Re: [Cake] diffserv based on firewall mark

2016-10-12 Thread David Lang
On Thu, 13 Oct 2016, ching lu wrote: Setting the DSCP with iptables rules should work just as well and in the same way as using the “firewall mark” functionality as you already do. Set it up that way in the first instance, directly replacing each HTB+fq_codel combination with a Cake instance,

Re: [Cake] diffserv based on firewall mark

2016-10-12 Thread ching lu
> Setting the DSCP with iptables rules should work just as well and in the same way as using the “firewall mark” functionality as you already do. Set it up that way in the first instance, directly replacing each HTB+fq_codel combination with a Cake instance, and see how it works. > > - Jonathan M

Re: [Cake] diffserv based on firewall mark

2016-10-12 Thread ching lu
2016年10月12日 下午9:07,"moeller0" 寫道: > > Hi Ching, > > > On Oct 12, 2016, at 14:40 , ching lu wrote: > > > > There is no need for cleansing dscp for wan ingress, I think it is unnecessary, too > > > > In https://www.bufferbloat.net/projects/codel/wiki/Cake/ > > > > There is a statement: > > > > “The

Re: [Cake] diffserv based on firewall mark

2016-10-12 Thread Sebastian Moeller
Hi there, On October 12, 2016 5:36:32 PM GMT+02:00, Jonathan Morton wrote: > >> On 12 Oct, 2016, at 15:40, ching lu wrote: >> >> DSCP -> unreliable, easily spoofed by attacker > >I’d like to address the “easily spoofed by attacker” point >specifically. > >Cake’s interpretation of Diffserv is a

Re: [Cake] diffserv based on firewall mark

2016-10-12 Thread Sebastian Moeller
Hi yuta, It would maybe be more convincing if you could share data showing how ack priority would help cake. I know that it has long been recommended, but I am missing recent data showing that it still would work for cake and fq_codel, as these tend to boost all sparse flows, and ack flows ofte

Re: [Cake] diffserv based on firewall mark

2016-10-12 Thread Y
Hi , I am yuta. I request to add TCP ACK priority first. Bye Bye. On Wed, 12 Oct 2016 13:52:14 +0800 ching lu wrote: > My current config is HTB+fq-codel. > > I deprioritize bittorrent traffic by marking related connections in > iptables (e.g. detect by port number) and route them to correspon

Re: [Cake] diffserv based on firewall mark

2016-10-12 Thread Jonathan Morton
> On 12 Oct, 2016, at 15:40, ching lu wrote: > > DSCP -> unreliable, easily spoofed by attacker I’d like to address the “easily spoofed by attacker” point specifically. Cake’s interpretation of Diffserv is as a three-way tradeoff between throughput priority, latency priority, and altruism. I

Re: [Cake] diffserv based on firewall mark

2016-10-12 Thread moeller0
Hi Ching, > On Oct 12, 2016, at 14:40 , ching lu wrote: > > There is no need for cleansing dscp for wan ingress, I think it is > unnecessary, too > > In https://www.bufferbloat.net/projects/codel/wiki/Cake/ > > There is a statement: > > “The only way we know how to “fix” bittorrent is to cla

Re: [Cake] diffserv based on firewall mark

2016-10-12 Thread ching lu
There is no need for cleansing dscp for wan ingress, I think it is unnecessary, too In https://www.bufferbloat.net/projects/codel/wiki/Cake/ There is a statement: "The only way we know how to “fix” bittorrent is to classify it somewhat, somehow, as “background”." But in fact, there is no simply

Re: [Cake] diffserv based on firewall mark

2016-10-12 Thread moeller0
> On Oct 12, 2016, at 12:21 , Dave Taht wrote: > > I still defend the idea of the diffserv "squash" option cake once had. > It was essentially RFC compliant, simple to use, and because iptables > was too late on inbound, needed, no matter the layer violation. As stated I am not sure whether tha

