I am using the Linux's traffic control (tc) utility, which to my understanding is used to configure the Linux kernel packet scheduler. I am also using the netem command in tc to add delay, drop, or corrupt traffic.

My main question is, does the netem modify transport layer datagrams, IP packets, or Link layer frames (like Ethernet)?

I found this page which explains the network communication flow in the Linux kernel. It mentions that the shaping and queuing disciplines are made in the "Layer 2: Link layer (e.g. Ethernet)". Does this mean that netem adds its corruption, loss, or delay on frames (layer 2)?

But since tc filter allows you to apply traffic rules to a certain IP:port pair, does that mean it operates on the transport layer datagrams (layer 4)?


tc affects the queuing discipline, i.e. the order in which outgoing "packets" are sent to the hardware. The implementation operates on sk_buff structs, and the documentation for sk_buff seems to imply that the packet format is whatever the particular network interfaces uses (e.g. Ethernet packets for an Ethernet interface).

So I'd assume netem corrupt adds corruption on this layer, which should be discovered through the layer-2 checksum (whatever layer 2 is for a particular interface).

In addition, sk_buff contains pointers to the higher layer payloads, which explains why tc filter can act on them.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.