3

I am happily limiting upload speed by port - but really want to limit download by process.

It seems iptables did have functionality for matching and marking packets by process in the form of --pid-owner or --cmd-owner - but both have now been removed?

$ iptables -m owner --help
...
owner match options:
[!] --uid-owner userid[-userid]      Match local UID
[!] --gid-owner groupid[-groupid]    Match local GID
[!] --socket-exists                  Match if socket exists

seems there are options to match by user or group, but not process.

I am aware of trickle, and wondershaper - but neither allow shaping of an already running process

10
  • one end of the connection will probably have a "random" port number, perhaps you can use that port-number for shaping.
    – Jasen
    Dec 6, 2016 at 4:07
  • Related (and maybe duplicate?)
    – Ikaros
    Dec 6, 2016 at 9:13
  • 1
    @Ikaros nope - the accepted answer --pid-owner or --cwd-owner has been removed from iptables, followed by trickle, which cannot limit an already rnning process
    – Chozabu
    Dec 9, 2016 at 3:47
  • 1
    @Ikaros I'd seen it before writing this question, and intended to limit it - but somehow did not (will do next time)
    – Chozabu
    Dec 9, 2016 at 11:57
  • 1
    I'm interested too. Did you find a solution?
    – rraallvv
    Nov 10, 2018 at 21:40

1 Answer 1

Reset to default
5

Put the process into a net_cls cgroup, use the cgroup to set the class of the packets, and then use a classful filter in tc to rate limit packets in that class. For example:

cgcreate -g net_cls:slow
echo 0x10001 > /sys/fs/cgroup/net_cls/slow/net_cls.classid
cgclassify -g net_cls:slow <pid of the process you want to limit>
tc qdisc add dev eth0 root handle 1: htb
tc filter add dev eth0 parent 1: handle 1: cgroup
tc class add dev eth0 parent 1: classid 1:1 htb rate 1mbps

That should then mean that the process you specify (and any of its child processes) are limited to 1 megabyte per second of bandwidth - tweak the parameter to the last command to whatever bandwidth you want.

2
  • Hmm, this does not seem to work for me cgcreate -g net_cls:slow echo 0x10001 > /sys/fs/cgroup/net_cls/slow/net_cls.classid cgclassify -g net_cls:slow 25775 tc qdisc add dev wlp3s0 root handle 1: htb tc filter add dev wlp3s0 parent 1: handle 1: cgroup tc class add dev wlp3s0 parent 1: classid 1:1 htb rate 10kbit
    – Chozabu
    Dec 9, 2016 at 3:54
  • gawd, sorry about comment formatting! I should say, not sure how this would limit download speed, there is no mention of "ingress"?
    – Chozabu
    Dec 9, 2016 at 3:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .