Linux Advanced Routing & Traffic Control HOWTO

Bert Hubert

Netherlabs BV

bert.hubert@netherlabs.nl

Thomas Graf (Section Author)

tgraf%suug.ch

Gregory Maxwell (Section Author)
Remco van Mook (Section Author)

remco@virtu.nl

Martijn van Oosterhout (Section Author)

kleptog@cupid.suninternet.com

Paul B Schroeder (Section Author)

paulsch@us.ibm.com

Jasper Spaans (Section Author)

jasper@spaans.ds9a.nl

Pedro Larroy (Section Author)

piotr%member.fsf.org

拞栰晲梇 - 擔杮岅栿

nakano@apm.seikei.ac.jp

Revision History                                                       
Revision Revision: 1.41j1         Date: 2003/10/19                     
擔杮岅東栿斉                                                           
Revision $Revision: 1.41 $        $Date: 2003/10/12 15:51:04 $         
DocBook Edition                                                        

iproute2丄僩儔僼傿僢僋惂屼丄偍傛傃懡彮偺 netfilter 偵娭偡傞丄嬌傔偰幚慔
揑側傾僾儘乕僠丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

Table of Contents
1. 專帿
2. 偼偠傔偵
   
    2.1. 柶愑偍傛傃儔僀僙儞僗
    2.2. 帠慜偵昁梫側抦幆
    2.3. Linux 偵偱偒傞偙偲
    2.4. 偙偺暥彂偺娗棟偵偮偄偰偺儊儌
    2.5. 庢摼丄CVS 偍傛傃傾僢僾僨乕僩偺搳峞
    2.6. 儊乕儕儞僌儕僗僩
    2.7. 偙偺暥彂偺峔惉
   
3. iproute2 擖栧
   
    3.1. 側偤 iproute2 側偺偐?
    3.2. iproute2 偺奣棯
    3.3. 帠慜偺昁梫忦審
    3.4. 尰嵼偺愝掕傪挷傋偰傒傞
    3.5. ARP
   
4. Rules - 儖乕僥傿儞僌億儕僔乕僨乕僞儀乕僗
   
    4.1. 娙扨側僜乕僗億儕僔乕儖乕僥傿儞僌
    4.2. 暋悢偺傾僢僾儕儞僋/僾儘僶僀僟偵懳偡傞儖乕僥傿儞僌
   
5. GRE 僩儞僱儖丄偦偺懠偺僩儞僱儖
   
    5.1. 僩儞僱儖偵娭偡傞堦斒揑側帠暱
    5.2. IP in IP 僩儞僱儕儞僌
    5.3. GRE 僩儞僱儕儞僌
    5.4. 儐乕僓儔儞僪偺僩儞僱儖
   
6. Cisco 傗 6bone 偲偺 IPv6 僩儞僱儖
   
    6.1. IPv6 僩儞僱儕儞僌
   
7. IPSEC: 僀儞僞乕僱僢僩墇偟偺埨慡側 IP
   
    7.1. 擖栧曇: 庤摦偱偺尞張棟
    7.2. 帺摦偱偺尞張棟
    7.3. IPSEC 僩儞僱儖
    7.4. 懠偺 IPSEC 僜僼僩僂僃傾
    7.5. 懠偺僔僗僥儉偲偺 IPSEC 偺憡屳塣梡
   
8. 儅儖僠僉儍僗僩偺儖乕僥傿儞僌
9. 僉儏乕僀儞僌婯懃偲僶儞僪暆娗棟
   
    9.1. 僉儏乕偍傛傃僉儏乕僀儞僌婯懃偺愢柧
    9.2. 僔儞僾儖側丄僋儔僗儗僗偺僉儏乕僀儞僌婯懃
    9.3. 偄偮偳傫側僉儏乕傪巊偆傋偒偐
    9.4. 梡岅愢柧
    9.5. 僋儔僗僼儖側僉儏乕僀儞僌婯懃
    9.6. 僼傿儖僞偵傛傞僷働僢僩偺僋儔僗慖暿
    9.7. 拞娫僉儏乕僀儞僌僨僶僀僗 (Intermediate queueing device :IMQ)
   
10. 暋悢偺僀儞僞乕僼僃乕僗傪梡偄偨晧壸暘嶶
   
    10.1. 拲堄
    10.2. 懠偺壜擻惈
   
11. Netfilter 偲 iproute 偱僷働僢僩偵報傪晅偗傞
12. 崅搙側僼傿儖僞偵傛傞僷働僢僩偺僋儔僗(嵞)慖暿
   
    12.1. u32 僋儔僗慖暿婍
    12.2. route 僋儔僗慖暿婍
    12.3. 娔帇惂尷 (policing) 僼傿儖僞
    12.4. 僴僢僔儏僼傿儖僞: 挻崅懍戝検僼傿儖僞儕儞僌
    12.5. IPv6 僩儔僼傿僢僋偺僼傿儖僞儕儞僌
   
13. 僇乕僱儖偺僱僢僩儚乕僋僷儔儊乕僞
   
    13.1. 栠傝宱楬僼傿儖僞 (Reverse Path Filtering)
    13.2. 偁傑傝抦傜傟偰偄側偄愝掕
   
14. 抦傜傟偞傞崅搙側僉儏乕僀儞僌婯懃
   
    14.1. bfifo/pfifo
    14.2. Clark-Shenker-Zhang 傾儖僑儕僘儉 (CSZ)
    14.3. DSMARK
    14.4. 擖岥 (ingress) qdisc
    14.5. 儔儞僟儉弶婜専抦 (Random Early Detection: RED)
    14.6. 斈梡儔儞僟儉弶婜専抦 (Generic Random Early Detection)
    14.7. VC/ATM 僄儈儏儗乕僔儑儞
    14.8. 廳傒晅偒儔僂儞僪儘價儞 (Weighted Round Robin: WRR)
   
15. 僋僢僋僽僢僋
   
    15.1. SLA 偺堎側傞暋悢偺僒僀僩傪摦嶌偝偣傞
    15.2. 儂僗僩傪 SYN 僼儔僢僪偐傜庣傞
    15.3. ICMP 傪懷堟惂尷偟偰 dDoS 傪杊偖
    15.4. 懳榖揑僩儔僼傿僢僋傪桪愭偡傞
    15.5. netfilter, iproute2, ipchains, squid 傪梡偄偨摟夁 Web 僉儍僢
        僔儏
    15.6. 宱楬偛偲偵 MTU 傪愝掕偟 Path MTU Discovery 栤戣傪夞旔偡傞
    15.7. MSS 僋儔儞僾偵傛偭偰 Path MTU Discovery 栤戣傪夞旔偡傞 (ADSL,
        働乕僽儖, PPPoE, PPtP 儐乕僓岦偗)
    15.8. 媶嬌偺僩儔僼傿僢僋挷惍婍: 掅抶墑, 崅懍傾僢僾儘乕僪/僟僂儞儘乕
        僪
    15.9. 扨堦偺儂僗僩傑偨偼僱僢僩儚乕僋偺懍搙惂尷
    15.10. QoS 晅偒 nat 偺姰慡側椺
   
16. 僽儕僢僕偲丄戙棟 ARP 傪梡偄偨媅帡僽儕僢僕偺峔抸
   
    16.1. 僽儕僢僕偲 iptables 偺忬嫷
    16.2. 僽儕僢僕偲懷堟惂尷
    16.3. 戙棟 ARP 傪梡偄偨媅帡僽儕僢僕
   
17. 摦揑儖乕僥傿儞僌 - OSPF 偲 BGP
   
    17.1. Zebra 偵傛傞 OSPF 偺愝掕
    17.2. Zebra 偵傛傞 BGP4 偺愝掕
   
18. 偦偺懠偺岓曗
19. 偝傜偵愭偵恑傓偨傔偵
20. 幱帿
21. 擔杮岅栿偵偮偄偰

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

Chapter 1. 專帿

偙偺暥彂偼懡偔偺恖偵曺偘傞傕偺偱丄挊幰偼偙傟偵傛偭偰壗傜偐偺偍曉偟傪偟
偨偄偲峫偊偰偄傑偡丅側偐偱傕壗恖偐偺曽偺偍柤慜傪嫇偘傟偽:

 

 丒 Rusty Russell
   
 丒 Alexey N. Kuznetsov
   
 丒 The good folks from Google
   
 丒 The staff of Casema Internet
   
劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

Chapter 2. 偼偠傔偵

傛偆偙偦丄恊垽側傞撉幰偺傒側偝傫丅

偙偺暥彂偼 Linux 2.2/2.4 傪梡偄偰丄傛傝忋媺偺儖乕僥傿儞僌 (宱楬憖嶌) 傪
峴偆曽朄偵偮偄偰弎傋傛偆偲偡傞傕偺偱偡丅傎偲傫偳偺儐乕僓偵偼抦傜傟偰偄
側偄偙偲偱偡偑丄僗儁僋僞僋儖側嶌嬈傪峴偆僣乕儖傪丄偁側偨偼婛偵幚峴偟偰
偄傞偺偱偡丅幚偼 route 傗 ifconfig 側偳偼丄旕忢偵僷儚僼儖側 iproute2 偲
偄偆僀儞僼儔僗僩儔僋僠儍偺丄偛偔堦晹偺傒傪巊偆儔僢僷偵偡偓側偄偺偱偡丅

巹偼偙偺 HOWTO 偑丄netfilter 偱 (傕偪傠傫傎偐偱偱傕) 桳柤側 Rusty
Russell 偺 HOWTO 偲摨偠偔傜偄撉傒堈偄傕偺偱偁傞傛偆丄朷傫偱偄傑偡丅

HOWTO team <mailto:HOWTO@ds9a.nl> 偵憲怣偡傟偽丄偄偮偱傕変乆偲僐儞僞僋
僩傪庢傟傑偡丅偟偐偟丄偦偺幙栤偑偙偺 HOWTO 偵捈愙娭楢偡傞傕偺偱側偗傟偽
丄偱偒傟偽儊乕儕儞僌儕僗僩 (娭楢偡傞愡傪尒偰偔偩偝偄) 偵憲偭偰偔偩偝偄
丅変乆偼柍椏偺僿儖僾僨僗僋偱偼偁傝傑偣傫偑丄儊乕儕儞僌儕僗僩偵偍偗傞幙
栤偵偼摎偊傞偙偲偑懡偄偼偢偱偡丅

偙偺 HOWTO 偱柪巕偵側傞慜偵堦尵丅傕偟娙扨側懷堟惂尷 (traffic shaping)
傪峴偄偨偄偩偗側傜偽丄偡傋偰旘偽偟偰偦偺懠偺岓曗偺復偵岦偐偭偰偔偩偝偄
丅偦偟偰 CBQ.init 偵娭偡傞婰弎傪撉傫偱偔偩偝偄丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

2.1. 柶愑偍傛傃儔僀僙儞僗

This document is distributed in the hope that it will be useful, but
WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

In short, if your STM-64 backbone breaks down and distributes
pornography to your most esteemed customers - it's never our fault.
Sorry.

