netdev - Re: [iproute PATCH 06/12] man: Add a man page for the police action

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <56DD72A5.9030309@mojatatu.com>
Date:	Mon, 7 Mar 2016 07:23:01 -0500
From:	Jamal Hadi Salim <jhs@...atatu.com>
To:	Phil Sutter <phil@....cc>, netdev@...r.kernel.org
Subject: Re: [iproute PATCH 06/12] man: Add a man page for the police action

On 16-03-04 07:11 AM, Phil Sutter wrote:
> Cc: Alexey Kuznetsov <kuznet@....inr.ac.ru>
> Signed-off-by: Phil Sutter <phil@....cc>
> ---
>   man/man8/tc-police.8 | 127 +++++++++++++++++++++++++++++++++++++++++++++++++++
>   1 file changed, 127 insertions(+)
>   create mode 100644 man/man8/tc-police.8
>
> diff --git a/man/man8/tc-police.8 b/man/man8/tc-police.8
> new file mode 100644
> index 0000000000000..2b1537ec52875
> --- /dev/null
> +++ b/man/man8/tc-police.8
> @@ -0,0 +1,127 @@

There are two approaches to measuring the rate and therefore
two algorithms. One uses the dual token bucket and is mostly
what you describe. The other uses a sampling technique;
you sort of glossed over that. They probably should have
been separate actions (I would have called this one
ewmapolice).

Here's an example:
----
REMOTEIP="10.0.0.13" # IP address of remote host
TC="sudo /sbin/tc"
# policer to allow average rate of 1Mbit bandwith estimated by $EST
AVRATE="avrate 10kbit"
EST="estimator 1sec 2sec" # sample 1 sec, average every 2 secs

$TC qdisc add dev $ETH ingress


$TC filter add dev $ETH parent ffff: pref 11 \
$EST protocol ip u32 match ip src $REMOTEIP flowid 1:1 \
action police $AVRATE conform-exceed drop/pipe
----

Essentially this says to use a sampling frequency of 1sec with
a smoothing frequency of 2secs and an average rate of 1Mbps.

cheers,
jamal