Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

So I'm trying to do roughly this

http://wiki.mikrotik.com/wiki/PCC

on Linux.

To explain a little further: PCC just takes, say, source address of the packet, hashes it, divides the hash by some number, and if the remainder is equal to some other number, it makes a rule match.

I'm actually using this to mostly randomly divide my network into several almost-equally-big groups. More specifically, six such groups would look like this:

Group 1: pcc_hash(source IP) % 6 = 0
Group 2: pcc_hash(source IP) % 6 = 1
... etc

The groups are then given some kind of common resource to share (say, bandwidth, or public IP address) that they don't like to change very often (esp. with public IP address).

My question is that if there is some good method to divide the network into any number of stochastically-equal subnets using some similar, preferably easy iptables rules.

I've succeeded in splitting the network into powers of two using u32 (2^n networks just by matching last n bits of source IP address). But some randomness would be great too, and having a network split into anything like exact thirds is impossible to do with this. Moreover, mikrotiks are essentially linux-based, so there has to be a way to do that :D

Is someone here aware of a good method, or at least of some good u32 documentation that would make this possible?

Thanks in advance

-mk

share|improve this question

2 Answers 2

up vote 0 down vote accepted

Moreover, mikrotiks are essentially linux-based, so there has to be a way to do that :D

Well, then Mikrotik™ has to go GPL or be sued for going not whilst selling a product based on GPLed software. In case they're GPLed already, you can look into the source code. In case they're not — help'em. ;-)


I doubt there's a module like this available for Netfilter, but I think it wouldn't be too hard to write it using any similar as an example.

having a network split into anything like exact thirds is impossible to do with this.

Why makes you think so? Suppose you're masking with 0xF [0..15]; what then makes you unable to split it into ranges [0..5], [6..11], [12..15]? Yeah, not preciselly but quite close to 1/3. The wide range you'duse, the closer division you'd get.

share|improve this answer
    
Yeah it's close. Still I'd like some hash-supplied randomization for this. Probably gonna contact mikrotik and ask them to explain that, or code an u32 patch (which shouldn't be difficult at all) –  exa Feb 20 '11 at 20:25

As an alternative to using netfilter's u32 module, which, as you've found, is pretty much undocumented, you could use the nfnetlink_queue subsystem of netfilter. The idea is that you send packets through a userspace process (most likely a daemon) that examines the packets, MARKs them as it sees fit, and then returns them to netfilter for further processing.

The mechanics of this are relatively straightforward. The iptables QUEUE and NFQUEUE targets put selected packets on a queue, and a userspace process takes the packets from there via the nfnetlink_queue API (documentation here). As each packet returns to netfilter from userspace, the MARK set by the process can be used to direct packets through further processing (by, say, iptables or tc).

Caveat: I have never actually implemented a solution using netlink's queue module, so I have no first hand experience regarding its potential robustness, security, or performance. Obviously, a userspace daemon through which network packets flows would need to be developed with a fair amount of care.

share|improve this answer
    
robustnes nor security wouldn't do any problem, routers are mostly dedicated right. Performance kindof scares me, it should be able to match around 10k packets per second without being the topmost CPU user of the router. Good idea though, gonna read the docs. –  exa Feb 20 '11 at 20:33
    
@exa, — That's why I didn't mention nfnetlink_queue at all — kernel-userspace switch overhead is too significant to allow use it under heavy load. –  poige Feb 21 '11 at 2:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.