Copyright (c) 2002 by bert hubert, Gregory Maxwell, Martijn van
Oosterhout, Remco van Mook, Paul B. Schroeder and others. This material
may be distributed only subject to the terms and conditions set forth
in the Open Publication License, v1.0 or later (the latest version is
presently available at http://www.opencontent.org/openpub/).

Please freely copy and distribute (sell or give away) this document in
any format. It's requested that corrections and/or comments be
forwarded to the document maintainer.

It is also requested that if you publish this HOWTO in hardcopy that
you send the authors some samples for "review purposes" :-)

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

2.1.1. 擔杮岅栿 (嶲峫)

偙偺暥彂偼桳塿偱偁傞偙偲傪婅偭偰攝晍偝傟偰偄傑偡偑丄堦愗偺曐徹偼偁傝傑
偣傫丅彜梡丒摿掕梡搑傊偺揔崌偵娭偡傞丄栙帵揑側曐徹傕堦愗偁傝傑偣傫丅

梫偡傞偵丄傕偟偁側偨偺 STM-64 僶僢僋儃乕儞偑夡傟偰棊偪偨傝丄戝帠側屭媞
偵億儖僲傪偽傜傑偄偰偟傑偭偨偲偟偰傕 - 偦傟偼巹偨偪偺愑擟偱偼偁傝傑偣傫
丅偛傔傫側偝偄丅

Copyright (c) 2002 by bert hubert, Gregory Maxwell, Martijn van
Oosterhout, Remco van Mook, Paul B. Schroeder 傎偐丅偙偺暥彂偼 Open
Publication License, v1.0 偍傛傃偦傟埲崀偵帵偝傟偰偄傞崁栚偲忦審偵廬偭
偨応崌偵尷傝丄攝晍偱偒傑偡 (OPL 偺嵟怴斉偼 http://www.opencontent.org/
openpub/ 偵偁傝傑偡)丅

偙偺暥彂偺暋幨傗嵞攝晍 (斕攧丒宨昳) 偼丄偳偺傛偆側僼僅乕儅僢僩偱傕壜擻
偱偡丅偨偩偟廋惓傗僐儊儞僩偑丄偙偺暥彂偺娗棟幰偵憲傜傟傞傛偆偵偟偰偔偩
偝偄丅

傑偨傕偟偙偺 HOWTO 傪彂愋偲偟偰弌斉偡傞応崌偼丄儗價儏乕偺偨傔偵丄挊幰傜
偵悢嶜偺僒儞僾儖傪憲偭偰偔偩偝偄 :-)

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

2.2. 帠慜偵昁梫側抦幆

僞僀僩儖偵偁傞傛偆偵丄偙傟偼 "Advanced" 側 HOWTO 偱偡丅儘働僢僩壢妛傎偳
偱偼偁傝傑偣傫偑丄偁傞掱搙偺帠慜抦幆偼偡偱偵偁傞傕偺偲偟偰偄傑偡丅

昁梫側抦幆傪摼傞偨傔偺嶲峫暥專傪偄偔偮偐偁偘偰偍偒傑偡丅

Rusty Russell 偺 networking-concepts-HOWTO <http://netfilter.samba.org/
    unreliable-guides/networking-concepts-HOWTO/index.html>
   
    旕忢偵椙偄摫擖暥彂偱丄僱僢僩儚乕僋偲偼壗偐丄懠偺僱僢僩儚乕僋偲愙懕
    偡傞偵偼偳偆偡傞偐傪愢柧偟偰偄傑偡丅
   
Linux Networking-HOWTO (埲慜偼 Net-3 HOWTO)
   
    朿戝側暘検偱丄偐偮傑偨摨帪偵旕忢偵徻嵶偱偡丅僀儞僞乕僱僢僩傊偺愙懕
    偵娭偡傞愝掕 (偦偺傎偲傫偳偼婛偵愝掕嵪傒側偺偱偟傚偆偑) 偵娭偟偰丄
    偨偔偝傫偺偙偲傪嫵偊偰偔傟傑偡丅 /usr/doc/HOWTO/NET3-4-HOWTO.txt 偵
    偁傞偙偲偑懡偄偲巚偄傑偡偑丄僆儞儔僀儞 <http://www.linuxports.com/
    howto/networking> 偱傕撉傔傑偡丅
   
劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

2.3. Linux 偵偱偒傞偙偲

幚尰壜擻側偙偲傪娙扨側儕僗僩偵偟偰傒傑偟偨丅

 丒 摿掕偺僐儞僺儏乕僞偵懳偡傞僶儞僪暆傪峣傞
   
 丒 摿掕偺僐儞僺儏乕僞偵乽岦偐偆乿僶儞僪暆傪峣傞
   
 丒 僶儞僪暆傪岞暯偵嫟桳偡傞偨傔偺庤彆偗傪偡傞
   
 丒 僱僢僩儚乕僋傪 DoS 峌寕偐傜庣傞
   
 丒 僀儞僞乕僱僢僩傪偁側偨偺屭媞偐傜庣傞
   
 丒 暋悢偁傞僒乕僶傪傂偲偮偵傑偲傔丄晧壸暘嶶傗壜梡惈偺岦忋傪幚尰偡傞
   
 丒 偁側偨偺僐儞僺儏乕僞傊偺傾僋僙僗傪惂尷偡傞
   
 丒 偁側偨偺儐乕僓偑峴偆懠偺儂僗僩傊偺傾僋僙僗傪惂尷偡傞
   
 丒 師偺傛偆側忣曬偵婎偯偄偰儖乕僥傿儞僌傪峴偆: 儐乕僓 id (杮摉)丄MAC
    傾僪儗僗丄敪怣尦 IP 傾僪儗僗丄億乕僩丄僒乕價僗僞僀僾丄帪崗丄僷働僢
    僩偺拞枴側偳
   
尰嵼偺偲偙傠丄偙傟傜偺愭恑揑側婡擻傪巊偭偰偄傞恖偼偁傑傝懡偔偁傝傑偣傫
丅偙傟偵偼偄偔偮偐偺棟桼偑偁傝傑偡丅採嫙偝傟偰偄傞暥彂偺婰弎偼徻嵶偱偡
偑丄偁傑傝幚慔揑側傕偺偱偼偁傝傑偣傫丅僩儔僼傿僢僋惂屼偼傎偲傫偳暥彂壔
偝傟偰偄傑偣傫丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

2.4. 偙偺暥彂偺娗棟偵偮偄偰偺儊儌

偙偺暥彂偵娭偟偰丄偄偔偮偐婥偵偲傔偰偄偰傎偟偄偙偲偑偁傝傑偡丅巹偼偙偺
暥彂偺戝晹暘傪彂偒傑偟偨偑丄崱屻傕偦偺傛偆偵偟懕偗偨偄偲偼寛偟偰巚偭偰
偄傑偣傫丅巹偼僆乕僾儞僜乕僗偺嫮偄怣曭幰偱偁傝丄偟偨偑偭偰奆偝傫偑僼傿
乕僪僶僢僋丄傾僢僾僨乕僩丄僷僢僠側偳傪憲偭偰偔偩偝傞偙偲傪丄偮偹偵娊寎
偟傑偡丅岆帤扙帤傗傛偔偁傞扨弮側娫堘偄偱傕丄墦椂偣偢偵抦傜偣偰偔偩偝偄
丅巹偺塸岅偑偪傚偭偲偓偛偪側偔姶偠傜傟傞傛偆偱偟偨傜丄偳偆偐巹偑僱僀僥
傿僽偱偼側偄偙偲傪巚偄弌偟偰偔偩偝偄丅婥寉偵採埬傪憲偭偰壓偝偄丅

偁傞晹暘偺儊儞僥僫儞僗傪傛傝椙偔峴偆帒奿偑帺暘偵偁傞偲姶偠傜傟偨傝丄偁
傞偄偼怴偟偄晹暘傪彂偄偰儊儞僥僫儞僗偱偒傞偲巚傢傟偨傜丄戝偄偵娊寎偟傑
偡丅偙偺 HOWTO 偺 SGML 偼 CVS 偱娗棟偝傟偰偄傑偡丅巹偼傕偭偲偨偔偝傫偺
恖偨偪偑偙偺暥彂偵娭偡傞嶌嬈傪峴偆傛偆側彨棃傪丄嫮偔婅偭偰偄傑偡丅

偙偺彆偗偲側傞傛偆丄偙偺暥彂偵偼 FIXME 偲偄偆拲堄彂偒偑偨偔偝傫抲偐傟偰
偄傑偡丅僷僢僠偼偮偹偵娊寎偟傑偡! FIXME 傪尒偮偗偨傜丄枹抦偺椞堟傪曕偄
偰偄傞偺偩偲巚偭偰偔偩偝偄丅偙傟偼懠偺晹暘偵娫堘偄偑側偄偲偄偆堄枴偱偼
偁傝傑偣傫偑丄偦偺傛偆側偲偙傠偱偼摿偵拲堄偟偰偔偩偝偄丅傕偟偳傟偐偺撪
梕傪妋擣偡傞偙偲偑偱偒偨傜丄巹偨偪偵抦傜偣偰偔偩偝偄丅偦偺 FIXME 傪彍嫀
偟傑偡丅

