1

I am happily limiting upload speed by port - but really want to limit download by process.

It seems iptables did have functionality for matching and marking packets by process in the form of --pid-owner or --cmd-owner - but both have now been removed?

$ iptables -m owner --help
...
owner match options:
[!] --uid-owner userid[-userid]      Match local UID
[!] --gid-owner groupid[-groupid]    Match local GID
[!] --socket-exists                  Match if socket exists

seems there are options to match by user or group, but not process.

I am aware of trickle, and wondershaper - but neither allow shaping of an already running process

  • one end of the connection will probably have a "random" port number, perhaps you can use that port-number for shaping. – Jasen Dec 6 '16 at 4:07
  • Related (and maybe duplicate?) – Ikaros Dec 6 '16 at 9:13
  • 1
    @Ikaros nope - the accepted answer --pid-owner or --cwd-owner has been removed from iptables, followed by trickle, which cannot limit an already rnning process – Chozabu Dec 9 '16 at 3:47
  • 1
    @Ikaros I'd seen it before writing this question, and intended to limit it - but somehow did not (will do next time) – Chozabu Dec 9 '16 at 11:57
  • 1
    I'm interested too. Did you find a solution? – rraallvv Nov 10 '18 at 21:40
3

Put the process into a net_cls cgroup, use the cgroup to set the class of the packets, and then use a classful filter in tc to rate limit packets in that class. For example:

cgcreate -g net_cls:slow
echo 0x10001 > /sys/fs/cgroup/net_cls/slow/net_cls.classid
cgclassify -g net_cls:slow <pid of the process you want to limit>
tc qdisc add dev eth0 root handle 1: htb
tc filter add dev eth0 parent 1: handle 1: cgroup
tc class add dev eth0 parent 1: classid 1:1 htb rate 1mbps

That should then mean that the process you specify (and any of its child processes) are limited to 1 megabyte per second of bandwidth - tweak the parameter to the last command to whatever bandwidth you want.

  • Hmm, this does not seem to work for me cgcreate -g net_cls:slow echo 0x10001 > /sys/fs/cgroup/net_cls/slow/net_cls.classid cgclassify -g net_cls:slow 25775 tc qdisc add dev wlp3s0 root handle 1: htb tc filter add dev wlp3s0 parent 1: handle 1: cgroup tc class add dev wlp3s0 parent 1: classid 1:1 htb rate 10kbit – Chozabu Dec 9 '16 at 3:54
  • gawd, sorry about comment formatting! I should say, not sure how this would limit download speed, there is no mention of "ingress"? – Chozabu Dec 9 '16 at 3:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.