Re: Bandwidth Throttling?

Kevin,

Sorry, I tried to post before but my mail transport got screwed up.
Everything on that table looks pretty normal for a NoCat-controlled
firewall.  Your host is indeed being added and marked as in the Co-Op
class, and traffic is passing in and out of the firewall properly.  What
you need to do next is to look at your tc rules and ensure that they are
being properly initialized by NoCat.  Those should recognize the mark set
by the firewall, and cap traffic accordingly.  There is something in the
Documentation which says you need to make the throttle.fw script
executable before it will run.  You did do that, right?  Also make sure
you have all the required kernel options compiled in your kernel (eg.
NETLINK or RT_NETLINK.)  Then, if you could, get the script to run and
then post us a listing of the tc settings with each of: tc
<qdisc/class/filter> show dev <device>.  Good luck.

-Troy

Kevin Hanser said:
> Anyone w/more iptables/tc experience than me that can make anything of
> the output below?
>
> thx
>
> k
>
> Kevin Hanser wrote:
>
>> Ok, I ran that command, but I need some help in interpreting the
>> output... I'm not really an iptables expert by any means :)
>>
>> Here's what I get:
>>
>> [root@nocatgw ~]# iptables -t mangle -nL -v
>> Chain FORWARD (policy ACCEPT 22M packets, 20G bytes)
>> pkts bytes target     prot opt in     out     source
>> destination
>>
>> Chain INPUT (policy ACCEPT 75513 packets, 8647K bytes)
>> pkts bytes target     prot opt in     out     source
>> destination
>>
>> Chain NoCat (1 references)
>> pkts bytes target     prot opt in     out     source
>> destination
>> 5316K  414M MARK       all  --  eth1   *       0.0.0.0/0
>> 0.0.0.0/0         MARK set 0x4
>> 11862 8565K MARK       all  --  *      *       192.168.123.200
>> 0.0.0.0/0         MAC 00:01:02:C8:11:DB MARK set 0x2
>>
>> Chain OUTPUT (policy ACCEPT 15991 packets, 2024K bytes)
>> pkts bytes target     prot opt in     out     source
>> destination
>>    0     0 TOS        tcp  --  *      *       0.0.0.0/0
>> 0.0.0.0/0         tcp dpt:22 TOS set 0x10
>>    6   240 TOS        tcp  --  *      *       0.0.0.0/0
>> 0.0.0.0/0         tcp dpt:80 TOS set 0x08
>>    0     0 TOS        tcp  --  *      *       0.0.0.0/0
>> 0.0.0.0/0         tcp dpt:443 TOS set 0x08
>>    0     0 TOS        tcp  --  *      *       0.0.0.0/0
>> 0.0.0.0/0         tcp dpt:22 TOS set 0x10
>>    3   120 TOS        tcp  --  *      *       0.0.0.0/0
>> 0.0.0.0/0         tcp dpt:80 TOS set 0x08
>>    0     0 TOS        tcp  --  *      *       0.0.0.0/0
>> 0.0.0.0/0         tcp dpt:443 TOS set 0x08
>>
>> Chain POSTROUTING (policy ACCEPT 22M packets, 20G bytes)
>> pkts bytes target     prot opt in     out     source
>> destination
>>
>> Chain PREROUTING (policy ACCEPT 22M packets, 20G bytes)
>> pkts bytes target     prot opt in     out     source
>> destination
>>  21M   20G NoCat      all  --  *      *       0.0.0.0/0
>> 0.0.0.0/0
>>
>>
>> I see my IP listed above (192.168.123.200), but I'm not sure what the
>> rest of it tells me... I'm still seeing no throttling.  When I do a
>> speed test, I'm getting 7+mbps so no throttling there... :)
>>
>> thx!
>>
>> k
>>
>> Troy M Jaqua wrote:
>>
>>> try:
>>> iptables -t mangle -nL -v
>>>
>>> That will give you the packet and byte counts as well.
>>>
>>> Kevin Hanser said:
>>>
>>>
>>>> Hmmm... any idea how I would look at the "mangle table"?  Not familiar
>>>> with that term...
>>>>
>>>> thx
>>>>
>>>> k
>>>>
>>>> Troy M Jaqua wrote:
>>>>
>>>>
>>>>
>>>>> Hey Kevin,
>>>>>
>>>>> I think you need to look at the mangle table to get the info which
>>>>> actually classifies your IP and MAC address.  The rules here are
>>>>> just to
>>>>> accept inbound packets, and those which have been previously marked
>>>>> to
>>>>> get
>>>>> accepted when they came in.  Anyway, I doubt you'll find the tc rules
>>>>> within the firewall itself, though I'm not that familiar with traffic
>>>>> shaping, either.
>>>>>
>>>>> -Troy
>>>>>
>>>>> Kevin Hanser said:
>>>>>
>>>>>
>>>>>
>>>>>
>>>>
>>>> _______________________________________________
>>>> NoCat mailing list
>>>> [email protected]
>>>> http://lists.nocat.net/mailman/listinfo/nocat
>>>>
>>>>
>>>
>>>
>>>
>>>
>>
>> _______________________________________________
>> NoCat mailing list
>> [email protected]
>> http://lists.nocat.net/mailman/listinfo/nocat
>
>
> _______________________________________________
> NoCat mailing list
> [email protected]
> http://lists.nocat.net/mailman/listinfo/nocat
>