Ingress qdisc
All qdiscs discussed so far are egress qdiscs. Each interface however can also have an ingress qdisc which is not used to send packets out to the network adaptor. Instead, it allows you to apply tc filters to packets coming in over the interface, regardless of whether they have a local destination or are to be forwarded.
As the tc filters contain a full Token Bucket Filter implementation, and are also able to match on the kernel flow estimator, there is a lot of functionality available. This effectively allows you to police incoming traffic, before it even enters the IP stack.
14.4.1. Parameters & usage
The ingress qdisc itself does not require any parameters. It differs from other qdiscs in that it does not occupy the root of a device. Attach it like this:
# delete original
tc qdisc del dev eth0 ingress
tc qdisc del dev eth0 root
tc qdisc add dev eth0 ingress
tc filter add dev eth0 parent ffff: protocol ip prio 50 u32 match ip src 0.0.0.0/0 police rate 2048kbps burst 1m drop flowid :1
tc qdisc add dev eth0 root tbf rate 2048kbps latency 50ms burst 1m
talking about it and came up with a few notes and a few questions.
: The ingress qdisc itself has no parameters. The only thing you can do
: is using the policers. I have a link with a patch to extend this :
: http://www.cyberus.ca/~hadi/patches/action/ Maybe this can help.
:
: I have some more info about ingress in my mail files, but I have to
: sort it out and put it somewhere on docum.org. But I still didn't
: found the the time to do so.
Regarding policers and the ingress qdisc. I have never used them before
today, but have the following understanding.
About the ingress qdisc:
- ingress qdisc (known as "ffff:") can't have any children classes (hence the existence of IMQ)
- the only thing you can do with the ingress qdisc is attach filters
About filtering on the ingress qdisc:
- since there are no classes to which to direct the packets, the only reasonable option (reasonable, indeed!) is to drop the packets
- with clever use of filtering, you can limit particular traffic signatures to particular uses of your bandwidth
Here's an example of using an ingress policer to limit inbound traffic
from a particular set of IPs on a per IP basis. In this case, traffic
from each of these source IPs is limited to a T1's worth of bandwidth.
Note that this means that this host can receive up to 1536kbit (768kbit +
768kbit) worth of bandwidth from these two source IPs alone.
# -- start of script
#! /bin/ash
#
# -- simulate a much smaller amount of bandwidth than the 100MBit interface
#
RATE=1536kbit
DEV=eth0
SOURCES="10.168.53.2/32 10.168.73.10/32 10.168.28.20/32"
# -- attach our ingress qdisc
#
tc qdisc add dev $DEV ingress
# -- cap bandwidth from particular source IPs
#
for SOURCE in $SOURCES ; do
tc filter add dev $DEV parent ffff: protocol ip \
u32 match ip src $SOURCE flowid :1 \
police rate $RATE mtu 12k burst 10k drop
done
# -- end of script
Now, if you are using multiple public IPs on your masquerading/SNAT host,
you can use "u32 match ip dst $PER_IP" with a drop action to force a
particular rate on inbound traffic to that IP.
My entirely unquantified impression is that latency suffers as a result,
but traffic is indeed bandwidth limited.
Just a few notes of dissection:
tc filter add dev $DEV # -- the usual beginnings
parent ffff: # -- the ingress qdisc itself
protocol ip # -- more preamble | make sure to visit
u32 match ip # -- u32 classifier | http://lartc.org/howto/
src $SOURCE # -- could also be "dst $SOME_LOCAL_IP"
flowid :1 # -- ??? (but it doesn't work without this)
police rate $RATE # -- put a policer here
mtu 12k burst 10k # -- ???
drop # -- drop packets exceeding our police params
Maybe a guru or two out there (Stef?, Bert?, Jamal?, Werner?) can explain
why mtu needs to be larger than 1k (didn't work for me anyway) and also
how these other parameters should be used.
Ingress qdisc的更多相关文章
- 使用ingress qdisc和ifb进行qos
ifb The Intermediate Functional Block device is the successor to the IMQ iptables module that was ...
- 使用tc ingress来限速接收方向
Linux中的QoS分为入口(Ingress)部分和出口(Egress)部分,入口部分主要用于进行入口流量限速(policing),出口部分主要用于队列调度(queuing scheduling).大 ...
- Linux内核中流量控制
linux内核中提供了流量控制的相关处理功能,相关代码在net/sched目录下:而应用层上的控制是通过iproute2软件包中的tc来实现, tc和sched的关系就好象iptables和netfi ...
- 全面介绍eBPF-概念
全面介绍eBPF-概念 前面介绍了BCC可观测性和BCC网络,但对底层使用的eBPF的介绍相对较少,且官方欠缺对网络方面的介绍.下面对eBPF进行全面介绍. 目录 全面介绍eBPF-概念 BPF概述 ...
- 流量控制--3.Linux流量控制的组件
Linux流量控制的组件 流量控制元素与Linux组件之间的相关性: traditional element Linux component 入队列 修订:从用户或网络接收报文 整流 class 提供 ...
- Linux TC 流量控制介绍
前段时间在做一些测试的时候接触到了Linux tc,因为需要对数据包添加延迟,用到了tc中的netem.添加简单的延迟非常简单,像这样一条命令就搞定了:$ tc qdisc add dev eth0 ...
- Ping Pod不通问题定位及Ingress验证
Ping Pod网络问题不通定位记录 1.验证墙是否通 flannel默认使用8285端口作为UDP封装报文的端口,VxLan使用8472端口,下面命令验证一下确定其在8472端口 ip -d lin ...
- Linux TC的ifb原理以及ingress流控-转
原文:http://www.xuebuyuan.com/2961303.html 首先贴上Linux内核的ifb.c的文件头注释: The purpose of this driver is ...
- 链路层输出 -qdisc
二层发送中,实现qdisc的主要函数是__dev_xmit_skb和net_tx_action,本篇将分析qdisc实现的原理,仅对框架进行分析. 其框架如下图所示 qdisc初始化 pktsched ...
随机推荐
- [问题2015S03] 复旦高等代数 II(14级)每周一题(第四教学周)
[问题2015S03] 设 \(g(x)=x^n+a_1x^{n-1}+\cdots+a_{n-1}x+a_n\) 是数域 \(\mathbb{K}\) 上的多项式, \(V\) 是 \(\math ...
- [问题2014A07] 解答
[问题2014A07] 解答 我们分三步进行证明. \(1^\circ\) 先证 \(\alpha_1,\alpha_2\) 线性无关. 用反证法, 设 \(\alpha_1,\alpha_2\) ...
- Unity3D之协程(Coroutines & Yield )
在Unity中StartCoroutine/yield return这个模式到底是怎么应用的? 比如你要一个方法进行一个比较耗时的复杂运算~同时又想让脚本流畅的进行其他操作而不是卡在那里等该方法执行完 ...
- Moving From Top To Bottom in Detailed Block in Oracle Forms
Suppose you want to scan a tabular grid block (loop through all records in detail block) from top to ...
- JSON-SCHEMA
这几天在写代码,和开发那边规范统一后,注释的JOSN需要写清楚schema, 于是学习了一下,国内的东西确实很少,看官网的英文文档也很蛋疼. 就把自己和看到的总结一下: http://json-sch ...
- 关于F12的有效利用
1.之前仅用F12查看页面的代码: 2.现在发现用F12可以查看css文件: 3.比如看到页面背景为黑色,然后在css里面把背景从黑色调成白色:
- c#中对rgb的使用
今天发现c#中没有和vb类似的函数RGB(), 后来发现可以通过Color类来实现 从R,G,B的值可以得到一个Color,如: Color c = Color.FromArgb(255,0,0); ...
- PHP 小方法之 二维数组排序
if (! function_exists ( 'multi_array_sort' )) { function multi_array_sort($arr, $keys, $type = 'desc ...
- find一些常用参数的一些常用实例和一些具体用法和注意事项。
find一些常用参数的一些常用实例和一些具体用法和注意事项. 1.使用name选项: 文件名选项是find命令最常用的选项,要么单独使用该选项,要么和其他选项一起使用. 可以使用某种文件名模式来匹配 ...
- 经典SQL语句大全以及50个常用的sql语句
经典SQL语句大全 一.基础 1.说明:创建数据库CREATE DATABASE database-name 2.说明:删除数据库drop database dbname3.说明:备份sql serv ...