Here it is now in plain text, just pls help me understand, cuz seems verry ilogic what happends. Sorry for sending this 3 times. I hope it is ok now. Hello lartc users, I mark pakets (by MAC and IP), works on my lan except for 1 single host. This host is able to fuck-up the entire network because not a single bit of his traffic is shaped. this way when he is downloading there is no more internet in the entire LAN. Here is what I get: ~ # iptables -L -n -v Chain INPUT (policy DROP 129 packets, 18244 bytes) pkts bytes target prot opt in out source destination 121K 89M ipac~o all -- * * 0.0.0.0/0 0.0.0.0/0 0 0 PSCAN tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x3F 0 0 PSCAN tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x00 2106 103K tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x16/0x02 limit: avg 10/sec burst 5 121K 89M CUSTOMINPUT all -- * * 0.0.0.0/0 0.0.0.0/0 117K 88M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 215 7951 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0 21 1260 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 671 40197 ACCEPT all -- eth0 * 192.168.1.1 0.0.0.0/0 MAC 00:02:44:67:30:30 54 4471 ACCEPT all -- eth0 * 192.168.1.2 0.0.0.0/0 MAC 00:02:44:67:30:5E 1417 87806 ACCEPT all -- eth0 * 192.168.1.3 0.0.0.0/0 MAC 00:02:44:59:71:40 734 56195 ACCEPT all -- eth0 * 192.168.1.4 0.0.0.0/0 MAC 00:D0:09:D5:6B:12 394 28308 ACCEPT all -- eth0 * 192.168.1.5 0.0.0.0/0 MAC 00:50:FC:9D:7A:5B 0 0 ACCEPT all -- eth0 * 192.168.1.6 0.0.0.0/0 MAC 00:80:5F:8F:C2:48 109 11947 ACCEPT all -- eth0 * 192.168.1.7 0.0.0.0/0 MAC 00:06:4F:05:FB:16 0 0 ACCEPT all -- ipsec+ * 0.0.0.0/0 0.0.0.0/0 129 18244 RED all -- * * 0.0.0.0/0 0.0.0.0/0 129 18244 XTACCESS all -- * * 0.0.0.0/0 0.0.0.0/0 113 16529 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 10/min burst 5 LOG flags 0 level 4 prefix `INPUT ' Chain FORWARD (policy DROP 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 198K 62M ipac~fi all -- * * 0.0.0.0/0 0.0.0.0/0 198K 62M ipac~fo all -- * * 0.0.0.0/0 0.0.0.0/0 0 0 PSCAN tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x3F 0 0 PSCAN tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x00 198K 62M CUSTOMFORWARD all -- * * 0.0.0.0/0 0.0.0.0/0 190K 61M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 0 0 ACCEPT all -- eth0 * 192.168.1.1 0.0.0.0/0 MAC 00:02:44:67:30:30 1 48 ACCEPT all -- eth0 * 192.168.1.2 0.0.0.0/0 MAC 00:02:44:67:30:5E 429 54514 ACCEPT all -- eth0 * 192.168.1.3 0.0.0.0/0 MAC 00:02:44:59:71:40 6831 832K ACCEPT all -- eth0 * 192.168.1.4 0.0.0.0/0 MAC 00:D0:09:D5:6B:12 478 28669 ACCEPT all -- eth0 * 192.168.1.5 0.0.0.0/0 MAC 00:50:FC:9D:7A:5B 0 0 ACCEPT tcp -- eth1 * 0.0.0.0/0 192.168.1.5 tcp dpt:19995 0 0 ACCEPT tcp -- eth1 * 0.0.0.0/0 192.168.1.5 tcp dpt:19995 0 0 ACCEPT all -- eth0 * 192.168.1.6 0.0.0.0/0 MAC 00:80:5F:8F:C2:48 72 5774 ACCEPT