Re: More layer7 filtering issues

Derek
Fri, 26 Sep 2003 17:23:18 -0000

Heh, I''m attempting to get it to work... I''m just not sure how
I can/if I can
combine two filters together, or at least attach them to the same class... I
guess the ideal solution would be a sub filter of a filter, or maybe
attaching a filter to another filter, but thats probably a little
blasphemist. I really want to be able to do this without hacking the kernel
source. Its probably much easier to get an lartc patch committed than a
kernel one.

Right now, I''m using 2.5.75 w/ the layer7 patch to try it out, but as
soon as
I finish my backports of the new layer7 patches to 2.4, I''ll give 2.4 a
shot.
(2.6 is awesome, but I kept getting panics when using tc to shape with a
pre-empt enabled kernel).

If you come up with anything, let me know, otherwise I''ll post to the
list
when/if I get it working :)

Thanks,
Derek

On Friday 26 September 2003 10:11 am, you wrote:
> > > > 	So, by the looks of things, that is going to drop all of
the
> > > > packets, not just class 1:10? or am I mistaken?
> > >
> > > It actually drops all incoming icmp packets. it''s just
an
> > > example of how to use policer to drop all packets.
> >
> > Ah, duh, I probably should stop looking at things prior to my morning
> > startbucks intake. Much obliged, though, thats exactly what I was
looking
> > for.
>
> Have you managed to use the layer7 filter to block things, then?  I still
> haven''t, even given that example code. (It''s rather
frustrating that the
> kernel hacking part of this is _easier_ than actually controlling it with
> tc...)  If you have, I''d like to see how you did it.
>
> -matthew