3

Got the following test rule setup:

tc qdisc add dev wlan0 root handle 1: htb
tc class add dev wlan0 parent 1: classid 1:1 htb rate 1000Mbps
tc class add dev wlan0 parent 1:1 classid 1:5 htb rate 50Kbps ceil 50Kbps burst 1kbit cburst 1kbit
tc qdisc add dev wlan0 parent 1:5 handle 5:0 sfq perturb 5
tc filter add dev wlan0 parent 1:0 protocol ip u32 match ip dport 80 0xffff classid 1:5
tc filter add dev wlan0 parent 1:0 protocol ip u32 match ip sport 80 0xffff classid 1:5

(I've tried this with iptables --set-mark as well but without any real luck so i defaulted back to plain "simple" tc rules.)

This example works in the sense that, it does mark my :80 packages and throttles them but not to 50Kbps...

  • wget says:

    0% [ ] 4,142,336    490K/s

  • tc -s class show dev wlan0 says:

    root@bt:~/Desktop/tk_net# tc -s class show dev wlan0
class htb 1:5 parent 1:1 leaf 5: prio 0 rate 400000bit ceil 400000bit burst 128b cburst 128b 
 Sent 7234 bytes 113 pkt (dropped 0, overlimits 0 requeues 0) 
 rate 3584bit 7pps backlog 0b 0p requeues 0 
 lended: 113 borrowed: 0 giants: 0
 tokens: 17500 ctokens: 17500

class htb 1:1 root rate 8000Mbit ceil 8000Mbit burst 0b cburst 0b 
 Sent 7234 bytes 113 pkt (dropped 0, overlimits 0 requeues 0) 
 rate 3584bit 7pps backlog 0b 0p requeues 0 
 lended: 0 borrowed: 0 giants: 0
 tokens: 15 ctokens: 15

  • Changing:

    classid 1:5 htb rate 50Kbps ceil 50Kbps

    to

    classid 1:5 htb rate 1Kbps ceil 1Kbps

    generates ~ 34.7K/s in wget

  • and tc says:

    root@bt:~/Desktop/tk_net# tc -s class show dev wlan0
class htb 1:5 parent 1:1 leaf 5: prio 0 rate 8000bit ceil 8000bit burst 127b cburst 127b 
 Sent 44799 bytes 644 pkt (dropped 112, overlimits 0 requeues 0) 
 rate 2544bit 4pps backlog 0b 0p requeues 0 
 lended: 641 borrowed: 0 giants: 0
 tokens: 1124984 ctokens: 1124984

class htb 1:1 root rate 8000Mbit ceil 8000Mbit burst 0b cburst 0b 
 Sent 44601 bytes 641 pkt (dropped 0, overlimits 0 requeues 0) 
 rate 4208bit 7pps backlog 0b 0p requeues 0 
 lended: 0 borrowed: 0 giants: 0
 tokens: 15 ctokens: 15

I followed these instructions:

What am I doing wrong trying to limit in/outbound :80 traffic?

Mat
  • 51,578
  • 10
  • 158
  • 140
Torxed
  • 3,567
  • 7
  • 27
  • 44

1 Answers1

8

You cannot use shaping to limit incoming traffic rates. For that, you need to use policing and it may have limited effectiveness.

Shaping controls the rate at which packets are sent out a network interface. The rules you have set up control network egress.

Packets arrive at whatever rate the other end is sending them. Policing can help by limiting the rate that packets are fed into the input queue by dropping packets that exceed this given rate. TCP should then adjust its sending rate. Protocols without congestion control (UDP and protocols build on it) will not slow down when packets are dropped, so policing will have no effect on the rate of the sender.

Policing with Linux traffic shaping is done with an ingress filter. Start with http://lartc.org/howto/lartc.adv-qdisc.ingress.html .

camh
  • 38,261
  • 8
  • 74
  • 62
  • Your "start with" link is the first reference i put in my post, been reading it and so far there's not much about ingress anywhere except for the first part. Followed this to the bones: [Rate limit ICMP](http://lartc.org/howto/lartc.cookbook.synflood-protect.html) which didn't work. Modified it for port 80 by replacing --syn with --dport & --sport 80. – Torxed Dec 19 '12 at 10:51
  • Can this be affected by me using a wireless controller? wlan0? I've noticed that they have different base policies all together? – Torxed Dec 19 '12 at 10:54
  • [This](http://serverfault.com/questions/350023/tc-ingress-policing-and-ifb-mirroring) appears to be working tho, but i can't for the love of god figure out why that works and why the examples you linked and i linked didn't work. And using the virtual ingress interface causes another problem, i have to route everything from that interface to wlan0 again, otherwise they appear to be suck. – Torxed Dec 19 '12 at 11:15
  • 1
    @Torxed: I'm not surprised older policing docs do not work. It's been a while since I looked, but I seem to recall you needed to use an intermediate queueing device (IMQ), which all changed around a few years ago (I think the ifb stuff you linked to is the new stuff). BTW I did not know how much of LARTC you had read so I linked to the page on ingress filtering directly. You did not link to this page so I did not know whether you had read it. – camh Dec 19 '12 at 12:15
  • Gotcha! Well i'll have to figure out how the IMQ works then and most importantly how to clear _ALL_ my rules I've setup because i'm starting to notice ghost lag from time to time, random chokes on port 80 which annoys the hell out of me :) (My own fault since i didn't bother to flush properly from the start and reboot doesn't do it) – Torxed Dec 19 '12 at 12:38