I have:

  • 2 linux boxes (A, B)
  • 1 switch (S)
  • 1 gateway (G) [I have no control over this one]
|  switch S     +-------+  
+---+--------+--+       |  
    |        |       +--+-+
    |        |       | gw |
 +--+-+   +--+-+     +----+
 | A  |   | B  |           
 +----+   +----+

Just for some testing purposes, I need to shape traffic coming from A before it reaches the gateway G. I inject traffic in A at the mac layer with tcpreplay, so I cannot do the shaping directly on A.

My idea is to:

  • route to B all traffic from A
  • apply traffic shaping on B (Linux traffic control or dummynet)
  • reroute to gateway G all traffic from A arriving at B

Is my solution fine? Is there a simpler one that doesn't require two (Ethernet) network interfaces on B?

Would a virtual network interface on B make my life easier?

What are some typical commands I need in order to deploy the above setting (traffic shaping excluded)?


Some ideas:

  1. You can even shape the outgoing traffic coming from A and B even on GW!
  2. If your switch were a little bit smarter... doesn't it have an embedded linux?
  3. If you route that through B, beware, some network flag settings will be needed on B to handle the arp redirects correctly.

The main problem with your solution, that it will make the network of A dependant from B. Your network will be more unstable.

Although your solution makes from B linux essentially an intelligent, linux-based router. If "gw" and "switch S" are dummy, and B is smart, you could even consider to throw out at least one of them and make B to your real gateway.

|improve this answer|||||
  • Thank you so much for your tips! I forgot to specify that the gateway is the only component over which I have no control. The switch in question is netgear prosafe 8 port 10/100 switch fs108 v2; I looked at its specs and it doesn't look like it runs Linux, unfortunately. Could you please elaborate more on point 3 or provide a simple example? It is true that A will heavily depend on B, but this is just for testing purposes and my personal use, so I guess it's ok. – Ricky Robinson Jul 29 '14 at 14:48
  • As for your last point, I believe I need an extra network interface on B in order to turn it into a router/gateway. Do you think a USB Ethernet adapter could do the job? – Ricky Robinson Jul 29 '14 at 14:49
  • 1
    @RickyRobinson an USB->Ethernet adapter will work fine but will be limited by the ports bandwidth, ie. 480mbps for USB2.0, so about half of what you'll get with a normal Gigabit Ethernet card. But this looks like an experiment only for learning purposes so yeah it'll be fine, just don't do that in production. – user186340 Jul 29 '14 at 15:01

You don't need to do any routing tricks for that, nor do you need a virtual interface.

You simply shape your traffic as it leaves system A.

Outline exactly what you want to do and it is trivial to write a 'tc' rule for it.

For example, say you want to limit A to 1mbit/s on all outgoing traffic:

# Flush tc
tc qdisc del dev eth0 root &> /dev/null

tc qdisc add dev eth0 root handle 1: htb default 1
tc class add dev eth0 parent 1: classid 1:1 htb rate 1mbit


Run a speed test from A and you will see your incoming traffic is probably unaffected, but your outgoing traffic is limited 1 Mebibit per second.

Why do I say 'incoming probably unaffected'? Because if you have a very high incoming rate your ACK packets might exceed the 1Mbit limit, and get throttled. And if your ACK's slow down, so does your incoming traffic.

If you are unable to use tc or iptables on A - such as if your traffic is invisible to tc/iptables - eg, tcpreplay, then you need to do the traffic control on B instead.

For this there are at least the following three ways to do it.

  1. Buy a network card for B and put A/B1 on network 1, and B2/gateway on network 2. ie, B becomes a gateway. Now use 'tc' to shape A's traffic.

  2. Multi home eth0 on B. ie, eth0:1 -> and give A an address in this network. Configure B to forward traffic between eth0 and eth0:1, mark and shape traffic (tc) heading to the main gateway.

  3. Use 'brctl' to create a bridge on eth0, and create interfaces for A/B and B/gw, and again mark and shape traffic (tc) heading to the main gateway.
|improve this answer|||||
  • Thank you for your input. I wanted to keep my post as short as possible, but I skipped an important detail: I do not shape traffic directly on A because I actually inject traffic on A at the mac layer (with tcpreplay). With dummynet and linux traffic control working at the IP layer, I would bypass them. – Ricky Robinson Jul 29 '14 at 16:43
  • The aim of my experiment is to manually select one or more traffic flows (defined by their (src addr, dst addr, src port, dst port, protocol) and insert them in a leaky bucket. – Ricky Robinson Jul 29 '14 at 16:45
  • I added a 2nd section to the answer to cater for that. – Ian Macintosh Jul 30 '14 at 9:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.