It looks like adding ECN to the other qdiscs would be good, and transparent to the upper layers, but a 10 minute glance at HTB seems to make it a non-trivial exercise. But that's me. I would certainly like to see ECN asserted more often than it is. Thoughts?<br>
<br>On the diffserv front, I'd meant to link to this RFC:<br><br><a href="http://tools.ietf.org/html/rfc4594">http://tools.ietf.org/html/rfc4594</a><br><br>in the first message on this thread.<br><br>... While laboring to classify hundreds of packet types into various buckets using conventional iptables rules (code in progress in my Cruft repo on github)<br>
<br>I came up with an interesting (and possibly bogus) idea for combining QoS and firewalling that seems both simple and low overhead (thus suspect)<br><br>There are only 64k ports in the world. To do diffserv, you need 6 bits. With a lookup table of 48k, instead of laborously matching packets with dozens of rules like this:<br>
<br>$iptables -t mangle -A Wireless -p tcp -m tcp -m multiport --ports $P2PPORTS -j DSCP --set-dscp-class CS4 -m comment --comment 'P2P'<br><br>Instead, you could have a table that had a 1to1 correspondence table between ports and DSCP values,<br>
and load that into the kernel at run time (generated perhaps from iana's list + some other collection, modified for decent diffserv classes by various providers (similar to how adblock plus provides varying lists)<br>
<br>That would result in a 48k table lookup, and would mostly stay 'hot' in that you would typically match against the lower of the port numbers. <br><br>The *crazy* part of the idea was that you basically need 2 bits to determine if you want to allow a packet of a given type or not.<br>
<br>00 = allow<br>01 = block incoming<br>10 = block outgoing<br>11 = block both<br><br>So a massive set of iptables and classification rules could be replaced by a table lookup, and the tables developed and distributed via means similar to how we do dnsrbls today, or adblock plus.<br>
<br>There are pesky problems like coping with ephemeral ports, etc, and cache misses, but I would hope that two table lookups would outperform two dozen iptables rules.<br><br>And provide a means for comprehensive classification that has not been done to date.<br>
<br><div class="gmail_quote">On Wed, Jun 8, 2011 at 7:32 AM, Dave Taht <span dir="ltr"><<a href="mailto:dave.taht@gmail.com">dave.taht@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<br><br><div class="gmail_quote"><div class="im">On Wed, Jun 8, 2011 at 6:56 AM, Eric Dumazet <span dir="ltr"><<a href="mailto:eric.dumazet@gmail.com" target="_blank">eric.dumazet@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
Le mercredi 08 juin 2011 à 06:12 -0600, Dave Taht a écrit :<br>
<div><br>
> SFQ is the second most commonly used qdisc, but doesn't balance in<br>
> ways ESFQ could.<br>
><br>
> ESFQ really looked like a winner and I'm sorry it never made the<br>
> mainline kernel.<br>
<br>
</div>Hmm, since 2007 SFQ has all ESFQ provided, if you use a flow classifier,<br>
you can exactly match your needs.<br>
<br>
[ SFQ uses an internal flow classifer on<br>
src,dst,proto,proto-src,proto-dst ]<br>
<br>
Say you want to make something only about dst addresses :<br>
<br>
tc filter add ... flow hash \<br>
keys dst divisor 1024<br>
<br>
With recent SFQ, you can play with a divisor in [256 .. 65536]<br>
<br>
<br></blockquote></div><div><br>Didn't know that!! VERY COOL. How history changes. <br> <br></div><div class="im"><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
Refs :<br>
<br>
<a href="http://lwn.net/Articles/236200/" target="_blank">http://lwn.net/Articles/236200/</a><br>
<br>
<a href="http://www.nuclearcat.com/mediawiki/index.php/Linux_iproute2" target="_blank">http://www.nuclearcat.com/mediawiki/index.php/Linux_iproute2</a><br>
<br>
<br>
<br>
</blockquote></div></div><br><br clear="all"><div><div></div><div class="h5"><br>-- <br>Dave Täht<br>SKYPE: davetaht<br>US Tel: <a href="tel:1-239-829-5608" value="+12398295608" target="_blank">1-239-829-5608</a><br><a href="http://the-edge.blogspot.com" target="_blank">http://the-edge.blogspot.com</a> <br>
</div></div></blockquote></div><br><br clear="all"><br>-- <br>Dave Täht<br>SKYPE: davetaht<br>US Tel: 1-239-829-5608<br><a href="http://the-edge.blogspot.com" target="_blank">http://the-edge.blogspot.com</a> <br>