LARTC - Sep 2007 - tc filter syntax (and general noobness)

Ok,

After much research and e-mails to the list, I''m finally to the point 
where I have filtering setup properly.

Now, I''m trying to figure out tc filter so that I can classify packets 
on both eth0 and eth1.

So, lets take for example Samba traffic. I want to be sure that its 
being sent with relative speed so that my shares don''t get lagged. And 
what the heck, its as good a place as any to start.

While I understand how to get the protocol number out of the header, I 
am having difficulty getting the rest of the field. Mostly, it has to do 
with offsets and which uX to use.

So, going off of what I think is correct, I have come up with this:

tc filter add dev eth1 parent 2: protocol ip prio 10 u32 match ip 
protocol 6 match u32 0xff534d42 0xffffffff at nexthdr+23 flowid 2:50

I seriously doubt this is the proper way to match a Samba header.

So  my question is this. How do I identify where the offset is for a 
given header? I assume that (going off the LARTC How To) I can look at 
output from wireshark and simply count to the field I am after. (This is 
how I figured out that tc filter add dev ppp14 parent 1:0 prio 10 u32 
match ip protocol 6 0xff match u8 0x10 0xff at nexthdr+13 flowid X:Y 
uses next header+13 to go from the protocol field to the ACK bit for the 
flags.)

The thing is. When I run this rule, none of the Samba traffic is being 
routed to 2:50... so obviously I''m not going something right.

Thanks for your help,


Vadtec

Vadtec wrote:
> 
> ...
> protocol 6 match u32 0xff534d42 0xffffffff at nexthdr+23 flowid 2:50
> ...
> 
Using nexthdr+ in as simple way as above won''t work. U32 won''t
automatically
adjust for the proper offset, you have to do it manually with another u32 
filter, using "link" option.

It''s very well explained in

http://ace-host.stuart.id.au/russell/files/tc/doc/cls_u32.txt

As a side note - don''t forget that you can simply mark the traffic in 
iptables and then use fwmark instead of u32 (or with u32 match mark).




Other bits of not so easily to find documentation re. tc, in case you need 
it later in other cases:

1) In source tarball, check doc subdirectory for info about extended action 
syntax

2) a bit of info about basic classifiers:
   http://marc.info/?l=lartc&m=117569441229800&w=2