similar to: tc actions and accounting

Hi, at my local university network, I have to make sure no student uploads more than x GB/day. So far, I give them unlimited bandwidth until they have more than y GB (y<x) upload. After that, I use the u32 filter to associate the affected IP address with a HTB class limited to the rate (remainingtraffic/remainingtime). Since the accounting is done with ipt_ACCOUNT right now and the netfilter

Hi, I''m having issues with policing my incoming traffic by matching packet marks made by iptables. I''ve checked as many sites and guides as I can find, and I seem to be doing the exact same thing as they all are, but there''s still no success. As such, I was wondering if anyone can have a quick look to see if I''ve done anything obviously stupid? Essentially, I

Hello, Sorry for the many Ccs, but I hope to reach all parties involved. I want to do traffic shaping with NAT and I wanted to do it with IFB instead of IMQ [1]. I tried a lot of things but now I am stuck (and maybe confused). The setup: eth0 eth1 WAN/(Internet) <-> Linux Router <-> LAN Linux router: - does NAT for the LANs - runs local processes

On Wed, Jul 17, 2013 at 6:06 AM, Qiu Yu <unicell@gmail.com> wrote: > After some digging in openvswitch code. My wild guess is that vlan tag > reconfiguring triggered iface_configure_qos (vswitchd/bridge.c), which > in turn called netdev_set_policing to reset ingress policing rate. > Although there's no ingress_policing_rate set in my case, existing > ingress qdisc still

When I start my script: * - Creating classes on br1 for upload control ... * - tc class add dev br1 parent 2:0 classid 2:46 hfsc ls m1 576.0Kbit d 2000ms m2 192.0Kbit ul m2 384Kbit ... [ ok ] * - tc class add dev br1 parent 2:46 classid 2:47 hfsc sc umax 1500b dmax 30ms rate 80Kbit . [ ok ] * - tc class add dev br1 parent 2:46 classid 2:48 hfsc ls m2 152.0Kbit ul m2 152.0Kbit

On Thu, Jul 18, 2013 at 12:15 AM, Ben Pfaff <blp@nicira.com> wrote: > On Wed, Jul 17, 2013 at 6:06 AM, Qiu Yu <unicell@gmail.com> wrote: >> After some digging in openvswitch code. My wild guess is that vlan tag >> reconfiguring triggered iface_configure_qos (vswitchd/bridge.c), which >> in turn called netdev_set_policing to reset ingress policing rate. >>

https://bugzilla.netfilter.org/bugzilla/show_bug.cgi?id=445 Summary: ipt_account reports: sleeping function called from invalid context at mm/slab.c:2063 Product: netfilter/iptables Version: patch-o-matic-ng Platform: All OS/Version: other Status: NEW Severity: normal Priority: P2

After some digging in openvswitch code. My wild guess is that vlan tag reconfiguring triggered iface_configure_qos (vswitchd/bridge.c), which in turn called netdev_set_policing to reset ingress policing rate. Although there's no ingress_policing_rate set in my case, existing ingress qdisc still remove by default. Could some openvswitch guy help to confirm and suggest how to fix or workaround?

Happy New Year. Finally got my fw and tc rules down pat for the bridge, now interested in introducing a third nic to have nat on the box as well. Does anyone have a idea of a good place to start reading up on the subject, mainly interested in how to setup the flow direction to start with as to get a overall understanding of the flow, found that help best. Internet --- eth0 --- eth1 ---

I am attempting to implement IMQ on a 2.4.31 version kernel with iptables 1.3.3. I am following the example at http://www.linuximq.net/usage.html. When I enter the line iptables -t mangle -A POSTROUTING -o eth1 -j IMQ --todev1 (eth1 is the external interface), the computer slows to a crawl. OK, the CPU is only an AMD K6 233 which is not the world''s greatest CPU, but egress shaping is

Hello everybody on the list, I have the following situation where I want to police the speed of incoming packets from specific subnets to 1024kbps and then police all the rest to 256kbps, which is the speed my ISP grants for the rest of the internet. So, eth1 is the one connected to the cable modem and then to the internet. I do: tc qdisc add dev eth1 ingress handle ffff: then: tc filter

hi, I''ve successfully implemented shaping and policing with HTB for my SDSL line. Some tips&tricks I discovered which were not covered in the FAQs and docs I read: - To discover the appropriate rate for your line, flood it with traffic and reduce the rate until the matching class starts to show a consistent backlog -- only then you''ve managed to take the queue away

-> Hi! -> -> I''ve a Linux Box that I want to apply a filter -> in order to limit FTP salient traffic from my -> linux box to internet. -> -> I''ve a: -> Red Hat 7.2 -> Kernel 2.4.20 (with HTB built in!) -> iptables 1.2.7a -> -> Also, I get "tc" binnary package from HTB home page. -> -> I have a script in

I have a Gentoo Linux (kernel 2.6.11) server. Several months ago, I made a traffic shaping setup for my box (running a 2.4 kernel then) that worked beautifully. It gave high priority to SSH and RealAudio traffic, and put HTTP downloading traffic on a lower prio so they could only use what bandwidth was left. However, I''ve only just realized that tc is no longer accepting the commands I

-------------- eth0------eth1 eth0------------ |211.241.219.xx | --- | ROUTER | --- |192.168.1.4 | --------------- --------- ------------ when i send traffic from ROUTER to 211.241.219.xx or 192.168.1.4(masquraded), the filter works fine... In ROUTER, tc filter policy is like this: tc filter add dev eth0 parent 1:0 protocol ip u32 match ip dport 80 0xffff

I have need to use HTB on multiple (5) IPs. The present setup has the DSL connection going to a switch and then each computer with an external IP configures the external interface to listen on that IP. I have had TERRIBLE luck trying to use iptables to DNAT so if DNAT needs to be done, any advice that includes tested and working examples would be sincerely appreciated. There are 3 computers

https://bugzilla.netfilter.org/show_bug.cgi?id=1173 Bug ID: 1173 Summary: Documentation/error messages around NAT statements in "inet" tables incorrect Product: nftables Version: unspecified Hardware: All OS: All Status: NEW Severity: critical Priority: P5

https://bugzilla.netfilter.org/bugzilla/show_bug.cgi?id=445 laforge@netfilter.org changed: What |Removed |Added ---------------------------------------------------------------------------- AssignedTo|laforge@netfilter.org |opensource@intra2net.com ------- Additional Comments From laforge@netfilter.org 2006-02-09 15:38 MET ------- ipt_account

Greetings from a newbie! (Well, to this list anyway) I''m having a problem and I hope someone here might be able to help... I am strongly expecting an answer along the lines of "upgrade to v2.4.x", but I would REALLY preffer to avoid that for now... The setup: "Home brewed" v2.2.24 (will patch to v2.2.25 later today) with the DS8 patch applied. Currently

Hello, it seems, that filtering on nexthdr (TCP/UDP) content, especially src or dst port, is not working. The following has no effect on 2.4.16 or older (even 2.2) kernels: # tc filter add dev eth0 parent ffff: protocol ip prio 50 u32 match tcp dst 3128 0xffff police rate 40kbit burst 10k drop flowid :1 Even if # tc filter ls dev eth0 parent ffff: filter protocol ip pref 50 u32 filter protocol