Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a nice shaper, with hashed filtering, built at a linux bridge. In short, br0 connects external and internal physical interfaces, VLAN tagged packets are bridged "transparently" (I mean, no VLAN interfaces are there).

Now, different kernels do it differently. I can be wrong with exact kernel verions ranges, please forgive me. Thanks.


So, in debian, 2.6.26 and up (up to 2.6.32, I believe) --- this works:

tc filter add dev internal protocol 802.1q parent 1:0 prio 100 \
    u32 ht 1:64 match ip dst flowid 1:200

Here, "kernel" matches two bytes in "protocol" field with 0x8100, but counts the beginning of ip packet as a "zero position" (sorry for my English, if I'm a bit unclear).


Again, in debian (I've not built vanilla kernel), 2.6.32-5 --- this works:

tc filter add dev internal protocol 802.1q parent 1:0 prio 100 \
    u32 ht 1:64 match ip dst at 20 flowid 1:200

Here, "kernel" matches the same for protocol, but counts offset from the beginning of this protocol's header --- I have to add 4 bytes to offset (20, not 16 for dst address). It's ok, seems more logical, as for me.

3.2.11, the latest stable now

This works --- as if there is no 802.1q tag at all:

tc filter add dev internal protocol ip parent 1:0 prio 100 \
    u32 ht 1:64 match ip dst flowid 1:200

The problem is that I couldn't find a way to match 802.1q tag so far.

Matching 802.1q tag at past

I could do this before as follows:

tc filter add dev internal protocol 802.1q parent 1:0 prio 100 \
    u32 match u16 0x0ed8 0x0fff at -4 flowid 1:300

Now I'm unable to match 802.1q tag with at 0, at -2, at -4, at -6 or like that. The main issue that I have zero hits count --- this filter is not being checked at all, "wrong protocol", in other words.

Please, anyone, help me :-)


share|improve this question

4 Answers 4

I would recommend using wireshark to capture what is going through the interface as visible in userspace, and using that to write the filter. I am wondering if perhaps the interface is stripping the VLAN tags for some reason (despite being configured to bridge transparently). Perhaps it is adding extra tags or something?

share|improve this answer
No, it's not stripping VLAN tag, definitely -- everything works (traffic gets switched via trunks on hardware switches), except filters in the shaper. I will look closer, however. I looked at VLAN tag offload capability, but those drivers are not capable to do vid offload. –  brownian Apr 13 '12 at 6:47
tcpdump shows vlan IDs at all interfaces bridge and it ports. –  brownian May 10 '12 at 12:47
Now my nice shaper works un linux kernel 3.3.4, everything works great except 8021q tag filtering (I can live without it). The problem remains unsolved. Thank you anyway. –  brownian May 21 '12 at 14:59

You can mark vlan packtes with ebtables.

# mark packets according to the vlan id
ebtables -i br0 -A PREROUTING -p 802_1Q --vlan-id 1 -j mark --mark-set 1
ebtables -i br0 -A PREROUTING -p 802_1Q --vlan-id 5 -j mark --mark-set 2

Then apply shaping based on markings. ebtables and iptables share the same marking.

Haven't done this myself yet. So its rather a hunch.

share|improve this answer
I doubt it will work smoothly on 10Gb link... I'd like to avoid any *tables. Thanks for suggestion anyway. –  brownian Apr 24 '13 at 17:18
@brownian you think doing exactly the same filtering in iproute2 will be higher performance? It's the same kernel, same code path, same algorithms. As long as you don't accidentally do something like turn on connection tracking, you shouldn't see a difference. *tables can impact performance because it can do a lot of complex stuff. But that doesn't means that it will. –  tylerl Jun 27 '13 at 3:16
@tylerl Since I actually have to filter with iproute2 (hundreds of customers in the same vlan, a bunch of filters hashes) -- any other extra check for every packet will impact performance, I do believe. –  brownian Jun 27 '13 at 7:05

VLAN tag is stripped from skb in recent kernels. Try something like this to do a meta match in skb:

tc filter add dev internal protocol all parent 1:0 prio 100 basic match 'meta(vlan mask 0xfff eq 0x0ed8)' flowid 1:300
share|improve this answer
Thank you, I'll try asap and will be back then. –  brownian Oct 10 '13 at 8:17
An attempt to add a root filter for protocol all gives me RTNETLINK answers: Invalid argument (3.3.4 kernel here). I will test this with newer kernels. Thank you. –  brownian Nov 18 '13 at 15:18

Try to turn off reorder_hdr option on vlan interface. If reorder header option is enabled, then tags from frames are being removed. Check it by command ip -d link list dev vlan_iface.

share|improve this answer
Please, can you clarify, when it is removed, and when it is inserted back? I mean, a tagged frame enters into linux bridge and then leaves it from another interface -- when/where these tag manipulations occur, and when/where tc filters are called? Do you have a link to a map or like that? Thanks! –  brownian May 24 '12 at 17:55
Please, another thought: which vlan interface do you mean? That bridge has no one vlan interface (I wrote "I mean, no VLAN interfaces are there" in the first paragraph). –  brownian May 25 '12 at 11:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.