Date: Tue, 14 Mar 2006 17:29:02 +0100 From: Andrew Seguin <asegu_fbsdnet@borgtech.ca> To: freebsd-ipfw@freebsd.org Subject: IPFW/Dummynet situation Message-ID: <4416EF4E.5020903@borgtech.ca>
next in thread | raw e-mail | index | archive | help
I have a problem nagging at me for a while now...
If I create a pipe with a dst-ip mask (I haven't tried with a src-ip
mask) and a bandwith limit, the limit isn't respected properly. I know
it's not in the firewall rules themselves, the traffic goes into the
pipe, just when I use ipfw pipe show, I see more traffic then should
have been allowed, which is starting to be problematic considering the
slow internet pipe here.
For example:
10 second averages show 5 users receiving closer to (and above) 300kbps.
I thought maybe it was just my mental conversion from bytes to kbit that
was wrong, but I calculated: 250kbit / 8 = 31.25KByte, so I shouldn't
see more then 31000bytes in a dump (310 000 bytes for a 10s dump, 3.1M
for a 100s dump, etc), yet it isn't so per the dumps below:
firewall# ipfw pipe 20 delete && ipfw pipe 20 config bw 250kbps mask
dst-ip 0x000000ff && sleep 10 && ipfw -s 4 pipe 20 show
00020: 250.000 Kbit/s 0 ms 50 sl. 13 queues (64 buckets) droptail
mask: 0x00 0x00000000/0x0000 -> 0x000000ff/0x0000
BKT Prot ___Source IP/port____ ____Dest. IP/port____ Tot_pkt/bytes
Pkt/Byte Drp
23 ip 0.0.0.0/0 0.0.0.215/0 541 393993 48
38867 113
49 ip 0.0.0.0/0 0.0.0.177/0 568 392311 50
50243 82
23 ip 0.0.0.0/0 0.0.0.151/0 419 359542 40
34010 26
25 ip 0.0.0.0/0 0.0.0.217/0 396 356667 44
41133 17
19 ip 0.0.0.0/0 0.0.0.147/0 589 338828 47
24481 34
59 ip 0.0.0.0/0 0.0.0.251/0 299 97693 0
0 0
14 ip 0.0.0.0/0 0.0.0.206/0 39 5878 0
0 0
33 ip 0.0.0.0/0 0.0.0.225/0 34 5039 0
0 0
100 second averages:
A014# ipfw pipe 20 delete && ipfw pipe 20 config bw 250kbps mask dst-ip
0x000000ff && sleep 100 && ipfw -s 4 pipe 20 show
00020: 250.000 Kbit/s 0 ms 50 sl. 28 queues (64 buckets) droptail
mask: 0x00 0x00000000/0x0000 -> 0x000000ff/0x0000
BKT Prot ___Source IP/port____ ____Dest. IP/port____ Tot_pkt/bytes
Pkt/Byte Drp
23 ip 0.0.0.0/0 0.0.0.215/0 4820 3561827 47
55472 1758
19 ip 0.0.0.0/0 0.0.0.147/0 3604 3171878 0
0 126
25 ip 0.0.0.0/0 0.0.0.217/0 3876 2915746 45
11570 71
49 ip 0.0.0.0/0 0.0.0.177/0 4845 2764112 5
2482 138
23 ip 0.0.0.0/0 0.0.0.151/0 2828 2344594 41
30362 212
59 ip 0.0.0.0/0 0.0.0.251/0 4670 1777891 0
0 21
...
Even with a 1000 second average I still see/have one computer fairly
high above the limit:
A014# ipfw pipe 20 delete && ipfw pipe 20 config bw 250kbps mask dst-ip
0x000000ff && sleep 1000 && ipfw -s 4 pipe 20 show
00020: 250.000 Kbit/s 0 ms 50 sl. 43 queues (64 buckets) droptail
mask: 0x00 0x00000000/0x0000 -> 0x000000ff/0x0000
BKT Prot ___Source IP/port____ ____Dest. IP/port____ Tot_pkt/bytes
Pkt/Byte Drp
23 ip 0.0.0.0/0 0.0.0.215/0 48823 34909898 49
39751 14002
25 ip 0.0.0.0/0 0.0.0.217/0 40294 30358282 23
19611 1301
...
So is this normal or is it caused by something I'm doing or maybe not?
Thank you for any info!
Andrew
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4416EF4E.5020903>