similar to: Unable to match/classify non-icmp traffic with TOS bigger than 0x10

I have a requirement which I guess it is not too unusually, however I haven''t quite figured out how to do it and couldn''t find any examples which handle that. I have made myself a Linux-based bridge, eth0 bridged with eth1 to form br0. In this bridge, I run ''tc'' script to handle QoS. So far nothing unusual. However, what''s different is that this

Hi all, I am wondering if anyone can help me to resolve a problem. I am trying to use tc command in linux to drop udp packets of specific diffserv value. I am able set diffserv value successfully in the udp packet using command:- [root@scotch src]#iptables --table mangle --append OUTPUT \ --out-interface eth0 --protocol udp --source-port 5060 \ --jump DSCP --set-dscp 8 but i am not able to

Does anyone know if load balancing and DNAT work well together? I know that load balancing and NAT do not, but what about a simple port forward? I can''t apply Julian Anastasov''s patches, because they don''t work with PPTP patches. :/ Anyhow, a simple: iptables -t nat -A PREROUTING -i eth0 -p tcp --dport xxx -j DNAT --to yyy:xxx iptables -I FORWARD -i eth0 -d yyy -p

Hello - What I want to do seems very simple - I want to make sure any H.323 traffic gets processed before anything else entering or leaving this network. The network has a videoconferencing device on the LAN at 192.168.16.4. A Linux firewall NATs an external IP Address to this internal address and I have appropriate SNAT and DNAT rules that work. The NAT and connection tracking rules all work

I''m trying to configure 4 queues with strict priorities based on DSCP. I tried to following commands, but it seems that the filters I defined have no effect tc qdisc add dev eth0 root handle 1: prio bands 4 tc qdisc add dev eth0 parent 1:0 handle 10: pfifo limit 100 tc qdisc add dev eth0 parent 1:1 handle 20: pfifo limit 100 tc qdisc add dev eth0 parent 1:2 handle 30: pfifo limit 100 tc

Hello all, Please could someone help me with this, I have been trying for days to get this to work. I would like to have BE, AF & EF classes with HTB qdisc. I can''t find any scripts online where this has been done. If I enable this filter: #tc filter add dev eth0 parent 2:0 protocol ip prio 1 \ #tcindex mask 0xf0 shift 4 pass_on then BE & AF classification seems to be fine but

I don't understand this message: [2009-10-29 16:31:51] WARNING[28510]: rtp.c:1997 ast_rtp_settos: Unable to set TOS to 184

Hi, I find this diagram which details the kernel packet traveling : http://www.docum.org/docum.org/kptd/ Is it up to date ? I made some test and I put a DNAT rules in the PREROUTING table of an interface and I attach it a ingress policy, the dst IP wasn''t changed. the DNAT it isn''t yet make. I''ve another question (I''m not sure is it the good mailing list), for

The LARTC howto correctly describes load balancing and split access for traffic from a machine with multiple ISP connections (http://www.lartc.org/lartc.html#LARTC.RPDB.MULTIPLE-LINKS) -- *provided* the traffic originates from the machine itself (i.e. traffic regularly handled by the INPUT and OUTPUT chains of iptables). When forwarding traffic from an attached local network, the following

I have tried using iptraf for my NAT firewall to analyse the IP traffic. Basically I am faced with this difficulty of related the source IP to the outgoing interface to the internet, so I am wondering if anyone has a suggestion for a different ways to do it, or a suggestion for a better tool. Details :- Supposed : eth0 - LAN eth1 - WAN1 eth2 - WAN2 And then

Has anyone figured this out yet? Lots of places say to add the following to sip.conf of an Asterisk 1.2 system (current production machine/Asterisk as root): tos=0xB8 (Hex B8 = Decimal 184 = Binary 10111000) or if you are running Asterisk v1.4 or newer: tos_sip=cs3 ; Sets TOS for SIP packets. tos_audio=ef ; Sets TOS for RTP audio packets. tos_video=af41 ;

Subject almost says it all, I wonder if there is a way for me to use iptables matches like l7 and/or ipp2p match in a bridge ( one ethernet in and one ethernet out ) ? Regards.

Normally when we talk about traffic control, we are talking about doing traffic control (tc) using a router, ie packets into an interface and based on routing, they goes out to somewhere else. However I have a box with two interfaces, eth0 and eth1 added to a bridge br0 and I would like to perform traffic control via the two interfaces. Is that supposed to work the same as the router

Hy, I would want to mark the packets that are entering in a machine, with a mark for using diffserv with DSMARK. My machine has 2 interfaces, a ethernet and a wireless. The ethernet interface is eth1 and the other is wifi0. Firs, I would want to test that I would be able to mark the tos of the paquets that I would be receiving, for this I write in the console of my linux: iptables -A

I''m successfully using HTB + GRED to shape traffic based on the DSCP field. I would like to strip the DSCP and possibly replace it with normal ToS bits on egress traffic leaving my network. Leaving DSCP set is pointless, and could potentially cause problems with some ISPs that use DSCP internally I suppose. Setting ToS bits would seem ideal as most networks still honor it to varying

I am assuming that the TOS values directly map to DSCP values in the ip header. Is this a correct assumption? If so, can someone tell me the correct setting to set call control packets with a DSCP of AF31(011010) and media with EF(101110)? So would the setting for AF be TOS=46?? Is it possible to mark the media and call control separately?? -------------- next part -------------- An HTML

I can use DSMARK to mark on the Egress side. Is there a way to mark/change the DSCP value of an incoming packet on the ingress side? Thanks. Jon Flechsenhaar Boeing WNW Team Network Services (714)-762-1231 202-E7

As you are probably aware, this is a ever green topic. I have personally tried doing it, testing it and verifying it and I am myself finding this problem challenging and frustrating. Most of the scripts will recommend some form of rate limiting ( or policing ) on the download. But the challenge is how to determine the correct value for the policing ? Lot of the recommendation says use x %

hi there, I just wanted to share a recent discovery I did on how to setup a secure VPN implementation for linux 2.4.x (I''m using 2.4.20 but it should be working, as far as documentation states, for > 2.4.18) without using FreeS/WAN. The tool (ipsec_tunnel: http://ringstrom.mine.nu/ipsec_tunnel/, by Tobias Ringström) is a kernel module based on ipip and ip_gre. It uses CyptoAPI to

Assuming if I have rules matching the same packet, the one chosen is the lower preference value or the high ? For example # ip rule list .... 100 from 192.168.1.0/24 lookup main 200 from all fwmark 5 lookup first ..... Packet is matching both rules, the one with priority/preference 100 or 200 is selected ? _______________________________________________ LARTC mailing list /