jamal wrote:
I gotta give it to you - you have helped isolate more bugs in this one
session than all others in the past summed up.
LOL - there may be more to come, though I haven't used CONNMARK before
and may be missing something about it - and maybe there is a tc way to
look at connmark anyway?
Works as I expect -
iptables -A POSTROUTING -t mangle -j CONNMARK --set-mark 1
iptables -A INPUT -t mangle -m mark --mark 1
iptables -A PREROUTING -t mangle -j CONNMARK --restore-mark
I ping a lan pc and I get matches for the marked incoming packets in INPUT.
If I do
iptables -A POSTROUTING -t mangle -j CONNMARK --set-mark 1
iptables -A INPUT -t mangle -m mark --mark 1
tc qdisc add dev eth0 ingress
tc filter add dev eth0 parent ffff: protocol ip prio 6 u32 match ip src
0/0 flowid 1:1 action ipt -j CONNMARK --restore-mark
It doesn't mark the packets.
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max/stddev = 0.355/0.415/0.529/0.081 ms
[root@amd /home/andy/Qos]# tc -s filter ls dev eth0 parent ffff:
filter protocol ip pref 6 u32
filter protocol ip pref 6 u32 fh 800: ht divisor 1
filter protocol ip pref 6 u32 fh 800::800 order 2048 key ht 800 bkt 0
flowid 1:1 (rule hit 3 success 3)
match 00000000/00000000 at 12 (success 3 )
action order 1: tablename: mangle hook: NF_IP_PRE_ROUTING
target CONNMARK restore
index 2 ref 1 bind 1 installed 44 sec used 31 sec
Action statistics:
Sent 252 bytes 3 pkt (dropped 0, overlimits 0 requeues 0)
rate 0bit 0pps backlog 0b 0p requeues 0
[root@amd /home/andy/Qos]# iptables -L -t mangle -v
Chain PREROUTING (policy ACCEPT 364 packets, 401K bytes)
pkts bytes target prot opt in out source
destination
Chain INPUT (policy ACCEPT 364 packets, 401K bytes)
pkts bytes target prot opt in out source
destination
0 0 all -- any any anywhere
anywhere MARK match 0x1
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source
destination
Chain OUTPUT (policy ACCEPT 300 packets, 19702 bytes)
pkts bytes target prot opt in out source
destination
Chain POSTROUTING (policy ACCEPT 300 packets, 19702 bytes)
pkts bytes target prot opt in out source
destination
3 252 CONNMARK all -- any any anywhere
anywhere CONNMARK set 0x1
Andy.
|