0

I need to add delay to packets after doing some modification using the SNORT inline module. However, I cannot seem to get the packets to match a filter using tc filter ... It always matches the default filter. The commands I am using are stated below:

sudo tc qdisc del dev em1 root
sudo tc qdisc add dev em1 root handle 1: prio
sudo tc filter add dev em1  parent 1:0 protocol all prio 1 u32  match u32 0xac18095a 0xffffffff at 0 flowid 1:1 
sudo tc filter add dev em1 parent 1:0  protocol all prio 2 u32 match ip dst 0.0.0.0/0 classid 1:2 
sudo tc qdisc add dev em1 parent 1:1 handle 10: netem delay 10ms
sudo tc qdisc add dev em1 parent 1:2 handle 20: netem drop 50%

Any help is highly appreciated.

0

Finally figured out how to do it. The below script seems to work.

#!/bin/bash

configure() {
    local device=$1
    local totalrate=$2
    local maxrate=$3
   local limited=$4

    # Delete qdiscs, classes and filters
    tc qdisc del dev $device root 2> /dev/null

    tc qdisc add dev $device root handle 1: cbq avpkt 1000 bandwidth $totalrate
    tc class add dev $device parent 1: classid 1:1 cbq rate $limited allot 1500 prio 3 bounded isolated
    tc class add dev $device parent 1: classid 1:2 cbq rate $maxrate allot 1500 prio 5 bounded isolated
    tc qdisc add dev $device parent 1:2 handle 20: netem delay 1000ms rate $maxrate


    # Classify ICMP into high priority queue
    tc filter add dev $device parent 1:0 protocol all  prio 3 u32 \
        match ip protocol 1 0xff flowid 1:1

    # Classify DNP3 into low priority queue
    tc filter add dev $device parent 1: protocol all prio 1 u32 \
        match ip protocol 6 0xff \
        match ip sport 20000 0xffff \
        flowid 1:2

    tc filter add dev $device parent 1: protocol all prio 2 u32 \
        match ip protocol 6 0xff \
        match u8 0x05 0x0f at 0 \
        match u16 0x0000 0xffc0 at 2 \
        match u8 0x10 0xff at 33 \
        flowid 1:2
}

main() {

    configure em1 1000Mbit 800Mbit 200Mbit
   # configure p24p1 200mbit 100mbit


}

main "$@"

However I encountered another problem. I have experimented with the following setups. The first works with the delay and inline packet modification of snort. However, the second does not. When I ping the Linux machine A from my Windows machine the Linux machine A sends 2 ping replies for some requests. Then some of if do not get replied.

Setup 1:
 _________               _________            _________               ___________
|Linux PC |             |Linux PC |          |    L2   |             |Windows PC |
|    A    |-------------|Running  |----------|  Switch |-------------|    A      |
|_________|             | Snort & |          |_________|             |___________|
                        | tc netem| 
                        |_________| 
Setup 2:
 _________     _____      _________            _________               ___________
|Linux PC |   |L2 SW|    |Linux PC |          |    L2   |             |Windows PC |
|    A    |---|_____|----|Running  |----------|  Switch |-------------|    A      |
|_________|              | Snort & |          |_________|             |___________|
                         | tc netem| 
                         |_________| 

Any help in it is highly appreciated.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.