Hot answers tagged

17

The chosen answer is incorrect/incomplete. I faced a similar issue, the chosen answer gave some help, but not enough. First, the following command is not really needed. tc qdisc del dev eth0 root It will 'delete' the root qdisc, but inmediately gets substituted by a pfifo_fast one (so you don't lose connectivity). The second command: tc qdisc add ...


10

Here is a solution, how to do traffic shaping for data rate limiting of individual clients with tc (traffic control) using a script called by OpenVPN. The traffic control settings are handled in a script tc.sh with the following features: Called by OpenVPN using directives: up, down, client-connect and client-disconnect All settings are passed via ...


8

RTNETLINK answers: No such file or directory is tc's way of saying that it can't find something - in this case: most probably the htb scheduler. To test and make sure try modprobe sch_htb You will probably get an error. And this probably means that your VPS provider is not using the default kernels from debian upstream. They usually provide you with a ...


8

Netfilter (iptables) has queue module to send frames to a userspace program. Libraries for different languages (c, python, perl, etc...) are available to examine packets. After processing a frame you will return an ACCEPT or DROP verdict, the original or modified frame, and an option to set a mark. My guess that you can use the mark to handle this packet ...


7

Userspace routing can be achieved by pointing a default route at a tun device, and having a userspace program examine each received packet. It's an inefficient and brittle approach, but it has been made to work — there was an AODVv2 implementation that worked that way, due to Henning Rogge. The other option, of course, is to implement your routing protocol ...


7

The command tc qdisc (or tc q) will show all active queueing disciplines, including any instances of netem. For example, after running the command tc qdisc add dev eth0 root netem delay 25ms, the output of tc q is: qdisc netem 8005: dev eth0 root refcnt 2 limit 1000 delay 25.0ms The man page for tc describes more options for displaying qdisc information.


6

Yes, you can use the Ident protocol to identify the user at the source. Well, you used to be able to. Nowadays the only people who expose ident servers to the Internet at large are IRC users who want a funky nickname. Oh, and people who've misconfigured their systems.


6

This is not achievable natively within the TCP/IP protocol, because... well, that's just not how the protocol works - it doesn't have a concept of users, and is designed to just transfer data between devices. The way this is generally done (rate-limiting a specific remote user) is through the use of sessions (layer 5 in your OSI networking model, which is 1 ...


6

I finally figured it out. After careful studying of this and this chapters I have much better understanding of how it is supposed to work and how tc processes packets. So basically, what I need to do, is to build this kind of tree: 1: root qdisc / | \ / | \ / | \ 1:1 1:2 1:3 classes | | | ...


6

Yes, the tc is designed for this. TC works over any types of interfaces (physical and software). Most simple queue scheduler is the htb (Hierarchical Token Bucket). Typical simple configuration: htb root queue discipline root class (100% bandwidth) default leaf class (80% bandwidth guarantee, up to to 100% bandwidth) bandwidth limited leaf class 1 (10% ...


5

I'm having trouble adding the script code for you here, it is available via this gist - https://gist.github.com/akrasic/7242498#file-limit-tc-sh The script is using TC and Hierarchical Token Bucket (HTB) to define the rules and lastly the filters that would act as a catch-all rule. You would need to modify the interface var if it's different than eth0˙and ...


5

You can use ematch - extended match - instead of u32 filter, which supports "less than" and "greater than" comparisons. Have a look at the man page. The following matches packets with source port in the range 70 - 90 (excluding) tc filter add dev eth0 parent 1: protocol ip prio 1 basic match "cmp(u16 at 0 layer transport gt 70) and cmp(u16 at 0 layer ...


5

Answer: DRR does not drop packets itself. To get the desired behavior, add child qdiscs to the DRR child classes like pfifo limit 50 to cause the child qdisc to drop packets instead of queueing them effectively indefinitely. The solution was found here: linux.org.ru thread Reference: man tc-drr NOTES This implementation does not drop packets from the ...


5

Using tc (because it's the most current, and I'm the most familiar with it), you should be able to slow traffic down without problems. I have a server acting as the firewall (called 'firewall' -- very creative) and then a second server behind that (called 'mil102'). without any tc commands, scp'ing a file from mil102 to firewall moves at full speed: root@...


4

VLAN tag is stripped from skb in recent kernels. Try something like this to do a meta match in skb: tc filter add dev internal protocol all parent 1:0 prio 100 basic match 'meta(vlan mask 0xfff eq 0x0ed8)' flowid 1:300


4

I thought this would do the trick but unless it has some mechanism controlling its outflow, the queue empties too fast and it never exhibits drr weightings (not exactly sure why this is). As soon as there is selection pressure, however, it works exactly as it is supposed to. tc qdisc add dev eth0 handle 1 root drr tc class add dev eth0 parent 1: classid 1:1 ...