all -- eth0 * 192.168.1.7 0.0.0.0/0 MAC 00:06:4F:05:FB:16 0 0 ACCEPT all -- ipsec+ * 0.0.0.0/0 0.0.0.0/0 0 0 PORTFWACCESS all -- * * 0.0.0.0/0 0.0.0.0/0 0 0 DMZHOLES all -- * eth0 0.0.0.0/0 0.0.0.0/0 0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 10/min burst 5 LOG flags 0 level 4 prefix `OUTPUT ' Chain OUTPUT (policy ACCEPT 141K packets, 85M bytes) pkts bytes target prot opt in out source destination 141K 85M ipac~i all -- * * 0.0.0.0/0 0.0.0.0/0 Chain CUSTOMFORWARD (1 references) pkts bytes target prot opt in out source destination The bad host is 192.168. 1.1. As you can see his pakets are marked, but then the shapeing is not done at all. ~ # tc -d -s class show dev eth1 class htb 10:10 root rate 125Kbit ceil 125Kbit burst 40Kb/8 mpu 0b cburst 1759b/8 mpu 0b level 7 Sent 45405999 bytes 110084 pkts (dropped 0, overlimits 0) rate 90bps 1pps lended: 35284 borrowed: 0 giants: 0 tokens: 2086912 ctokens: 79872 class htb 10:1 parent 10:10 prio 2 quantum 1500 rate 18Kbit ceil 125Kbit burst 40Kb/8 mpu 0b cburst 1759b/8 mpu 0b level 0 Sent 0 bytes 0 pkts (dropped 0, overlimits 0) lended: 0 borrowed: 0 giants: 0 tokens: 14563554 ctokens: 90112 class htb 10:2 parent 10:10 prio 2 quantum 1500 rate 18Kbit ceil 125Kbit burst 40Kb/8 mpu 0b cburst 1759b/8 mpu 0b level 0 Sent 0 bytes 0 pkts (dropped 0, overlimits 0) lended: 0 borrowed: 0 giants: 0 tokens: 14563554 ctokens: 90112 class htb 10:3 parent 10:10 prio 2 quantum 1500 rate 18Kbit ceil 125Kbit burst 40Kb/8 mpu 0b cburst 1759b/8 mpu 0b level 0 Sent 446562 bytes 6804 pkts (dropped 0, overlimits 0) rate 5bps lended: 6804 borrowed: 0 giants: 0 tokens: 14344532 ctokens: 58573 class htb 10:4 parent 10:10 prio 2 quantum 1500 rate 18Kbit ceil 125Kbit burst 40Kb/8 mpu 0b cburst 1759b/8 mpu 0b level 0 Sent 44734592 bytes 102026 pkts (dropped 0, overlimits 0) rate 37bps lended: 66742 borrowed: 35284 giants: 0 tokens: 14518044 ctokens: 83560 class htb 10:5 parent 10:10 prio 2 quantum 1500 rate 18Kbit ceil 125Kbit burst 40Kb/8 mpu 0b cburst 1759b/8 mpu 0b level 0 Sent 216317 bytes 1153 pkts (dropped 0, overlimits 0) rate 60bps lended: 1153 borrowed: 0 giants: 0 tokens: 12304384 ctokens: 79872 class htb 10:6 parent 10:10 prio 2 quantum 1500 rate 18Kbit ceil 125Kbit burst 40Kb/8 mpu 0b cburst 1759b/8 mpu 0b level 0 Sent 0 bytes 0 pkts (dropped 0, overlimits 0) lended: 0 borrowed: 0 giants: 0 tokens: 14563554 ctokens: 90112 class htb 10:7 parent 10:10 prio 2 quantum 1500 rate 18Kbit ceil 125Kbit burst 40Kb/8 mpu 0b cburst 1759b/8 mpu 0b level 0 Sent 8528 bytes 101 pkts (dropped 0, overlimits 0) lended: 101 borrowed: 0 giants: 0 tokens: 14546488 ctokens: 87655 And this is the version I use kernel HTB init, kernel part version 3.10 _______________________________________________ LARTC mailing list / LARTC@xxxxxxxxxxxxxxx http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
