+++ /dev/null
-
-gact <ACTION> [RAND] [INDEX]
-
-Where:
- ACTION := reclassify | drop | continue | pass | ok
- RAND := random <RANDTYPE> <ACTION> <VAL>
- RANDTYPE := netrand | determ
- VAL : = value not exceeding 10000
- INDEX := index value used
-
-ACTION semantics
-- pass and ok are equivalent to accept
-- continue allows to restart classification lookup
-- drop drops packets
-- reclassify implies continue classification where we left off
-
-randomization
---------------
-
-At the moment there are only two algorithms. One is deterministic
-and the other uses internal kernel netrand.
-
-Examples:
-
-Rules can be installed on both ingress and egress - this shows ingress
-only
-
-tc qdisc add dev eth0 ingress
-
-# example 1
-tc filter add dev eth0 parent ffff: protocol ip prio 6 u32 match ip src \
-10.0.0.9/32 flowid 1:16 action drop
-
-ping -c 20 10.0.0.9
-
---
-filter u32
-filter u32 fh 800: ht divisor 1
-filter u32 fh 800::800 order 2048 key ht 800 bkt 0 flowid 1:16 (rule hit 32 success 20)
- match 0a000009/ffffffff at 12 (success 20 )
- action order 1: gact action drop
- random type none pass val 0
- index 1 ref 1 bind 1 installed 59 sec used 35 sec
- Sent 1680 bytes 20 pkts (dropped 20, overlimits 0 )
-
-----
-
-# example 2
-#allow 1 out 10 randomly using the netrand generator
-tc filter add dev eth0 parent ffff: protocol ip prio 6 u32 match ip src \
-10.0.0.9/32 flowid 1:16 action drop random netrand ok 10
-
-ping -c 20 10.0.0.9
-
-----
-filter protocol ip pref 6 u32 filter protocol ip pref 6 u32 fh 800: ht divisor 1filter protocol ip pref 6 u32 fh 800::800 order 2048 key ht 800 bkt 0 flowid 1:16 (rule hit 20 success 20)
- match 0a000009/ffffffff at 12 (success 20 )
- action order 1: gact action drop
- random type netrand pass val 10
- index 5 ref 1 bind 1 installed 49 sec used 25 sec
- Sent 1680 bytes 20 pkts (dropped 16, overlimits 0 )
-
---------
-#alternative: deterministically accept every second packet
-tc filter add dev eth0 parent ffff: protocol ip prio 6 u32 match ip src \
-10.0.0.9/32 flowid 1:16 action drop random determ ok 2
-
-ping -c 20 10.0.0.9
-
-tc -s filter show parent ffff: dev eth0
------
-filter protocol ip pref 6 u32 filter protocol ip pref 6 u32 fh 800: ht divisor 1filter protocol ip pref 6 u32 fh 800::800 order 2048 key ht 800 bkt 0 flowid 1:16 (rule hit 20 success 20)
- match 0a000009/ffffffff at 12 (success 20 )
- action order 1: gact action drop
- random type determ pass val 2
- index 4 ref 1 bind 1 installed 118 sec used 82 sec
- Sent 1680 bytes 20 pkts (dropped 10, overlimits 0 )
------
-