偙偺 HOWTO 偱丄巹偼彑庤側怳傞晳偄傪偟偰偄傞偙偲傕偁傝傑偡丅椺偊偽丄巹偼
10Mbit 偺僀儞僞乕僱僢僩愙懕傪慜採偲偟偰偄傑偡偑丄偙傟偑偦傟傎偳傛偔偁傞
忬嫷偱偼柍偄偙偲偼傛乕偔傢偐偭偰偄傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

2.5. 庢摼丄CVS 偍傛傃傾僢僾僨乕僩偺搳峞

偙偺暥彂偺尨杮偺抲偒応強偼偙偪傜 <http://www.ds9a.nl/lartc> 偱偡丅

尰嵼丄慡悽奅偐傜偺摻柤 CVS 傾僋僙僗偑壜擻偵側偭偰偄傑偡丅偙傟偵偼偄傠偄
傠側柺偱棙揰偑偁傝傑偡丅偙偺 HOWTO 偺傛傝怴偟偄斉傊偺峏怴偑娙扨偱偡偟丄
僷僢僠偺搳峞偵傕傑偭偨偔柺搢偑偁傝傑偣傫丅

偝傜偵丄挊幰払偑僜乕僗偵懳偟偰撈棫偵嶌嬈偱偒傞偺傕椙偄偲偙傠偱偡丅

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆$ export CVSROOT=:pserver:anon@outpost.ds9a.nl:/var/cvsroot         劆
劆$ cvs login                                                         劆
劆CVS password: [enter 'cvs' (without 's)]                            劆
劆$ cvs co 2.4routing                                                 劆
劆cvs server: Updating 2.4routing                                     劆
劆U 2.4routing/lartc.db                                               劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

曄峏傪峴偄丄偦傟傜傪採嫙偟偨偄偲巚傢傟傑偟偨傜丄 cvs -z3 diff -uBb 傪幚
峴偟丄偦偺弌椡傪 <howto@ds9a.nl> 偵儊乕儖偟偰偔偩偝偄丅偙偆偡傞偲丄変乆
偼妝偵斀塮嶌嬈偑偱偒傑偡丅傛傠偟偔丅偳偆偐曇廤偼昁偢 .db 僼傽僀儖偵懳偟
偰峴偭偰偔偩偝偄丅偪側傒偵懠偺僼傽僀儖偼丄偙偺 .db 僼傽僀儖偐傜惗惉偝傟
偨傕偺偱偡丅

Makefile 傪梡偄傞偲丄postscript, dvi, pdf, html, 僾儗僀儞僥僉僗僩偺惗惉
偑妝偵偱偒傑偡丅偙傟傜偺僼僅乕儅僢僩偡傋偰傪惗惉偡傞偵偼丄 docbook,
docbook-utils, ghostscript, tetex 偺僀儞僗僩乕儖偑昁梫偱偡丅

2.4routing.sgml 偼曇廤偟側偄傛偆偵偛拲堄偔偩偝偄! 偙偺拞枴偼杮 HOWTO 偺
屆偄斉偱偡丅惓偟偄僼傽僀儖偼 lartc.db 偱偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

2.6. 儊乕儕儞僌儕僗僩

昅幰偨偪偑庴偗庢傞丄偙偺 HOWTO 偵娭偡傞儊乕儖偼丄偩傫偩傫憹偊偰偒偰偄傑
偡丅僐儈儏僯僥傿偐傜偺嫽枴偑柧傜偐偵側偭偨偺偱丄儊乕儕儞僌儕僗僩傪奐巒
偟偰丄Advanced 儖乕僥傿儞僌偲僩儔僼傿僢僋惂屼偵娭偡傞媍榑傪奆偱偱偒傞傛
偆偵偟傑偟偨丅儕僗僩傪峸撉偡傞偺偼偙偪傜 <http://mailman.ds9a.nl/
mailman/listinfo/lartc> 偐傜偱偒傑偡丅

怽偟栿偁傝傑偣傫偑丄挊幰払偼儕僗僩埲奜偱恞偹傜傟偨幙栤偵懳偟偰偼丄傎偲
傫偳夞摎偡傞偙偲偑偁傝傑偣傫丅巹偨偪偼儕僗僩偺傾乕僇僀僽傪丄偁傞庬偺抦
幆僨乕僞儀乕僗偵偟偨偄偲峫偊偰偄傞偺偱偡丅幙栤偑偁傝傑偟偨傜丄傑偢傾乕
僇僀僽傪専嶕偟丄偦偟偰儊乕儕儞僌儕僗僩偵搳峞偟偰偔偩偝偄丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

2.7. 偙偺暥彂偺峔惉

変乆偼帺暘偨偪偑柺敀偄偲巚偭偨撪梕偼傎傏捈偪偵嶌嬈偟傑偡偑丄偙傟偼媡偵
丄嵟弶偼愢柧偑晄廫暘偩偭偨傝丄姰惉偟偰偄側偄晹暘偑偁傞偲偄偆偙偲偱傕偁
傝傑偡丅偡傒傑偣傫偑偦偺傛偆側偲偙傠偼栚傪偮傇偭偰偄偨偩偒丄偦偺偆偪偡
傋偰偑柧傜偐偵側傞丄偲巚偭偰偍偄偰偔偩偝偄丅

儖乕僥傿儞僌偲僼傿儖僞儕儞僌偼 2 偮偺暿乆偺偙偲偱偡丅僼傿儖僞儕儞僌偼
Rusty 偺 HOWTO 偱旕忢偵椙偔愢柧偝傟偰偄傑偡丅師偺応強偵偁傝傑偡丅

 丒 Rusty's Remarkably Unreliable Guides <http://netfilter.samba.org/
    unreliable-guides/>
   
巹偨偪偼丄 netfilter 偲 iproute2 傪慻傒崌傢偣偰壜擻偵側傞偙偲偵偮偄偰廤
拞偡傞偮傕傝偱偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

Chapter 3. iproute2 擖栧

3.1. 側偤 iproute2 側偺偐?

傎偲傫偳偺 Linux 僨傿僗僩儕價儏乕僔儑儞 (偍傛傃傎偲傫偳偺 UNIX) 偱偼丄
揱摑偁傞 arp, ifconfig, route 偲偄偭偨僐儅儞僪傪尰嵼偱傕梡偄偰偄傑偡丅
偙傟傜偺僣乕儖偼摦嶌偼偡傞傕偺偺丄 Linux 2.2 埲崀偱偼偲偒偳偒婜懸捠傝偺
摥偒傪偟側偄偙偲偑偁傝傑偡丅椺偊偽丄GRE 僩儞僱儖偼崱擔偱偼儖乕僥傿儞僌
偺堦晹偲側偭偰偄傑偡偑丄偙傟偵偼姰慡偵暿偺僣乕儖偑昁梫偱偡丅

iproute2 傪梡偄傟偽丄僩儞僱儖偺晹暘傕僣乕儖僙僢僩偵慻傒崬傑傟傑偡丅

2.2 埲崀偺 Linux 僇乕僱儖偵偼丄姰慡偵嵞愝寁偝傟偨僱僢僩儚乕僋僒僽僔僗僥
儉偑娷傑傟偰偄傑偡丅偙偺怴偟偄僱僢僩儚乕僋僐乕僪偵傛偭偰丄 Linux 偵偼惈
擻偲婡擻偲偺 (摿偵婡擻偵娭偟偰偼堦斒偺 OS 偺側偐偵傎偲傫偳嫞憟幰偑偄側
偄偔傜偄偺) 岦忋偑傕偨傜偝傟傑偟偨丅幚嵺偺偲偙傠丄怴偟偄儖乕僥傿儞僌丒
僼傿儖僞儕儞僌丒僋儔僗晅偗偺僐乕僪偼丄儖乕僞傗僼傽僀傾僂僅乕儖丄懷堟惂
尷側偳偺愱梡惢昳偺懡偔偵斾傋偰傕丄傛傝崅婡擻偵側偭偰偄傑偡丅

僱僢僩儚乕僉儞僌偵娭偡傞怴偨側奣擮偑敪柧偝傟傞偵偮傟丄偦傟傜偼婛懚偺 OS
偺婛懚偺僼儗乕儉儚乕僋偺忋偵揾傝屌傔傜傟偰偒傑偟偨丅偙偺傛偆側僔僗僥儉
偺懡憌壔偑恑傓偙偲偵傛偭偰丄僱僢僩儚乕僉儞僌僐乕僪偼 (恖娫偺尵岅偺懡偔
偵旕忢偵傛偔帡偨) 偨偔偝傫偺婏柇側怳傞晳偄偩傜偗偵側偭偰偟傑偄傑偟偨丅
夁嫀偵偼丄Linux 偼 SunOS 偺張棟偺懡偔傪僄儈儏儗乕僩偟偰偒傑偟偨偑丄偙傟
偼棟憐揑側偙偲偲偼尵偊傑偣傫偱偟偨丅

偙偺怴偟偄僼儗乕儉儚乕僋偼丄埲慜偺 Linux 偑媦偽側偐偭偨婡擻傪丄柧妋偵昞
尰偡傞偙偲傪壜擻偲偟偨偺偱偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

3.2. iproute2 偺奣棯

Linux 偼僶儞僪暆偺嫙媼偵娭偟偰愻楙偝傟偨僔僗僥儉傪旛偊偰偍傝丄偙傟偼
Traffic Control 偲屇偽傟偰偄傑偡丅偙偺僔僗僥儉偼丄僋儔僗暘偗丒桪愭晅偗
丄嫟桳壔丄惂尷偲偄偭偨條乆側庤朄傪丄撪岦偒丒奜岦偒偺僩儔僼傿僢僋椉曽偱
僒億乕僩偟偰偄傑偡丅

