Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

In my quest to find a way to limit outgoing bandwidth for a running instance of bitcoind, I came across this guide that explains how to rate limit traffic to a particular destination IP:

tc qdisc add dev $DEV root handle 1: cbq avpkt 1000 bandwidth 10mbit 
tc class add dev $DEV parent 1: classid 1:1 cbq rate 512kbit allot 1500 prio 5 bounded isolated 
tc filter add dev $DEV parent 1: protocol ip prio 16 u32 match ip dst 195.96.96.97 flowid 1:1

I'm not trying to limit traffic to a certain destination IP, though, but to and from a specific port, so I found this guide which tells me how to match traffic by source and destination port:

tc filter add dev eth0 protocol ip parent 10: prio 1 u32 match ip dport 22 0xffff flowid 10:1
tc filter add dev eth0 protocol ip parent 10: prio 1 u32 match ip sport 80 0xffff flowid 10:1

The combination of the first script with the port matching of the second script leads me to the following set of commands that should limit outgoing traffic to port 21 to 160 kbit/s. I'm testing the setup using FTP first, because limiting bitcoind, which uses port 8333, isn't optimal for testing since I can't decide when traffic is sent.

tc qdisc add dev eth0 root handle 1: cbq avpkt 1000 bandwidth 800kbit 
tc class add dev eth0 parent 1: classid 1:1 cbq rate 160kbit allot 1500 prio 5 bounded isolated
tc filter add dev eth0 parent 1: protocol ip prio 16 u32 match ip dport 21 0xffff flowid 1:1

As far as I can see, this should limit outgoing traffic to port 21 on the eth0 interface with an outgoing bandwidth of 800kbit/s to 160kbit/s, but it's not working:

NetHogs version 0.8.0

  PID USER     PROGRAM                      DEV        SENT      RECEIVED       
23653 rune     filezilla                    eth0     102.609       2.978 KB/sec

The FTP connection consists of two connections to port 21:

$ netstat -n|grep "21 "
tcp        0      0 192.168.1.33:59967      194.192.207.26:21       ESTABLISHED
tcp        0      0 192.168.1.33:59974      194.192.207.26:21       ESTABLISHED

What am I doing wrong?

I'm running Ubuntu Raring, in case that's relevant.

share|improve this question
    
Is there any reason why you take CBQ and not HTB? –  Hauke Laging May 30 '13 at 20:47
    
Is there any reason why you take HTB and not HFSC? ;) Also FTP is a weird protocol which may not be using the ports you expect it to. Filtering may be easier if you mark packets using iptables first. –  frostschutz May 30 '13 at 21:17
    
@HaukeLaging No there isn't. I just followed the example from the URL. –  runeks Jun 1 '13 at 13:40
    
@frostschutz As you can see from the netstat output, the destination port is 21. Unless I can't count on that information? –  runeks Jun 1 '13 at 13:41
    
If netstat says there's a connection for port 21, then there's a connection for port 21, however that doesn't mean it's the only connection. FTP has control and data connections, passive and active mode, depending on the situation it may be using random ports on both ends. –  frostschutz Jun 1 '13 at 18:55

1 Answer 1

You need ad least two classes: One limited and one "unlimited". So that you can filter one kind of traffic to the limited class and keep the rest out of that. If you have only one class then all traffic is limited.

share|improve this answer
    
Since you mentioned HTB, the usual recommendation there was (if I remember correctly) that the sum of the child class rates should equal the parent class rate. Which made sense to me at the time I dabbled with the mystery that is QoS in Linux... –  frostschutz May 30 '13 at 21:21
    
@frostschutz That is important if you shape outgoing traffic for maximising incoming bandwidth like with ADSL and the ACK problem. For this case I guess it doesn't matter. But for the sake of a clean solution it's OK to do that in this case, too. The root qdiscs limit is the physical interface limit then. –  Hauke Laging May 30 '13 at 21:34
    
@HaukeLaging How does this explain the fact that the FTP traffic isn't limited at all? Nothing seems limited with the above script. Also, I can't figure out how to make a non-matching filter. –  runeks Jun 1 '13 at 13:59
    
@runeks CBQ is strange; no reason to use that. Maybe limiting it turned off if there is just one class (as having just one class doesn't make sense)? AFAIK you cannot explicitely create a non-matching filter (HTB has a default class BTW). So you need two rules: The first one moves away the matching stuff, the second does the non-matching operation with all that's left. This is much easier in Netfilter, though. You should do the matching there and mark the packets. Then you just have to match for all marks in tc. –  Hauke Laging Jun 1 '13 at 14:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.