Using tc filter together with Snort

Question

I need to add delay to packets after doing some modification using the SNORT inline module. However, I cannot seem to get the packets to match a filter using tc filter ... It always matches the default filter. The commands I am using are stated below:

sudo tc qdisc del dev em1 root
sudo tc qdisc add dev em1 root handle 1: prio
sudo tc filter add dev em1  parent 1:0 protocol all prio 1 u32  match u32 0xac18095a 0xffffffff at 0 flowid 1:1 
sudo tc filter add dev em1 parent 1:0  protocol all prio 2 u32 match ip dst 0.0.0.0/0 classid 1:2 
sudo tc qdisc add dev em1 parent 1:1 handle 10: netem delay 10ms
sudo tc qdisc add dev em1 parent 1:2 handle 20: netem drop 50%

Any help is highly appreciated.

Answer 1

Finally figured out how to do it. The below script seems to work.

#!/bin/bash

configure() {
    local device=$1
    local totalrate=$2
    local maxrate=$3
   local limited=$4

    # Delete qdiscs, classes and filters
    tc qdisc del dev $device root 2> /dev/null

    tc qdisc add dev $device root handle 1: cbq avpkt 1000 bandwidth $totalrate
    tc class add dev $device parent 1: classid 1:1 cbq rate $limited allot 1500 prio 3 bounded isolated
    tc class add dev $device parent 1: classid 1:2 cbq rate $maxrate allot 1500 prio 5 bounded isolated
    tc qdisc add dev $device parent 1:2 handle 20: netem delay 1000ms rate $maxrate


    # Classify ICMP into high priority queue
    tc filter add dev $device parent 1:0 protocol all  prio 3 u32 \
        match ip protocol 1 0xff flowid 1:1

    # Classify DNP3 into low priority queue
    tc filter add dev $device parent 1: protocol all prio 1 u32 \
        match ip protocol 6 0xff \
        match ip sport 20000 0xffff \
        flowid 1:2

    tc filter add dev $device parent 1: protocol all prio 2 u32 \
        match ip protocol 6 0xff \
        match u8 0x05 0x0f at 0 \
        match u16 0x0000 0xffc0 at 2 \
        match u8 0x10 0xff at 33 \
        flowid 1:2
}

main() {

    configure em1 1000Mbit 800Mbit 200Mbit
   # configure p24p1 200mbit 100mbit


}

main "$@"

However I encountered another problem. I have experimented with the following setups. The first works with the delay and inline packet modification of snort. However, the second does not. When I ping the Linux machine A from my Windows machine the Linux machine A sends 2 ping replies for some requests. Then some of if do not get replied.

Setup 1:
 _________               _________            _________               ___________
|Linux PC |             |Linux PC |          |    L2   |             |Windows PC |
|    A    |-------------|Running  |----------|  Switch |-------------|    A      |
|_________|             | Snort & |          |_________|             |___________|
                        | tc netem| 
                        |_________| 

Setup 2:
 _________     _____      _________            _________               ___________
|Linux PC |   |L2 SW|    |Linux PC |          |    L2   |             |Windows PC |
|    A    |---|_____|----|Running  |----------|  Switch |-------------|    A      |
|_________|              | Snort & |          |_________|             |___________|
                         | tc netem| 
                         |_________| 

Any help in it is highly appreciated.