偱偼丄iproute2 偺壜擻惈傪庤抁偵偛徯夘偡傞偙偲偵偟傑偟傚偆丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

3.3. 帠慜偺昁梫忦審

傑偢儐乕僓儔儞僪偺僣乕儖偑僀儞僗僩乕儖偝傟偰偄傞偙偲傪妋擣偡傞昁梫偑偁
傝傑偡丅偙偺僷僢働乕僕偼 RedHat 偲 Debian 偺椉幰偱偼 'iproute' 偲偄偆柤
慜偵側偭偰偄傑偡丅偦傟埲奜偺応崌偱傕 ftp://ftp.inr.ac.ru/ip-routing/
iproute2-2.2.4-now-ss??????.tar.gz" 偐傜庢摼偱偒傑偡丅

嵟怴斉傪擖庤偡傞偵偼偙偺儕儞僋 <ftp://ftp.inr.ac.ru/ip-routing/
iproute2-current.tar.gz> 傕棙梡偱偒傑偡丅

iproute 偺堦晹偵偼丄揔愗側僇乕僱儖僆僾僔儑儞傪桳岠偵偟側偗傟偽巊偊側偄
傕偺傕偁傝傑偡丅側偍 RedHat 偺儕儕乕僗 6.2 埲慜偺僇乕僱儖偱偼丄僩儔僼傿
僢僋惂屼婡擻偑僨僼僅儖僩偺僇乕僱儖偵偼慻傒崬傑傟偰偄傑偣傫丅

RedHat 7.2 偵偼丄偡傋偰偑僨僼僅儖僩偱慻傒崬傑傟偰偄傑偡丅

傑偨帺暘偱僇乕僱儖傪梡堄偡傞応崌偵偼丄 netlink 僒億乕僩偑娷傑傟偰偄傞偙
偲傪妋擣偟偰偔偩偝偄丅 iproute2 偱偼偙傟偑昁梫偱偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

3.4. 尰嵼偺愝掕傪挷傋偰傒傞

嬃偐傟傞偐傕偟傟傑偣傫偑丄iproute2 偼婛偵愝掕嵪傒側偺偱偡! 尰忬偺僐儅儞
僪偱偁傞 ifconfig 偲 route 傕丄婛偵 advanced 側僔僗僥儉僐乕儖傪梡偄偰偄
傞偺偱偡丅偨偩偟旕忢偵婎杮揑側 (戅孅側) 愝掕偺傒偱偡偑丅

拞怱偲側傞僐儅儞僪偼 ip 偱偡丅偱偼偙偺僐儅儞僪偵丄変乆偺僀儞僞乕僼僃乕
僗偺忬懺傪昞帵偝偣偰傒傑偟傚偆丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

3.4.1. ip 偵儕儞僋傪昞帵偝偣傞

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆[ahu@home ahu]$ ip link list                                                    劆
劆1: lo: <LOOPBACK,UP> mtu 3924 qdisc noqueue                                     劆
劆    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00                       劆
劆2: dummy: <BROADCAST,NOARP> mtu 1500 qdisc noop                                 劆
劆    link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff                          劆
劆3: eth0: <BROADCAST,MULTICAST,PROMISC,UP> mtu 1400 qdisc pfifo_fast qlen 100    劆
劆    link/ether 48:54:e8:2a:47:16 brd ff:ff:ff:ff:ff:ff                          劆
劆4: eth1: <BROADCAST,MULTICAST,PROMISC,UP> mtu 1500 qdisc pfifo_fast qlen 100    劆
劆    link/ether 00:e0:4c:39:24:78 brd ff:ff:ff:ff:ff:ff                          劆
劆3764: ppp0: <POINTOPOINT,MULTICAST,NOARP,UP> mtu 1492 qdisc pfifo_fast qlen 10  劆
劆    link/ppp                                                                    劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

娐嫬偵傛偭偰昞帵偼堎側傝傑偡偑丄巹偺帺戭偺 NAT 儖乕僞偱 ip 偑昞帵偟偨偺
偼偙偺傛偆側撪梕偱偟偨丅偙偙偱偼偡傋偰偑捈愙娭學偟偰偄傞傢偗偱偼側偄偺
偱丄堦晹偺傒傪愢柧偟傑偡丅 

傑偢 loopback 僀儞僞乕僼僃乕僗偑偁傝傑偡丅偙傟偑側偔偰傕摦嶌偟偰偄傞僐
儞僺儏乕僞傕偁傞偐傕偟傟傑偣傫偑丄偦偺傛偆側忬嫷偼傑偢偄丄偲偄偆偺偑巹
偺傾僪僶僀僗偱偡丅 MTU 僒僀僘 (嵟戝揮憲扨埵) 偼 3924 僆僋僥僢僩偱丄僉儏
乕僀儞僌偼峴偄傑偣傫丅 loopback 僀儞僞乕僼僃乕僗偼僇乕僱儖偵傛傞堦庬偺
嫊峔偱偡偐傜丄偙傟偼摉慠偱偡丅

偄傑偼 dummy 僀儞僞乕僼僃乕僗偼旘偽偟傑偡丅偙傟偼偁側偨偺僐儞僺儏乕僞偵
偼側偄偱偟傚偆偐傜丅懕偄偰暔棟揑側僱僢僩儚乕僋僀儞僞乕僼僃乕僗偑 2 偮偁
傝傑偡丅傂偲偮偼働乕僽儖儌僨儉偺懁偵丄傕偆堦偮偼帺戭僀乕僒僱僢僩僙僌儊
儞僩偺懁偵偁傝傑偡丅偝傜偵丄ppp0 僀儞僞乕僼僃乕僗偑偁傞偺傕傢偐傝傑偡丅

IP 傾僪儗僗偑昞帵偝傟偰偄側偄偙偲偵婥偯偐傟偨偱偟傚偆偐丅 iproute 偼乽
儕儞僋乿偲乽IP 傾僪儗僗乿偲偄偆擇偮偺奣擮傪愗傝棧偟偰偄傑偡丅 IP 僄僀儕
傾僗傪梡偄傞偲丄乽摿掕偺乿IP 傾僪儗僗偲偄偆奣擮偼丄偳偺傒偪嬌傔偰晄揔愗
側傕偺偵側偭偰偟傑偄傑偡丅

偦偺偐傢傝 MAC 傾僪儗僗偼昞帵偝傟偰偄傑偡丅偙傟偼僀乕僒僱僢僩僀儞僞乕僼
僃乕僗偺僴乕僪僂僃傾幆暿巕偱偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

3.4.2. ip 偵 IP 傾僪儗僗傪昞帵偝偣傞

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆[ahu@home ahu]$ ip address show                                                 劆
劆1: lo: <LOOPBACK,UP> mtu 3924 qdisc noqueue                                     劆
劆    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00                       劆
劆    inet 127.0.0.1/8 brd 127.255.255.255 scope host lo                          劆
劆2: dummy: <BROADCAST,NOARP> mtu 1500 qdisc noop                                 劆
劆    link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff                          劆
劆3: eth0: <BROADCAST,MULTICAST,PROMISC,UP> mtu 1400 qdisc pfifo_fast qlen 100    劆
劆    link/ether 48:54:e8:2a:47:16 brd ff:ff:ff:ff:ff:ff                          劆
劆    inet 10.0.0.1/8 brd 10.255.255.255 scope global eth0                        劆
劆4: eth1: <BROADCAST,MULTICAST,PROMISC,UP> mtu 1500 qdisc pfifo_fast qlen 100    劆
劆    link/ether 00:e0:4c:39:24:78 brd ff:ff:ff:ff:ff:ff                          劆
劆3764: ppp0: <POINTOPOINT,MULTICAST,NOARP,UP> mtu 1492 qdisc pfifo_fast qlen 10  劆
劆    link/ppp                                                                    劆
劆    inet 212.64.94.251 peer 212.64.94.1/32 scope global ppp0                    劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

崱夞偼忣曬偑懡偔側傝傑偟偨丅偡傋偰偺傾僪儗僗偲丄偦傟偑偳偺僇乕僪偵懏偟
偰偄傞偐偑昞帵偝傟偰偄傑偡丅'inet' 偼 Internet (IPv4) 偺堄枴偱偡丅傎偐
偵傕偨偔偝傫偺傾僪儗僗僼傽儈儕乕偑偁傝傑偡偑丄尰嵼偺偲偙傠偼傑偩弌偰偒
偰偄傑偣傫丅

eth0 傪傕偆偪傚偭偲徻偟偔挷傋偰傒傑偟傚偆丅偙傟偵偼 inet 傾僪儗僗
'10.0.0.1/8' 偑娭楢晅偗傜傟偰偄傑偡丅偙傟偼壗傪堄枴偡傞偺偱偟傚偆? /8
偼僱僢僩儚乕僋傾僪儗僗晹偺價僢僩悢傪昞偟偰偄傑偡丅慡晹偱 32 價僢僩偁傝
傑偡偐傜丄巆傝偺 24 價僢僩偑僱僢僩儚乕僋偺撪晹偱巊偊傞傢偗偱偡丅
10.0.0.1 偺嵟弶偺 8 價僢僩偼 10.0.0.0 偲側傝傑偡偺偱丄偙傟偑変乆偺僱僢
僩儚乕僋傾僪儗僗偱偡丅傑偨変乆偺僱僢僩儅僗僋偼 255.0.0.0 偱偡丅

