[LARTC] Filter for large packets?

[LARTC] Filter for large packets?

[Simon Stemplinger]

Hi,

i am using the wondershaper script on a DSL-router-firewall combination 
for several LAN clients. My Problem is that the port based filter rules 
dont match bulk traffic satisfyingly, because many file sharing programs 
allow to use custom ports. Usually a few connections that is not 
recognized as bulk are enough to fill up the 1:20 queue and slow down 
www and other normal traffic. Can anyone tell me a filter rule that 
matches Packets greater that a certain number of bytes. I think 
classifying outgoing packets > 512 or 1024 bytes as bulk should help 
here. Do you think this is a good idea, or am i missing something?

What would be a good size threshold to separate normal from bulk traffic?

regards,
Simon

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

Re: [LARTC] Filter for large packets?

[Simon Stemplinger]

I figure it should be

tc filter add dev $DEV parent 1: protocol ip prio 10 u32 \
  match ip protocol 6 0xff \
  match u8 0x05 0x0f at 0 \
  match u8 0x04 0x04 at 2 \
  match u8 0x10 0xff at 33 \
  flowid 1:30

but it doesn´t work... what am I doing wrong?

regards,
Simon


Simon Stemplinger wrote:

> Hi,
>
> i am using the wondershaper script on a DSL-router-firewall 
> combination for several LAN clients. My Problem is that the port based 
> filter rules dont match bulk traffic satisfyingly, because many file 
> sharing programs allow to use custom ports. Usually a few connections 
> that is not recognized as bulk are enough to fill up the 1:20 queue 
> and slow down www and other normal traffic. Can anyone tell me a 
> filter rule that matches Packets greater that a certain number of 
> bytes. I think classifying outgoing packets > 512 or 1024 bytes as 
> bulk should help here. Do you think this is a good idea, or am i 
> missing something?
>
> What would be a good size threshold to separate normal from bulk traffic?
>
> regards,
> Simon




_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

Re: [LARTC] Filter for large packets?

[Stef Coene]

On Friday 24 January 2003 10:43, Simon Stemplinger wrote:
> Hi,
>
> i am using the wondershaper script on a DSL-router-firewall combination
> for several LAN clients. My Problem is that the port based filter rules
> dont match bulk traffic satisfyingly, because many file sharing programs
> allow to use custom ports. Usually a few connections that is not
> recognized as bulk are enough to fill up the 1:20 queue and slow down
> www and other normal traffic. Can anyone tell me a filter rule that
> matches Packets greater that a certain number of bytes. I think
> classifying outgoing packets > 512 or 1024 bytes as bulk should help
> here. Do you think this is a good idea, or am i missing something?
Maybe iptables can help you.  It has a length match option so you can mark the 
packets based on the lengths.

Stef

-- 

stef.coene@docum.org
 "Using Linux as bandwidth manager"
     http://www.docum.org/
     #lartc @ irc.oftc.net

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/