Hi

In "tc add filter .. fw ..":

"prio" was apparently renamed to "preference" and
"flowid" to "classid".
The manual examples still often uses this term, it should be annotated
or replace because it confuses.

bye,

-christian-

--
Christian Hammers    WESTEND GmbH - Aachen und Dueren     Tel 0241/701333-0
ch@westend.com     Internet & Security for Professionals    Fax 0241/911879
          WESTEND ist CISCO Systems Partner - Authorized Reseller

Hi

My ingress policies _seems_ to work but the statistics are somwhat strange:
When sending only 4 SYN packets, they are passed and counted in neither
"dropped" nor "overlimit".  When sending 40 SYN packets they
are also
only show up in "overlimits" and not "dropped" although they
should be
above the (testing) values I've choosen! Why?

I also wonder why the counters at the ingress qdisc never increase?

I'm using linux kernel 2.4.18 with IMQ patch (IMQ not enabled).

thanks,

-christian-

--- qdisc ---

qdisc ingress ffff: dev eth0
 Sent 0 bytes 0 pkts (dropped 0, overlimits 0)

--- filter ---

filter protocol ip pref 49152 fw
filter protocol ip pref 49152 fw handle 0x14 classid :1 police 28 action
drop rate 200bps burst 159b mtu 320b peakrate 400bps
 Sent 1920 bytes 48 pkts (dropped 0, overlimits 33)

----------------------------------------------------------------------------

    $TC qdisc add \
      dev eth0 \
      handle ffff: \
      ingress

    # testing with 40byte tcp syn packets
    # rate:  5 SYN packets = 200 bytes/s = 1600 bit/s
    # peak: 10 SYN packets = 400 bytes/s = 3200 bit/s
    $TC filter add \
      dev eth0 \
      protocol ip \
      parent ffff: \
      handle 20 \
      fw \
        police \
          rate 1600 burst 160 \
          peakrate 3200 mtu 320 \
          drop \
      classid :1

    # tag all incoming SYN packets through eth0 as mark value 20.
    # (20 is an arbitrary number)
    $IPT -A PREROUTING -t mangle  -i eth0 -p tcp --syn  -j MARK --set-mark 20




--
Christian Hammers    WESTEND GmbH - Aachen und Dueren     Tel 0241/701333-0
ch@westend.com     Internet & Security for Professionals    Fax 0241/911879
          WESTEND ist CISCO Systems Partner - Authorized Reseller