similar to: Fwd: Flexible SFQ flow classification

Hello, It seems on RHEL/CentOS 5.2 iproute package is version 2.6.18, which apparently do not support IFB properly. The end result is that while no error is given, counters on ifb0 do not update, and capturing on the interface turns out nothing. Simply replacing tc with one from 2.6.26 solves this issue, it seems... Best regards -- Haim Gelfenbeyn Hagel Technologies Ltd.

How does LOGFORMAT in shorewall.conf control the length of the zone name as discussed in the zones man page? The default max length is 5. What would I specify in LOGFORMAT to allow a 6 character zone name? ------------------------------------------------------------------------------ Apps built with the Adobe(R) Flex(R) framework and Flex Builder(TM) are powering Web 2.0 with engaging,

Hello, I have a problem with simple traffic shapping in shorewall, my current configuration is: zones vlan10 ipv4 # interfaces vlan10 vlan10 detect tcpflags,routeback shorewall.conf TC_ENABLED=Simple tcinterfaces vlan10 Internal 1mbit:50kb shorewall show tc Device vlan10: qdisc prio 5: root refcnt 2 bands 3 priomap 1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1

Hello Tom, On the page 'http://lwn.net/Articles/313328/' i found info about changes in 'cls_flow.c' in kernel-2.6.29: net/sched/cls_flow.c | 4 +- and may be now it will work properly to everyone's entertainment. Thank you, Alex --- Прогноз погоды ТУТ - http://pogoda.tut.by

Hello guys, I past the last days trying to configure my shorewall 4.06 firewall to allow openvpn bridging connection. My scenario is the following: roadwarrior (openvpn client) -------------> Internet ------------> (X.Y.W.Z - eth0) Firewall/Gateway (10.x.x.254 - eth1) --------> Local Lan -------> OpenVPN Server (10.x.x.249 - br0) where 10.x.x.0-254 is my private lan X.Y.Z.W is

Folk, My network is described and illustrated here. http://carnot.yi.org/NetworksPage.html To allow Cantor and Dalton, in the vpn zone connected to Joule through tun0, to SMTP to my ISP, I tried this in /etc/shorewall/masq. #INTERFACE SOURCE ADDRESS PROTO PORT(S) IPSEC MARK eth0 tun0 Shorewall complains. 07:21:58 Setting up Masquerading/SNAT... 07:21:58 To 0.0.0.0/0

I''d like to implement something like SFQ, but with a cap of a rate per flow. Essentially, I''d like to be able to limit citrix connections to 30KBps without having an overall traffic flow cap for all citrix connections. Slightly preferable to this would be something that would actually work per flow instead of the stochastic algorithm. Is this possible? Thanks, Bill --

Hello, From a user perspective, the simple (tcpri) and complex TC configs offers two rather distinct choices. A user can very well be OK with only using the simple way and that''s very fine. Then again, even in doing so, the more complex config options are available. What is the interplay between the two as far as having some parameters configured in both at the same time ? So far

I read the sched/qdiscs code from kernel source ... and I have some questions : When the .enqueue, .dequeue, .drop, .requeue functions are called ? What is the event that triggers them and how often this event apears ( per second ? ) ? When a qdisc is dequeued ( when it''s limit is reached ) ? Thanks _______________________________________________ LARTC mailing list /

Hi folks, I`ve a problem to use HTB and SFQ. The first script, below, to show a simple configuration, does work fine...!!! But, in the second example, does not work, becouse i put more code to clasify the traffic by protocol, http and ftp in this case. Somebody can tell me the errors? Thx, in advance.- NOTICE: IMQ device is to asociate with ETH1 my external iface. SCRIPT que funciona:

Beta 1 is now available for testing. ---------------------------------------------------------------------------- I. P R O B L E M S C O R R E C T E D I N T H I S R E L E A S E ---------------------------------------------------------------------------- 1) Previously /var/log/shorewall*-init.log was created in the wrong Selinux context. The rpm''s have been modified to

Beta 1 is now available for testing. ---------------------------------------------------------------------------- I. P R O B L E M S C O R R E C T E D I N T H I S R E L E A S E ---------------------------------------------------------------------------- 1) Previously /var/log/shorewall*-init.log was created in the wrong Selinux context. The rpm''s have been modified to

Hi All, I''ve got an interoffice IPSEC VPN in place that I''m trying to give priority to terminal service (tcp 3389) traffic. I''ve created rules at each end, but have hit a bit of a dillemma. As the data is encrypted I must also give highest priority to protocol 50 otherwise the priority is lost as the packet gets encrypted. When I do this however, I can''t

Hi If I use sfq qdisc on a CBQ class I get a lot of dropped packets and the backlog itr almost always to its full value: 128. From the HOWTO I understand that the queue is at 128 packets, and SFQ shows 128/1024 flows , but how can I increase that value ? I have tried ip link set txqueuelen but this only increases the tx queue on the interface. qdisc sfq d468: quantum 1514b limit 128p flows

I''m grappling with a problem that looks like sfq is not working (packets don''t get fairly queued, they appear to be always sent FIFO). My configuration appears to be correct. The machine is running quite an old kernel and if I could convince myself that the sfq code it has is just broken, I''d spend the time to upgrade it. Is there any way to inspect or dump the sfq hash

Hello, I wrote a simple traffic shaping script (below) that should have allowed me to shape my internet traffic a bit (ppp0 - adsl 128kbit/64kbit; local interface eth0). The script works only partially - the speed is being limited but too much. Without running this script my download rate is about 10kBytes (with second computer also downloading at about 6kBytes). After running it my download speed

The limit parameter for SFQ qdiscs isn''t listed in the howto. Based on a mail from this list from 4 may 2002 ("SFQ queue lengths - generalization"), I''d guess it limits the number of packets/bytes in in the queue, but wether it does so by number of bytes, packets, or time spent in the queue I don''t know. Perhaps someone in the know could add a line to the

Anyone notices that using sfq qdisc adds latency compared to pfifo? With "sfq perturb 10" ping latency is around 100-120ms, while with "pfifo limit 3" drops to ~10-30ms (qdiscs belong to htb class). I''m missing something or is this expected? { $TC_CLASS parent 1:1 classid 1:20 htb prio 0 rate 900kbit ceil 1000kbit burst 7k $TC_QDISC parent 1:20 handle 200: {pfifo

Hi to all, i''m following this guide (http://www.opalsoft.net/qos/DS-28.htm), is very detailed, but i''m a bit confused about queuing disciplinse of leaf classes. In this guide the author uses PFIFO (see the scheme that i attached at message) in this way: # tc class add dev eth0 parent 1:21 handle 210: pfifo lmit 10 # tc class add dev eth0 parent 1:22 handle 220: pfifo lmit 10 #

I looked online for documentation about this, but couldn''t find it. Is anybody else running a Teredo relay, on a firewall that has both Shorewall and Shorewall6 installed? I''m running IPv6 at home (thanks to a Hurricane Electric tunnel). I''m having trouble with external Teredo clients being able to ping my home IPv6 addresses. All of these clients can reliably ping