similar to: throttle lan client only

I know this will be trivial for most, but I am having trouble with getting my scenario to work correctly. I want to ''tag'' and ''throttle'' the bandwidth to and from a particular client on my lan side. Better yet, I just want to throttle smtp traffic, per say, for that ip. ----lan----------eth1-[linux.box]-eth0----------internet I have used the technique

Hi, I got the following lines from ''Linux Advanced Routing & Traffice Control HOWTO'' and got confused! iptables -A PREROUTING -i $INDEV -t mangle -p tcp --syn \ -j MARK --set-mark 1 tc qdisc add dev $INDEV handle ffff: ingress tc filter add dev $INDEV parent ffff: protocol ip prio 50 handle 1 fw \ police rate 1kbit burst 40 mtu 9k drop flowid

Hi, Thanks for the fast response, .)Okay I tried your suggestion for my port 8099 and nothing happened: The tcp ip information goes from a firewall to my port 8099 and this port is than routed to the original 8080, I do that because I don`t want to dirturb my port 8080. But it seams the ingress filter doesn`t work on it!! iptables -L -t nat Chain PREROUTING (policy ACCEPT) target prot opt

Hi, what is needed to activate ingress policies for enterprise server 9! My current loaded modules: in the attachments my kernel: Linux linux 2.6.5-7.97-smp #1 SMP Fri Jul 2 14:21:59 UTC 2004 i686 i686 i386 GNU/Linux So you can see the module sch_ingress is loaded and also the package iprout2 is installed. I have set also a filter for ingress policies but i don`t think it is working,

Hi, So far, if have understand correctly: I route the incoming tcpip message of port 8099 directly to 8080 and then the ingress filter on port 8099 has nothing to do!? Yes I think on different interface on one machine (different Ports for different Request, with different restriction). What has exactly to be done to set the policier before Prerouting! Which kernel options, or also extra

Is it possible to have multiple filters around an ingress so that you can police your downloads more specific. What I''m trying to achieve is to have all my ftp-traffic limited to 1024kbit on downloads. I included some commands below so that you might better understand my thoughts on the matter. tc qdisc add dev eth0 root handle 1: htb default 2 tc class add dev eth0 parent 1: classid 1:1

Hi, My problem is following now: I would like to set the filters for port 8099. I have tried it, but nothing happened. When I try the same filter for the port 8080 it is working very well. .) working filter (here I can see the dropped packages): tc filter add dev eth0 parent ffff: protocol ip u32 match ip dport 8080 0xffff police rate 1kbit burst 1 drop flowid :1 .) not working filter (here I

I''m trying to simulate a satellite link to a Linux server to test application performance. I haven''t used any of the tc stuff before, but I blandly assured people it would be "easy" to set up a simulated long thin pipe on a spare network interface. However, now that I''m exploring, it''s proving quite difficult. Let me start with the general question

I tried installing the WonderShaper on my internal link, mostly to get the SFQ installed. I set uplink and downlink to 100000 to match the link speed and changed the bandwidth on the cbq line to 100mbit. This killed transfer speed *to* the box, knocking it from 30-40 Mbps down to about 800 kbps. Commenting out just the ingress control restored the speed. What about the ingress policer would do

I''m having trouble getting ingress policing to work on a bridged device. The bridge contains several interfaces: peth0, vif0.0, vif[1-7]0.1, vif[25].1 . (This is under xen, in case the vif''s didn''t give that away, so peth0 is renamed eth0.) The tc rules I have are: tc qdisc del dev peth0 root tc qdisc del dev peth0 ingress handle ffff: tc qdisc add dev peth0 root

Hi stef and all I want measure the policy perfomance for video traffic on mpls diffserv network. there are two different polices for video packet 1. Video packets that are marked that are over the limit are to be rejected at the edge router. 2. Video packets that are marked that are over the limit are to be downgraded as best effort and are sent through. Before video enter my mpls

Hi guys , i am starting to "play" with qos in linux. Well , i am trying to setup an ingress filter but i do not know why it is not working. tc add qdisc dev eth0 ingress tc filter add dev eth0 parent ffff: protocol ip prio 1 handle 1 fw police rate 160kbit burst 256kbit drop flowid :1 After that : iptables -A PREROUTING -t mangle --sport 80 -j MARK --set-mark 1 So , i think this

Hello, i''ve found this page (lartc currently down) http://www.lartc.org/howto/lartc.cookbook.synflood-protect.html where someone used iptables firewall mark to mark specific packets which will be shaped thru ingress qdisc with a fw filter and rate policy appended. I''ve tried similar this way, but it don''t work. Now i''m belief this could''nt work

Hi, I''m having issues with policing my incoming traffic by matching packet marks made by iptables. I''ve checked as many sites and guides as I can find, and I seem to be doing the exact same thing as they all are, but there''s still no success. As such, I was wondering if anyone can have a quick look to see if I''ve done anything obviously stupid? Essentially, I

Hi all I am attempting to police the incoming rate by using the ingress filter based on the TOS of the incoming packet. I used the following commands: tc qdisc add dev eth0 handle ffff: ingress tc filter add dev eth0 parent ffff: protocol ip prio 6 u32 match ip tos 0x10 0xff police rate 24kbit burst 1k drop flowid :1 On downloading a 6 Mb file which was TCP and TOS 0x10, this filter made on

Hi listizens, Complete tc newbie here. I''m in a pinch because of a mail assault on a server. I''ve firewalled away many of the most egregious offenders but non-smtp services are still being DOS''ed because of all the mail traffic. Here is what I''ve tried. (I did say newbie ;) ----------------- #!/bin/sh # # policing parent tc qdisc add dev eth0 handle

Hi all. Since I move on to 2.6 kernel , filter ingress policy based on nfmark won´t work. Sorry for my english. Simple example: iptables -t mangle -I PREROUTING -j MARK --set-mark 1 ${QDISC_ADD} handle ffff: ingress ${FILTER_ADD} parent ffff: protocol ip prio 100 handle 1 fw \ police rate 128Kbit burst 10k drop flowid 2:11 # tc -s -d qdisc ls dev eth0 qdisc ingress ffff: ----------------

Hi, I''m trying to police the incoming traffic by using ingress qdisc,this is what I have in my script tc qdisc add dev eth0 handle ffff: ingress tc filter add dev eth0 parent ffff: protocol ip prio 4 \ handle 1: u32 divisor 1 tc filter add dev eth0 parent ffff: protocol ip prio 4 u32 \ match ip dport 4001 0xffff \ police rate 2000kbit burst 50k drop \ flowid

Hi, all I''ve got problems with tc qdisc ingress. I''m using vanillia kernel 2.6.14.4 patched with http://www.ssi.bg/~ja/routes-2.6.14-12.diff, and iproute2-2.6.14-051107. i am using ingress to limit incoming traffic : (DEV is eth1 / DOWNLINK is 7700) # attach ingress policer: tc qdisc add dev $DEV handle ffff: ingress # filter *everything* to it (0.0.0.0/0), drop everything

Hi Everyone, This is a simple question but I don''t understand why the below tbf is not working as expected by throttling traffic to 5kbps If I throttle a PC''s traffic using the below when traffic exceeds 5kbps packets start getting dropped (as they should) but all traffic gets dropped. not just the bit over 5kbps. TC="tc add dev ppp0" $TC parent 8001:2 handle 2: