|
Packit Service |
3880ab |
.TH "Policing action in tc" 8 "20 Jan 2015" "iproute2" "Linux"
|
|
Packit Service |
3880ab |
|
|
Packit Service |
3880ab |
.SH NAME
|
|
Packit Service |
3880ab |
police - policing action
|
|
Packit Service |
3880ab |
.SH SYNOPSIS
|
|
Packit Service |
3880ab |
.in +8
|
|
Packit Service |
3880ab |
.ti -8
|
|
Packit Service |
3880ab |
.BR tc " ... " "action police"
|
|
Packit Service |
3880ab |
.BI rate " RATE " burst
|
|
Packit Service |
3880ab |
.IR BYTES [\fB/ BYTES "] ["
|
|
Packit Service |
3880ab |
.B mtu
|
|
Packit Service |
3880ab |
.IR BYTES [\fB/ BYTES "] ] ["
|
|
Packit Service |
3880ab |
.BI peakrate " RATE"
|
|
Packit Service |
3880ab |
] [
|
|
Packit Service |
3880ab |
.BI overhead " BYTES"
|
|
Packit Service |
3880ab |
] [
|
|
Packit Service |
3880ab |
.BI linklayer " TYPE"
|
|
Packit Service |
3880ab |
] [
|
|
Packit Service |
3880ab |
.IR CONTROL " ]"
|
|
Packit Service |
3880ab |
|
|
Packit Service |
3880ab |
.ti -8
|
|
Packit Service |
3880ab |
.BR tc " ... " filter " ... [ " estimator
|
|
Packit Service |
3880ab |
.IR "SAMPLE AVERAGE " ]
|
|
Packit Service |
3880ab |
.BR "action police avrate"
|
|
Packit Service |
3880ab |
.IR RATE " [ " CONTROL " ]"
|
|
Packit Service |
3880ab |
|
|
Packit Service |
3880ab |
.ti -8
|
|
Packit Service |
3880ab |
.IR CONTROL " :="
|
|
Packit Service |
3880ab |
.BI conform-exceed " EXCEEDACT\fR[\fB/\fINOTEXCEEDACT"
|
|
Packit Service |
3880ab |
|
|
Packit Service |
3880ab |
.ti -8
|
|
Packit Service |
3880ab |
.IR EXCEEDACT/NOTEXCEEDACT " := { "
|
|
Packit Service |
3880ab |
.BR pipe " | " ok " | " reclassify " | " drop " | " continue " | " goto " " chain " " CHAIN_INDEX " }"
|
|
Packit Service |
3880ab |
.SH DESCRIPTION
|
|
Packit Service |
3880ab |
The
|
|
Packit Service |
3880ab |
.B police
|
|
Packit Service |
3880ab |
action allows to limit bandwidth of traffic matched by the filter it is
|
|
Packit Service |
3880ab |
attached to. Basically there are two different algorithms available to measure
|
|
Packit Service |
3880ab |
the packet rate: The first one uses an internal dual token bucket and is
|
|
Packit Service |
3880ab |
configured using the
|
|
Packit Service |
3880ab |
.BR rate ", " burst ", " mtu ", " peakrate ", " overhead " and " linklayer
|
|
Packit Service |
3880ab |
parameters. The second one uses an in-kernel sampling mechanism. It can be
|
|
Packit Service |
3880ab |
fine-tuned using the
|
|
Packit Service |
3880ab |
.B estimator
|
|
Packit Service |
3880ab |
filter parameter.
|
|
Packit Service |
3880ab |
.SH OPTIONS
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI rate " RATE"
|
|
Packit Service |
3880ab |
The maximum traffic rate of packets passing this action. Those exceeding it will
|
|
Packit Service |
3880ab |
be treated as defined by the
|
|
Packit Service |
3880ab |
.B conform-exceed
|
|
Packit Service |
3880ab |
option.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI burst " BYTES\fR[\fB/\fIBYTES\fR]"
|
|
Packit Service |
3880ab |
Set the maximum allowed burst in bytes, optionally followed by a slash ('/')
|
|
Packit Service |
3880ab |
sign and cell size which must be a power of 2.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI mtu " BYTES\fR[\fB/\fIBYTES\fR]"
|
|
Packit Service |
3880ab |
This is the maximum packet size handled by the policer (larger ones will be
|
|
Packit Service |
3880ab |
handled like they exceeded the configured rate). Setting this value correctly
|
|
Packit Service |
3880ab |
will improve the scheduler's precision.
|
|
Packit Service |
3880ab |
Value formatting is identical to
|
|
Packit Service |
3880ab |
.B burst
|
|
Packit Service |
3880ab |
above. Defaults to unlimited.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI peakrate " RATE"
|
|
Packit Service |
3880ab |
Set the maximum bucket depletion rate, exceeding
|
|
Packit Service |
3880ab |
.BR rate .
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI avrate " RATE"
|
|
Packit Service |
3880ab |
Make use of an in-kernel bandwidth rate estimator and match the given
|
|
Packit Service |
3880ab |
.I RATE
|
|
Packit Service |
3880ab |
against it.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI overhead " BYTES"
|
|
Packit Service |
3880ab |
Account for protocol overhead of encapsulating output devices when computing
|
|
Packit Service |
3880ab |
.BR rate " and " peakrate .
