gact <ACTION> [RAND] [INDEX]

Where:

	ACTION := reclassify | drop | continue | pass | ok

	RAND := random <RANDTYPE> <ACTION> <VAL>

	RANDTYPE := netrand | determ

        VAL : = value not exceeding 10000

        INDEX := index value used

ACTION semantics

- pass and ok are equivalent to accept

- continue allows to restart classification lookup

- drop drops packets

- reclassify implies continue classification where we left off

randomization

--------------

At the moment there are only two algorithms. One is deterministic

and the other uses internal kernel netrand.

Examples:

Rules can be installed on both ingress and egress - this shows ingress

only

tc qdisc add dev eth0 ingress

# example 1

tc filter add dev eth0 parent ffff: protocol ip prio 6 u32 match ip src \

10.0.0.9/32 flowid 1:16 action drop

ping -c 20 10.0.0.9

--

filter u32

filter u32 fh 800: ht divisor 1

filter u32 fh 800::800 order 2048 key ht 800 bkt 0 flowid 1:16  (rule hit 32 success 20)

  match 0a000009/ffffffff at 12 (success 20 )

        action order 1: gact action drop

         random type none pass val 0

         index 1 ref 1 bind 1 installed 59 sec used 35 sec

         Sent 1680 bytes 20 pkts (dropped 20, overlimits 0 )

----

# example 2

#allow 1 out 10 randomly using the netrand generator

tc filter add dev eth0 parent ffff: protocol ip prio 6 u32 match ip src \

10.0.0.9/32 flowid 1:16 action drop random netrand ok 10

ping -c 20 10.0.0.9

----

filter protocol ip pref 6 u32 filter protocol ip pref 6 u32 fh 800: ht divisor 1filter protocol ip pref 6 u32 fh 800::800 order 2048 key ht 800 bkt 0 flowid 1:16  (rule hit 20 success 20)

  match 0a000009/ffffffff at 12 (success 20 )

        action order 1: gact action drop

         random type netrand pass val 10

         index 5 ref 1 bind 1 installed 49 sec used 25 sec

         Sent 1680 bytes 20 pkts (dropped 16, overlimits 0 )

--------

#alternative: deterministically accept every second packet

tc filter add dev eth0 parent ffff: protocol ip prio 6 u32 match ip src \

10.0.0.9/32 flowid 1:16 action drop random determ ok 2

ping -c 20 10.0.0.9

tc -s filter show parent ffff: dev eth0

-----

filter protocol ip pref 6 u32 filter protocol ip pref 6 u32 fh 800: ht divisor 1filter protocol ip pref 6 u32 fh 800::800 order 2048 key ht 800 bkt 0 flowid 1:16  (rule hit 20 success 20)

  match 0a000009/ffffffff at 12 (success 20 )

        action order 1: gact action drop

         random type determ pass val 2

         index 4 ref 1 bind 1 installed 118 sec used 82 sec

         Sent 1680 bytes 20 pkts (dropped 10, overlimits 0 )

-----