4

when a user connects to OpenVPN the following learn-address script is called The $1, $2, and $3 are the arguments passed to the script, that are documented in the man page. --learn-address cmd ... Three arguments will be appended to any arguments in cmd as follows: [1] operation -- "add", "update", or "delete" based on whether or not the address is ...


4

Creating delays can be simulated by the traffic shaping algorithms supported by the Linux kernel. From the netem manual: # tc qdisc add dev eth0 root handle 1: prio # tc qdisc add dev eth0 parent 1:3 handle 30: tbf rate 20kbit buffer 1600 limit 3000 # tc qdisc add dev eth0 parent 30:1 handle 31: netem delay 200ms 10ms distribution normal # tc filter add ...


4

The filter priority isn't family specific. So, your commands to create filters should look like: /sbin/tc filter add dev eth0 parent 1:0 prio 1 protocol ip handle 1/0xF fw flowid 1:1 /sbin/tc filter add dev eth0 parent 1:0 prio 2 protocol ip handle 2/0xF fw flowid 1:2 /sbin/tc filter add dev eth0 parent 1:0 prio 3 protocol ip handle 3/0xF fw flowid 1:3 /...


3

drr is a scheduler, you still have to allocate different bandwidth to classes with htb. I guess you though specifying quantum as 600 and 1400 will give close to 1:2 ratio. In fact it will not. You may get close to that ratio on your config only in case of congestion, e.g. create multiple UDP streams, and then measure two in question, but it's still not the ...


3

I had to do exactly this. I found that the answer suggested by @Thusitha was the correct way to do it for new kernels. Tested with the Debian wheezy kernel 3.2.0-4 and iproute (from where the tc command comes from) version 20120521-3+b3 Here is the complete script, the tc filter lines being almost exactly as specified by @Thusitha function qos() { if=...


3

The question is rather old, but just in case someone comes across a similar problem. Parameter all can be used for protocol instead of ip to also filter for other traffic like arp. tc filter add dev $IF_LAN parent 1: protocol all prio 7 u32 match u32 0 0 flowid 1:190 Also match u32 0 0 is a shorter expression to filter all traffic.


3

Based on Sérgio Carvalho answer I made small bash script to limit bandwidth: File name: netspeed #!/bin/bash #USAGE: sudo ./netspeed -l limit_in_kbit -s usage="sudo $(basename "$0") -l speed_limit -s -l speed_limit - speed limit with units (eg. 1mbit, 100kbit, more on \`man tc\`) -s - remove all limits " # default values LIMIT=0 STOP=0 # hardcoded ...


3

In your example, you are trying to add two root qdiscs on the egress. The second command fails because you already have a root qdisc, and only one is allowed. Instead, create the root qdisc, then a child class for it, and then add your second qdisc as a child of the class. For example: tc qdisc add dev eth0 root handle 1:0 cbq avpkt 1000 bandwidth 10kbit tc ...


3

Yes it is the right tool. In fact the traffic shaping is implemented on kernel level. tc is the userland interface tool to control it. It is part of the iproute2 package. http://lartc.org/ has good documentation or see also references in How to do traffic shaping (rate limiting) with TC per OpenVPN client rate in HTB classes is used to set the minimum ...


3

Use this example: tc qdisc del dev eth1 root tc qdisc add dev eth1 root handle 1: htb default 10 tc class add dev eth1 parent 1: classid 1:10 htb rate 1mbit ceil 1mbit tc class add dev eth1 parent 1: classid 1:11 htb rate 1mbit ceil 1mbit tc class add dev eth1 parent 1: classid 1:12 htb rate 1mbit ceil 1mbit Add more if needed tc filter add dev ...


3

Your solution relies on web browser behaviour to set IP ToS field accordingly. This could be relied upon only in trusted environment. I can easily write mangle rules on my machine to flatten all ToS into some single value and your TC rules wouldn't be able to distingush my bulk from browsing. Also, I wouldn't be sure that all browser and other http(s) ...


3

This could be done the way I describing below. First we should change the root discipline of interface (usually pfifo_fast) with the prio one: tc q a dev eno1 root handle 1: prio This command creates qdisc on eno1 with 3 classes by default (1:1 - the highest priority, 1:2 - middle, 1:3 - the lowest priority). Normally all the regular traffic goes to 1:2, ...


2

It is possible. I believe tc(8) man is not comprehensive. Citing from man7.org/tc(8): tc filters If tc filters are attached to a class, they are consulted first for relevant instructions. Filters can match on all fields of a packet header, as well as on the firewall mark applied by ipchains or iptables. Just checked on my Linux 5.0.3-zen1-2-zen ...


2

I made a script to do what @alvosu described for anyone interested. http://blog.roeften.com/2017/01/mask-calculator.html Currently it will include more ports on the right of the range. The fiddle is at http://jsfiddle.net/hp6dfnvg/13/ A messy python implementation as well: import logging logging.getLogger().setLevel(logging.DEBUG) fp = ...


Only top voted, non community-wiki answers of a minimum length are eligible