Daniel Harold L. wrote:
Dear all,
First, sorry for my bad English ..
To night one of my client is the victim of UDP attack from internet. It's tons
of UDP packets from internet with destination to port 80. But when I look at
class of that victim client, the actual class rate is over than configured
rate class.
Below is my screen capture. You can see at class 1:913 which have actual rate
105136bit while configured with ceil at 96000bit. Also it's parent class
(1:91) which have actual rate 107680bit while configured with ceil at
96000bit.
Is this normal? Or I have miss something in my script. Sometimes ago I found
this situation but I forgot to capture the screen and the traffic is UDP too
(maybe from torrent-like client)
Yes it is normal!
The rate tables that tc use normally have an 8 byte steps, so it is
possible for up to a 56bit/s error per packet and you have 300 pps.
There was a small patch submitted for tc to make the error fall on the
underrate rather than overrate side, but I think it got lost in the
middle of the long ATM overhead patch thread on netdev.
Andy.
_______________________________________________
LARTC mailing list
LARTC@xxxxxxxxxxxxxxx
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
