tcpdump mailing list archives

Re: libpcap and tc filters


From: Adam Katz <adamkatz0 () gmail com>
Date: Mon, 6 Jun 2011 11:55:08 +0300

my ip and tcp checksums should be correct, but i'll check it out.
Could you point me in the direction of an ACTIVE mailing list with traffic
shaping guys? The ones I found were pretty much abandoned.

thanks!

On Sun, Jun 5, 2011 at 7:59 PM, Aaron Turner <synfinatic () gmail com> wrote:

On Sun, Jun 5, 2011 at 12:29 AM, Adam Katz <adamkatz0 () gmail com> wrote:
First of all, thanks for the quick reply.

Well, I am using Linux, sorry for not mentioning that explicitly. tc is
the
built in linux utility for (among other things) traffic shaping... it's a
pretty useful piece of software. I use it to create three output queues
on
eth0 with a scheduler that selects which of them to dequeue. I
immediately
though of the explanation you gave me and imagined pcap might bypass some
of
the stack but it doesn't seem that way as packets sent with pcap do show
up
in those queues I created, they're only not classified correctly and end
up
in the default queue.

If pcap was completely bypassing the stack, I imagine i would not have
seen
the packets in the queue at all.

Correct.  If they are getting classified, but not correctly, then I'd
have to guess that the classification rules you're using don't match
the traffic.   No idea if it matters, but make sure your IP checksums
are correct.  When you captured the traffic, outbound traffic may have
the wrong checksums.

Other then that, may want to ask the traffic shaping guys.


--
Aaron Turner
http://synfin.net/         Twitter: @synfinatic
http://tcpreplay.synfin.net/ - Pcap editing and replay tools for Unix &
Windows
Those who would give up essential Liberty, to purchase a little temporary
Safety, deserve neither Liberty nor Safety.
    -- Benjamin Franklin
"carpe diem quam minimum credula postero"
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.

-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.


Current thread: