Hi, in the LARTC-HowTo is an example given for matching packets with the ACK-bit set. Does "IP Total length 0x34 (ACK + 12 bytes of TCP options)" (from the HowTo) mean that you are just matching Packets with an ACK set but without any data? If I am right, this would mean that just Forward-Acknowledgements are matched, isn''t it? What about matching ACKs with iptables, is it possible to mark Packets with ACK set but without data? bye, Hannes
hi * he@fli4l.de wrote:> in the LARTC-HowTo is an example given for matching packets with the > ACK-bit set. > > Does "IP Total length 0x34 (ACK + 12 bytes of TCP options)" (from the > HowTo) mean that you are just matching Packets with an ACK set but > without any data? If I am right, this would mean that just > Forward-Acknowledgements are matched, isn''t it?>tc filter add dev $DEV parent 1: protocol ip prio 12 u32 \ > match ip protocol 6 0xff \matches tcp> match u8 0x05 0x0f at 0 \matches packets with IHL == 5 -> no ip options> match u16 0x0000 0xffc0 at 2 \matches packets smaller than 64 byte. now we have 14 byte ethernet + 20 byte ip + ~20 bytes tcp header makes 56 byte headers, so there is not much free space for payload> match u8 0x10 0xff at 33 \matches the ACK bit> flowid 1:10now, cause almost all packets have the ACK bit set this rule matches all small packets with no ip options. it could be done better with nexthdr to match packets with ip options set too.> What about matching ACKs with iptables, is it possible to mark Packets > with ACK set but without data?Doesnt make much sense, because every packet except a few during handshake at begin and end have the ACK bit set. Actually, packets with only ACK set and no payload are rare. -- Thomas Graf
Thanks for your explanation! Thomas Graf wrote:> now, cause almost all packets have the ACK bit set this rule > matches all small packets with no ip options. it could be > done better with nexthdr to match packets with ip options > set too.Wouldn''t it also be necessary to match the packets with ACK set + Data or aren''t they as much important as the packets we are already matching? bye, Hannes
Hi * he@fli4l.de wrote:> Thomas Graf wrote: > >now, cause almost all packets have the ACK bit set this rule > >matches all small packets with no ip options. it could be > >done better with nexthdr to match packets with ip options > >set too. > > Wouldn''t it also be necessary to match the packets with ACK set + Data > or aren''t they as much important as the packets we are already matching?Read about biggy packing, most ACKs are sent within a data packet to avoid too much overhead, further all data packets in a transaction have the ACK bit set. You might want to look for a more practical explanation about TCP than most books provide. To quote myself: now, cause almost all packets have the ACK bit set this rule matches all small packets with no ip options. I never tested if this rule actually improves anything, if you do please let me know. I think it really depens on what kind of protocols you use and the average use of your line. The match for 5 WORDS ip header len is not really needed because you could match the ACK bit with help of the nexthdr feature w/o taking care of possible ip options. Hope that helps. -- Thomas Graf