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI linklayer " TYPE"
|
|
Packit Service |
3880ab |
Specify the link layer type.
|
|
Packit Service |
3880ab |
.I TYPE
|
|
Packit Service |
3880ab |
may be one of
|
|
Packit Service |
3880ab |
.B ethernet
|
|
Packit Service |
3880ab |
(the default),
|
|
Packit Service |
3880ab |
.BR atm " or " adsl
|
|
Packit Service |
3880ab |
(which are synonyms). It is used to align the precomputed rate tables to ATM
|
|
Packit Service |
3880ab |
cell sizes, for
|
|
Packit Service |
3880ab |
.B ethernet
|
|
Packit Service |
3880ab |
no action is taken.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI estimator " SAMPLE AVERAGE"
|
|
Packit Service |
3880ab |
Fine-tune the in-kernel packet rate estimator.
|
|
Packit Service |
3880ab |
.IR SAMPLE " and " AVERAGE
|
|
Packit Service |
3880ab |
are time values and control the frequency in which samples are taken and over
|
|
Packit Service |
3880ab |
what timespan an average is built.
|
|
Packit Service |
3880ab |
.TP
|
|
Packit Service |
3880ab |
.BI conform-exceed " EXCEEDACT\fR[\fB/\fINOTEXCEEDACT\fR]"
|
|
Packit Service |
3880ab |
Define how to handle packets which exceed or conform the
|
|
Packit Service |
3880ab |
configured bandwidth limit. Possible values are:
|
|
Packit Service |
3880ab |
.RS
|
|
Packit Service |
3880ab |
.IP continue
|
|
Packit Service |
3880ab |
Don't do anything, just continue with the next action in line.
|
|
Packit Service |
3880ab |
.IP drop
|
|
Packit Service |
3880ab |
Drop the packet immediately.
|
|
Packit Service |
3880ab |
.IP shot
|
|
Packit Service |
3880ab |
This is a synonym to
|
|
Packit Service |
3880ab |
.BR drop .
|
|
Packit Service |
3880ab |
.IP ok
|
|
Packit Service |
3880ab |
Accept the packet. This is the default for conforming packets.
|
|
Packit Service |
3880ab |
.IP pass
|
|
Packit Service |
3880ab |
This is a synonym to
|
|
Packit Service |
3880ab |
.BR ok .
|
|
Packit Service |
3880ab |
.IP reclassify
|
|
Packit Service |
3880ab |
Treat the packet as non-matching to the filter this action is attached to and
|
|
Packit Service |
3880ab |
continue with the next filter in line (if any). This is the default for
|
|
Packit Service |
3880ab |
exceeding packets.
|
|
Packit Service |
3880ab |
.IP pipe
|
|
Packit Service |
3880ab |
Pass the packet to the next action in line.
|
|
Packit Service |
3880ab |
.RE
|
|
Packit Service |
3880ab |
.SH EXAMPLES
|
|
Packit Service |
3880ab |
A typical application of the police action is to enforce ingress traffic rate
|
|
Packit Service |
3880ab |
by dropping exceeding packets. Although better done on the sender's side,
|
|
Packit Service |
3880ab |
especially in scenarios with lack of peer control (e.g. with dial-up providers)
|
|
Packit Service |
3880ab |
this is often the best one can do in order to keep latencies low under high
|
|
Packit Service |
3880ab |
load. The following establishes input bandwidth policing to 1mbit/s using the
|
|
Packit Service |
3880ab |
.B ingress
|
|
Packit Service |
3880ab |
qdisc and
|
|
Packit Service |
3880ab |
.B u32
|
|
Packit Service |
3880ab |
filter:
|
|
Packit Service |
3880ab |
|
|
Packit Service |
3880ab |
.RS
|
|
Packit Service |
3880ab |
.EX
|
|
Packit Service |
3880ab |
# tc qdisc add dev eth0 handle ffff: ingress
|
|
Packit Service |
3880ab |
# tc filter add dev eth0 parent ffff: u32 \\
|
|
Packit Service |
3880ab |
match u32 0 0 \\
|
|
Packit Service |
3880ab |
police rate 1mbit burst 100k
|
|
Packit Service |
3880ab |
.EE
|
|
Packit Service |
3880ab |
.RE
|
|
Packit Service |
3880ab |
|
|
Packit Service |
3880ab |
As an action can not live on it's own, there always has to be a filter involved as link between qdisc and action. The example above uses
|
|
Packit Service |
3880ab |
.B u32
|
|
Packit Service |
3880ab |
for that, which is configured to effectively match any packet (passing it to the
|
|
Packit Service |
3880ab |
.B police
|
|
Packit Service |
3880ab |
action thereby).
|
|
Packit Service |
3880ab |
|
|
Packit Service |
3880ab |
.SH SEE ALSO
|
|
Packit Service |
3880ab |
.BR tc (8)
|