For purpose of continuous testing, I would like have apache server to serve static files with at least 20ms delay.

I tried to find a apache configuration setting or a plugin with similar ability, but failed.

Combination of tc and iptables might work, but I only found a way to add delay based on outgoing port, (which is different for every client).

IFSPEED=100Mbps # Get from sudo /sbin/ethtool $IF

# Create a tree of classful HTB objects
sudo /sbin/tc qdisc add dev $IF handle 1: root htb

# Create a classful child bucket with classid 1:11
sudo /sbin/tc class add dev $IF parent 1: classid 1:11 htb rate $IFSPEED

# Create a qdisc (classless) netem child to provide a delay for packets in this 'bucket'
sudo /sbin/tc qdisc add dev $IF parent 1:11 handle 11: netem delay $DELAY

# Filter mangled/marked traffic to the above class
sudo /sbin/tc filter add dev $IF parent 1:0 prio 1 protocol ip handle 11 fw flowid 1:11

# Use iptables to mangle TCP packets to port 4001 and mark packet for tc filtering
sudo /sbin/iptables -A OUTPUT -t mangle -p tcp --dport 4001 -j MARK --set-mark 11

So the previous snippet work, but how to change policy so every incoming packet with destinatiom port 80 is delayed? -- attempted to try iptables with PREROUTING , but still didn't work?

  • Please clarify: do you want to delay incoming or outgoing packets? I'm not quite sure if both will have the same effect, but delaying outgoing packets is easier.
    – skarap
    May 10, 2013 at 21:24
  • For my purpose, delay either of them will suffice.
    – bbaja42
    May 11, 2013 at 3:05
  • 1
    Well, won't changing the iptables rule to iptables -t mangle -A OUTPUT -p tcp -m tcp --sport 80 -j MARK --set-mark 11 be enough? At least for me it delays the outgoing packets for 1000ms.
    – skarap
    May 11, 2013 at 6:04
  • Yes, you are right. My mistake was trying to use --sport with PREROUTEING table, and --dport with OUTPUT table. I didn't realize that I can combine --sport with OUTPUT table.
    – bbaja42
    May 11, 2013 at 19:24

1 Answer 1


Adding delay can be done on incoming (ingress) or outgoing (egress) packets (or both). Delaying ingress packets is a bit harder (cause the packet has already arrived) but is achievable with Intermediate Functional Block device (have a look here. search for "netem on incoming traffic").

Because your goal can be achieved by delaying ingress or egress traffic and delaying egress is easier, I'd recommend to do that. Your configuration is almost correct: you just need to replace the iptables mangle line with

sudo iptables -t mangle -A OUTPUT -p tcp -m tcp --sport 80 -j MARK --set-mark 11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.