|
|
我有个想法就是把L7-filter和U32结合起来用,U32能对端口和协议分类,L7-filter能对很多常用程序分类,
我建的分类是这样的
tc qdisc add dev $DEV1 root handle 2: htb default 24
## first class
tc class add dev $DEV1 parent 2: classid 2:1 htb rate ${DOWNLINK}kbps ceil $[$DOWNLINK]kbps burst 10K prio 0
## SYN,ACK,ICMP
tc class add dev $DEV1 parent 2:1 classid 2:11 htb rate $[$DOWNLINK]kbps ceil $[$DOWNLINK]kbps prio 1
## CRM
tc class add dev $DEV1 parent 2:1 classid 2:12 htb rate 1100kbps ceil 1500kbps prio 2
## second class
tc class add dev $DEV1 parent 2: classid 2:2 htb rate $[$DOWNLINK]kbps ceil $[$DOWNLINK]kbps prio 3
### http pop
tc class add dev $DEV1 parent 2:2 classid 2:21 htb rate 720kbps ceil 1200kbps burst 10k prio 4
### smtp
tc class add dev $DEV1 parent 2:2 classid 2:22 htb rate 560kbps ceil 1000kbps prio 5
## ftp data
tc class add dev $DEV1 parent 2:2 classid 2:23 htb rate 300kbps ceil 1200kbps prio 6
tc class add dev $DEV1 parent 2:2 classid 2:24 htb rate 160kbps ceil 1200kbps prio 7
过滤器用U32
tc filter add dev $DEV1 parent 2:0 protocol ip prio 1 u32 match ip dport 53 0xffff classid 2:11
tc filter add dev $DEV1 parent 2:0 protocol ip prio 1 u32 match ip protocol 1 0xff classid 2:11
tc filter add dev $DEV1 parent 2:0 protocol ip prio 2 u32 match ip dport 22 0xffff classid 2:12
tc filter add dev $DEV1 parent 2:0 protocol ip prio 2 u32 match ip dport 4001 0xffff classid 2:12
tc filter add dev $DEV1 parent 2:0 protocol ip prio 2 u32 match ip tos 0x10 0xff classid 2:12
现在的问题是,假如我用L7-filter做标记
iptables -t mangle -A PREROUTING -m layer7 --l7proto edonkey -j MARK --set-mark ?
这个set-mark该怎么写呢? |
|