Hello,
I''ve been trying to shape the bittorrent traffic (on my external
interface,
upload), but without luck, for this I''m using layer7 filter right now,
but
I''ve also tried ipp2p, with the same results, I might say that this is
not a
problem with this packet classifiers, the problem is with HTB, here''s
why.
When I open azureus (the bittorrent client I use) I see upload traffic
getting shapped, but also I see that my download traffic won''t go up if
I''m
shaping on the upload interface, if I stop shaping on that interface then
upload ( as expected) will increase, and so the download rate, this happens
to me using the default bittorrent client (classic), so its not a client
problem. Ok, the problem here is that when using bittorrent, although I see
the traffic is shaped I can''t surf web pages, nor chat in msn
messenger, nor
do anything at all, and merely that''s all I want to do, shape p2p
traffic to
be able to use my bandwidth fairly, maybe its a bittorrent problem, because
with the edonkey protocol I have no problem at all, traffic get shaped and I
can use the rest of my bandwidth, I''ll post my iptables rules for
marking the
bittorrent packets and the htb rules I use (using tcng):
### IPTABLES RULES ###
iptables -t mangle -F
iptables -t mangle -X
iptables -t mangle -N lay7
iptables -t mangle -A POSTROUTING -j lay7
iptables -t mangle -A lay7 -m layer7 --l7proto bittorrent -j MARK --set-mark 1
iptables -t mangle -A lay7 -o eth1 -m mark --mark 1 -j CLASSIFY --set-class
2:2
iptables -t mangle -A lay7 -m layer7 --l7proto smtp -j MARK --set-mark 2
iptables -t mangle -A lay7 -o eth1 -m mark --mark 2 -j CLASSIFY --set-class
2:3
### HTB RULES ###
#define UPLOAD eth1
#define UPRATE 25kBps
#define P2P 10kBps
dev UPLOAD {
egress {
class ( <$emule> ) ;
class ( <$smtp> ) ;
class ( <$ssh> ) if tcp_dport == 8080 ; /*Changed port from 22 to 8080
*/
class ( <$otro> ) if 1 ;
htb () {
class ( rate UPRATE, ceil UPRATE ) {
$emule = class ( prio 8, rate 6kBps, ceil P2P ) { sfq; } ;
$smtp = class ( prio 1, rate 6kBps, ceil 12kBps ) { sfq; } ;
$ssh = class ( prio 0, rate 3kBps, ceil 5kBps) { sfq; } ;
$otro = class ( prio 1, rate 8kBps, ceil UPRATE ) { sfq; } ;
}
}
}
}
Also, given the priorities it''s expected to let me surf the web or chat
in msn
messenger rather than take my whole bandwidth.
I hope someone can help me out with this, maybe it not ok to use tcng with
iptables? thank you in advance
EDGAR MERINO
On Wednesday 06 July 2005 23:23, Edgar wrote:> I''ve been trying to shape the bittorrent traffic (on my external > interface, upload), but without luck, for this I''m using layer7 filter > right now, but I''ve also tried ipp2p, with the same resultsI don''t have any problems with BT shaping... if you want to have a look at my script, it''s this one: http://www.metamorpher.de/fairnat/ It uses IPP2P, but should work about the same way with layer7. The main difference between my iptables rules and yours seems to be that you are not using CONNMARK to mark BT connections permamently - IIRC you can''t do without because the filters only match one of the first few packets of a connection. Have you checked your class statistics with tc, somehow I doubt that all BT packets go into your P2P class in your current setup.> I hope someone can help me out with this, maybe it not ok to use tcng > with iptables? thank you in advanceWell, I''m not familiar with tcng syntax at all. I think this kind of setup is weird; in the tcng part no class ids seem to be specified, yet you have to use them in iptables to classify your packets. How can you be sure that you got the right class... HTH Andreas
You need to use connection marking as well. --l7proto bittorrent will only recognize the first packet in a bittorrent stream, you need to save a mark on the whole tcp connection, and restore the mark for all future packets if you want the entire connection to be classified. iptables -t mangle -A lay7 -p tcp -j CONNMARK --restore-mark iptables -t mangle -A lay7 -m layer7 --l7proto bittorrent -j MARK --set-mark 1 iptables -t mangle -A lay7 -o eth1 -m mark --mark 1 -j CLASSIFY --set-class 2:2 iptables -t mangle -A lay7 -m layer7 --l7proto smtp -j MARK --set-mark 2 iptables -t mangle -A lay7 -o eth1 -m mark --mark 2 -j CLASSIFY --set-class 2:3 iptables -t mangle -A lay7 -p tcp -m mark ! --mark 0 -j CONNMARK --save-mark If you''re marking ever gets more complex, it might take a little more work ( -j accepts for matching already classified connections after the --restore-mark) but the above should help get the full bittorrent connection classified, not just the first packet. - Jody Edgar wrote:>Hello, > >I''ve been trying to shape the bittorrent traffic (on my external interface, >upload), but without luck, for this I''m using layer7 filter right now, but >I''ve also tried ipp2p, with the same results, I might say that this is not a >problem with this packet classifiers, the problem is with HTB, here''s why. >When I open azureus (the bittorrent client I use) I see upload traffic >getting shapped, but also I see that my download traffic won''t go up if I''m >shaping on the upload interface, if I stop shaping on that interface then >upload ( as expected) will increase, and so the download rate, this happens >to me using the default bittorrent client (classic), so its not a client >problem. Ok, the problem here is that when using bittorrent, although I see >the traffic is shaped I can''t surf web pages, nor chat in msn messenger, nor >do anything at all, and merely that''s all I want to do, shape p2p traffic to >be able to use my bandwidth fairly, maybe its a bittorrent problem, because >with the edonkey protocol I have no problem at all, traffic get shaped and I >can use the rest of my bandwidth, I''ll post my iptables rules for marking the >bittorrent packets and the htb rules I use (using tcng): > >### IPTABLES RULES ### >iptables -t mangle -F >iptables -t mangle -X >iptables -t mangle -N lay7 >iptables -t mangle -A POSTROUTING -j lay7 >iptables -t mangle -A lay7 -m layer7 --l7proto bittorrent -j MARK --set-mark 1 >iptables -t mangle -A lay7 -o eth1 -m mark --mark 1 -j CLASSIFY --set-class >2:2 >iptables -t mangle -A lay7 -m layer7 --l7proto smtp -j MARK --set-mark 2 >iptables -t mangle -A lay7 -o eth1 -m mark --mark 2 -j CLASSIFY --set-class >2:3 > >### HTB RULES ### > >#define UPLOAD eth1 >#define UPRATE 25kBps >#define P2P 10kBps > >dev UPLOAD { > egress { > class ( <$emule> ) ; > class ( <$smtp> ) ; > class ( <$ssh> ) if tcp_dport == 8080 ; /*Changed port from 22 to 8080 */ > class ( <$otro> ) if 1 ; > > htb () { > class ( rate UPRATE, ceil UPRATE ) { > $emule = class ( prio 8, rate 6kBps, ceil P2P ) { sfq; } ; > $smtp = class ( prio 1, rate 6kBps, ceil 12kBps ) { sfq; } ; > $ssh = class ( prio 0, rate 3kBps, ceil 5kBps) { sfq; } ; > $otro = class ( prio 1, rate 8kBps, ceil UPRATE ) { sfq; } ; > } > } > } >} > >Also, given the priorities it''s expected to let me surf the web or chat in msn >messenger rather than take my whole bandwidth. > >I hope someone can help me out with this, maybe it not ok to use tcng with >iptables? thank you in advance > >EDGAR MERINO >_______________________________________________ >LARTC mailing list >LARTC@mailman.ds9a.nl >http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc > > >
First of all thank you for answering to my email, I will answer to all the questions you ask:> On Wednesday 06 July 2005 23:23, Edgar wrote: > > I''ve been trying to shape the bittorrent traffic (on my external > > interface, upload), but without luck, for this I''m using layer7 filter > > right now, but I''ve also tried ipp2p, with the same results > > I don''t have any problems with BT shaping... if you want to have a look at > my script, it''s this one: http://www.metamorpher.de/fairnat/ > It uses IPP2P, but should work about the same way with layer7. > > The main difference between my iptables rules and yours seems to be that > you are not using CONNMARK to mark BT connections permamently - IIRC you > can''t do without because the filters only match one of the first few > packets of a connection. >In the layer7 filter the examples don''t use CONNMARK like with ipp2p, but I will try to add CONNMARK to my rules, and see what happens.> Have you checked your class statistics with tc, somehow I doubt that all BT > packets go into your P2P class in your current setup. >I''ve checked this with tc -s class show dev eth1, and I see almost all the traffic going to the p2p class, right now I will add a new ACK rule, to match ack packets, since someone told me that might be the problem.> > I hope someone can help me out with this, maybe it not ok to use tcng > > with iptables? thank you in advance > > Well, I''m not familiar with tcng syntax at all. I think this kind of setup > is weird; in the tcng part no class ids seem to be specified, yet you have > to use them in iptables to classify your packets. How can you be sure that > you got the right class...When the tcng code gets compiled, it returns tc commands, and then I can see them, and I know those are the classes I need for iptables =) Thanks for your interest, I''ll check your rules right now, to see if that helps.> > HTH > Andreas > _______________________________________________ > LARTC mailing list > LARTC@mailman.ds9a.nl > http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartcEDGAR MERINO
Hi, thanks for your help and interest, someone told me about that already, so I did it, and this is the script I''m running to do it: #!/bin/sh ### ERASING RULES AND USER CREATED CHAINS ### iptables -t mangle -F iptables -t mangle -X iptables -t mangle -N lay7PRE iptables -t mangle -N lay7POST ### PREROUTING RULES ### iptables -t mangle -A lay7PRE -j CONNMARK --restore-mark iptables -t mangle -A lay7PRE -m mark ! --mark 0 -j ACCEPT iptables -t mangle -A lay7PRE -m layer7 --l7proto bittorrent -j MARK --set-mark 1 iptables -t mangle -A lay7PRE -m layer7 --l7proto smtp -j MARK --set-mark 2 iptables -t mangle -A lay7PRE -m layer7 --l7proto http -j MARK --set-mark 3 iptables -t mangle -A lay7PRE -j CONNMARK --save-mark ### POSTROUTING RULES ### iptables -t mangle -A lay7POST -o eth1 -m mark --mark 1 -j CLASSIFY --set-class 2:2 iptables -t mangle -A lay7POST -o eth1 -m mark --mark 2 -j CLASSIFY --set-class 2:3 iptables -t mangle -A lay7POST -o eth1 -m mark --mark 3 -j CLASSIFY --set-class 2:4 ### ------------------------------------------------------------------- ### iptables -t mangle -A PREROUTING -j lay7PRE iptables -t mangle -A POSTROUTING -j lay7POST I''m trying this right now, and I believe its kind of working, but web surfing is very slow, I might say unusable, so this is not what I want, also I had to mark http traffic to make this work, give it a higher prio in htb, so I believe I''m missing something else? someone suggested to add a new class for ACK packets, I''ve done that already, but I''ve only noticed little difference... really don''t know whats happening, if you don''t have tcng I can show you my tc rules (showed by tc -s class show dev eth1). Thank you again EDGAR MERINO On Wednesday 06 July 2005 23:30, Jody Shumaker wrote:> You need to use connection marking as well. --l7proto bittorrent will > only recognize the first packet in a bittorrent stream, you need to save > a mark on the whole tcp connection, and restore the mark for all future > packets if you want the entire connection to be classified. > > iptables -t mangle -A lay7 -p tcp -j CONNMARK --restore-mark > iptables -t mangle -A lay7 -m layer7 --l7proto bittorrent -j MARK > --set-mark 1 iptables -t mangle -A lay7 -o eth1 -m mark --mark 1 -j > CLASSIFY --set-class 2:2 iptables -t mangle -A lay7 -m layer7 --l7proto > smtp -j MARK --set-mark 2 iptables -t mangle -A lay7 -o eth1 -m mark --mark > 2 -j CLASSIFY --set-class 2:3 iptables -t mangle -A lay7 -p tcp -m mark ! > --mark 0 -j CONNMARK --save-mark > > > If you''re marking ever gets more complex, it might take a little more work > ( -j accepts for matching already classified connections after the > --restore-mark) but the above should help get the full bittorrent > connection classified, not just the first packet. > > - Jody > > Edgar wrote: > >Hello, > > > >I''ve been trying to shape the bittorrent traffic (on my external > > interface, upload), but without luck, for this I''m using layer7 filter > > right now, but I''ve also tried ipp2p, with the same results, I might say > > that this is not a problem with this packet classifiers, the problem is > > with HTB, here''s why. When I open azureus (the bittorrent client I use) I > > see upload traffic getting shapped, but also I see that my download > > traffic won''t go up if I''m shaping on the upload interface, if I stop > > shaping on that interface then upload ( as expected) will increase, and > > so the download rate, this happens to me using the default bittorrent > > client (classic), so its not a client problem. Ok, the problem here is > > that when using bittorrent, although I see the traffic is shaped I can''t > > surf web pages, nor chat in msn messenger, nor do anything at all, and > > merely that''s all I want to do, shape p2p traffic to be able to use my > > bandwidth fairly, maybe its a bittorrent problem, because with the > > edonkey protocol I have no problem at all, traffic get shaped and I can > > use the rest of my bandwidth, I''ll post my iptables rules for marking the > > bittorrent packets and the htb rules I use (using tcng): > > > >### IPTABLES RULES ### > >iptables -t mangle -F > >iptables -t mangle -X > >iptables -t mangle -N lay7 > >iptables -t mangle -A POSTROUTING -j lay7 > >iptables -t mangle -A lay7 -m layer7 --l7proto bittorrent -j MARK > > --set-mark 1 iptables -t mangle -A lay7 -o eth1 -m mark --mark 1 -j > > CLASSIFY --set-class 2:2 > >iptables -t mangle -A lay7 -m layer7 --l7proto smtp -j MARK --set-mark 2 > >iptables -t mangle -A lay7 -o eth1 -m mark --mark 2 -j CLASSIFY > > --set-class 2:3 > > > >### HTB RULES ### > > > >#define UPLOAD eth1 > >#define UPRATE 25kBps > >#define P2P 10kBps > > > >dev UPLOAD { > > egress { > > class ( <$emule> ) ; > > class ( <$smtp> ) ; > > class ( <$ssh> ) if tcp_dport == 8080 ; /*Changed port from 22 to 8080 > > */ class ( <$otro> ) if 1 ; > > > > htb () { > > class ( rate UPRATE, ceil UPRATE ) { > > $emule = class ( prio 8, rate 6kBps, ceil P2P ) { sfq; } ; > > $smtp = class ( prio 1, rate 6kBps, ceil 12kBps ) { sfq; } ; > > $ssh = class ( prio 0, rate 3kBps, ceil 5kBps) { sfq; } ; > > $otro = class ( prio 1, rate 8kBps, ceil UPRATE ) { sfq; } ; > > } > > } > > } > >} > > > >Also, given the priorities it''s expected to let me surf the web or chat in > > msn messenger rather than take my whole bandwidth. > > > >I hope someone can help me out with this, maybe it not ok to use tcng with > >iptables? thank you in advance > > > >EDGAR MERINO > >_______________________________________________ > >LARTC mailing list > >LARTC@mailman.ds9a.nl > >http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc > > _______________________________________________ > LARTC mailing list > LARTC@mailman.ds9a.nl > http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
ipp2p vs. l7 filter l7 uses regular expressions, so they are slower (some rules are EXTREME slow like fasttrack) and not so strong like the ipp2p rules (which can have for example packet length checks). ipp2p is specialized for p2p detection, so a many p2p packets are not detected by l7 (for example not all BitTorrent connections start with a 013h "BitTorrent"). The worst part is that l7 filter has some p2p rules which detect false positives: http://l7-filter.sourceforge.net/layer7-protocols/protocols/edonkey.pat "... This will match about 1% of streams with random data in them! ..." If you drop p2p connection, one of hundred downloads / web pages will fail (and fail every time) ? I would recommend l7-filter for everything but not for p2p. It is a VERY nice filter, but if they would have something else than regexp, i would use it maybe too. Klaus, Maintainer of ipp2p Edgar wrote:> Hi, thanks for your help and interest, someone told me about that already, so > I did it, and this is the script I''m running to do it: > #!/bin/sh > > ### ERASING RULES AND USER CREATED CHAINS ### > iptables -t mangle -F > iptables -t mangle -X > iptables -t mangle -N lay7PRE > iptables -t mangle -N lay7POST > > ### PREROUTING RULES ### > iptables -t mangle -A lay7PRE -j CONNMARK --restore-mark > iptables -t mangle -A lay7PRE -m mark ! --mark 0 -j ACCEPT > iptables -t mangle -A lay7PRE -m layer7 --l7proto bittorrent -j MARK > --set-mark 1 > iptables -t mangle -A lay7PRE -m layer7 --l7proto smtp -j MARK --set-mark 2 > iptables -t mangle -A lay7PRE -m layer7 --l7proto http -j MARK --set-mark 3 > iptables -t mangle -A lay7PRE -j CONNMARK --save-mark > > ### POSTROUTING RULES ### > iptables -t mangle -A lay7POST -o eth1 -m mark --mark 1 -j CLASSIFY > --set-class 2:2 > iptables -t mangle -A lay7POST -o eth1 -m mark --mark 2 -j CLASSIFY > --set-class 2:3 > iptables -t mangle -A lay7POST -o eth1 -m mark --mark 3 -j CLASSIFY > --set-class 2:4 > > ### ------------------------------------------------------------------- ### > iptables -t mangle -A PREROUTING -j lay7PRE > iptables -t mangle -A POSTROUTING -j lay7POST > > I''m trying this right now, and I believe its kind of working, but web surfing > is very slow, I might say unusable, so this is not what I want, also I had to > mark http traffic to make this work, give it a higher prio in htb, so I > believe I''m missing something else? someone suggested to add a new class for > ACK packets, I''ve done that already, but I''ve only noticed little > difference... really don''t know whats happening, if you don''t have tcng I can > show you my tc rules (showed by tc -s class show dev eth1). Thank you again > > EDGAR MERINO > > On Wednesday 06 July 2005 23:30, Jody Shumaker wrote: > >>You need to use connection marking as well. --l7proto bittorrent will >>only recognize the first packet in a bittorrent stream, you need to save >>a mark on the whole tcp connection, and restore the mark for all future >>packets if you want the entire connection to be classified. >> >>iptables -t mangle -A lay7 -p tcp -j CONNMARK --restore-mark >>iptables -t mangle -A lay7 -m layer7 --l7proto bittorrent -j MARK >>--set-mark 1 iptables -t mangle -A lay7 -o eth1 -m mark --mark 1 -j >>CLASSIFY --set-class 2:2 iptables -t mangle -A lay7 -m layer7 --l7proto >>smtp -j MARK --set-mark 2 iptables -t mangle -A lay7 -o eth1 -m mark --mark >>2 -j CLASSIFY --set-class 2:3 iptables -t mangle -A lay7 -p tcp -m mark ! >>--mark 0 -j CONNMARK --save-mark >> >> >>If you''re marking ever gets more complex, it might take a little more work >>( -j accepts for matching already classified connections after the >>--restore-mark) but the above should help get the full bittorrent >>connection classified, not just the first packet. >> >>- Jody >> >>Edgar wrote: >> >>>Hello, >>> >>>I''ve been trying to shape the bittorrent traffic (on my external >>>interface, upload), but without luck, for this I''m using layer7 filter >>>right now, but I''ve also tried ipp2p, with the same results, I might say >>>that this is not a problem with this packet classifiers, the problem is >>>with HTB, here''s why. When I open azureus (the bittorrent client I use) I >>>see upload traffic getting shapped, but also I see that my download >>>traffic won''t go up if I''m shaping on the upload interface, if I stop >>>shaping on that interface then upload ( as expected) will increase, and >>>so the download rate, this happens to me using the default bittorrent >>>client (classic), so its not a client problem. Ok, the problem here is >>>that when using bittorrent, although I see the traffic is shaped I can''t >>>surf web pages, nor chat in msn messenger, nor do anything at all, and >>>merely that''s all I want to do, shape p2p traffic to be able to use my >>>bandwidth fairly, maybe its a bittorrent problem, because with the >>>edonkey protocol I have no problem at all, traffic get shaped and I can >>>use the rest of my bandwidth, I''ll post my iptables rules for marking the >>>bittorrent packets and the htb rules I use (using tcng): >>> >>>### IPTABLES RULES ### >>>iptables -t mangle -F >>>iptables -t mangle -X >>>iptables -t mangle -N lay7 >>>iptables -t mangle -A POSTROUTING -j lay7 >>>iptables -t mangle -A lay7 -m layer7 --l7proto bittorrent -j MARK >>>--set-mark 1 iptables -t mangle -A lay7 -o eth1 -m mark --mark 1 -j >>>CLASSIFY --set-class 2:2 >>>iptables -t mangle -A lay7 -m layer7 --l7proto smtp -j MARK --set-mark 2 >>>iptables -t mangle -A lay7 -o eth1 -m mark --mark 2 -j CLASSIFY >>>--set-class 2:3 >>> >>>### HTB RULES ### >>> >>>#define UPLOAD eth1 >>>#define UPRATE 25kBps >>>#define P2P 10kBps >>> >>>dev UPLOAD { >>> egress { >>> class ( <$emule> ) ; >>> class ( <$smtp> ) ; >>> class ( <$ssh> ) if tcp_dport == 8080 ; /*Changed port from 22 to 8080 >>>*/ class ( <$otro> ) if 1 ; >>> >>> htb () { >>> class ( rate UPRATE, ceil UPRATE ) { >>> $emule = class ( prio 8, rate 6kBps, ceil P2P ) { sfq; } ; >>> $smtp = class ( prio 1, rate 6kBps, ceil 12kBps ) { sfq; } ; >>> $ssh = class ( prio 0, rate 3kBps, ceil 5kBps) { sfq; } ; >>> $otro = class ( prio 1, rate 8kBps, ceil UPRATE ) { sfq; } ; >>> } >>> } >>> } >>>} >>> >>>Also, given the priorities it''s expected to let me surf the web or chat in >>>msn messenger rather than take my whole bandwidth. >>> >>>I hope someone can help me out with this, maybe it not ok to use tcng with >>>iptables? thank you in advance >>> >>>EDGAR MERINO >>>_______________________________________________ >>>LARTC mailing list >>>LARTC@mailman.ds9a.nl >>>http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc >> >>_______________________________________________ >>LARTC mailing list >>LARTC@mailman.ds9a.nl >>http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc > > _______________________________________________ > LARTC mailing list > LARTC@mailman.ds9a.nl > http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
I would suggest classifing interactive connections, and leave all the bulk traffic in the default class. This way, the bt,kazaa,emule traffic will go in the same class, without additional filtering. Also, using HFSC instead of HTB helps you increase the delay of the default class. This way bulk traffic will be sent every n ms, leaving priority to the interactive/web/mail traffic. Think about it. Iosif Peterfi S.C. Forte Systems SRL http://www.fortesys.ro/ -----Original Message----- From: lartc-bounces@mailman.ds9a.nl [mailto:lartc-bounces@mailman.ds9a.nl] On Behalf Of Klaus Sent: Thursday, July 07, 2005 10:22 AM To: lartc@mailman.ds9a.nl Subject: Re: [LARTC] HTB and bittorrent, won''t work ipp2p vs. l7 filter l7 uses regular expressions, so they are slower (some rules are EXTREME slow like fasttrack) and not so strong like the ipp2p rules (which can have for example packet length checks). ipp2p is specialized for p2p detection, so a many p2p packets are not detected by l7 (for example not all BitTorrent connections start with a 013h "BitTorrent"). The worst part is that l7 filter has some p2p rules which detect false positives: http://l7-filter.sourceforge.net/layer7-protocols/protocols/edonkey.pat "... This will match about 1% of streams with random data in them! ..." If you drop p2p connection, one of hundred downloads / web pages will fail (and fail every time) ? I would recommend l7-filter for everything but not for p2p. It is a VERY nice filter, but if they would have something else than regexp, i would use it maybe too. Klaus, Maintainer of ipp2p Edgar wrote:> Hi, thanks for your help and interest, someone told me about that already,so> I did it, and this is the script I''m running to do it: > #!/bin/sh > > ### ERASING RULES AND USER CREATED CHAINS ### > iptables -t mangle -F > iptables -t mangle -X > iptables -t mangle -N lay7PRE > iptables -t mangle -N lay7POST > > ### PREROUTING RULES ### > iptables -t mangle -A lay7PRE -j CONNMARK --restore-mark > iptables -t mangle -A lay7PRE -m mark ! --mark 0 -j ACCEPT > iptables -t mangle -A lay7PRE -m layer7 --l7proto bittorrent -j MARK > --set-mark 1 > iptables -t mangle -A lay7PRE -m layer7 --l7proto smtp -j MARK --set-mark2> iptables -t mangle -A lay7PRE -m layer7 --l7proto http -j MARK --set-mark3> iptables -t mangle -A lay7PRE -j CONNMARK --save-mark > > ### POSTROUTING RULES ### > iptables -t mangle -A lay7POST -o eth1 -m mark --mark 1 -j CLASSIFY > --set-class 2:2 > iptables -t mangle -A lay7POST -o eth1 -m mark --mark 2 -j CLASSIFY > --set-class 2:3 > iptables -t mangle -A lay7POST -o eth1 -m mark --mark 3 -j CLASSIFY > --set-class 2:4 > > ### -------------------------------------------------------------------###> iptables -t mangle -A PREROUTING -j lay7PRE > iptables -t mangle -A POSTROUTING -j lay7POST > > I''m trying this right now, and I believe its kind of working, but websurfing> is very slow, I might say unusable, so this is not what I want, also I hadto> mark http traffic to make this work, give it a higher prio in htb, so I > believe I''m missing something else? someone suggested to add a new classfor> ACK packets, I''ve done that already, but I''ve only noticed little > difference... really don''t know whats happening, if you don''t have tcng Ican> show you my tc rules (showed by tc -s class show dev eth1). Thank youagain> > EDGAR MERINO > > On Wednesday 06 July 2005 23:30, Jody Shumaker wrote: > >>You need to use connection marking as well. --l7proto bittorrent will >>only recognize the first packet in a bittorrent stream, you need to save >>a mark on the whole tcp connection, and restore the mark for all future >>packets if you want the entire connection to be classified. >> >>iptables -t mangle -A lay7 -p tcp -j CONNMARK --restore-mark >>iptables -t mangle -A lay7 -m layer7 --l7proto bittorrent -j MARK >>--set-mark 1 iptables -t mangle -A lay7 -o eth1 -m mark --mark 1 -j >>CLASSIFY --set-class 2:2 iptables -t mangle -A lay7 -m layer7 --l7proto >>smtp -j MARK --set-mark 2 iptables -t mangle -A lay7 -o eth1 -m mark--mark>>2 -j CLASSIFY --set-class 2:3 iptables -t mangle -A lay7 -p tcp -m mark ! >>--mark 0 -j CONNMARK --save-mark >> >> >>If you''re marking ever gets more complex, it might take a little more work >>( -j accepts for matching already classified connections after the >>--restore-mark) but the above should help get the full bittorrent >>connection classified, not just the first packet. >> >>- Jody >> >>Edgar wrote: >> >>>Hello, >>> >>>I''ve been trying to shape the bittorrent traffic (on my external >>>interface, upload), but without luck, for this I''m using layer7 filter >>>right now, but I''ve also tried ipp2p, with the same results, I might say >>>that this is not a problem with this packet classifiers, the problem is >>>with HTB, here''s why. When I open azureus (the bittorrent client I use) I >>>see upload traffic getting shapped, but also I see that my download >>>traffic won''t go up if I''m shaping on the upload interface, if I stop >>>shaping on that interface then upload ( as expected) will increase, and >>>so the download rate, this happens to me using the default bittorrent >>>client (classic), so its not a client problem. Ok, the problem here is >>>that when using bittorrent, although I see the traffic is shaped I can''t >>>surf web pages, nor chat in msn messenger, nor do anything at all, and >>>merely that''s all I want to do, shape p2p traffic to be able to use my >>>bandwidth fairly, maybe its a bittorrent problem, because with the >>>edonkey protocol I have no problem at all, traffic get shaped and I can >>>use the rest of my bandwidth, I''ll post my iptables rules for marking the >>>bittorrent packets and the htb rules I use (using tcng): >>> >>>### IPTABLES RULES ### >>>iptables -t mangle -F >>>iptables -t mangle -X >>>iptables -t mangle -N lay7 >>>iptables -t mangle -A POSTROUTING -j lay7 >>>iptables -t mangle -A lay7 -m layer7 --l7proto bittorrent -j MARK >>>--set-mark 1 iptables -t mangle -A lay7 -o eth1 -m mark --mark 1 -j >>>CLASSIFY --set-class 2:2 >>>iptables -t mangle -A lay7 -m layer7 --l7proto smtp -j MARK --set-mark 2 >>>iptables -t mangle -A lay7 -o eth1 -m mark --mark 2 -j CLASSIFY >>>--set-class 2:3 >>> >>>### HTB RULES ### >>> >>>#define UPLOAD eth1 >>>#define UPRATE 25kBps >>>#define P2P 10kBps >>> >>>dev UPLOAD { >>> egress { >>> class ( <$emule> ) ; >>> class ( <$smtp> ) ; >>> class ( <$ssh> ) if tcp_dport == 8080 ; /*Changed port from 22 to 8080 >>>*/ class ( <$otro> ) if 1 ; >>> >>> htb () { >>> class ( rate UPRATE, ceil UPRATE ) { >>> $emule = class ( prio 8, rate 6kBps, ceil P2P ) { sfq; } ; >>> $smtp = class ( prio 1, rate 6kBps, ceil 12kBps ) { sfq; } ; >>> $ssh = class ( prio 0, rate 3kBps, ceil 5kBps) { sfq; } ; >>> $otro = class ( prio 1, rate 8kBps, ceil UPRATE ) { sfq; } ; >>> } >>> } >>> } >>>} >>> >>>Also, given the priorities it''s expected to let me surf the web or chatin>>>msn messenger rather than take my whole bandwidth. >>> >>>I hope someone can help me out with this, maybe it not ok to use tcngwith>>>iptables? thank you in advance >>> >>>EDGAR MERINO >>>_______________________________________________ >>>LARTC mailing list >>>LARTC@mailman.ds9a.nl >>>http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc >> >>_______________________________________________ >>LARTC mailing list >>LARTC@mailman.ds9a.nl >>http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc > > _______________________________________________ > LARTC mailing list > LARTC@mailman.ds9a.nl > http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc_______________________________________________ LARTC mailing list LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc -- This message was scanned for spam and viruses by BitDefender. For more information please visit http://linux.bitdefender.com/ -- This message was scanned for spam and viruses by BitDefender. For more information please visit http://linux.bitdefender.com/
