[LARTC] Nearly complettly victory

[LARTC] Nearly complettly victory

[David Coello]

Hi

At last i achive to make QOS works limitting bandwidth per port but with 
one exception : ftp. I don´t know why this port doesn´t works (aplies the 
default rule not the own). Anyone has experience with a similar problem?

Thanks and regards
					David



_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

Re: [LARTC] Nearly complettly victory

[Martin Josefsson]

On Sun, 2002-12-15 at 18:02, David Coello wrote:
> Hi
> 
> At last i achive to make QOS works limitting bandwidth per port but with 
> one exception : ftp. I don´t know why this port doesn´t works (aplies the 
> default rule not the own). Anyone has experience with a similar problem?

Do you know how ftp works?

It uses one control-connection on a static port and dynamic
data-connections. So it's only the control-connection that uses a known
port. It's the data in this control-connection that you probably are
limiting, and this is not what you want.

It is possible to mark all packets that are part of a ftp
data-connection using iptables.

iptables -t mangle -A PREROUTING -m helper --helper ftp -j MARK
--set-mark 1

This will work if you have the ip_conntrack_ftp module loaded or
compiled into your kernel. It will only work for the ports
(control-connection) which ip_conntrack_ftp has been told to listen to.
(default only port 21, change with module option 'ports')

For control-connections on port 21 you use "ftp" to match.
If it's say port 2121 and you've told ip_conntrack_ftp to listen to that
port you should use "ftp-2121" to match.

I hope this helps.

-- 
/Martin

Never argue with an idiot. They drag you down to their level, then beat
you with experience.
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/