Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to impose an arbitrary latency on outbound UDP packets using a fw filter in tc; however, I cannot get the filter to work properly:

tc qdisc add dev eth0 root handle 1: prio
tc qdisc add dev eth0 parent 1:3 handle 30: netem delay 200ms
tc filter add dev eth0 parent 1:0 protocol ip prio 3 handle 1 fw flowid 1:3

iptables -A PREROUTING -i eth0 -t mangle -p udp -j MARK --set-mark 1

If I use the following u32 filter instead I get the desired effect:

tc filter add dev eth0 parent 1:0 protocol ip prio 3 u32 match ip dport 53 0xffff flowid 1:3

I don't wish to use the u32 filters, and what is more troubling I can't get the --ttl-set or --set-tos manglers to work in Ubuntu 10.04.

The two may be completely unrelated, but I am concerned that the packets aren't being marked by iptables. I have been unable to find a way to test marking.

share|improve this question

migrated from Nov 30 '11 at 5:53

This question came from our site for computer enthusiasts and power users.

Doing a iptables -t mangle -A PREROUTING -j LOG after your MARK line will log the packet to syslog, and part of the log message will be the current mark value - hopefully that will help with debugging. – Andy Smith Dec 1 '11 at 0:25
Just noticed - you're marking inbound packets, but trying to add latency to outbound packets... or am I missing something? – Andy Smith Dec 1 '11 at 0:32
up vote 2 down vote accepted

I ended solving my problem with another feature of iptables instead of --set-mark:

iptables -t mangle -A POSTROUTING -o eth0 -p udp -j CLASSIFY --set-class 1:3

I hope this helps someone as I toiled over the complexities of tc for sometime before accomplishing this seemingly simple task.


Andy Smith is correct, I should have been marking the POSTROUTING chain! The following rule should work with --set-mark:

iptables -A POSTROUTING -t mangle -p udp -j MARK --set-mark 1
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.