Thank you for your response, I will try to do what you told me, but I have a squid sever, and I don''t know which port I should use for that, since the http layer7 protocol won''t work, when I have that mark rule in iptables I don''t see traffic going into that rule, it''ll only work when I''m surfing the web without the squid cache; another problem I have is that the msn messenger I use (kopete for kde) isn''t recognized by the layer7 protocol, so the question is this, can I do this specifying the ports in tcng ? EDGAR MERINO On Thursday 07 July 2005 06:36, Forte Systems - Iosif Peterfi wrote:> I would suggest classifing interactive connections, and leave all the bulk > traffic in the default class. This way, the bt,kazaa,emule traffic will go > in the same class, without additional filtering. > Also, using HFSC instead of HTB helps you increase the delay of the default > class. This way bulk traffic will be sent every n ms, leaving priority to > the interactive/web/mail traffic. Think about it. > > > Iosif Peterfi > S.C. Forte Systems SRL > http://www.fortesys.ro/ > > -----Original Message----- > From: lartc-bounces@mailman.ds9a.nl [mailto:lartc-bounces@mailman.ds9a.nl] > On Behalf Of Klaus > Sent: Thursday, July 07, 2005 10:22 AM > To: lartc@mailman.ds9a.nl > Subject: Re: [LARTC] HTB and bittorrent, won''t work > > ipp2p vs. l7 filter > > l7 uses regular expressions, so they are slower (some rules are EXTREME > slow like fasttrack) and not so strong like the ipp2p rules (which can > have for example packet length checks). ipp2p is specialized for p2p > detection, so a many p2p packets are not detected by l7 (for example not > all BitTorrent connections start with a 013h "BitTorrent"). The worst > part is that l7 filter has some p2p rules which detect false positives: > > http://l7-filter.sourceforge.net/layer7-protocols/protocols/edonkey.pat > > "... This will match about 1% of streams with random data in them! ..." > > If you drop p2p connection, one of hundred downloads / web pages will > fail (and fail every time) ? > > I would recommend l7-filter for everything but not for p2p. It is a VERY > nice filter, but if they would have something else than regexp, i would > use it maybe too. > > Klaus, Maintainer of ipp2p > > Edgar wrote: > > Hi, thanks for your help and interest, someone told me about that > > already, > > so > > > I did it, and this is the script I''m running to do it: > > #!/bin/sh > > > > ### ERASING RULES AND USER CREATED CHAINS ### > > iptables -t mangle -F > > iptables -t mangle -X > > iptables -t mangle -N lay7PRE > > iptables -t mangle -N lay7POST > > > > ### PREROUTING RULES ### > > iptables -t mangle -A lay7PRE -j CONNMARK --restore-mark > > iptables -t mangle -A lay7PRE -m mark ! --mark 0 -j ACCEPT > > iptables -t mangle -A lay7PRE -m layer7 --l7proto bittorrent -j MARK > > --set-mark 1 > > iptables -t mangle -A lay7PRE -m layer7 --l7proto smtp -j MARK --set-mark > > 2 > > > iptables -t mangle -A lay7PRE -m layer7 --l7proto http -j MARK --set-mark > > 3 > > > iptables -t mangle -A lay7PRE -j CONNMARK --save-mark > > > > ### POSTROUTING RULES ### > > iptables -t mangle -A lay7POST -o eth1 -m mark --mark 1 -j CLASSIFY > > --set-class 2:2 > > iptables -t mangle -A lay7POST -o eth1 -m mark --mark 2 -j CLASSIFY > > --set-class 2:3 > > iptables -t mangle -A lay7POST -o eth1 -m mark --mark 3 -j CLASSIFY > > --set-class 2:4 > > > > ### ------------------------------------------------------------------- > > ### > > > iptables -t mangle -A PREROUTING -j lay7PRE > > iptables -t mangle -A POSTROUTING -j lay7POST > > > > I''m trying this right now, and I believe its kind of working, but web > > surfing > > > is very slow, I might say unusable, so this is not what I want, also I > > had > > to > > > mark http traffic to make this work, give it a higher prio in htb, so I > > believe I''m missing something else? someone suggested to add a new class > > for > > > ACK packets, I''ve done that already, but I''ve only noticed little > > difference... really don''t know whats happening, if you don''t have tcng I > > can > > > show you my tc rules (showed by tc -s class show dev eth1). Thank you > > again > > > EDGAR MERINO > > > > On Wednesday 06 July 2005 23:30, Jody Shumaker wrote: > >>You need to use connection marking as well. --l7proto bittorrent will > >>only recognize the first packet in a bittorrent stream, you need to save > >>a mark on the whole tcp connection, and restore the mark for all future > >>packets if you want the entire connection to be classified. > >> > >>iptables -t mangle -A lay7 -p tcp -j CONNMARK --restore-mark > >>iptables -t mangle -A lay7 -m layer7 --l7proto bittorrent -j MARK > >>--set-mark 1 iptables -t mangle -A lay7 -o eth1 -m mark --mark 1 -j > >>CLASSIFY --set-class 2:2 iptables -t mangle -A lay7 -m layer7 --l7proto > >>smtp -j MARK --set-mark 2 iptables -t mangle -A lay7 -o eth1 -m mark > > --mark > > >>2 -j CLASSIFY --set-class 2:3 iptables -t mangle -A lay7 -p tcp -m mark ! > >>--mark 0 -j CONNMARK --save-mark > >> > >> > >>If you''re marking ever gets more complex, it might take a little more > >> work ( -j accepts for matching already classified connections after the > >> --restore-mark) but the above should help get the full bittorrent > >> connection classified, not just the first packet. > >> > >>- Jody > >> > >>Edgar wrote: > >>>Hello, > >>> > >>>I''ve been trying to shape the bittorrent traffic (on my external > >>>interface, upload), but without luck, for this I''m using layer7 filter > >>>right now, but I''ve also tried ipp2p, with the same results, I might say > >>>that this is not a problem with this packet classifiers, the problem is > >>>with HTB, here''s why. When I open azureus (the bittorrent client I use) > >>> I see upload traffic getting shapped, but also I see that my download > >>> traffic won''t go up if I''m shaping on the upload interface, if I stop > >>> shaping on that interface then upload ( as expected) will increase, and > >>> so the download rate, this happens to me using the default bittorrent > >>> client (classic), so its not a client problem. Ok, the problem here is > >>> that when using bittorrent, although I see the traffic is shaped I > >>> can''t surf web pages, nor chat in msn messenger, nor do anything at > >>> all, and merely that''s all I want to do, shape p2p traffic to be able > >>> to use my bandwidth fairly, maybe its a bittorrent problem, because > >>> with the edonkey protocol I have no problem at all, traffic get shaped > >>> and I can use the rest of my bandwidth, I''ll post my iptables rules for > >>> marking the bittorrent packets and the htb rules I use (using tcng): > >>> > >>>### IPTABLES RULES ### > >>>iptables -t mangle -F > >>>iptables -t mangle -X > >>>iptables -t mangle -N lay7 > >>>iptables -t mangle -A POSTROUTING -j lay7 > >>>iptables -t mangle -A lay7 -m layer7 --l7proto bittorrent -j MARK > >>>--set-mark 1 iptables -t mangle -A lay7 -o eth1 -m mark --mark 1 -j > >>>CLASSIFY --set-class 2:2 > >>>iptables -t mangle -A lay7 -m layer7 --l7proto smtp -j MARK --set-mark 2 > >>>iptables -t mangle -A lay7 -o eth1 -m mark --mark 2 -j CLASSIFY > >>>--set-class 2:3 > >>> > >>>### HTB RULES ### > >>> > >>>#define UPLOAD eth1 > >>>#define UPRATE 25kBps > >>>#define P2P 10kBps > >>> > >>>dev UPLOAD { > >>> egress { > >>> class ( <$emule> ) ; > >>> class ( <$smtp> ) ; > >>> class ( <$ssh> ) if tcp_dport == 8080 ; /*Changed port from 22 to > >>> 8080 */ class ( <$otro> ) if 1 ; > >>> > >>> htb () { > >>> class ( rate UPRATE, ceil UPRATE ) { > >>> $emule = class ( prio 8, rate 6kBps, ceil P2P ) { sfq; } ; > >>> $smtp = class ( prio 1, rate 6kBps, ceil 12kBps ) { sfq; } ; > >>> $ssh = class ( prio 0, rate 3kBps, ceil 5kBps) { sfq; } ; > >>> $otro = class ( prio 1, rate 8kBps, ceil UPRATE ) { sfq; } ; > >>> } > >>> } > >>> } > >>>} > >>> > >>>Also, given the priorities it''s expected to let me surf the web or chat > > in > > >>>msn messenger rather than take my whole bandwidth. > >>> > >>>I hope someone can help me out with this, maybe it not ok to use tcng > > with > > >>>iptables? thank you in advance > >>> > >>>EDGAR MERINO > >>>_______________________________________________ > >>>LARTC mailing list > >>>LARTC@mailman.ds9a.nl > >>>http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc > >> > >>_______________________________________________ > >>LARTC mailing list > >>LARTC@mailman.ds9a.nl > >>http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc > > > > _______________________________________________ > > LARTC mailing list > > LARTC@mailman.ds9a.nl > > http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc > > _______________________________________________ > LARTC mailing list > LARTC@mailman.ds9a.nl > http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc > > > -- > This message was scanned for spam and viruses by BitDefender. > For more information please visit http://linux.bitdefender.com/
You can classify kopete traffic using iptables rules. Depending on the im protocol you use. Yahoo messenger uses TCP ports 5050 and 5051 i think.. MSN uses TCP 1863... you can google for them. You also have to setup tcp_sport as the squid port in orded for the l7 http filter to work. And if that is not working classify using iptables as source your internal eth ip and source port your squid port. There is a slighter chance that some btclients will use the same ports as described in the iptables rules... but i don''t think that will mess up your shaping that bad. Iosif Peterfi S.C. Forte Systems SRL http://www.fortesys.ro/ -----Original Message----- From: lartc-bounces@mailman.ds9a.nl [mailto:lartc-bounces@mailman.ds9a.nl] On Behalf Of Edgar Sent: Thursday, July 07, 2005 11:35 PM To: lartc@mailman.ds9a.nl Subject: Re: [LARTC] HTB and bittorrent, won''t work Thank you for your response, I will try to do what you told me, but I have a squid sever, and I don''t know which port I should use for that, since the http layer7 protocol won''t work, when I have that mark rule in iptables I don''t see traffic going into that rule, it''ll only work when I''m surfing the web without the squid cache; another problem I have is that the msn messenger I use (kopete for kde) isn''t recognized by the layer7 protocol, so the question is this, can I do this specifying the ports in tcng ? EDGAR MERINO On Thursday 07 July 2005 06:36, Forte Systems - Iosif Peterfi wrote:> I would suggest classifing interactive connections, and leave all the bulk > traffic in the default class. This way, the bt,kazaa,emule traffic will go > in the same class, without additional filtering. > Also, using HFSC instead of HTB helps you increase the delay of thedefault> class. This way bulk traffic will be sent every n ms, leaving priority to > the interactive/web/mail traffic. Think about it. > > > Iosif Peterfi > S.C. Forte Systems SRL > http://www.fortesys.ro/ > > -----Original Message----- > From: lartc-bounces@mailman.ds9a.nl [mailto:lartc-bounces@mailman.ds9a.nl] > On Behalf Of Klaus > Sent: Thursday, July 07, 2005 10:22 AM > To: lartc@mailman.ds9a.nl > Subject: Re: [LARTC] HTB and bittorrent, won''t work > > ipp2p vs. l7 filter > > l7 uses regular expressions, so they are slower (some rules are EXTREME > slow like fasttrack) and not so strong like the ipp2p rules (which can > have for example packet length checks). ipp2p is specialized for p2p > detection, so a many p2p packets are not detected by l7 (for example not > all BitTorrent connections start with a 013h "BitTorrent"). The worst > part is that l7 filter has some p2p rules which detect false positives: > > http://l7-filter.sourceforge.net/layer7-protocols/protocols/edonkey.pat > > "... This will match about 1% of streams with random data in them! ..." > > If you drop p2p connection, one of hundred downloads / web pages will > fail (and fail every time) ? > > I would recommend l7-filter for everything but not for p2p. It is a VERY > nice filter, but if they would have something else than regexp, i would > use it maybe too. > > Klaus, Maintainer of ipp2p > > Edgar wrote: > > Hi, thanks for your help and interest, someone told me about that > > already, > > so > > > I did it, and this is the script I''m running to do it: > > #!