Can't get tc to limit network traffic

Question

Based on this section of the Linux Advanced Routing & Traffic Control HOWTO, I can't get tc to limit the network speed in my computer.

The router is a Motorola SurfBoard modem with a few routing capabilities and firewall. The machine I want to limit the traffic is 192.168.0.5, and also the script is being run from 192.168.0.5.

Here is my adaption of the commands on the link above for /etc/NetworkManager/dispatcher.d/:

#!/bin/sh -eu

# clear any previous queuing disciplines (qdisc)
tc qdisc del dev wlan0 root 2>/dev/null ||:

# add a cbq qdisc; see `man tc-cbq' for details
if [ $2 = up ]; then
    # set to a 3mbit interface for more precise calculations
    tc qdisc add dev wlan0 root handle 1: cbq avpkt 1000  \
        bandwidth 3mbit

    # leave 30KB (240kbps) to other machines in the network
    tc class add dev wlan0 parent 1: classid 1:1 cbq      \
        rate 2832kbit allot 1500 prio 5 bounded isolated

    # redirect all traffic on 192.168.0.5 to the previous class
    tc filter add dev wlan0 parent 1: protocol ip prio 16 \
        u32 match ip dst 192.168.0.5 flowid 1:1

    # change the hashing algorithm every 10s to avoid collisions
    tc qdisc add dev wlan0 parent 1:1 sfq perturb 10
fi

The problem is that I have tried setting 2832kbit to very small values for testing (like 16kbit), but I still can browse the web at high speed. The problem is not in NetworkManager, because I'm testing the script manually.

EDIT: I have found that by changing dst 192.168.0.5 to src 192.168.0.5, the upload speed is reliably limited, but I still haven't figured how to get the download speed to work, which is the most important for me.

Is IPv6 enabled on the machine? Perhaps the downloads are via IPv6? — Jan, Sep 10 '14 at 16:20
@Jan I had IPv6 enabled on /etc/hosts, but disabling it made no difference. `wondershaper` actually works on my machine, but it actually spits a couple of errors, and also does more than what I need (setting priorities, etc). For the downlink, `wondershaper` uses `handle ffff:`, but I'm still not sure of how this works. — admirabilis, Sep 10 '14 at 17:43
The special handle ffff:0 is reserved for the ingress qdisc. An ingress qdisc allows you to apply tc filters to packets coming in over the interface, regardless of whether they have a local destination or are to be forwarded. Try to add an ingress qdisc, use handle ffff and report back. — Jan, Sep 10 '14 at 19:34
@Jan If I try to replace **root** with **ingress**, tc prints ***What is "cbq"?***. I don't really know how to do that, so I've taken this from wondershaper: `tc qdisc add dev wlan0 handle ffff: ingress; tc filter add dev wlan0 parent ffff: protocol ip prio 50 u32 match ip dst 192.168.0.5 police rate 200kbps burst 10k drop flowid :1`. The problem with this is that it is very unreliable, it results in unstable download speeds (if set to 200, it downloads at ~80-120). As mentioned in my question, the upload speed is really limited to the desired value. — admirabilis, Sep 10 '14 at 19:48

score 1 · Accepted Answer · answered Sep 15 '14 at 12:03

You cannot limit incoming traffic on the destination machine because it has already arrived.

To properly do what you want to do, you need to put tc onto your gateway. This is probably not an option for you, but it's the way.

Ingress traffic can only be policed, in that it discards packets that exceed the speed limit. This is inefficient because you now take more bandwidth later to receive the same packet again. This works somewhat roughly because TCP is designed to handle traffic loss by slowing down when packets are lost, but you end up constantly going slower and faster as TCP scales which your most recent comment shows you are experiencing.

However, there is a way to make your system into a gateway for itself by shoving an 'Intermediate Functional Block Device' into your network pathway. I suggest reading up on it and then trying that for inbound rate limiting.

See this 'Theory' discussion re INGRESS / EGRESS shaping / policing on the Gentoo site.

http://www.funtoo.org/Traffic_Control under the section "Incoming and Outgoing Traffic" possibly has a better discussion than the Gentoo page. — Ian Macintosh, Sep 15 '14 at 12:12

Can't get tc to limit network traffic

1 Answers1