Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've been using debian with 2.6.26 kernel; now I've started to test 2.6.32 for my needs. And I've noticed that u32 filter behaves differently for, namely, "protocol 802.1q".

To discover the tendency, I've run my tests on ubuntu server with 3.0.0-12 kernel. And I've found that I can not match packets by VLAN id at all:

# this worked in 2.6.26:
/sbin/tc filter add dev world0 parent 1:0 prio 100 protocol 802.1q \
        u32 match u16 0x0ed8 0x0fff at -4 \
        flowid 1:fe51

So, that's the preface.

I would like to ask where is the best place to discuss these questions? -- it seems that LARTC list is rather inactive. I am not a programmer, so I hardly believe that I should dive into LKML...

Thank you!


I've built 3.2.11 (latest stable) and in all my tests it appeared impossible to catch any protocol but ip (or all, which seems to be quite the same as ip now). But when catching ip or any it appeared impossible to match vlan tag or the like, with negative at value, too.

share|improve this question
I see there's a vote-to-close here. I would argue that this is a great question, because it's someone actually trying to solve problems on their own! Also, selfishly, I'm interested in the answer, because there's nothing like a "linux kernel" stackexchange site, and as brownian says the LKML mailing list isn't really a great place to start. – larsks Mar 14 '12 at 14:09
I'd suggest splitting this into two questions. One for here, with more details on this particular kernel behavior - provide some sample output from the filter, which would at least help others realize what the filter did before and why such a thing might be helpful, or whether this is a bug that should be reported. Then a separate question on where to ask such questions, which you should ask on or meta.stackexchange or somewhere like that, since that question is off-topic for this particular spot, I think. Other possibilities are "superuser" and "unix/linux". – nealmcb Mar 17 '12 at 0:02
@nealmcb Thank you, I've followed your suggestion:… – brownian Mar 17 '12 at 22:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.