/bin/sh > > > > ### ERASING RULES AND USER CREATED CHAINS ### > > iptables -t mangle -F > > iptables -t mangle -X > > iptables -t mangle -N lay7PRE > > iptables -t mangle -N lay7POST > > > > ### PREROUTING RULES ### > > iptables -t mangle -A lay7PRE -j CONNMARK --restore-mark > > iptables -t mangle -A lay7PRE -m mark ! --mark 0 -j ACCEPT > > iptables -t mangle -A lay7PRE -m layer7 --l7proto bittorrent -j MARK > > --set-mark 1 > > iptables -t mangle -A lay7PRE -m layer7 --l7proto smtp -j MARK--set-mark> > 2 > > > iptables -t mangle -A lay7PRE -m layer7 --l7proto http -j MARK--set-mark> > 3 > > > iptables -t mangle -A lay7PRE -j CONNMARK --save-mark > > > > ### POSTROUTING RULES ### > > iptables -t mangle -A lay7POST -o eth1 -m mark --mark 1 -j CLASSIFY > > --set-class 2:2 > > iptables -t mangle -A lay7POST -o eth1 -m mark --mark 2 -j CLASSIFY > > --set-class 2:3 > > iptables -t mangle -A lay7POST -o eth1 -m mark --mark 3 -j CLASSIFY > > --set-class 2:4 > > > > ### ------------------------------------------------------------------- > > ### > > > iptables -t mangle -A PREROUTING -j lay7PRE > > iptables -t mangle -A POSTROUTING -j lay7POST > > > > I''m trying this right now, and I believe its kind of working, but web > > surfing > > > is very slow, I might say unusable, so this is not what I want, also I > > had > > to > > > mark http traffic to make this work, give it a higher prio in htb, so I > > believe I''m missing something else? someone suggested to add a new class > > for > > > ACK packets, I''ve done that already, but I''ve only noticed little > > difference... really don''t know whats happening, if you don''t have tcngI> > can > > > show you my tc rules (showed by tc -s class show dev eth1). Thank you > > again > > > EDGAR MERINO > > > > On Wednesday 06 July 2005 23:30, Jody Shumaker wrote: > >>You need to use connection marking as well. --l7proto bittorrent will > >>only recognize the first packet in a bittorrent stream, you need to save > >>a mark on the whole tcp connection, and restore the mark for all future > >>packets if you want the entire connection to be classified. > >> > >>iptables -t mangle -A lay7 -p tcp -j CONNMARK --restore-mark > >>iptables -t mangle -A lay7 -m layer7 --l7proto bittorrent -j MARK > >>--set-mark 1 iptables -t mangle -A lay7 -o eth1 -m mark --mark 1 -j > >>CLASSIFY --set-class 2:2 iptables -t mangle -A lay7 -m layer7 --l7proto > >>smtp -j MARK --set-mark 2 iptables -t mangle -A lay7 -o eth1 -m mark > > --mark > > >>2 -j CLASSIFY --set-class 2:3 iptables -t mangle -A lay7 -p tcp -m mark!> >>--mark 0 -j CONNMARK --save-mark > >> > >> > >>If you''re marking ever gets more complex, it might take a little more > >> work ( -j accepts for matching already classified connections after the > >> --restore-mark) but the above should help get the full bittorrent > >> connection classified, not just the first packet. > >> > >>- Jody > >> > >>Edgar wrote: > >>>Hello, > >>> > >>>I''ve been trying to shape the bittorrent traffic (on my external > >>>interface, upload), but without luck, for this I''m using layer7 filter > >>>right now, but I''ve also tried ipp2p, with the same results, I mightsay> >>>that this is not a problem with this packet classifiers, the problem is > >>>with HTB, here''s why. When I open azureus (the bittorrent client I use) > >>> I see upload traffic getting shapped, but also I see that my download > >>> traffic won''t go up if I''m shaping on the upload interface, if I stop > >>> shaping on that interface then upload ( as expected) will increase,and> >>> so the download rate, this happens to me using the default bittorrent > >>> client (classic), so its not a client problem. Ok, the problem here is > >>> that when using bittorrent, although I see the traffic is shaped I > >>> can''t surf web pages, nor chat in msn messenger, nor do anything at > >>> all, and merely that''s all I want to do, shape p2p traffic to be able > >>> to use my bandwidth fairly, maybe its a bittorrent problem, because > >>> with the edonkey protocol I have no problem at all, traffic get shaped > >>> and I can use the rest of my bandwidth, I''ll post my iptables rulesfor> >>> marking the bittorrent packets and the htb rules I use (using tcng): > >>> > >>>### IPTABLES RULES ### > >>>iptables -t mangle -F > >>>iptables -t mangle -X > >>>iptables -t mangle -N lay7 > >>>iptables -t mangle -A POSTROUTING -j lay7 > >>>iptables -t mangle -A lay7 -m layer7 --l7proto bittorrent -j MARK > >>>--set-mark 1 iptables -t mangle -A lay7 -o eth1 -m mark --mark 1 -j > >>>CLASSIFY --set-class 2:2 > >>>iptables -t mangle -A lay7 -m layer7 --l7proto smtp -j MARK --set-mark2> >>>iptables -t mangle -A lay7 -o eth1 -m mark --mark 2 -j CLASSIFY > >>>--set-class 2:3 > >>> > >>>### HTB RULES ### > >>> > >>>#define UPLOAD eth1 > >>>#define UPRATE 25kBps > >>>#define P2P 10kBps > >>> > >>>dev UPLOAD { > >>> egress { > >>> class ( <$emule> ) ; > >>> class ( <$smtp> ) ; > >>> class ( <$ssh> ) if tcp_dport == 8080 ; /*Changed port from 22 to > >>> 8080 */ class ( <$otro> ) if 1 ; > >>> > >>> htb () { > >>> class ( rate UPRATE, ceil UPRATE ) { > >>> $emule = class ( prio 8, rate 6kBps, ceil P2P ) { sfq; } ; > >>> $smtp = class ( prio 1, rate 6kBps, ceil 12kBps ) { sfq; } ; > >>> $ssh = class ( prio 0, rate 3kBps, ceil 5kBps) { sfq; } ; > >>> $otro = class ( prio 1, rate 8kBps, ceil UPRATE ) { sfq; } ; > >>> } > >>> } > >>> } > >>>} > >>> > >>>Also, given the priorities it''s expected to let me surf the web or chat > > in > > >>>msn messenger rather than take my whole bandwidth. > >>> > >>>I hope someone can help me out with this, maybe it not ok to use tcng > > with > > >>>iptables? thank you in advance > >>> > >>>EDGAR MERINO > >>>_______________________________________________ > >>>LARTC mailing list > >>>LARTC@mailman.ds9a.nl > >>>http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc > >> > >>_______________________________________________ > >>LARTC mailing list > >>LARTC@mailman.ds9a.nl > >>http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc > > > > _______________________________________________ > > LARTC mailing list > > LARTC@mailman.ds9a.nl > > http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc > > _______________________________________________ > LARTC mailing list > LARTC@mailman.ds9a.nl > http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc > > > -- > This message was scanned for spam and viruses by BitDefender. > For more information please visit http://linux.bitdefender.com/_______________________________________________ LARTC mailing list LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc -- This message was scanned for spam and viruses by BitDefender. For more information please visit http://linux.bitdefender.com/ -- This message was scanned for spam and viruses by BitDefender. For more information please visit http://linux.bitdefender.com/