Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

with "u32 match ip sport 80" in Linux tc I can match port 80, but how can I match a port range 10000 - 20000 ?

share|improve this question

3 Answers 3

up vote 4 down vote accepted

You can use mask, but it difficult:

 u32 match ip sport 4096 0xf000 = sport 4096-8191
 u32 match ip sport 8192 0xe000 = sport 8192-16383

0xf000/0xe000 is the mask. The word extracted from the packet is bit-wise with this mask before comparison.

value = 0001000000000000
mask  = 1111000000000000

start = 0001000000000000
end   = 0001111111111111

Also you can create many filter for one classid:

tc filter add dev eth0 parent 1:0 prio 3 protocol ip u32 match ip protocol 6 0xff match ip sport 10000 0xffff classid 1:13
tc filter add dev eth0 parent 1:0 prio 3 protocol ip u32 match ip protocol 6 0xff match ip sport 10001 0xffff classid 1:13
tc filter add dev eth0 parent 1:0 prio 3 protocol ip u32 match ip protocol 6 0xff match ip sport 10002 0xffff classid 1:13

For your example, your need create several 'tc filter':

first: sport 10000 0xfff0 (10000-10015)
second: sport 10016 0xffe0 (10016-10047)
.............

etc.

10000=10011100010000

0010011100010000
           |
     first not zero
1111111111111111
mask
1111111111110000=0xfff0
share|improve this answer
    
How the mask is created here ? –  Supratik Feb 6 '11 at 18:49
    
See my update, but I do not compute all the masks, only the first two –  alvosu Feb 6 '11 at 23:13
    
@alvosu Can you please tell what is the logic behind the mask calculation ? –  Supratik Feb 7 '11 at 11:43
    
$probe_port LOGIN_AND $MASK compared $PORT –  alvosu Feb 7 '11 at 11:58
    
@alvosu I think I am not able to explain here properly. Let me rephrase it once again. sport 10000 0xfff0 represents a port range between 10000-10015, can you please tell me how you have calculated the value "0xfff0" ? –  Supratik Feb 7 '11 at 13:43

You can use ematch - extended match - instead of u32 filter, which supports "less than" and "greater than" comparisons. Have a look at the man page.

The following matches packets with source port in the range 70 - 90 (excluding)

tc filter add dev eth0 parent 1: protocol ip prio 1 basic match "cmp(u16 at 0 layer transport gt 70) and cmp(u16 at 0 layer transport lt 90)" flowid 1:3

share|improve this answer

I've created this simple script on my blog to create the masks for any port range...

I got tired of googling it just to find the wrong ways to do it... Enjoy!

http://marcelustrojahn.blogspot.com/2011/06/u32-port-masks_14.html site is down :(

share|improve this answer
    
Thanks! this will really help a lot. –  Supratik Jun 15 '11 at 6:28

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.