LARTC - Apr 2002 - Fwmark and HTB: Mark not working!

Hello:

For some reason, marked packets don''t seem to be hitting the correct
HTB
queues. This is my rule set:

tc qdisc add dev eth0 root handle 1: htb default 50
tc class add dev eth0 parent 1:  classid 1:1  htb \
	rate 128kbps ceil 128kbps burst 2k

tc class add dev eth0 parent 1:1 classid 1:2  htb \
	rate 64kbps ceil 64kbps burst 2k
tc class add dev eth0 parent 1:2 classid 1:10 htb \
	rate 56kbps ceil 64kbps burst 2k prio 4
tc class add dev eth0 parent 1:2 classid 1:20 htb \
	rate  8kbps ceil 64kbps burst 2k prio 5

tc class add dev eth0 parent 1:1 classid 1:30 htb \
	rate  8kbps ceil 16kbps  burst 2k prio 2
tc class add dev eth0 parent 1:1 classid 1:40 htb \
	rate 16kbps ceil 128kbps burst 2k prio 1
tc class add dev eth0 parent 1:1 classid 1:50 htb \
	rate 40kbps ceil 128kbps burst 2k prio 3

tc qdisc add dev eth0 parent 1:10 handle 10: sfq perturb 10
tc qdisc add dev eth0 parent 1:20 handle 20: sfq perturb 10
tc qdisc add dev eth0 parent 1:30 handle 30: sfq perturb 10
tc qdisc add dev eth0 parent 1:40 handle 40: sfq perturb 10
tc qdisc add dev eth0 parent 1:50 handle 50: sfq perturb 10

tc filter add dev eth0 parent 1:0 protocol ip prio 1 handle 1 fw classid 1:10
iptables -t mangle -A PREROUTING -i eth0 -p tcp -d 192.168.1.24 
	--dport 80 -j MARK --set-mark 1


No matter what, marked traffic are still handled by the the default
queue (1:50) instead of "1:10".

Here is my iptables and "tc -s qdisc" output:

# iptables -t mangle -L -v
Chain PREROUTING (policy ACCEPT 156K packets, 18M bytes)
 pkts bytes target     prot opt in     out     source
 destination         
  2739  151K MARK       tcp  --  eth0   any     anywhere
  godzilla.exocore.comtcp dpt:www MARK set 0x1 

# tc -s qdisc
qdisc sfq 50: dev eth0 quantum 1514b perturb 10sec 
 Sent 11461182 bytes 8185 pkts (dropped 0, overlimits 0) 

qdisc sfq 40: dev eth0 quantum 1514b perturb 10sec 
 Sent 0 bytes 0 pkts (dropped 0, overlimits 0) 

qdisc sfq 30: dev eth0 quantum 1514b perturb 10sec 
 Sent 0 bytes 0 pkts (dropped 0, overlimits 0) 

qdisc sfq 20: dev eth0 quantum 1514b perturb 10sec 
 Sent 0 bytes 0 pkts (dropped 0, overlimits 0) 

qdisc sfq 10: dev eth0 quantum 1514b perturb 10sec 
 Sent 0 bytes 0 pkts (dropped 0, overlimits 0) 

qdisc htb 1: dev eth0 r2q 10 default 50 dcache 0
 deq_util 1/1000000 deq_rate 1 trials_per_deq 0
 dcache_hits 0 direct_packets 0
 Sent 11461182 bytes 8185 pkts (dropped 0, overlimits 16658) 

As you can see, the byte count for the MARK rule is increasing but queue
1:10 is not utilized. Only 1:50 (the default) is working. If I replace
the "fw" with a "u32" filter, it works without issues.

System Details:

Debian Unstable
Kernel 2.4.18+XFS+HTB+WRR patches
Iproute 20010824-8 (Deb) (Already contains HTB Iproute patches)

I don''t know how to debug this. IAC, I am recompiling my Kernel without
the WRR patches to see whether it makes a difference.

Thank you for your time.

-- Shanu

-- 
I love Mickey Mouse more than any woman I''ve ever known.
		-- Walt Disney

Hello:

Shanker Balan wrote,
> tc filter add dev eth0 parent 1:0 protocol ip prio 1 handle 1 fw classid
1:10
> iptables -t mangle -A PREROUTING -i eth0 -p tcp -d 192.168.1.24 
> 	--dport 80 -j MARK --set-mark 1
Woohoo! I found my bug! It never quite occurred to me that marking has
to be done on packets which _leave_ the interface! :-D

tc filter add dev eth0 protocol ip parent 1:0 prio 1 handle 1 fw flowid 1:10
iptables -t mangle -A POSTROUTING -p tcp -s 192.168.1.24 --sport 80 -j MARK
--set-mark 1

Thank you for your time.

-- Shanu

BTW: PiotR, thanx a lot for the wonderful rrdtool scripts, works great
over here.

I want to filter traffic from source ports X and Y into a filter I try

tc filter add dev eth0 parent 1: protocol ip prio 9 u32 \
   match ip sport X 0xffff \
   flow id 1:30

and it works fine but when i add

tc filter add dev eth0 parent 1: protocol ip prio 9 u32 \
   match ip sport X 0xffff \
   match ip sport Y 0xffff \
   flow id 1:30

I get and illegal match error. whats going wrong and how to i do it
properly?

Hello!

ewan wrote:
> I want to filter traffic from source ports X and Y into a filter I
> try
[...]
> tc filter add dev eth0 parent 1: protocol ip prio 9 u32 \
>    match ip sport X 0xffff \
>    match ip sport Y 0xffff \
>    flow id 1:30
>
> I get and illegal match error. whats going wrong and how to i do it
> properly?
A paket can only have one sourceport, so the match above can not work.
You will have to use one filter for each sport!

tc filter add dev eth0 parent 1: protocol ip prio 9 u32 \
   match ip sport X 0xffff \
   flow id 1:30

tc filter add dev eth0 parent 1: protocol ip prio 9 u32 \
   match ip sport Y 0xffff \
   flow id 1:30

Greetings, Nils

> A paket can only have one sourceport, so the match above can not work.
> You will have to use one filter for each sport!

 does it matter that they are both prioity 9?

Hello!

ewan wrote:
>> A paket can only have one sourceport, so the match above can not
>> work. You will have to use one filter for each sport!
>
>  does it matter that they are both prioity 9?
Well, as far as I know, the priority decides about on whitch filter to
check first. If there are more than one with the same priority, the
order of adding them decides witch of them to check first. So all your
filters could have the same priority (exept for different
filter-modules, a u32 can not share the same priority with a fw-filter
and so on).

Greetings, Nils