H323 and Traffic Control

H323 and Traffic Control

[yves.metivier]

Hi!

I recently installed h323 netfilter extension on my home
firewall/gateway and it works fine! Thanks!

But I have a problem with traffic control :
I want to give highest priority to real time traffic, like
h323.

I use HTB queuing discipline with four different priority
classes. I use packet marking in netfilter through the mangle
table and fw mark option in "tc filter add ..." to send
packets in one of the four classes depending on the mark

I was expecting that h323 netfilter module should mark all
h323 traffic, including RTP and RTCP UDP packets, but it seems
that it only marks packets from known ports (those explicitely
declared in iptables), and not UDP related packets.

Is my analyse right?

Thanks in advance for any answer.

Yves




Accédez au courrier électronique de La Poste : www.laposte.net ; 3615 LAPOSTENET (0,13 €/mn) ; tél : 08 92 68 13 50 (0,34€/mn)"

Re: H323 and Traffic Control

[Cedric Blancher]

Le ven 25/10/2002 à 13:36, yves.metivier a écrit :
> I was expecting that h323 netfilter module should mark all 
> h323 traffic, including RTP and RTCP UDP packets, but it seems 
> that it only marks packets from known ports (those explicitely 
> declared in iptables), and not UDP related packets.

H323 module's goal is to declare what kind of packets are expected by
H323 flows to have them given the RELATED state. And that's all.

If you want to mark thoses packets, then you'll have to do it yourself.
The main Netfilter distribution does not provide matches to do it well,
but you'll find helper pacth in submitted section of iptables 1.2.7a
patch-o-matic. This patch creates a new match called helper that allows
you to spot packets that are handled by a specific conntrack module. I
didn't tried what you want to do, but I think this can do the trick :

	iptables -t mangle -A PREROUTING -m helper --helper h323 \
		-j MARK --set-mark 0x01
 
> Is my analyse right?

Nope ;)
Conntrack is something particular in Netfilter. It gives state to
packets, and then, it's up to you to use this state value to achieve
what you want to do.

-- 
Cédric Blancher  <blancher@cartel-securite.fr>
Consultant en sécurité des systèmes et réseaux  - Cartel Sécurité
Tél: +33 (0)1 44 06 97 87 - Fax: +33 (0)1 44 06 97 99
PGP KeyID:157E98EE  FingerPrint:FA62226DA9E72FA8AECAA240008B480E157E98EE

H323 and Traffic Control

[yves]

Hi!

I recently installed h323 netfilter extension on my home
firewall/gateway and it works fine! Thanks!

But I have a problem with traffic control :
I want to give highest priority to real time traffic, like h323.

I use HTB queuing discipline with four different priority classes. I use
packet marking in netfilter through the mangle table and fw mark option
in "tc filter add" to send packets in one of the four classes depending
on the mark

I was expecting that h323 netfilter module should mark all h323 traffic,
including RTP and RTCP UDP packets, but it seems that it only marks
packets from known ports (those explicitely declared in iptables) and
not UDP related packets.

Is my analyse right?

Thank you in advance for your answer.

Regards

Yves

Re: H323 and Traffic Control

[Jozsef Kadlecsik]

On Fri, 25 Oct 2002 yves@famillemetivier.net wrote:

> But I have a problem with traffic control :
> I want to give highest priority to real time traffic, like h323.
>
> I was expecting that h323 netfilter module should mark all h323 traffic,
> including RTP and RTCP UDP packets, but it seems that it only marks
> packets from known ports (those explicitely declared in iptables) and
> not UDP related packets.

You can mark the related stream by using the helper matching from
patch-o-matic. In the case of h323, you can match the H.225 and H.245
channels by the following command-fragments:

iptables .... -m helper --helper H.225 ...
iptables .... -m helper --helper H.245 ...

Regards,
Jozsef
-
E-mail  : kadlec@blackhole.kfki.hu, kadlec@sunserv.kfki.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : KFKI Research Institute for Particle and Nuclear Physics
          H-1525 Budapest 114, POB. 49, Hungary