Hot answers tagged tc
12
IFB is an alternative to tc filters for handling ingress traffic, by redirecting it to a virtual interface and treat is as egress traffic there.You need one ifb interface per physical interface, to redirect ingress traffic from eth0 to ifb0, eth1 to ifb1 and so on.
When inserting the ifb module, tell it the number of virtual interfaces you need. The default ...
3
There is not out of the box solution in Ubuntu. You have to recompile your kernel with the imq patch applied. There are a lot of tutorials on how to do that. Here is the first I have found: http://ubuntuforums.org/showthread.php?t=1404537
3
You should patch your kernel to add support for IMQ. Here you find the patches http://www.linuximq.net/patches.html and here you will find details instructions how to compile it: http://ubuntuforums.org/showthread.php?t=1404537
Regards
3
I know this is an old post but I'm using this and it seems to work well:
Add filter:
tc filter add dev eth1 parent 1: handle ::100 prio 1 protocol ip u32 match ip dst 10.10.10.10/32 flowid 1:100
Delete filter:
tc filter del dev eth1 parent 1: handle 800::100 prio 1 protocol ip u32
Just change the number '100' for each filter you need
3
You should be able to rate limit tcp connections, if the remote servers are obeying tcp packet transmit and receive rules then you should be able to rate limit to avoid a dos.
I've had good success with HTB http://luxik.cdi.cz/~devik/qos/htb/manual/userg.htm
if your more familiar with cisco, then you could implement a qos policy on your gateway rather ...
3
Simple script to limit ingress and egress http traffic:
#!/bin/bash
INT="eth1"
case "$1" in
start|restart)
tc qdisc del dev $INT handle ffff: ingress 2>/dev/null
tc qdisc add dev $INT handle ffff: ingress
tc filter add dev $INT parent ffff: protocol ip prio 50 u32 match ip dport 80 0xffff police rate 50Mbit burst 10m drop flowid ...
3
This from the perspective of iptables for a sec. When you handle packets one by one it is not possible to identify a packet as coming from the transfer of a large or a small file, you just pass them along. If you do deep packet inspection you can find a little bit more about the content, but you still don't really know how big a file is going to be or even ...
3
As already posted by Caleb, this is not a task for iptables as you are lacking "proper" content inspection features there. You might want to take a look into a HTTP proxy like Squid. Recent versions come with sophisticated bandwidth regulation mechanisms called "delay pools" which can be combined with tagging mechanisms called "ACLs" for complex bandwidth ...
2
Unless I am misunderstanding your goals, you cannot really restrict the rate at which packets come in to your network from your ISP unless you coordinate some form of QoS with your ISP to shape traffic at their routers. This typically requires a business-class connection and money.
You are seeing packet drops because that is the only way to shape traffic - ...
2
You can use mask, but it difficult:
u32 match ip sport 4096 0xf000 = sport 4096-8191
u32 match ip sport 8192 0xe000 = sport 8192-16383
0xf000/0xe000 is the mask. The word extracted from the packet is bit-wise with this mask before comparison.
value = 0001000000000000
mask = 1111000000000000
start = 0001000000000000
end = 0001111111111111
Also you ...
2
Nice Script, I like the part with the time depended dynamic download speed. ;) Anyway, I am doing excactly what you want. I did it with htb, but switched a few months ago to hfsc. The trick is to limit q3 with rate to a very low rate, but give it with ceil the full bandwith. q1 on the other hand gets a higher rate and the same ceil.
One realworld example:
...
2
i think that you should not put 64k users with upstream and downstream classes and filters for each of them on the same interface. You can repeat the handlers for each interface you have, so add more interfaces. You will need a incredible work/server/NIC to have this things. If the server crashes, you will have 64k users offline (and it will crash easily ...
2
Just to conclude, here is the simple solution to have priority traffic based on any parameter without thottling bandwidth
tc qdisc add dev eth0 root handle 1: prio
tc filter add dev eth0 protocol ip parent 1: prio 1 u32 match ip dport 22 0xffff flowid 1:1
tc filter add dev eth0 protocol ip parent 1: prio 1 u32 match ip dport 3306 0xffff flowid 1:1
tc ...
2
A couple of things jump out at me...
You're not maxing-out or approaching the bandwidth limits, are you?
Have you looked at system entropy pool levels during the period of slow sftp performance (check /proc/sys/kernel/random/entropy_avail)? E.g. are your nginx sessions doing a lot of SSL requests? That can have a clear effect on other services that use ...
2
The problem here is not well documented but I've experienced it before.
On 64 bit systems, the value you echo is not represented as a 16bit integer but a 32bit integer.
Try replacing:
echo 0x1001 > A/net_cls.classid # 10:1
echo 0x1002 > B/net_cls.classid # 10:2
With
echo 0x00100001 > A/net_cls.classid # 10:1
echo 0x00100002 > ...
