rateest usage problem - slightly lost

rateest usage problem - slightly lost

[Anton VG]

Hi friends,

Am a little lost with using of the rateest target.

I'm trying to match if one of my interfaces have load over 2000kbit
but it does not seem to work.
While trying to understand the MAN page I'm a little lost - while man
gives example on the comparing the delta, but even trying the simpler
case it does not work for me.

my example s simpler - i just want to know if one interface have load
X to mark packets (to route them later to interface y) - and it does
not seem to work at all.

# iptables -t mangle -A POSTROUTING -o eth0.3810 -j RATEEST
--rateest-name fiber --rateest-interval 250ms --rateest-ewma 0.5s
# iptables -t mangle -A POSTROUTING -o eth0.3811 -j RATEEST
--rateest-name satellite --rateest-interval 250ms --rateest-ewma 0.5s
# iptables -t mangle -A PREROUTING -s 82.198.22.27/32 -m rateest
--rateest1 fiber --rateest-bps1 2000kbit --rateest-gt -j MARK
--set-mark 4
# iptables -t mangle -A PREROUTING -s 82.198.22.27/32 -m rateest
--rateest1 fiber --rateest-bps1 2000kbit --rateest-lt -j MARK
--set-mark 7

iptables -nL -v -t mangle gives

Chain PREROUTING (policy ACCEPT 302M packets, 151G bytes)
 pkts bytes target     prot opt in     out     source               destination
 1426  140K MARK       all  --  *      *       82.198.22.27
0.0.0.0/0           rateest match fiber bps gt 0 MARK xset
0x4/0xffffffff
    0     0 MARK       all  --  *      *       82.198.22.27
0.0.0.0/0           rateest match fiber bps lt 0 MARK xset
0x7/0xffffffff


May anyone give me a piece of clue?

Re: rateest usage problem - slightly lost

[Anton VG]

Seems finally I've got it working, and had to look at the sources of
the xt_rateest.c to understand what it wants :)

Possibly it's good to update man page with more examples of rateest
usage, so it would be clear, that we have to use the first and the
second (bps1 and bps2) parameters, and rateest give it's result as
difference of them, so the following

iptables -t mangle -A PREROUTING -s $SOURCE -m rateest --rateest1
$RATEESTIMATOR --rateest-bps1 0 --rateest-bps2 200kbit --rateest-lt -j
MARK --set-mark $TARGETMARK

will set mark only when estimated rate is below 200kbit

Regards,
Anton.

2009/5/31 Anton VG <anton.vazir@gmail.com>:
> Hi friends,
>
> Am a little lost with using of the rateest target.
>
> I'm trying to match if one of my interfaces have load over 2000kbit
> but it does not seem to work.
> While trying to understand the MAN page I'm a little lost - while man
> gives example on the comparing the delta, but even trying the simpler
> case it does not work for me.
>
> my example s simpler - i just want to know if one interface have load
> X to mark packets (to route them later to interface y) - and it does
> not seem to work at all.
>
> # iptables -t mangle -A POSTROUTING -o eth0.3810 -j RATEEST
> --rateest-name fiber --rateest-interval 250ms --rateest-ewma 0.5s
> # iptables -t mangle -A POSTROUTING -o eth0.3811 -j RATEEST
> --rateest-name satellite --rateest-interval 250ms --rateest-ewma 0.5s
> # iptables -t mangle -A PREROUTING -s 82.198.22.27/32 -m rateest
> --rateest1 fiber --rateest-bps1 2000kbit --rateest-gt -j MARK
> --set-mark 4
> # iptables -t mangle -A PREROUTING -s 82.198.22.27/32 -m rateest
> --rateest1 fiber --rateest-bps1 2000kbit --rateest-lt -j MARK
> --set-mark 7
>
> iptables -nL -v -t mangle gives
>
> Chain PREROUTING (policy ACCEPT 302M packets, 151G bytes)
>  pkts bytes target     prot opt in     out     source               destination
>  1426  140K MARK       all  --  *      *       82.198.22.27
> 0.0.0.0/0           rateest match fiber bps gt 0 MARK xset
> 0x4/0xffffffff
>    0     0 MARK       all  --  *      *       82.198.22.27
> 0.0.0.0/0           rateest match fiber bps lt 0 MARK xset
> 0x7/0xffffffff
>
>
> May anyone give me a piece of clue?
>
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: rateest usage problem - slightly lost

[Jan Engelhardt]

On Sunday 2009-05-31 18:24, Anton VG wrote:

>Seems finally I've got it working, and had to look at the sources of
>the xt_rateest.c to understand what it wants :)
>
>Possibly it's good to update man page with more examples of rateest
>usage, so it would be clear, that we have to use the first and the
>second (bps1 and bps2) parameters, and rateest give it's result as
>difference of them,[...]

If you have any concrete recommendations — perhaps even your use case — 
on how to improve the wording, we would like to hear. Ideally in the 
form of a patch, but an unformatted text/plain blob will also do.

> so the following
>
>iptables -t mangle -A PREROUTING -s $SOURCE -m rateest --rateest1
>$RATEESTIMATOR --rateest-bps1 0 --rateest-bps2 200kbit --rateest-lt -j
>MARK --set-mark $TARGETMARK
>
>will set mark only when estimated rate is below 200kbit
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html