________
>> >Do You Yahoo!?
>> >摊开你的掌心 让我看看你
>> >http://sweepstakes.yahoo.com/2002cnuser
>> >_______________________________________________
>> >LARTC mailing list / LARTC@mailman.ds9a.nl
>> >http://mailman.ds9a.nl/mailman/listinfo/lartc
>> HOWTO: http://lartc.org/
>> >
>>
>> -----------------------------------
>> mailto:alexey_talikov@texlab.com.uz
>> BR
>> Alexey Talikov
>> FORTEK
>> -----------------------------------
>>
>>
>
>
>_________________________________________________________
>Do You Yahoo!?
>摊开你的掌心 让我看看你
>http://sweepstakes.yahoo.com/2002cnuser
>
-----------------------------------
mailto:alexey_talikov@texlab.com.uz
BR
Alexey Talikov
FORTEK
-----------------------------------
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
^ permalink raw reply [flat|nested] 6+ messages in thread