Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've tried my best before asking, but struggling.

I am running 10.04 ubuntu server and it has a fast-ish 8 drive Raid5 array, which is home to a number of samba share points.

This machine only gets used as a nearline samba file server.

Files are ingested to here and later consolidated onto another server on the network for realtime access, so I need to implement some traffic shaping.

My aim is to stop each individual client from using more than 200mbps of the gigabit pipe to the switch.

So far I've managed to do this with HTB, but I've hit a brick wall.

Using the commands below I am able to throttle traffic leaving the interface, but I want to carve individual 200mbit pipes per client, not limit the overall traffic for the interface to 200mbit.

sudo /sbin/tc qdisc del dev eth1 root

sudo /sbin/tc qdisc add dev eth1 root handle 1:0 htb default 10

sudo /sbin/tc class add dev eth1 parent 1:0 classid 1:10 htb rate 200mbps ceil 200mbps prio 0

sudo tc filter add dev eth1 parent 1:0 prio 0 protocol ip handle 10 fw flowid 1:10

Can anybody help with this?

I read that there is a way to do this with Shorewall per IP, but the kernel extension required is not present in the standard ubuntu kernel - and I can't find any information about patching to achieve what is required.

Im not a network admin, actually a film technician with too much on my plate.

Any ideas greatly appreciated.

share|improve this question
do you not need to mark the packets as a specific class ? as in iptables -s [ip] -j MARK --set-mark – Sirex Sep 19 '11 at 14:27
up vote 1 down vote accepted

To have a 200Mbit limit for each IP, you have to add one class and filter with IP; I hope my memory is serving well :

tc qdisc add dev eth0 root handle 1: htb  
for ((  i = 2 ;  i <= 10;  i++  ))
tc class add dev eth0 parent 1:0 classid 1:$i htb rate 200Mbps 
tc filter add dev eth0 protocol ip parent 1:0 prio 1 u32 match ip src 1.2.3.$i flowid 1:$i

Also you can use htb tool because it's more easy to understand.

share|improve this answer
Im almost there now, thanks to responses. Receiving an "illegal match" response when I replace 1.2.3.$i with my IP range, leaving the .$i at the end. – alex g Sep 22 '11 at 11:06
try (notice the /32 after the 1.2.3.$i/32 ) : tc filter add dev eth0 protocol ip parent 1:0 prio 1 u32 match ip src 1.2.3.$i/32 flowid 1:$i . If it is not working, maybe the "u32 match ip src" target is not supported by Ubuntu. – migabi Sep 22 '11 at 13:55
Thanks for the reply migabi. – alex g Sep 22 '11 at 15:12
I'm not sure how to check the features supported in TC, if I run "sudo shorewall show capabilities" I receive a list of supported iptables/netfilter functions. I suppose I can migrate to a different disto. – alex g Sep 22 '11 at 15:27
If still not working, replace 5th line with (from tc filter add dev eth0 protocol ip parent 1:0 prio 1 handle $i fw flowid 1:$i ; iptables -A PREROUTING -t mangle -i eth0 -s 1.2.3.$i -j MARK --set-mark $i – migabi Sep 22 '11 at 15:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.