Hello ladies and gentlemen. I hope you might be able to help me with my very strange problem.
I have a very typical setup - a LAN masquerading behind a Linux box. This linux box has HTB going. It works surprisingly well for outbound traffic (low latency stuff is low, pings are low, everything is great) but there's some strange behavior with downloads. Let me explain. I have a bunch of streams going at a high port. Lets say their combined downstream bandwidth is 20kbyte/s. When I remove the QoS, the bandwidth shoots up considerably - to about 80kbyte/s. If I leave QoS on, but only enable _one_ stream, the downstream bandwidth is similarly increased. I do not have any sort of inbound bandwidth shaping. I've also tried to prioritize ACKs above everything else. That didn't seem to change anything. The multiple-stream downloads are slow regardless of whether the upstream bandwidth is fully utilized. The class that contains the ACKs is never being used close to capacity. I'm completely stumped. Hopefully you guys can spot something strange in the script below. The service in question runs on ports 47504-47654. Thanks in advance. ---------------------------------------------------------------- # http://lartc.org/howto/lartc.cookbook.fullnat.intro.html export CEIL=374 # initial setup tc qdisc add dev eth0 root handle 1: htb default 15 tc class add dev eth0 parent 1: classid 1:1 htb rate ${CEIL}kbit ceil ${CEIL}kbit tc class add dev eth0 parent 1:1 classid 1:10 htb rate 128kbit ceil ${CEIL}kbit prio 0 tc class add dev eth0 parent 1:1 classid 1:11 htb rate 120kbit ceil ${CEIL}kbit prio 1 tc class add dev eth0 parent 1:1 classid 1:12 htb rate 20kbit ceil ${CEIL}kbit prio 2 tc class add dev eth0 parent 1:1 classid 1:13 htb rate 20kbit ceil ${CEIL}kbit prio 2 tc class add dev eth0 parent 1:1 classid 1:14 htb rate 10kbit ceil ${CEIL}kbit prio 3 tc class add dev eth0 parent 1:1 classid 1:15 htb rate 52kbit ceil ${CEIL}kbit prio 3 tc class add dev eth0 parent 1:1 classid 1:16 htb rate 24kbit ceil ${CEIL}kbit prio 4 tc qdisc add dev eth0 parent 1:12 handle 120: sfq perturb 10 tc qdisc add dev eth0 parent 1:13 handle 130: sfq perturb 10 tc qdisc add dev eth0 parent 1:14 handle 140: sfq perturb 10 tc qdisc add dev eth0 parent 1:15 handle 150: sfq perturb 10 tc qdisc add dev eth0 parent 1:16 handle 160: sfq perturb 10 # classify packets tc filter add dev eth0 parent 1:0 protocol ip prio 1 handle 1 fw classid 1:10 tc filter add dev eth0 parent 1:0 protocol ip prio 2 handle 2 fw classid 1:11 tc filter add dev eth0 parent 1:0 protocol ip prio 3 handle 3 fw classid 1:12 tc filter add dev eth0 parent 1:0 protocol ip prio 4 handle 4 fw classid 1:13 tc filter add dev eth0 parent 1:0 protocol ip prio 5 handle 5 fw classid 1:14 tc filter add dev eth0 parent 1:0 protocol ip prio 6 handle 6 fw classid 1:15 tc filter add dev eth0 parent 1:0 protocol ip prio 7 handle 7 fw classid 1:16 # mark packets for CHAIN in PREROUTING OUTPUT; do # prioritize small ACK packets above all else iptables -t mangle -A $CHAIN -p tcp --tcp-flags ALL ACK -m state --state ESTABLISHED -m length --length :100 -j MARK --set-mark 0x1 iptables -t mangle -A $CHAIN -p tcp --tcp-flags ALL ACK -m state --state ESTABLISHED -m length --length :100 -j RETURN # prioritize small initial domain/WWW requests for faster browsing iptables -t mangle -A $CHAIN -p tcp --dport www --syn -m state --state NEW -m length --length 40:68 -j MARK --set-mark 0x1 iptables -t mangle -A $CHAIN -p tcp --dport www --syn -m state --state NEW -m length --length 40:68 -j RETURN iptables -t mangle -A $CHAIN -p tcp --dport domain --syn -m state --state NEW -m length --length 40:68 -j MARK --set-mark 0x1 iptables -t mangle -A $CHAIN -p tcp --dport domain --syn -m state --state NEW -m length --length 40:68 -j RETURN # icmp gets priority iptables -t mangle -A $CHAIN -p icmp -j MARK --set-mark 0x1 iptables -t mangle -A $CHAIN -p icmp -j RETURN # new connections packets get priority iptables -t mangle -A $CHAIN -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j MARK --set-mark 0x1 iptables -t mangle -A $CHAIN -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j RETURN # prioritize domain requests iptables -t mangle -A $CHAIN -p tcp --dport domain -j MARK --set-mark 0x2 iptables -t mangle -A $CHAIN -p tcp --dport domain -j RETURN iptables -t mangle -A $CHAIN -p udp --dport domain -j MARK --set-mark 0x2 iptables -t mangle -A $CHAIN -p udp --dport domain -j RETURN # prioritize webserver requests iptables -t mangle -A $CHAIN -p tcp --dport www -j MARK --set-mark 0x2 iptables -t mangle -A $CHAIN -p tcp --dport www -j RETURN iptables -t mangle -A $CHAIN -p udp --dport www -j MARK --set-mark 0x2 iptables -t mangle -A $CHAIN -p udp --dport www -j RETURN # bulk - Torrents iptables -t mangle -A $CHAIN -p tcp --sport 6880:6899 -j MARK --set-mark 0x7 iptables -t mangle -A $CHAIN -p tcp --sport 6880:6899 -j RETURN iptables -t mangle -A $CHAIN -p tcp --dport 6880:6899 -j MARK --set-mark 0x7 iptables -t mangle -A $CHAIN -p tcp --dport 6880:6899 -j RETURN iptables -t mangle -A $CHAIN -p tcp --sport 47504:47654 -j MARK --set-mark 0x7 iptables -t mangle -A $CHAIN -p tcp --sport 47504:47654 -j RETURN # edonkey iptables -t mangle -A $CHAIN -p tcp --dport 4662:4665 -j MARK --set-mark 0x7 iptables -t mangle -A $CHAIN -p tcp --dport 4662:4665 -j RETURN # make ssh sorta interactive iptables -t mangle -A $CHAIN -p tcp -m tcp --sport 22 -j MARK --set-mark 0x2 iptables -t mangle -A $CHAIN -p tcp -m tcp --sport 22 -j RETURN # funky TOS flags iptables -t mangle -A $CHAIN -m tos --tos Minimize-Delay -j MARK --set-mark 0x1 iptables -t mangle -A $CHAIN -m tos --tos Minimize-Delay -j RETURN iptables -t mangle -A $CHAIN -m tos --tos Minimize-Cost -j MARK --set-mark 0x5 iptables -t mangle -A $CHAIN -m tos --tos Minimize-Cost -j RETURN iptables -t mangle -A $CHAIN -m tos --tos Maximize-Throughput -j MARK --set-mark 0x6 iptables -t mangle -A $CHAIN -m tos --tos Maximize-Throughput -j RETURN # redundant. iptables -t mangle -A $CHAIN -j MARK --set-mark 0x6 done _______________________________________________ LARTC mailing list / [EMAIL PROTECTED] http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