懠偺價僢僩偼偙偺僀儞僞乕僼僃乕僗偲愙懕偟偰偄傑偡丅椺偊偽 10.250.3.13 偵
偼丄 (尰嵼 10.0.0.1 偱偁傞) eth0 偐傜捈愙偵愙懕偱偒傑偡丅

ppp0 偵傕摨偠峫偊偑揔梡偱偒傑偡偑丄悢抣偑堘偄傑偡丅 ppp0 偺傾僪儗僗偼
212.64.94.251 偱丄僒僽僱僢僩儅僗僋偼偁傝傑偣傫丅偙傟偼 point-to-point
愙懕偱偁傞偙偲傪堄枴偟偰偍傝丄 212.64.94.251 傪彍偄偰偼丄偡傋偰偺傾僪儗
僗偑儕儌乕僩偱偡丅偨偩偟丄懠偵傕忣曬偑偁傝傑偡丅偙偺昞帵偵傛傟偽丄愙懕
偺懠抂偵偼丄 (傑偨傕傗) 扨撈偺傾僪儗僗 212.64.94.1 偺傒偑偁傝傑偡丅偙偺
/32 偼丄僱僢僩儚乕僋價僢僩偑堦愗懚嵼偟側偄偙偲傪堄枴偟偰偄傑偡丅

偙傟傜偺奣擮傪攃埇偡傞偙偲偼丄寛掕揑偵廳梫偱偡丅傕偟栤戣偑偁傞傛偆側傜
丄偙偺 HOWTO 偺嵟弶偺傎偆偱徯夘偟偨暥彂傪嶲徠偟偰壓偝偄丅

偝傜偵 'qdisc' 偵傕婥偯偄偨偱偟傚偆偐丅偙傟偼 Queueing Discipline 傪昞
偟偰偄傑偡丅偙傟傕屻傎偳旕忢偵廳梫偲側傝傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

3.4.3. ip 偵宱楬傪昞帵偝偣傞

偝偰丄偙傟偱 10.x.y.z 偲偄偆傾僪儗僗偺扵偟曽偼傢偐傝傑偟偨丅傑偨
212.64.94.1 偵摓払偡傞偙偲傕偱偒傑偡丅偟偐偟偙傟偩偗偱偼廫暘偱偼偁傝傑
偣傫丅慡悽奅傊偲摓払偡傞偨傔偺曽朄傪抦傞昁梫偑偁傝傑偡丅僀儞僞乕僱僢僩
偵偼 ppp 愙懕宱桼偱偮側偑偭偰偍傝丄傛偭偰 212.64.94.1 偼変乆偐傜悽奅偵
岦偗偨僷働僢僩傪憲傞愭偱丄傑偨偦偺寢壥傪巹偨偪偺偲偙傠偵栠偟偰偔傞応強
偱偁傞偙偲偑傢偐傝傑偡丅

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆[ahu@home ahu]$ ip route show                                       劆
劆212.64.94.1 dev ppp0  proto kernel  scope link  src 212.64.94.251   劆
劆10.0.0.0/8 dev eth0  proto kernel  scope link  src 10.0.0.1         劆
劆127.0.0.0/8 dev lo  scope link                                      劆
劆default via 212.64.94.1 dev ppp0                                    劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

偙傟偼傎傏尒偨偩偗偱傢偐傞偱偟傚偆丅嵟弶偺 3 峴偼丄婛偵 ip address show
偵傛偭偰帵偝傟偨忬懺傪昞帵偟偰偄傑偡丅嵟屻偺峴偼丄巆傝偺悽奅偑
212.64.94.1 偺愭偵尒偮偐傞偙偲丄偙傟偑変乆偺僨僼僅儖僩僎乕僩僂僃僀偱偁
傞偙偲傪帵偟偰偄傑偡丅偙傟偑傑偝偵乽尯娭岥乿偱偁傞偙偲偼丄尵梩偐傜傕傢
偐傝傑偡丅偡側傢偪変乆偼 212.64.94.1 偵僷働僢僩傪憲傟偽丄偁偲偺巆傝偼偦
偪傜偱柺搢傪尒偰傕傜偊傞偺偱偡丅

嶲徠偺偨傔偵丄屆偄 route 儐乕僥傿儕僥傿偺寢壥傕偍尒偣偟偰偍偒傑偟傚偆丅

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆[ahu@home ahu]$ route -n                                                      劆
劆Kernel IP routing table                                                       劆
劆Destination     Gateway         Genmask         Flags Metric Ref    Use       劆
劆Iface                                                                         劆
劆212.64.94.1     0.0.0.0         255.255.255.255 UH    0      0        0 ppp0  劆
劆10.0.0.0        0.0.0.0         255.0.0.0       U     0      0        0 eth0  劆
劆127.0.0.0       0.0.0.0         255.0.0.0       U     0      0        0 lo    劆
劆0.0.0.0         212.64.94.1     0.0.0.0         UG    0      0        0 ppp0  劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

3.5. ARP

ARP 偼傾僪儗僗夝寛僾儘僩僐儖 (Address Resolution Protocol) 偺堄枴偱丄 
RFC 826 <http://www.faqs.org/rfcs/rfc826.html> 偵婰弎偝傟偰偄傑偡丅ARP
偼僱僢僩儚乕僋偵偁傞儅僔儞偑丄摨偠儘乕僇儖僱僢僩儚乕僋偵偁傞懠偺儅僔儞
偺僴乕僪僂僃傾埵抲 (傾僪儗僗) 傪夝寛偡傞偨傔偵梡偄傑偡丅僀儞僞乕僱僢僩
偵偁傞儅僔儞偼丄堦斒偵柤慜偱抦傜傟偰偍傝丄偙偺柤慜偑 IP 傾僪儗僗傊偲夝
寛偝傟傑偡丅偙傟偑丄foo.com 僱僢僩儚乕僋偵偁傞儅僔儞偑 bar.net 僱僢僩儚
乕僋偵偁傞懠偺儅僔儞偲捠怣偱偒傞棟桼偱偡丅偟偐偟 IP 傾僪儗僗偼丄儅僔儞
偺暔棟揑側埵抲傪揱偊偰偼偔傟傑偣傫丅偦偙偱 ARP 偑搊応偡傞傢偗偱偡丅

旕忢偵娙扨側椺傪庢傝忋偘傑偟傚偆丅偄偔偮偐偺儅僔儞偐傜側傞僱僢僩儚乕僋
傪憐憸偟偰偔偩偝偄丅偄傑巹偺僱僢僩儚乕僋偵偁傞 2 戜偺儅僔儞偑丄 IP 傾僪
儗僗 10.0.0.1 偺 foo 偲 IP 傾僪儗僗 10.0.0.2 偺 bar 偱偁傞偲偟傑偡丅偄
傑 foo 偑丄bar 偑惗偒偰偄傞偐偳偆偐 ping 偱妋偐傔偨偄偲巚偄傑偟偨丅偟偐
偟巆擮側偙偲偵丄foo 偼偳偙偵 bar 偑偄傞偐偑傢偐傝傑偣傫丅傛偭偰 foo 偼
bar 偵 ping 偡傞傑偊偵丄ARP 梫媮傪憲傞昁梫偑偁傝傑偡丅偙偺 ARP 梫媮偼丄
乽bar (10.0.0.2)! 偳偙偵偄傞傫偩?乿偲 foo 偑嫨傇傛偆側傕偺偱偡丅偙偺寢
壥僱僢僩儚乕僋偺偡傋偰偺儅僔儞偼 foo 偑嫨傫偱偄傞偺傪暦偒傑偡偑丄bar
(10.0.0.2) 偺傒偑偙傟偵墳偊傑偡丅 bar 偼偙偺偲偒 ARP 曉怣傪捈愙 foo 偵
曉偟傑偡丅偙傟偼乽foo (10.0.0.1)丄巹偼偙偙 00:60:94:E9:08:12 偵偄傞傛乿
偲 bar 偑尵偆偺偵帡偰偄傑偡丅偙偺娙扨側丄桭払偑僱僢僩儚乕僋偺偳偙偵偄傞
偐傪抦傞偨傔偺傗傝庢傝偺屻偵丄 foo 偼 bar 偲捠怣偱偒傞傛偆偵側傝傑偡丅
偙傟偼 foo (foo 偺 arp 僉儍僢僔儏) 偑 bar 偺応強傪朰傟傞傑偱 (捠忢 Unix
偱偼 15 暘) 桳岠偱偡丅

偱偼丄幚嵺偵偳偺傛偆偵摦嶌偡傞偐傪尒偰傒傑偟傚偆丅偁側偨偺儅僔儞偺尰嵼
偺 arp/嬤椬僉儍僢僔儏/僥乕僽儖偼丄師偺傛偆偵偟偰傒傞偙偲偑偱偒傑偡丅

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆[root@espa041 /home/src/iputils]# ip neigh show                     劆
劆9.3.76.42 dev eth0 lladdr 00:60:08:3f:e9:f9 nud reachable           劆
劆9.3.76.1 dev eth0 lladdr 00:06:29:21:73:c8 nud reachable            劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

傒偰傢偐傞偲偍傝巹偺儅僔儞 espa041 (9.3.76.41) 偼丄 espa042 (9.3.76.42)
偍傛傃 espagate (9.3.76.1) 偺埵抲傪抦偭偰偄傑偡丅偙偙偱暿偺儅僔儞傪 arp
僉儍僢僔儏偵捛壛偟偰傒傑偟傚偆丅

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆[root@espa041 /home/paulsch/.gnome-desktop]# ping -c 1 espa043                  劆
劆PING espa043.austin.ibm.com (9.3.76.43) from 9.3.76.41 : 56(84) bytes of data.  劆
劆64 bytes from 9.3.76.43: icmp_seq=0 ttl=255 time=0.9 ms                         劆
劆                                                                                劆
劆--- espa043.austin.ibm.com ping statistics ---                                  劆
劆1 packets transmitted, 1 packets received, 0% packet loss                       劆
劆round-trip min/avg/max = 0.9/0.9/0.9 ms                                         劆
劆                                                                                劆
劆[root@espa041 /home/src/iputils]# ip neigh show                                 劆
劆9.3.76.43 dev eth0 lladdr 00:06:29:21:80:20 nud reachable                       劆
劆9.3.76.42 dev eth0 lladdr 00:60:08:3f:e9:f9 nud reachable                       劆
劆9.3.76.1 dev eth0 lladdr 00:06:29:21:73:c8 nud reachable                        劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

espa041 偑 espa043 偵愙懕傪帋傒偨寢壥丄 espa043 偺僴乕僪僂僃傾傾僪儗僗/
埵抲偑 arp/嬤椬僉儍僢僔儏偵捛壛偝傟傑偟偨丅傛偭偰 espa043 偺僄儞僩儕偑
(偦偺娫 2 戜偺娫偵捠怣偑側偔) 帪娫愗傟偵側傞傑偱丄 espa041 偼 espa043
偺応強傪抦偭偰偍傝丄ARP 梫媮傪憲傞昁梫偼偁傝傑偣傫丅

