From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Wayne" Date: Wed, 20 Aug 2003 08:48:00 +0000 Subject: [LARTC] FTP Connection Tracking in a Bridge MIME-Version: 1 Content-Type: multipart/mixed; boundary="----=_NextPart_000_0014_01C36708.865A25C0" Message-Id: List-Id: To: lartc@vger.kernel.org This is a multi-part message in MIME format. ------=_NextPart_000_0014_01C36708.865A25C0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hello, I have a box running as a bridge and am trying to track the passive FTP = sessions by marking them with iptables (CONNMARK option installed) and = then trying to pick up the mark using tc filter fwmark. This is not = working. I have checked the marking of the packets and this is working fine = because I can see the marks when I cat /proc/net/ip_conntrack. Having setup my queues and using the following command: tc filter add dev eth1 parent 1:2 protocol ip prio 1 handle 2 fw classid = 1:2a I do not get any traffic going in to this queue. I am running kernel = 2.4.21.=20 My question is whether the packet that I have marked is actually every = getting to the tc filter. As I am running a bridge, does the packet get = marked in iptables PREROUTING, and then go straight to the FORWARD rule = and then out. What is the sequence in which iptables processes the packet and then the = tc filter processes the packet. Many thanks Wayne ------=_NextPart_000_0014_01C36708.865A25C0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

Hello,

I have a box running as a bridge and am trying to track the passive = FTP=20 sessions by marking them with iptables (CONNMARK option installed) and = then=20 trying to pick up the mark using tc filter fwmark. This is not = working.

I have checked the marking of the packets and this is working fine = because I=20 can see the marks when I cat /proc/net/ip_conntrack.

Having setup my queues and using the following command:

tc filter add dev eth1 parent 1:2 protocol ip prio 1 handle 2 fw = classid=20 1:2a

I do not get any traffic going in to this queue. I am running kernel = 2.4.21.=20

My question is whether the packet that I have marked is actually = every=20 getting to the tc filter. As I am running a bridge, does the packet get = marked=20 in iptables PREROUTING, and then go straight to the FORWARD rule and = then=20 out.

What is the sequence in which iptables processes the packet and then = the tc=20 filter processes the packet.

Many thanks

Wayne

------=_NextPart_000_0014_01C36708.865A25C0-- _______________________________________________ LARTC mailing list / LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/