Re: [Cake] diffserv based on firewall mark

2016-10-12 Thread moeller0
Hi Ching? > On Oct 12, 2016, at 12:17 , ching lu wrote: > > > 2016年10月12日 下午6:05,"moeller0" 寫道: > > > > Hi Ching, > > > > > On Oct 12, 2016, at 11:35 , ching lu wrote: > > > > > > How to archive "cake follows iptables"? is it “wan ingress -> iptables > > > > Yes. > > > > > -> wifi egress/LAN e

Re: [Cake] diffserv based on firewall mark

2016-10-12 Thread Kevin Darbyshire-Bryant
On 12/10/16 11:21, Dave Taht wrote: I still defend the idea of the diffserv "squash" option cake once had. It was essentially RFC compliant, simple to use, and because iptables was too late on inbound, needed, no matter the layer violation. Yeah I liked it too, so much I even thought about ha

Re: [Cake] diffserv based on firewall mark

2016-10-12 Thread Dave Taht
I still defend the idea of the diffserv "squash" option cake once had. It was essentially RFC compliant, simple to use, and because iptables was too late on inbound, needed, no matter the layer violation. ___ Cake mailing list Cake@lists.bufferbloat.net h

Re: [Cake] diffserv based on firewall mark

2016-10-12 Thread ching lu
2016年10月12日 下午6:05,"moeller0" 寫道: > > Hi Ching, > > > On Oct 12, 2016, at 11:35 , ching lu wrote: > > > > How to archive "cake follows iptables"? is it “wan ingress -> iptables > > Yes. > > > -> wifi egress/LAN egress -> ifb egress -> cake”? > > Except that if you instantiate cake on the i

Re: [Cake] diffserv based on firewall mark

2016-10-12 Thread moeller0
Hi Ching, > On Oct 12, 2016, at 11:35 , ching lu wrote: > > How to archive "cake follows iptables"? is it “wan ingress -> iptables Yes. > -> wifi egress/LAN egress -> ifb egress -> cake”? Except that if you instantiate cake on the interface connecting to the outers LAN/WLAN side (let

Re: [Cake] diffserv based on firewall mark

2016-10-12 Thread ching lu
How to archive "cake follows iptables"? is it "wan ingress -> iptables -> wifi egress/LAN egress -> ifb egress -> cake"? On Wed, Oct 12, 2016 at 5:10 PM, moeller0 wrote: > Hi, > > >> On Oct 12, 2016, at 10:11 , ching lu wrote: >> >> For egress, setting DSCP field should work. >> >> iptables ->

Re: [Cake] diffserv based on firewall mark

2016-10-12 Thread moeller0
Hi, > On Oct 12, 2016, at 10:11 , ching lu wrote: > > For egress, setting DSCP field should work. > > iptables -> wan egress -> cake > > But is it possible to set DSCP to 0x0 after cake's classification? i > do not know how ISP handle non-zero DSCP, there seems to be no > standard for this.

Re: [Cake] diffserv based on firewall mark

2016-10-12 Thread ching lu
For egress, setting DSCP field should work. iptables -> wan egress -> cake But is it possible to set DSCP to 0x0 after cake's classification? i do not know how ISP handle non-zero DSCP, there seems to be no standard for this. For ingress, DSCP field may not be set by network peer at all, and i

Re: [Cake] diffserv based on firewall mark

2016-10-12 Thread Jonathan Morton
> On 12 Oct, 2016, at 08:52, ching lu wrote: > > I deprioritize bittorrent traffic by marking related connections in > iptables (e.g. detect by port number) and route them to corresponding > HTB class and qdisc. > > How can i archive the same goal using the cake qdisc? Modify your iptables rul

[Cake] diffserv based on firewall mark

2016-10-12 Thread ching lu
My current config is HTB+fq-codel. I deprioritize bittorrent traffic by marking related connections in iptables (e.g. detect by port number) and route them to corresponding HTB class and qdisc. How can i archive the same goal using the cake qdisc? I am aware that cake supports Diffserv by DSCP,