* tc ingress filters not applied
@ 2015-03-30 14:15 Erik Hugne
2015-03-30 17:00 ` Cong Wang
2015-07-06 17:24 ` Huan Le
0 siblings, 2 replies; 5+ messages in thread
From: Erik Hugne @ 2015-03-30 14:15 UTC (permalink / raw)
To: netdev
I'm having troubles with TC policing, the ingress filters does not seem to be
applied.
node1 ~ # tc qdisc add dev eth0 ingress
node1 ~ # tc qdisc ls
qdisc pfifo_fast 0: dev eth0 root refcnt 2 bands 3 priomap 1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
qdisc ingress ffff: dev eth0 parent ffff:fff1 ----------------
//Test 1: Limit TIPC low importance traffic to 100mbit
node1 ~ # tc filter add dev eth0 parent ffff: protocol tipc u32 match u8 0 1E at
0 police rate 100mbit buffer 10k drop flowid :1
node1 ~ # tc filter show dev eth0
node1 ~ #
//Test 2: Limit ICMP to 20kbit
node1 ~ # tc filter add dev eth0 parent ffff: protocol ip prio 20 u32 match ip p
rotocol 1 0xff police rate 20kbit buffer 10k drop flowid :2
node1 ~ # tc filter show dev eth0
node1 ~ #
There are no errors in dmesg, just silence.
Are my filter rules wrong, or is ingress filtering broken?
Kernel: net-next/latest
iproute2: shemminger/master
//E
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: tc ingress filters not applied
2015-03-30 14:15 tc ingress filters not applied Erik Hugne
@ 2015-03-30 17:00 ` Cong Wang
2015-03-31 6:32 ` Erik Hugne
2015-07-06 17:24 ` Huan Le
1 sibling, 1 reply; 5+ messages in thread
From: Cong Wang @ 2015-03-30 17:00 UTC (permalink / raw)
To: Erik Hugne; +Cc: netdev
On Mon, Mar 30, 2015 at 7:15 AM, Erik Hugne <erik.hugne@ericsson.com> wrote:
> I'm having troubles with TC policing, the ingress filters does not seem to be
> applied.
>
> node1 ~ # tc qdisc add dev eth0 ingress
> node1 ~ # tc qdisc ls
> qdisc pfifo_fast 0: dev eth0 root refcnt 2 bands 3 priomap 1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
> qdisc ingress ffff: dev eth0 parent ffff:fff1 ----------------
> //Test 1: Limit TIPC low importance traffic to 100mbit
> node1 ~ # tc filter add dev eth0 parent ffff: protocol tipc u32 match u8 0 1E at
> 0 police rate 100mbit buffer 10k drop flowid :1
> node1 ~ # tc filter show dev eth0
> node1 ~ #
>
> //Test 2: Limit ICMP to 20kbit
> node1 ~ # tc filter add dev eth0 parent ffff: protocol ip prio 20 u32 match ip p
> rotocol 1 0xff police rate 20kbit buffer 10k drop flowid :2
> node1 ~ # tc filter show dev eth0
tc filter show dev eth0 parent ffff:
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: tc ingress filters not applied
2015-03-30 17:00 ` Cong Wang
@ 2015-03-31 6:32 ` Erik Hugne
0 siblings, 0 replies; 5+ messages in thread
From: Erik Hugne @ 2015-03-31 6:32 UTC (permalink / raw)
To: Cong Wang; +Cc: netdev
On Mon, Mar 30, 2015 at 10:00:58AM -0700, Cong Wang wrote:
> tc filter show dev eth0 parent ffff:
Of course, thanks Cong.
//E
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: tc ingress filters not applied
2015-03-30 14:15 tc ingress filters not applied Erik Hugne
2015-03-30 17:00 ` Cong Wang
@ 2015-07-06 17:24 ` Huan Le
2015-07-06 17:43 ` Daniel Borkmann
1 sibling, 1 reply; 5+ messages in thread
From: Huan Le @ 2015-07-06 17:24 UTC (permalink / raw)
To: netdev
Erik Hugne <erik.hugne <at> ericsson.com> writes:
>
> I'm having troubles with TC policing, the ingress filters does not seem to be
> applied.
>
>
> Kernel: net-next/latest
> iproute2: shemminger/master
>
> //E
>
I observed similar behavior when configuring a filter on ingress qdisc.
Test shows that traffic was rate-limited to the configured value.
However, "tc filter show" does not show any filtering rule.
(1) add ingress qdisc on eth1
# tc qdisc add dev eth1 ingress
# tc qdisc show dev eth1 ingress
qdisc pfifo_fast 0: root refcnt 2 bands 3 priomap \
1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
qdisc ingress ffff: parent ffff:fff1 ----------------
(2) add filter under ingress qdisc
# tc filter add dev eth1 parent ffff: protocol all \
u32 match ip src 0.0.0.0/0 \
police rate 256kbit burst 10k drop flowid :1
# tc filter show dev eth1
(3) verified sch_ingress kernel module is installed
# lsmod | grep sch_ingress
sch_ingress 12866 1
(4) uname -a (if needed for debugging)
Linux huan-lnx 3.16.0-30-generic #40~14.04.1-Ubuntu SMP
Thu Jan 15 17:43:14 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
I am testing this using ubuntu 14.04 on a virtualbox VM
(eth1 is a host-only adapter).
Thanks,
Huan
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: tc ingress filters not applied
2015-07-06 17:24 ` Huan Le
@ 2015-07-06 17:43 ` Daniel Borkmann
0 siblings, 0 replies; 5+ messages in thread
From: Daniel Borkmann @ 2015-07-06 17:43 UTC (permalink / raw)
To: Huan Le; +Cc: netdev
On 07/06/2015 07:24 PM, Huan Le wrote:
> Erik Hugne <erik.hugne <at> ericsson.com> writes:
>
>>
>> I'm having troubles with TC policing, the ingress filters does not seem to be
>> applied.
>>
>>
>> Kernel: net-next/latest
>> iproute2: shemminger/master
>>
>> //E
>>
>
> I observed similar behavior when configuring a filter on ingress qdisc.
> Test shows that traffic was rate-limited to the configured value.
> However, "tc filter show" does not show any filtering rule.
>
> (1) add ingress qdisc on eth1
> # tc qdisc add dev eth1 ingress
> # tc qdisc show dev eth1 ingress
> qdisc pfifo_fast 0: root refcnt 2 bands 3 priomap \
> 1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
> qdisc ingress ffff: parent ffff:fff1 ----------------
>
> (2) add filter under ingress qdisc
> # tc filter add dev eth1 parent ffff: protocol all \
> u32 match ip src 0.0.0.0/0 \
> police rate 256kbit burst 10k drop flowid :1
> # tc filter show dev eth1
You have to add the handle/parent here, otherwise this shows egress filters.
> (3) verified sch_ingress kernel module is installed
> # lsmod | grep sch_ingress
> sch_ingress 12866 1
>
> (4) uname -a (if needed for debugging)
> Linux huan-lnx 3.16.0-30-generic #40~14.04.1-Ubuntu SMP
> Thu Jan 15 17:43:14 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
>
> I am testing this using ubuntu 14.04 on a virtualbox VM
> (eth1 is a host-only adapter).
>
> Thanks,
> Huan
>
> --
> To unsubscribe from this list: send the line "unsubscribe netdev" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2015-07-06 17:43 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-03-30 14:15 tc ingress filters not applied Erik Hugne
2015-03-30 17:00 ` Cong Wang
2015-03-31 6:32 ` Erik Hugne
2015-07-06 17:24 ` Huan Le
2015-07-06 17:43 ` Daniel Borkmann
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.