From owner-freebsd-ipfw@FreeBSD.ORG Wed Jan 24 16:44:00 2007 Return-Path: X-Original-To: freebsd-ipfw@freebsd.org Delivered-To: freebsd-ipfw@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id E7D0516A401 for ; Wed, 24 Jan 2007 16:44:00 +0000 (UTC) (envelope-from michael@gargantuan.com) Received: from phoenix.gargantuan.com (srv01.lak.lwxdatacom.net [24.73.171.238]) by mx1.freebsd.org (Postfix) with ESMTP id 8ED1213C4A6 for ; Wed, 24 Jan 2007 16:43:58 +0000 (UTC) (envelope-from michael@gargantuan.com) Received: by phoenix.gargantuan.com (Postfix, from userid 1001) id B4972191; Wed, 24 Jan 2007 11:12:13 -0500 (EST) Date: Wed, 24 Jan 2007 11:12:13 -0500 From: "Michael W. Oliver" To: Arone Silimantia Message-ID: <20070124161213.GB34537@gargantuan.com> Mail-Followup-To: Arone Silimantia , freebsd-ipfw@freebsd.org References: <108951.34916.qm@web58610.mail.re3.yahoo.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; x-action=pgp-signed Content-Disposition: inline In-Reply-To: <108951.34916.qm@web58610.mail.re3.yahoo.com> X-WWW-URL: http://michael.gargantuan.com X-GPG-PGP-Public-Key: http://michael.gargantuan.com/gnupg/pubkey.asc X-GPG-PGP-Fingerprint: 0881 F6F6 F92B F8A4 A1AB B3C3 B29C 7277 AC60 0B0E X-Home-Phone: +1-863-816-8091 X-Mobile-Phone: +1-863-738-2334 X-Mailing-Address0: 8008 Apache Lane X-Mailing-Address1: Lakeland, FL 33810-2172 X-Mailing-Address2: United States of America X-Guide-Questions: http://www.catb.org/~esr/faqs/smart-questions.html X-Guide-Netiquette: http://www.ietf.org/rfc/rfc1855.txt User-Agent: mutt-ng/devel-r804 (FreeBSD) Cc: freebsd-ipfw@freebsd.org Subject: Re: ipfw pipe show .... clarification, please ... X-BeenThere: freebsd-ipfw@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: IPFW Technical Discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jan 2007 16:44:01 -0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 2007-01-23T16:37:13-0800, Arone Silimantia wrote: > > I set up a dummynet pipe with this sequence of commands: > > sysctl -w net.inet.ip.fw.one_pass=0 > ipfw pipe 1 config bw 16Mbit/s > ipfw add 10000 pipe 1 all from any to any > > So far so good. Works great. However, when I look at the pipe > itself, with this command: > > ipfw pipe show 1 > > I see this: > > # ipfw pipe show 1 > 00001: 16.000 Mbit/s 0 ms 50 sl. 1 queues (1 buckets) droptail > mask: 0x00 0x00000000/0x0000 -> 0x00000000/0x0000 > BKT Prot ___Source IP/port____ ____Dest. IP/port____ Tot_pkt/bytes Pkt/Byte Drp > 0 tcp 1.2.3.4/22 1.2.3.4/4333 2970975653 2649647615805 2 2992 10414733 > > I would like to clarify a few things... > > First, the ipfw pipe creation command I ran is not (as far as I can > tell) TCP specific, and further, my ipfw rule says "any to any" - but > when I look at the pipe, it has a protocol specified (TCP) and > further, has a port number (22). I want to throttle ALL IP traffic, > not just TCP, and certainly not just port 22. > > What am I doing wrong ? I think what you are seeing is just the latest user of the rule, and it happened to be that SSH connection. Since you are using an all-zeros mask, all traffic will fall into the same bucket and as such you will only see the latest flow/conversation/stream that used the rule. I could be wrong here, and would like clarification if so. > Second, there are seven headings (from BKT at the left to Drp on the > right) but underneath those seven headings are _9_ values. What I > really want to know is how many packets I am droppinig ... but I can't > tell which of the fields are the "dropped" - I assume it is the final > number .. if so, what is that measured in ? Packets ? Yes, the drops are listed in number of packets, and what you are seeing as nine fields is broken down as follows: BKT Prot Source IP/port Dest. IP/port Tot_pkt bytes Pkt Byte Drp The "Tot_pkt/bytes" and "Pkt/Byte" values are split, even though the headings are not. Not very intuitive, and actually quite ugly. Again, I am no expert and would like clarification if I am wrong. Personally, if I could code at all, I would try to whip up a patch that would do something like this.... 00001: 16.000 Mbit/s 0 ms 50 sl. 1 queues (1 buckets) droptail mask: 0x00 0x00000000/0x0000 -> 0x00000000/0x0000 BKT 0 Prot: TCP Source: 1.2.3.4(22) Dest: 1.2.3.4(4333) Total (pkts/bytes): 2970975653/2649647615805 Current (pkts/bytes): 2/2992 Drops: 10414733 > Finally, why am I dropping any packets ? My total traffic is 5-7 > Mbits/s on average ... I don't see why I would be dropping any packets > at all ... are they being dropped because the system can't keep up, or > are they being dropped because I am hitting the throttle limit and it > drops everything above that ? I think you are dropping packets because you are exceeding the pipe bandwidth. I am no expert on this stuff, just offering some possible answers to your questions. Have fun! - -- Mike Oliver, KI4OFU [see complete headers for contact information] - ------------------------------------------------------------------------ If your email to me is rejected, it is likely a problem with the MTA on your end, so please send the error report to me at mwoliver at gmail dot com and I will investigate the issue. Thanks. - ------------------------------------------------------------------------ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (FreeBSD) iD8DBQFFt4VdboLl4ADjAhARAlhZAJ0e8bOB7qmbrGixUdyXdiX/UGJx8gCgpU5h kHA5fOsAia5iZo97ExtVXQ0= =ybB5 -----END PGP SIGNATURE-----