Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Our application has three classes of traffic, and every type of traffic involves three ports. We want to limit the traffic by port number via TC, so I made a simple TC script to have the test, however the script doesnt work as I expected.

Below are those shell commands I use to set the TC. The expected result is that Downloading rate of SecureCRT and Apache (SecureCRT uses 22 port and Apache uses 80) will be limited to 100K/S, but the actual result we got is that Downloading rate remains unchanged -- about 5MB/s.

   tc qdisc del dev eth0 root
   tc qdisc add dev eth0 root handle 1:0 cbq bandwidth 1Mbit avpkt 1000 cell 8

   tc class add dev eth0 parent 1:0 classid 1:1 cbq bandwidth 1Mbit rate 1Mbit 
   weight 100kbit prio 5 allot 1514 cell 8 maxburst 20 avpkt 1000 bounded

   tc class add dev eth0 parent 1:0 classid 1:2 cbq bandwidth 1Mbit rate 1Mbit
   weight 100kbit prio 5 allot 1514 cell 8 maxburst 20 avpkt 1000 bounded

   tc class add dev eth0 parent 1:0 classid 1:3 cbq bandwidth 1Mbit rate 1Mbit
   weight 100kbit prio 5 allot 1514 cell 8 maxburst 20 avpkt 1000 bounded


   tc class add dev eth0 parent 1:1 classid 1:1001 cbq bandwidth 1Mbit rate 
   800kbit weight 80kbit prio 8 allot 1514 cell 8 maxburst 20 avpkt 1000
   tc qdisc add dev eth0 parent 1:1001 handle 1001: sfq

   tc class add dev eth0 parent 1:1 classid 1:1002 cbq bandwidth 1Mbit rate
   800kbit weight 80kbit prio 8 allot 1514 cell 8 maxburst 20 avpkt 1000
   tc qdisc add dev eth0 parent 1:1002 handle 1002: sfq

   tc class add dev eth0 parent 1:1 classid 1:1003 cbq bandwidth 1Mbit rate 
   800kbit weight 80kbit prio 8 allot 1514 cell 8 maxburst 20 avpkt 1000
   tc qdisc add dev eth0 parent 1:1003 handle 1003: sfq


   tc class add dev eth0 parent 1:2 classid 1:2001 cbq bandwidth 1Mbit rate
    800kbit weight 80kbit prio 8 allot 1514 cell 8 maxburst 20 avpkt 1000
   tc qdisc add dev eth0 parent 1:2001 handle 2001: sfq

   tc class add dev eth0 parent 1:2 classid 1:2002 cbq bandwidth 1Mbit rate
      800kbit weight 80kbit prio 8 allot 1514 cell 8 maxburst 20 avpkt 1000
   tc qdisc add dev eth0 parent 1:2002 handle 2002: sfq

   tc class add dev eth0 parent 1:2 classid 1:2003 cbq bandwidth 1Mbit rate 
      800kbit weight 80kbit prio 8 allot 1514 cell 8 maxburst 20 avpkt 1000
   tc qdisc add dev eth0 parent 1:2003 handle 2003: sfq


   tc class add dev eth0 parent 1:3 classid 1:3001 cbq bandwidth 1Mbit rate
      800kbit weight 80kbit prio 8 allot 1514 cell 8 maxburst 20 avpkt 1000
   tc qdisc add dev eth0 parent 1:3001 handle 3001: sfq

   tc class add dev eth0 parent 1:3 classid 1:3002 cbq bandwidth 1Mbit rate
     800kbit weight 80kbit prio 8 allot 1514 cell 8 maxburst 20 avpkt 1000
   tc qdisc add dev eth0 parent 1:3002 handle 3002: sfq

   tc class add dev eth0 parent 1:3 classid 1:3003 cbq bandwidth 1Mbit rate
     800kbit weight 80kbit prio 8 allot 1514 cell 8 maxburst 20 avpkt 1000
   tc qdisc add dev eth0 parent 1:3003 handle 3003: sfq

   tc filter add dev eth0 parent 1:0 protocol ip prio 1 u32 match ip sport 
             80 0xffff flowid 1:3001
   tc filter add dev eth0 parent 1:0 protocol ip prio 1 u32 match ip sport
             22 0xffff flowid 1:3002
share|improve this question

1 Answer 1

up vote 1 down vote accepted

You can't classify traffic and then use shaping or delaying on "incoming" traffic or on ingress how it's often called. This diagram is borrowed from LARTC document:

 Userspace programs
                     ^
                     |
     +---------------+-----------------------------------------+
     |               Y                                         |
     |    -------> IP Stack                                    |
     |   |              |                                      |
     |   |              Y                                      |
     |   |              Y                                      |
     |   ^              |                                      |
     |   |  / ----------> Forwarding ->                        |
     |   ^ /                           |                       |
     |   |/                            Y                       |
     |   |                             |                       |
     |   ^                             Y          /-qdisc1-\   |
     |   |                            Egress     /--qdisc2--\  |
  --->->Ingress                       Classifier ---qdisc3---- | ->
     |   Qdisc                                   \__qdisc4__/  |
     |                                            \-qdiscN_/   |
     |                                                         |
     +----------------------------------------------------------+

Linux has simple ingres qdisc but it's features are very limited as there is no ingress queue. But it is possible to workaround it with IMQ device (InterMediate Queuing device) which "emulates" queuing on ingress.

Moreover, you can shape/delay incoming traffic when your server acts as a router (with IP forwarding turned on). If the server has two network interfaces - e.g. eth0 for Internet access and eth1 for local network access - and a client from the local network is downloading something, then, this traffic is incoming/ingress on eth0 interface and outgoing/egress on eth1 interface. So if you define your QoS policy on eth1 interface it will work.

Finally, I would recommend you to switch to htb qdisc from cbq as it is more accurate (it uses TBF or Token Bucket Filter which does not depend on interface characteristics).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.