Hey, I'm definately glad because i can see that someone else knows what is happening here. Thank for all the help and also i'm here to help anyone as much as i can. So, refreshing my current setup, i have this rules for each customer: tc qdisc del dev eth0 root tc qdisc add dev eth0 root handle 1:0 htb tc class add dev eth0 parent 1:0 classid 1:1 htb rate 100mbit tc qdisc del dev eth1 root tc qdisc add dev eth1 root handle 1:0 htb tc class add dev eth1 parent 1:0 classid 1:1 htb rate 100mbit user 1 tc class add dev eth0 parent 1:1 classid 1:5 htb rate 150kbit ceil 150kbit tc qdisc add dev eth0 parent 1:5 handle 5: sfq perturb 10 tc class add dev eth1 parent 1:1 classid 1:5 htb rate 50kbit ceil 50kbit tc qdisc add dev eth1 parent 1:5 handle 5: sfq perturb 10 iptables -t mangle -A POSTROUTING --dest 10.30.0.54 -o eth0 -j CLASSIFY --set-class 1:5 iptables -t mangle -A FORWARD --src 10.30.0.54 -o eth1 -j CLASSIFY --set-class 1:5 user n tc class add dev eth0 parent 1:1 classid 1:8 htb rate 150kbit ceil 150kbit tc qdisc add dev eth0 parent 1:8 handle 8: sfq perturb 10 tc class add dev eth1 parent 1:1 classid 1:8 htb rate 50kbit ceil 50kbit tc qdisc add dev eth1 parent 1:8 handle 8: sfq perturb 10 iptables -t mangle -A POSTROUTING --dest 10.20.0.43 -o eth0 -j CLASSIFY --set-class 1:8 iptables -t mangle -A FORWARD --src 10.20.0.43 -o eth1 -j CLASSIFY --set-class 1:8 what u32 rules could replace these iptables rules? I would like to try u32 filters and see if them will solve the problem, if i had no success, i will try the IPCLASSIFY patch. Thanks again in Advance. Regards Pablo Fernandes -----Ursprüngliche Nachricht----- Von: VladSun [mailto:vladsun@xxxxxxxxx] Gesendet: segunda-feira, 28 de maio de 2007 14:39 An: Alexandru Dragoi Cc: Pablo Fernandes Yahoo; lartc@xxxxxxxxxxxxxxx Betreff: Re: big problem with HTB/CBQ and CPU for more than 1.700 customers Alexandru Dragoi написа: > u32 hash filters is the key, as somebody pointed. You can also tune your > iptables setup, like this > > #192.168.1.0/24 > iptables -t mangle -N 192-168-1-0-24 > iptables -t mangle -A FORWARD -s 192.168.1.0/24 -j 192-168-1-0-24 > iptables -t mangle -N 192-168-1-0-25 > iptables -t mangle -N 192-168-1-128-25 > iptables -t mangle -A 192-168-1-0-24 -s 192.168.1.0/25 -j 192-168-1-0-25 > iptables -t mangle -A 192-168-1-0-24 -s 192.168.128.0/25 -j 192-168-1-128-25 > . > . > and so on, until (ip 192.168.1.11, which is called in chain created for > 192.168.1.10/31) > > iptables -t mangle -A 192-168-1-10-31 -s 192.168.1.10 -j CLASSIFY > --set-class 1:10 > iptables -t mangle -A 192-168-1-10-31 -s 192.168.1.11 -j CLASSIFY > --set-class 1:11 > > .. I guess you got the ideea, it requires some RAM, which i belive is > not such a big problem. Similar rules should be made for download. > > Or you can use my patch - IPCLASSIFY. Then the rules above would be substituted by a signle rule per direction: iptables -t mangle -A FORWARD -s 192.168.1.0/24 -j IPCLASSIFY --addr=src --and-mask=0xff --or-mask=0x11000 iptables -t mangle -A FORWARD -d 192.168.1.0/24 -j IPCLASSIFY --addr=dst --and-mask=0xff --or-mask=0x12000 This is equal to applying CLASSIFY target to each packet with --set-class (srcIP & 0xFF | 0x1100 ) and --set-class (dstIP & 0xFF | 0x1200 ). It is very similar to IPMARK, but it uses skb->priority field instead mark. So no tc filters are needed. _______________________________________________________ Yahoo! Mail - Sempre a melhor op� para voc� Experimente j� veja as novidades. http://br.yahoo.com/mailbeta/tudonovo/ _______________________________________________ LARTC mailing list LARTC@xxxxxxxxxxxxxxx http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
