0

In my small, private, network I have a device (IP address 192.168.0.240) which I want to have a "guaranteed" section of the pipe. To that end, I've been following this Server Fault article to shape the egress on a my interface. I've done, on interface ifb0, the same things I've done on eth1 as discussed in this article. The egress traffic on eth1 is working as expected (tc -s class show dev eth1 verifies this). However, when I look at the stats on the class for ifb0, there are no bytes or packets moving through it.

# tc -s class show dev ifb0
class htb 1:1 root rate 950000Kbit ceil 950000Kbit burst 120293b cburst 120293b 
 Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0) 
 rate 0bit 0pps backlog 0b 0p requeues 0 
 lended: 0 borrowed: 0 giants: 0
 tokens: 1013 ctokens: 1013

class htb 1:10 parent 1:1 prio 1 rate 10000Kbit ceil 25000Kbit burst 2850b cburst 4725b 
 Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0) 
 rate 0bit 0pps backlog 0b 0p requeues 0 
 lended: 0 borrowed: 0 giants: 0
 tokens: 2280 ctokens: 1512

class htb 1:20 parent 1:1 leaf 8003: prio 2 rate 900000Kbit ceil 950000Kbit burst 114075b cburst 120293b 
 Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0) 
 rate 0bit 0pps backlog 0b 0p requeues 0 
 lended: 0 borrowed: 0 giants: 0
 tokens: 1014 ctokens: 1013

The rules are set thusly:

echo Changing MTU of ingress interface to that of eth1
eth1Mtu=$(cat /sys/class/net/eth1/mtu)
echo ${eth1Mtu} > /sys/class/net/ifb0/mtu

# This little bit of redirection magic is taken from https://serverfault.com/a/386791
echo Adding ingress qdisc to the eth1 interface
tc qdisc add dev eth1 handle ffff: ingress
tc filter add dev eth1 parent ffff: protocol ip u32 match u32 0 0 action mirred egress redirect dev ifb0

echo Adding egress logic to the pseudo interface
tc qdisc add dev ifb0 root handle 1: htb default 20
tc class add dev ifb0 parent 1: classid 1:1 htb rate 950mbit
tc class add dev ifb0 parent 1:1 classid 1:10 htb rate 10mbit ceil 25mbit prio 1
tc class add dev ifb0 parent 1:1 classid 1:20 htb rate 900mbit ceil 950mbit prio 2
tc qdisc add dev ifb0 parent 1:20 sfq
tc filter add dev ifb0 parent 1: protocol ip prio 1 u32 match ip src 192.168.0.240/32 flowid 1:10

What am I doing incorrectly in this that the traffic isn't being routed through the pseudo, mirrored, interface?


EDIT

A respondent tried these rules and was showing traffic routed as I'd expected. This made me think that I should have included: this is being done on Red Hat EL 5 (CentOS 5: kernel 2.6.18-348.18.1.el5). It's terribly, terribly old I know. I cannot change the OS though.

4
  • I more or less copied your setup and it's working here (I do have packets in stats for ifb0). So you might have done (or not done) something else that's not written in your question. What about tc -s filter show dev eth1 ingress? – A.B Jan 13 '20 at 23:05
  • @A.B Thank you for looking into this. I wonder if this is is showing a bug in RHEL5 (yes, I know, woefully old but I have no control over that decision). I'm showing some sort of activity on the filters (the command you suggested). However, both tx_packets and rx_packets in /sys/.../statistics show 0. Traffic is routing because stuff within the LAN works, but why are there no stats on these classes? – Andrew Falanga Jan 14 '20 at 15:56
  • Your kernel is so old it doesn't even support network namespaces to do tests (unless it's patched by RH). Really you should check this on recent kernels. Your rules might all be fine but not supported correctly on your kernel (even with a live cd). If you get the same problem on a recent kernel, then it's worth searching more. – A.B Jan 14 '20 at 16:29
  • @A.B I should have thought of trying these rules on another system. Thank you for drawing my attention to this. Trying these on a CentOS 7.6 system, as written in the script, works as expected. So, the problem, the kernel is too old. Thanks for you help. – Andrew Falanga Jan 14 '20 at 19:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.