On Tuesday 01 April 2003 10:58, Roché Compaan wrote:
> Hi everybody
>
> I've been using htb to shape traffic successfully for quite a while now
> but I am wondering if it can be improved in some ways.
There is not much to say about it. I think your script is ok. But, you have
a low prio class for ssh. If that class is overlimited (there is more
traffic then the configured rate), the latency for that class will raise a
lot.
There is not so much you can do to prevent this. You can use policers in
filters, or make sure you don't put bulk traffic in that low prio class.
> # Company 1 (2, 3 has the same classes)
> tc class add dev eth1 parent 1:1 classid 1:21 htb \
> rate 62kbit ceil 192kbit prio 1
> # Class for SSH
> tc class add dev eth1 parent 1:21 classid 1:210 htb \
> rate 32kbit ceil 192kbit prio 0
> # The rest
> tc class add dev eth1 parent 1:21 classid 1:211 htb \
> rate 30kbit ceil 192kbit prio 1
>
> # ACK bit filter
> tc filter add dev eth1 parent 1: protocol ip prio 10 u32 \
> match ip protocol 6 0xff \
> match u8 0x05 0x0f at 0 \
> match u16 0x0000 0xffc0 at 2 \
> match u8 0x10 0xff at 33 \
> flowid 1:10
>
> # I don't know if this one is correct????
> # SYN bit filter
> tc filter add dev eth1 parent 1: protocol ip prio 10 u32 \
> match ip protocol 6 0xff \
> match u8 0x02 0x0f at 0 \
> flowid 1:10
>
> # DNS filter
> tc filter add dev eth1 parent 1: protocol ip prio 10 u32 \
> match ip dport 53 0xffff \
> match ip protocol 17 0xff \
> flowid 1:10
> tc filter add dev eth1 parent 1: protocol ip prio 10 u32 \
> match ip sport 53 0xffff \
> match ip protocol 17 0xff \
> flowid 1:10
>
> # Company1 Filters (2, 3 has the same filters)
> # Filter for SSH
> tc filter add dev eth1 parent 1: protocol ip prio 10 u32 \
> match ip dst X.Y.Z \
> match ip dport 22 0xffff \
> match ip protocol 6 0xff \
> flowid 1:210
> # Filter for the rest
> tc filter add dev eth1 parent 1: protocol ip prio 10 u32 \
> match ip dst X.Y.Z \
> flowid 1:211
>
> If you think the above can be improved in any way or see obvious gaps in
> my shaping strategy please let me know.
>
> One final question I have. If one uses the u32 filter does the mask get
> XOR'ed or AND'ed with the incoming packet. Is there any easy way to
> calculate the mask?
--
stef.coene@xxxxxxxxx
"Using Linux as bandwidth manager"
http://www.docum.org/
#lartc @ irc.oftc.net
