netdev - Re: iproute2 action/policer question

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4A368025.5000902@itcare.pl>
Date:	Mon, 15 Jun 2009 19:08:53 +0200
From:	Paweł Staszewski <pstaszewski@...are.pl>
To:	Jarek Poplawski <jarkao2@...il.com>
CC:	jamal <hadi@...erus.ca>,
	Linux Network Development list <netdev@...r.kernel.org>
Subject: Re: iproute2 action/policer question

Jarek Poplawski pisze:
> On Mon, Jun 15, 2009 at 06:37:06PM +0200, Jarek Poplawski wrote:
>   
>> On Mon, Jun 15, 2009 at 06:09:57PM +0200, Paweł Staszewski wrote:
>>     
>>> Jarek Poplawski pisze:
>>>       
>>>> On Mon, Jun 15, 2009 at 09:32:08AM -0400, jamal wrote:
>>>>   
>>>>         
>>>>> On Mon, 2009-06-15 at 11:19 +0000, Jarek Poplawski wrote:
>>>>>
>>>>>     
>>>>>           
>>>>>>> This is only a sample but is not working
>>>>>>>         
>>>>>>>               
>>>>> It does seem to be working!
>>>>> How did you reach conclusion it wasnt working?
>>>>>
>>>>>     
>>>>>           
>>>>>>>         Action statistics:
>>>>>>>         Sent 42351 bytes 110 pkt (dropped 0, overlimits 32 requeues 0)
>>>>>>>         rate 0bit 0pps backlog 0b 0p requeues 0
>>>>>>>         
>>>>>>>               
>>>>> 32 packets hit the policer - double check your parameters please to make
>>>>> sure they are correct.
>>>>>     
>>>>>           
>>>>   
>>>>         
>>> Yes. packets hits policer but second action dont drop packets.
>>>       
>> I guess Jamal meant 'hit the policer' == 'dropped' (and 110 - 32
>> passed). So the question is how did you checked it's otherwise.
>>     
>
> Hmm... Not that we don't believe you, but some other (tc -s qdisc ?)
> stats with this would be appreciated before checking the code.;-)
>
>   

hmm...
Test that i make


ping -I 94.246.128.23 194.6.246.23 -s 900
PING 194.6.246.23 (194.6.246.23) from 94.246.128.23 : 900(928) bytes of 
data.
908 bytes from 194.6.246.23: icmp_seq=1 ttl=63 time=0.595 ms
908 bytes from 194.6.246.23: icmp_seq=8 ttl=63 time=0.451 ms
^C
--- 194.6.246.23 ping statistics ---
9 packets transmitted, 2 received, 77% packet loss, time 8046ms


tc -s -d filter show dev eth0
filter parent 1: protocol ip pref 2 u32
filter parent 1: protocol ip pref 2 u32 fh 800: ht divisor 1
filter parent 1: protocol ip pref 2 u32 fh 800::800 order 2048 key ht 
800 bkt 0 flowid 1:2  (rule hit 145 success 134)
  match 5ef6801c/ffffffff at 12 (success 134 )
filter parent 1: protocol ip pref 10 u32
filter parent 1: protocol ip pref 10 u32 fh 801: ht divisor 1
filter parent 1: protocol ip pref 10 u32 fh 801::800 order 2048 key ht 
801 bkt 0 flowid 1:3  (rule hit 11 success 11)
  match 00000000/00000000 at 12 (success 11 )
        action order 1: tablename: mangle  hook: NF_IP_POST_ROUTING
        target MARK xset 0x1/0xffffffff
        index 20 ref 1 bind 1 installed 15 sec used 3 sec
        Action statistics:
        Sent 10762 bytes 11 pkt (dropped 0, overlimits 0 requeues 0)
        rate 0bit 0pps backlog 0b 0p requeues 0

        action order 2:  police 0xf rate 1000bit burst 1023b mtu 2Kb 
action drop overhead 0b
ref 1 bind 1
        Action statistics:
        Sent 10762 bytes 11 pkt (dropped 0, overlimits 9 requeues 0)
        rate 0bit 0pps backlog 0b 0p requeues 0

tc -s -d qdisc show dev eth0
qdisc hfsc 1: root default 10
 Sent 32180 bytes 288 pkt (dropped 13, overlimits 77 requeues 0)
 rate 0bit 0pps backlog 0b 0p requeues 0
qdisc sfq 2: parent 1:2 limit 127p quantum 1514b flows 127/1024
 Sent 30296 bytes 286 pkt (dropped 0, overlimits 0 requeues 0)
 rate 0bit 0pps backlog 0b 0p requeues 0
qdisc sfq 3: parent 1:3 limit 127p quantum 1514b flows 127/1024
 Sent 1884 bytes 2 pkt (dropped 0, overlimits 0 requeues 0)
 rate 0bit 0pps backlog 0b 0p requeues 0

in stats i see overlimits / no drops

but packets are dropped :) yes sorry for this that i write before - that 
there is no drops


But what with ipt -j MARK ?
Where i can catch this mark ?
Or i can't catch packet like this, but then for what will be this ipt 
action ?


Because if i understand correct this action works like iptables -j MARK 
in POSTROUTING mangle ?


> Jarek P.
> --
> To unsubscribe from this list: send the line "unsubscribe netdev" in
> the body of a message to majordomo@...r.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>
>
>   

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html