Hello,
The recent thread titled:
working ftp shaping, i think
provided a script example where 100Mbps was specified as the rate for a typical NIC.
If that NIC is connected to a switch, chances are that it runs at 100Mbps in each direction concurrently - duplexed Writing a rule that specifies a 100Mbps rate and thereby a 100Mbps ceil, limits the connection to half the available bandwidth.
I haven't seen anything in tc (not iptables) that addresses direction - inbound or outbound.
Is there a way of writing rules that take duplexing into account so that you end up with 2 virtual devices, each capable of 100Mbps, but the traffic is direction specific?
Traffic shaping is generally only outgoing, that is why you need to pull many tricks to be able to *shape* (means control speed) inbound and not only *police* (only drop/allow through).
You cannot tell the senders on the internet how fast they should send to you so you can only shape outgoing. With IMQ you can shape incoming, however you already received the packets so delaying/dropping them may not be useful.
If you have an internet gateway, you can of course shape both directions, at least what is going through the box. What comes in on eth0 is then outbound on eth1 for example and you can again shape outgoing.
Shaping makes most sense where the traffic originates. With that said, I hope your question is answered: Even in full duplex you only have 100mbits going out which you can shape.
In iptables you can always specify direction. The built-in chain INPUT is only traversed when a packet is inbound *and terminates* on the machine (local service recieves packet). OUTPUT is only traversed when a packet goes out of a machine and has been created on that machine (ie service / program sent data on that machine) and FORWARD is all traffic that comes in on one interface and goes out to another interface, thereby passing through the machine/gateway.
Furthemore you can select the input and output interfaces in a given FORWARD rule by the -i and -o matches giving you a direction in the forward case. In OUTPUT or INPUT the direction is already known by the chain name.
If you jump from both INPUT and OUTPUT into the same user-defined chain, you can use -i and -o respectively.
tc always uses outgoing unless you're working on the INGRESS special case. To shape incoming via IMQ, you need an IMQ dummy interface on whose "outgoing" direction you can shape again.
So to answer your last question, yes using the IMQ device you can shape inbound. Otherwise you can only shape outgoing or police incoming using INGRESS.
--
C U
- -- ---- ----- -----/\/ René Gallati \/\---- ----- --- -- - _______________________________________________ LARTC mailing list / LARTC@xxxxxxxxxxxxxxx http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