1
Many of the non-hypervisor containers (lxc, jails) tend to have dodgy/incomplete metering (disk iops, net) that impacts other containers. If limiting external transit is the main concern, stick a transparent firewall (i.e., ArmorLogic, Barracuda, etc.) in front of these first.
In any case, definitely load test to see if it makes a difference.
(ProTip: ...
1
Quote from the developers to someone trying to do the same thing: Doing traffic control on vlan's may not work as expected because the vlan pseudo-device does not have any transmit queue.
Since you've already written your rules to rate limit by subnet, it's a matter of getting Linux to rate control it.
I would suggest working around it by putting the VLAN ...
1
A google search would have easily yielded this article from the vger kernel mailing list:
These patches contain a classful multiqueue ("mq") dummy scheduler to
fix a couple of problems with the current multiqueue TC API
integration. The changelogs of patch 05 and 07 contain more details.
The mq scheduler does two things:
present device ...
1
Adding delay can be done on incoming (ingress) or outgoing (egress) packets (or both). Delaying ingress packets is a bit harder (cause the packet has already arrived) but is achievable with Intermediate Functional Block device (have a look here. search for "netem on incoming traffic").
Because your goal can be achieved by delaying ingress or egress traffic ...
1
I think you have to use handle for that, like this:
sudo tc filter change dev eth0 pref 1 protocol ip handle 800::800 u32 match ip dst 10.0.0.5 flowid 1:15
— this way I can issue the same command with different ip dst and it applies successfully.
P. S. Handles are shown with tc show, or, I believe you can specify them when adding rules for the first time.
...
1
So it turns out I had at least three different problems masking one another. Here's what I did to solve the problems:
Prioritize ICMP and ingoing/outgoing traffic on port 22 (as shown in my question above). This boosts sftp responsiveness (e.g., ls) and also transmission throughput during peak times.
Solve the entropy shortage by installing the haveged ...
1
I could finally solve the problem, so I document it here in case it can be useful for somebody else. The trick was to use the IMQ device instead of the IFB one. There was no problem then classifying with iptables and using IMQ.
Best Regards
Daniel
This is the working script:
#!/bin/sh
# This script classifies all the Internet traffic addressed to a ...
1
From what I understand, the ifb device is the successor to imq. I'm very new to imq/ifb queing, but I believe they can be used in the same way as each other. You can load the ifb module by running sudo modprobe ifb.
Also, I came across this:
"There is the also IMQ patch, but it is not recommended. The IMQ design is unsafe and ifb is better" (from ...
1
Look into use of "priority", "rate", and "ceil".
You should be able to basically give Q3 a low rate (and high ceiling)...and Q1 a "lower" priority (which makes it actually more important). What this should do is give Q1 the predominant bandwidth...when its not in use...Q3 should then be raised to its ceiling (as its not as important).
1
You should be able to do a good few hundred megabit. Load balancing's a lot easier so I'd say Chopper3's answer doesn't really apply.
By far the best thing to do is look at the CPU logs in the system stats you should already be recording (Cacti is my preference, but many people swear by Munin) and compare them with the bandwidth graphs. In this case you are ...
1
You can't control the speed of incoming traffic on the internet side. A common workaround/solution is to shape the traffic on the interface facing your network instead.
HOWEVER, if you mean you want to differentiate a http download of a web page vs the http download of an ISO, slowing down the ISO download, then you are more likely looking at some kind ...
1
I've created this simple script on my blog to create the masks for any port range...
I got tired of googling it just to find the wrong ways to do it... Enjoy!
http://marcelustrojahn.blogspot.com/2011/06/u32-port-masks_14.html
1
If they have not been renamed, you can find all ethernet devices by looking for directories matching eth* in /sys/class/net/. For applying these operations to multiple NICs and IP addresses, look into for loops. Here is an example
#!/bin/bash
ADDRESSES="192.0.2.1 192.0.2.2"
for I in /sys/class/net/eth*
do
I=$(basename $I)
for A in ...
1
You could do something like:
tc qdisc add dev eth1 root handle 1: htb default 2
tc class add dev eth1 parent 1: classid 1:1 htb rate 2.4mbit
tc filter add dev eth0 protocol ip parent 1:0 prio 1 u32 match ip dst 192.168.0.0/24 flowid 1:1
This would restrict traffic going out to the LAN (assuming eth1 is LAN) on the given subnet.
(edit: nudged formatting a ...
1
I think I kinda sorta fixed the issue: I needed to tie the qdiscs/classes to an IMQ device rather than an ETH device. Once I did that, the shaper started working.
However!
While I could get the shaper to limit traffic incoming to a machine, I couldn't get it to split traffic fairly (even though I've attached a SFQ to my HTB).
What happened is this: I ...
Only top voted, non community-wiki answers of a minimum length are eligible
