1

I have found this prior answer (https://serverfault.com/questions/461153/vlan-based-rate-limiting-using-tc), however attempting to add the vlan match to my script yields :

What is "handle"? Usage: ... basic [ match EMATCH_TREE ] [ action ACTION_SPEC ] [ classid CLASSID ]

Where: SELECTOR := SAMPLE SAMPLE ... FILTERID := X:Y:Z ACTION_SPEC := ... look at individual actions

NOTE: CLASSID is parsed as hexadecimal input.

My script is as below. It works fine with a phyisical interface, but if I replace em1 wtih vlanXXX (where XX is the VLAN number !) it fails.

The OS is openSUSE LEAP15 (4.12.14-lp150.12.16-default #1 SMP Tue Aug 14 17:51:27 UTC 2018 (28574e6) x86_64 x86_64 x86_64 GNU/Linux)

#!/bin/bash
tc qdisc add dev vlanXX root handle 1:0 htb default 10
tc class add dev vlanXX parent 1:0 classid 1:10 htb rate 1000mbit ceil 1000mbit prio 0
tc class add dev vlanXX parent 1:0 classid 1:20 htb rate  15mbit ceil 16mbit prio 0
iptables -A OUTPUT -t mangle -p tcp --dport 80 -j MARK --set-mark 20
iptables -A OUTPUT -t mangle -p tcp --dport 443 -j MARK --set-mark 20
tc filter add dev vlanXX parent 1:0 prio 0 protocol ip handle 20 fw flowid 1:20

This is the filter VLAN match I have been trying based on the other answer:

tc filter add dev em1 parent 1:0 prio 0 protocol ip basic match "meta(vlan mask 0xfff eq 0x07D1)" handle 20 fw flowid 1:20

***UPDATE:

I have found this syntax installs ok:

 tc filter add dev em1 parent 1:0 prio 0 protocol ip handle 20 basic match "meta(vlan mask 0xfff eq 0xB2)" flowid 1:20

sudo tc filter show dev em1 filter parent 1: protocol ip pref 49152

basic filter parent 1: protocol ip pref 49152 basic handle 0x14

flowid 1:20 meta(vlan mask 0x00000fff eq 178)

But I can't figure out how to get the fw syntax to work (so that I can use iptables to set which ports the rate limit applies to instead of rate limiting the entire interface)

e.g. this does not work:

 sudo tc filter add dev em1 parent 1:0 prio 0 protocol ip handle 20 fw basic match "meta(vlan mask 0xfff eq 0xB2)" flowid 1:20

basic match "meta(vlan mask 0xfff eq 0xB2)" flowid 1:20

What is "basic"? Usage: ... fw [ classid CLASSID ] [ indev DEV ] [ action ACTION_SPEC ] CLASSID := Push matching packets to the class identified by CLASSID with format X:Y CLASSID is parsed as hexadecimal input. DEV := specify device for incoming device classification. ACTION_SPEC := Apply an action on matching packets. NOTE: handle is represented as HANDLE[/FWMASK]. FWMASK is 0xffffffff by default.

0

The order of parameters is important. From the man page:

tc [ OPTIONS ] filter [ add | change | replace | delete | get ] dev DEV
   [ parent qdisc-id | root ] [ handle filter-id ] protocol protocol prio priority 
   filtertype [ filtertype specific parameters ] flowid flow-id

According to this, the handle specification should be before protocol.

Although the tc command itself shows it the other way around:

$ tc filter help
Usage: tc filter [ add | del | change | replace | show ] [ dev STRING ]
[...]
   [ pref PRIO ] protocol PROTO [ chain CHAIN_INDEX ]
   [ estimator INTERVAL TIME_CONSTANT ]
   [ root | ingress | egress | parent CLASSID ]
   [ handle FILTERID ] [ [ FILTER_TYPE ] [ help | OPTIONS ] ]
     ^^^

But it's still before FILTER_TYPE which is the actual filter criteria.

In your command:

tc filter add dev em1 parent 1:0 prio 0 protocol ip
   basic match "meta(vlan mask 0xfff eq 0x07D1)"
   handle 20 fw flowid 1:20

... the handle is after the filter (basic match ...) and thus, it's not recognized anymore. Of course there could be a filter with its own handle parameter, but I think it's not the case here.

Please note I haven't checked whether this filter makes any sense otherwise, but the "what is handle?" parse error should be caused by the parameter order alone. I also didn't get this error for the other commands you showed.

  • ignore this comment... I'll update the original question, its neater ! – Little Code Sep 26 '18 at 17:22
  • "Error talking to the kernel" usually means tc and kernel disagree what should be supported. This can be a bug in tc, but usually down to old kernel version or missing drivers/modules. – frostschutz Sep 26 '18 at 17:59
  • I have updated my update. Any ideas most welcome ! – Little Code Sep 27 '18 at 8:50
  • 1
    @LittleCode I haven't used tc in a long while and it shows... ;) I guess you can't mix tc filters. I guess you have to pick one that does the thing you want, or use more subclasses with a new filter chain for each class. If you could find a way to only mark vlan packets with iptables, you'd just need check the mark alone in tc (assuming the mark isn't lost). Sorry for confusion – frostschutz Sep 27 '18 at 9:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.