偱偼 espa043 傪 arp 僉儍僢僔儏偐傜嶍彍偟偰傒傑偟傚偆丅

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆[root@espa041 /home/src/iputils]# ip neigh delete 9.3.76.43 dev eth0  劆
劆[root@espa041 /home/src/iputils]# ip neigh show                       劆
劆9.3.76.43 dev eth0  nud failed                                        劆
劆9.3.76.42 dev eth0 lladdr 00:60:08:3f:e9:f9 nud reachable             劆
劆9.3.76.1 dev eth0 lladdr 00:06:29:21:73:c8 nud stale                  劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

偙傟偱 espa041 偼嵞傃 espa043 偑偳偙偵偁傞偐傪朰傟偰偟傑偭偨偺偱丄師偵
espa043 偲捠怣偟傛偆偲巚偭偨偲偒偵偼嵞搙 ARP 梫媮傪憲傞昁梫偑偁傝傑偡丅
忋婰偺弌椡偵偼丄espagate (9.3.76.1) 偑 "stale" 忬懺偵曄傢偭偨偙偲傕帵偝
傟偰偄傑偡丅偙傟偑堄枴偡傞偺偼丄埵抲忣曬偼傑偩桳岠偱偁傞傕偺偺丄偦偺儅
僔儞偲嵟弶偵傗傝庢傝傪偡傞嵺偵偼妋擣偑昁梫偱偁傞丄偲偄偆偙偲偱偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

Chapter 4. Rules - 儖乕僥傿儞僌億儕僔乕僨乕僞儀乕僗

戝婯柾側儖乕僞傪娗棟偟偰偄傞偲丄棙梡幰偦傟偧傟偵墳偠偰丄堘偭偨傗傝曽偱
僒乕價僗傪採嫙偟側偗傟偽側傜側偄偙偲偑傛偔偁傝傑偡丅儖乕僥傿儞僌億儕僔
乕僨乕僞儀乕僗偱暋悢偺儖乕僥傿儞僌僥乕僽儖僙僢僩傪梡偄傞偲丄偙傟偑壜擻
偲側傝傑偡丅

偙偺婡擻傪棙梡偟偨偄応崌偼丄僇乕僱儖偺僐儞僷僀儖偺嵺偵 "IP: advanced
router" 偲 "IP: policy routing" 偺奺婡擻傪桳岠偵偡傞昁梫偑偁傝傑偡丅

僇乕僱儖偼儖乕僥傿儞僌偺敾抐傪偡傞嵺偵丄偳偺僥乕僽儖偵偁偨傞傋偒偐傪傑
偢寛掕偟傑偡丅僨僼僅儖僩偱偼 3 偮偺僥乕僽儖偑偁傝傑偡丅屆偄 'route' 僣
乕儖偼丄main 僥乕僽儖偲 local 僥乕僽儖傪曄峏偟傑偡丅僨僼僅儖僩偱偼 ip
僣乕儖傕摨條偱偡丅

僨僼僅儖僩偺儖乕儖偼:

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆[ahu@home ahu]$ ip rule list                                        劆
劆0:      from all lookup local                                       劆
劆32766:  from all lookup main                                        劆
劆32767:  from all lookup default                                     劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

偙傟偼偡傋偰偺儖乕儖偺桪愭搙偺堦棗偱偡丅偡傋偰偺儖乕儖偑偡傋偰偺僷働僢
僩 ('from all') 偵揔梡偝傟傞偙偲偑傢偐傝傑偡丅埲慜偵傕 'main' 僥乕僽儖
偼尒偰偄傑偡 (ip route ls 偱弌椡偝傟偨傕偺偱偡)丅偟偐偟 'local' 僥乕僽
儖偲 'default' 僥乕僽儖偼崱夞偑弶傔偰偱偡丅

嬅偭偨偙偲傪偡傞偵偼丄暿偺僥乕僽儖傪巜偡儖乕儖傪惗惉偟傑偡丅偙傟偵傛偭
偰僔僗僥儉儚僀僪偺儖乕僥傿儞僌婯懃傪忋彂偒偱偒傞偺偱偡丅

暋悢偺儅僢僠儖乕儖偑偁傞偲偒偵僇乕僱儖偑偳偺傛偆偵摦嶌偡傞偐偵娭偡傞惓
妋側巇慻傒偵偮偄偰偼丄Alexey 偺 ip-cref 暥彂傪尒偰偔偩偝偄丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

4.1. 娙扨側僜乕僗億儕僔乕儖乕僥傿儞僌

偙偙偱傑偨幚嵺偺椺傪尒偰傒傞偙偲偵偟傑偟傚偆丅巹偼 2 戜 (幚嵺偵偼偦傠偦
傠曉偝側偄偲偄偗側偄偺傕娷傔傞偲 3 戜) 偺働乕僽儖儌僨儉傪帩偭偰偄偰丄偦
傟傜偼 Linux 偺 NAT (儅僗僇儗乕僪) 儖乕僞偵偮側偑偭偰偄傑偡丅偙偙偵廧傫
偱偄傞恖払偼丄僀儞僞乕僱僢僩愙懕偺懳壙傪巹偵巟暐偭偰偄傑偡丅巹偺摨嫃恖
偺堦恖偑丄hotmail 偟偐尒偵峴偐側偄偺偱妟傪尭傜偟偰傎偟偄丄偲尵偭偰偒偨
偲偟傑偟傚偆丅巹偵堎懚偼偁傝傑偣傫偑丄斵傜偵偼儘乕僄儞僪偺曽偺働乕僽儖
儌僨儉傪巊偭偰傕傜偆偙偲偵偟傑偡丅

乽懍偄乿働乕僽儖儌僨儉偼 212.64.94.251 偱丄 212.64.94.1 偵 PPP 愙懕偝傟
偰偄傑偡丅乽抶偄乿働乕僽儖儌僨儉偼偄傠偄傠側 IP 傾僪儗僗傪庢傝傑偡偑丄
偙偺椺偱偼 212.64.78.148 偲偟丄195.96.98.253 偵愙懕偝傟偰偄傞偲偟傑偡丅

local 僥乕僽儖偼師偺捠傝:

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆[ahu@home ahu]$ ip route list table local                                   劆
劆broadcast 127.255.255.255 dev lo  proto kernel  scope link  src 127.0.0.1   劆
劆local 10.0.0.1 dev eth0  proto kernel  scope host  src 10.0.0.1             劆
劆broadcast 10.0.0.0 dev eth0  proto kernel  scope link  src 10.0.0.1         劆
劆local 212.64.94.251 dev ppp0  proto kernel  scope host  src 212.64.94.251   劆
劆broadcast 10.255.255.255 dev eth0  proto kernel  scope link  src 10.0.0.1   劆
劆broadcast 127.0.0.0 dev lo  proto kernel  scope link  src 127.0.0.1         劆
劆local 212.64.78.148 dev ppp2  proto kernel  scope host  src 212.64.78.148   劆
劆local 127.0.0.1 dev lo  proto kernel  scope host  src 127.0.0.1             劆
劆local 127.0.0.0/8 dev lo  proto kernel  scope host  src 127.0.0.1           劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

帺柧偱偡偑丄偳偙偐偱巜掕偟偰偍偐側偗傟偽側傜側偄撪梕偱偡丅偱丄偦傟偑偙
傟傜偱偡丅default 僥乕僽儖偼嬻偱偡丅

偱偼 'main' 僥乕僽儖傪傒傑偟傚偆:

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆[ahu@home ahu]$ ip route list table main                              劆
劆195.96.98.253 dev ppp2  proto kernel  scope link  src 212.64.78.148   劆
劆212.64.94.1 dev ppp0  proto kernel  scope link  src 212.64.94.251     劆
劆10.0.0.0/8 dev eth0  proto kernel  scope link  src 10.0.0.1           劆
劆127.0.0.0/8 dev lo  scope link                                        劆
劆default via 212.64.94.1 dev ppp0                                      劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

偙偙偱 'John' 偲偄偆怴偟偄僥乕僽儖傪丄偝偒傎偳壖掕偟偨摨嫃恖偺偨傔偵嶌
傝傑偡丅悢抣偩偗偱愝掕傪峴偆偙偲傕偱偒傑偡偑丄偙偺僥乕僽儖傪 /etc/
iproute2/rt_tables 偵捛壛偡傞傎偆偑偢偭偲妝偵側傝傑偡丅

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# echo 200 John >> /etc/iproute2/rt_tables                          劆
劆# ip rule add from 10.0.0.10 table John                             劆
劆# ip rule ls                                                        劆
劆0:      from all lookup local                                       劆
劆32765:  from 10.0.0.10 lookup John                                  劆
劆32766:  from all lookup main                                        劆
劆32767:  from all lookup default                                     劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

偙傟偱偁偲昁梫側偺偼 John 偺僥乕僽儖傪嶌偭偰丄儖乕僩僉儍僢僔儏傪僼儔僢
僔儏 (僋儕傾) 偡傞偩偗偱偡丅

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# ip route add default via 195.96.98.253 dev ppp2 table John        劆
劆# ip route flush cache                                              劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

偙傟偱姰椆偱偡丅偙傟傪 ip-up 偵懳偟偰幚憰偡傞偺偼丄撉幰偺壽戣偲偟偰偍偒
傑偟傚偆丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

4.2. 暋悢偺傾僢僾儕儞僋/僾儘僶僀僟偵懳偡傞儖乕僥傿儞僌

埲壓偺傛偆側傛偔偁傞応崌傪峫偊偰傒傑偟傚偆丅儘乕僇儖側僱僢僩儚乕僋 (1
戜偺儅僔儞偐傕偟傟傑偣傫偑) 傪僀儞僞乕僱僢僩傊偲愙懕偟偰偄傞僾儘僶僀僟
偑 2 偮偁傞傛偆側応崌偱偡丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆                                                                 ________ 劆
劆                                          +------------+        /         劆
劆                                          |            |       |          劆
劆                            +-------------+ Provider 1 +-------           劆
劆        __                  |             |            |     /            劆
劆    ___/  \_         +------+-------+     +------------+    |             劆
劆  _/        \__      |     if1      |                      /              劆
劆 /             \     |              |                      |              劆
劆| Local network -----+ Linux router |                      |     Internet 劆
劆 \_           __/    |              |                      |              劆
劆   \__     __/       |     if2      |                      \              劆
劆      \___/          +------+-------+     +------------+    |             劆
劆                            |             |            |     \            劆
劆                            +-------------+ Provider 2 +-------           劆
劆                                          |            |       |          劆
劆                                          +------------+        \________ 劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

偙偺愝掕偵偍偄偰偼丄捠忢 2 偮偺栤戣揰偑偁傝傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

4.2.1. 傾僋僙僗暘妱

嵟弶偺栤戣揰偼丄摿掕偺僾儘僶僀僟偐傜傗偭偰棃偨僷働僢僩偵懳偟偰丄墳摎傪
偳偺傛偆偵儖乕僥傿儞僌偡傞偐偱偡丅椺偊偽 Provider 1 偐傜偺僷働僢僩偵懳
偟偰丄曉怣傪嵞傃摨偠僾儘僶僀僟偵栠偡偵偼偳偆偡傟偽偄偄偱偟傚偆丅

傑偢婰崋揑側柤慜傪愝掕偟傑偟傚偆丅 $IF1 傪戞堦僀儞僞乕僼僃乕僗 (忋婰偺
奊偺 if1)丄 $IF2 傪戞擇僀儞僞乕僼僃乕僗偲偟傑偡丅師偵 $IP1 偼 $IF1 偵娭
楢晅偗傜傟偨 IP 傾僪儗僗丄 $IP2 偼 $IF2 偵娭楢晅偗傜傟偨 IP 傾僪儗僗偲
偟傑偡丅偝傜偵丄 $P1 傪 Provider 1 偺僎乕僩僂僃僀偺 IP 傾僪儗僗丄 $P2
傪 Provider 2 偺僎乕僩僂僃僀偺 IP 傾僪儗僗偲偟傑偡丅嵟屻偵丄$P1_NET 傪 
$P1 偺強懏偡傞 IP 僱僢僩儚乕僋丄 $P2_NET 傪 $P2 偺強懏偡傞 IP 僱僢僩儚
乕僋偲偟傑偡丅

2 偮偺儖乕僥傿儞僌僥乕僽儖傪捛壛偟傑偡丅偙偙偱偼 T1 偍傛傃 T2 偲偟傑偡
丅偙傟傜偼 /etc/iproute2/rt_tables 偵捛壛偟傑偡丅偦偟偰偙傟傜偺僥乕僽儖
偱偺儖乕僥傿儞僌傪師偺傛偆偵愝掕偟傑偡丅

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆          ip route add $P1_NET dev $IF1 src $IP1 table T1           劆
劆          ip route add default via $P1 table T1                     劆
劆          ip route add $P2_NET dev $IF2 src $IP2 table T2           劆
劆          ip route add default via $P2 table T2                     劆
劆                                                                    劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
摿暿側偙偲偼壗傕偟偰偍傜偢丄僎乕僩僂僃僀傊偺宱楬偲丄偦偺僎乕僩僂僃僀傪
宱桼偡傞 default 宱楬傪嶌偭偨偩偗偱偡丅偙傟偼忋棳偺僾儘僶僀僟偑 1 偮偩
偗偺応崌偲摨偠偱偡偑丄宱楬傪僾儘僶僀僟偛偲偵暿乆偺僥乕僽儖偵抲偄偰偄傑
偡丅偙偙偱偼僱僢僩儚乕僋偺宱楬偩偗偱廫暘偱偡丅側偤側傜僱僢僩儚乕僋傪巜
掕偡傟偽丄偦偙偵偁傞偡傋偰偺儂僗僩偵摓払偱偒丄慜弎偺傛偆偵僎乕僩僂僃僀
傕偦偺偆偪偺傂偲偮偩偐傜偱偡丅

師偵 main 儖乕僥傿儞僌僥乕僽儖傪愝掕偟傑偡丅僷働僢僩傪捈愙偺嬤椬偵憲傞
嵺偵偼丄偦偺嬤椬偵愙懕偟偰偄傞僀儞僞乕僼僃乕僗偐傜偵偡傞偺偑椙偄峫偊偱
偡丅偙偙偱 `src' 堷悢偵傛偭偰丄妋幚偵惓偟偄婲揰 IP 傾僪儗僗偑慖戰偝傟偰
偄傞偙偲偵傕拲栚偟偰偔偩偝偄丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆            ip route add $P1_NET dev $IF1 src $IP1                  劆
劆            ip route add $P2_NET dev $IF2 src $IP2                  劆
劆                                                                    劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
偙偙偱 default 儖乕僩傪岲偒側曽偵愝掕偟傑偡丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆            ip route add default via $P1                            劆
劆                                                                    劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
師偵儖乕僥傿儞僌偺 rule 傪愝掕偟傑偡丅偙傟傜偼幚嵺偵偼丄偳偺儖乕僥傿儞
僌僥乕僽儖傪巊偆偐偺慖戰偱偡丅婛偵僜乕僗傾僪儗僗偑晅偗傜傟偰偄傞応崌偵
偼丄偦偺僀儞僞乕僼僃乕僗偐傜弌偰偄偔傛偆偵宱楬傪慖傃偨偄偼偢偱偡丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆            ip rule add from $IP1 table T1                          劆
劆            ip rule add from $IP2 table T2                          劆
劆                                                                    劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
偙偺堦楢偺僐儅儞僪偵傛偭偰丄摿掕偺僀儞僞乕僼僃乕僗偐傜傗偭偰棃偨僩儔僼
傿僢僋偑丄昁偢偦偺僀儞僞乕僼僃乕僗傪捠偟偰墳摎偝傟傞偙偲偑妋幚偲側傝傑
偟偨丅

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆                                      Warning                                       劆
劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劎
劆撉幰偱偁傞 Rod Roark 偵傛傞偲: 乽$P0_NET 偑儘乕僇儖僱僢僩儚乕僋偱 $IF0              劆
劆傪偦偺僀儞僞乕僼僃乕僗偲偡傞偲丄師偺傛偆側僄儞僩儕傕捛壛偟偰偍偔傎偆偑              劆
劆椙偄偱偟傚偆                                                                        劆
劆劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉劆
劆劆ip route add $P0_NET     dev $IF0 table T1                                      劆劆
劆劆ip route add $P2_NET     dev $IF2 table T1                                      劆劆
劆劆ip route add 127.0.0.0/8 dev lo   table T1                                      劆劆
劆劆ip route add $P0_NET     dev $IF0 table T2                                      劆劆
劆劆ip route add $P1_NET     dev $IF1 table T2                                      劆劆
劆劆ip route add 127.0.0.0/8 dev lo   table T2                                      劆劆
劆劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊劆
劆乿                                                                                  劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

偝偰丄偙傟偼旕忢偵婎杮揑側愝掕偵偡偓傑偣傫丅偙傟偼儖乕僞偱摦嶌偟偰偄傞
僾儘僙僗偲丄儅僗僇儗乕僪偝傟偰偄傞応崌偵偼儘乕僇儖僱僢僩儚乕僋偵懳偟偰
傕摦嶌偡傞偱偟傚偆丅偦傟埲奜偲偟偰偼丄椉曽偺僾儘僶僀僟偐傜 IP 嬻娫傪傕
傜偭偰偄傞応崌偲丄曅曽偺僾儘僶僀僟偵懳偟偰偺傒儅僗僇儗乕僪傪偟偰偄傞応
崌偲偑峫偊傜傟傑偡丅偙偺偄偢傟偵偍偄偰傕丄偳偪傜偺僾儘僶僀僟傪捠偟偰敪
怣偡傞偐傪丄儘乕僇儖僱僢僩儚乕僋偺儅僔儞偺 IP 傾僪儗僗偐傜寛傔傞傛偆側
儖乕儖傪捛壛偡傞偙偲偵側傞偱偟傚偆丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

4.2.2. 晧壸暘嶶

擇斣栚偺栤戣揰偼丄擇偮偺僾儘僶僀僟傪捠偟偰弌偰峴偔僩儔僼傿僢僋傪僶儔儞
僗偝偣傞傗傝曽偱偡丅偙傟偼幚嵺偵偼丄慜弎偺傛偆側傾僋僙僗暘妱傪婛偵峴偭
偰偄傟偽丄擄偟偔偁傝傑偣傫丅

default 偺宱楬偲偟偰曅曽偺僾儘僶僀僟傪慖傇戙傢傝偵丄 default 宱楬傪
multipath 宱楬偲偟偰愝掕偟傑偡丅僨僼僅儖僩偺僇乕僱儖偱偼丄偙傟偱椉幰偺
僾儘僶僀僟傊偺宱楬偑僶儔儞僗偝傟傑偡丅偙傟偼師偺傛偆偵偟偰峴偄傑偡 (偙
偙偱傕傾僋僙僗暘妱偺愡偵偍偗傞椺偱偺応崌傪峫偊傑偡)丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆            ip route add default scope global nexthop via $P1 dev $IF1 weight 1 \ 劆
劆            nexthop via $P2 dev $IF2 weight 1                                     劆
劆                                                                                  劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
偙傟偱椉曽偺僾儘僶僀僟傊偺宱楬偑僶儔儞僗偝傟傑偡丅 weight 僷儔儊乕僞偼
丄堦曽偺僾儘僶僀僟傪傕偆堦曽傛傝桪愭偡傞傛偆挷愡偟傑偡丅

偙偺僶儔儞僗壔偼宱楬偵婎偯偄偨傕偺偱丄宱楬偼僉儍僢僔儏偝傟傞偨傔丄姰慡
偲偼尵偊傑偣傫丅側偤偐偲偄偆偲丄椙偔棙梡偝傟傞僒僀僩偵懳偡傞宱楬偼丄偮
偹偵摨偠僾儘僶僀僟偐傜弌偰峴偔偙偲偵側傞偐傜偱偡丅

偝傜偵丄杮摉偵偙傟傪幚峴偟偨応崌偼丄 Julian Anastasov 偺儁乕僕 <http://
www.ssi.bg/~ja/#routes> 偵偁傞僷僢僠傪傒傞偲傛偄偱偟傚偆丅偙傟傜傪梡偄
傞偲丄傛傝椙岲側摦嶌偑婜懸偱偒傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

Chapter 5. GRE 僩儞僱儖丄偦偺懠偺僩儞僱儖

Linux 偱偼 3 庬椶偺僩儞僱儖傪棙梡偱偒傑偡丅 IP in IP 僩儞僱儖丄GRE 僩儞
僱儖丄偦偟偰僇乕僱儖奜偱偺僩儞僱儖 (椺偊偽 PPTP 偺傛偆側傕偺) 偱偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

5.1. 僩儞僱儖偵娭偡傞堦斒揑側帠暱

僩儞僱儖傪梡偄傞偲丄旕忢偵椺奜揑側丄傑偨旕忢偵僗儅乕僩側忬嫷傪幚尰偱偒
傑偡丅傑偨僩儞僱儖偼丄愝掕傪惓偟偔峴傢側偄偲丄忬嫷傪儊僠儍儊僠儍偵偡傞
偙偲傕偁傝傑偡丅堄恾偟偰偄傞偙偲傪乽惓妋偵乿棟夝偟偰偄側偄尷傝丄
default 宱楬傪僩儞僱儖僨僶僀僗偵岦偗偰偼偄偗傑偣傫 :-) 傑偨丄僩儞僱儖傪
捠偡偲僆乕僶乕僿僢僪偑憹偊傑偡丅側偤側傜僩儞僱儖偱偼 IP 僿僢僟偵梋暘側
僨乕僞僙僢僩傪昁梫偲偡傞偐傜偱偡丅捠忢偙傟偼僷働僢僩偁偨傝 20 僶僀僩側
偺偱丄壖偵僱僢僩儚乕僋偺捠忢偺僷働僢僩僒僀僘 (MTU) 傪 1500 僶僀僩偲偡傟
偽丄僩儞僱儖傪捠偟偰憲傜傟傞僷働僢僩偼 1480 僶僀僩偺戝偒偝偟偐帩偨側偄
偙偲偵側傝傑偡丅偙傟偼昁偢偟傕栤戣偵側傞偲偼尷傝傑偣傫偑丄戝偒側僱僢僩
儚乕僋傪僩儞僱儖偱愙懕偟傛偆偲偡傞嵺偵偼丄 IP 僷働僢僩偺僼儔僌儊儞僩壔/
嵞峔惉偵偮偄偰丄傛偔曌嫮偟偰偍偔偙偲偱偡丅偁丄偦傟偐傜傕偪傠傫丄僩儞僱
儖傪孈傞嵟懍偺曽朄偼丄椉懁偐傜孈傝恑傔傞偙偲偱偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

5.2. IP in IP 僩儞僱儕儞僌

Linux 偱偼丄偙偺僩儞僱儖偺棙梡偼偐側傝愄偐傜壜擻偱偟偨丅 2 偮偺僇乕僱儖
儌僕儏乕儖丄ipip.o 偲 new_tunnel.o 偑昁梫偱偡丅

偄傑 3 偮偺僱僢僩儚乕僋偑偁傞偲偟傑偟傚偆丅撪晹僱僢僩儚乕僋 A 偲 B丄偦
偟偰偦偺拞娫偵偁傞僱僢僩儚乕僋 C (偁傞偄偼僀儞僞乕僱僢僩) 偱偡丅僱僢僩
儚乕僋 A 偼:

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆network 10.0.1.0                                                    劆
劆netmask 255.255.255.0                                               劆
劆router  10.0.1.1                                                    劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

偙偺儖乕僞偺僱僢僩儚乕僋 C 懁偺傾僪儗僗偼 172.16.17.18 偱偡丅

僱僢僩儚乕僋 B 偱偼:

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆network 10.0.2.0                                                    劆
劆netmask 255.255.255.0                                               劆
劆router  10.0.2.1                                                    劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

偙偺儖乕僞偺僱僢僩儚乕僋 C 懁偺傾僪儗僗偼 172.19.20.21 偱偡丅

偙偙偱偼僱僢僩儚乕僋 C 偼丄 A 偐傜 B 傊偺僷働僢僩 (偍傛傃偦偺媡) 傪偡傋
偰捠偡偲偟傑偡丅偙偙偵偼僀儞僞乕僱僢僩傪棙梡偡傞偙偲傕偱偒傑偡丅

偱偼嶌嬈偵擖傝傑偡:

傑偢嵟弶偵儌僕儏乕儖傪僀儞僗僩乕儖偟傑偡丅

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆modprobe ipip.o                                                     劆
劆modprobe new_tunnel.o                                               劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

懕偄偰僱僢僩儚乕僋 A 偺儖乕僞偱師偺撪梕傪幚峴偟傑偡:

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆ifconfig tunl0 10.0.1.1 pointopoint 172.19.20.21                    劆
劆route add -net 10.0.2.0 netmask 255.255.255.0 dev tunl0             劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

偦偟偰僱僢僩儚乕僋 B 偺儖乕僞偱偼:

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆ifconfig tunl0 10.0.2.1 pointopoint 172.16.17.18                    劆
劆route add -net 10.0.1.0 netmask 255.255.255.0 dev tunl0             劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

僩儞僱儖偺棙梡傪廔傢傞偵偼:

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆ifconfig tunl0 down                                                 劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

偁偭偲偄偆娫偵廔傢傝傑偟偨丅偨偩偟丄僽儘乕僪僉儍僗僩傗 IPv6 偺僩儔僼傿
僢僋傪 IP-in-IP 僩儞僱儖傪捠偟偰僼僅儚乕僪偡傞偙偲偼偱偒傑偣傫丅扨偵捠
忢偱偼捠怣偑偱偒側偄 2 偮偺 IPv4 僱僢僩儚乕僋傪愙懕偟偨偩偗丄偱偡丅屳姺
惈偵娭偟偰尵偄傑偡偲丄偙偺僐乕僪偼挿偄偙偲懚嵼偟偰偄傞偨傔丄偢偭偲愄偺
1.3 僇乕僱儖偔傜偄傑偱偼屳姺偱偡丅偟偐偟巹偑抦傞尷傝丄 Linux 偺
IP-in-IP 僩儞僱儖偼懠偺 OS 傗儖乕僞偲堦弿偵偼摦嶌偟傑偣傫丅偙傟偼僔儞僾
儖偱丄偪傖傫偲摥偒傑偡丅偙傟偱側偗傟偽側傜側偄棟桼偑偁傞側傜巊偊偽偄偄
偱偡偟丄偦偆偱側偗傟偽 GRE 傪巊偆偲偄偄偱偟傚偆丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

5.3. GRE 僩儞僱儕儞僌

GRE 偼尦乆 Cisco 偵傛偭偰奐敪偝傟偨僩儞僱儕儞僌僾儘僩僐儖偱丄 IP-in-IP
僩儞僱儕儞僌傛傝偼傕偆偪傚偭偲崅婡擻偱偡丅椺偊偽儅儖僠僉儍僗僩僩儔僼傿
僢僋傗 IPv6 傕丄GRE 僩儞僱儖傪捠偟偰揮憲偱偒傑偡丅

Linux 偱偼丄ip_gre.o 儌僕儏乕儖偑昁梫偱偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

5.3.1. IPv4 僩儞僱儕儞僌

傑偢愭偵 IPv4 偺僩儞僱儕儞僌偐傜峴偒傑偟傚偆丅

偄傑 3 偮偺僱僢僩儚乕僋偑偁傞偲偟傑偟傚偆丅撪晹僱僢僩儚乕僋 A 偲 B丄偦
偟偰偦偺拞娫偵偁傞僱僢僩儚乕僋 C (偁傞偄偼僀儞僞乕僱僢僩) 偱偡丅

僱僢僩儚乕僋 A 偼:
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆network 10.0.1.0                                                    劆
劆netmask 255.255.255.0                                               劆
劆router  10.0.1.1                                                    劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
偙偺儖乕僞偺僱僢僩儚乕僋 C 懁偺傾僪儗僗偼 172.16.17.18 偱偡丅偙偺僱僢僩
儚乕僋傪 neta 偲屇傃傑偟傚偆 (偊偊丄撈憂揑側柤慜偱側偄偺偼傢偐偭偰傑偡)
丅

偦偟偰僱僢僩儚乕僋 B 偼:
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆network 10.0.2.0                                                    劆
劆netmask 255.255.255.0                                               劆
劆router  10.0.2.1                                                    劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
偙偺儖乕僞偺僱僢僩儚乕僋 C 懁偺傾僪儗僗偼 172.19.20.21 偱偡丅偙偺僱僢僩
儚乕僋傪 netb 偲屇傃傑偟傚偆 (偙傟傕撈憂揑偱偼偁傝傑偣傫側)丅

僱僢僩儚乕僋 C 偼丄 A 偐傜 B 傊偺僷働僢僩 (偍傛傃偦偺媡) 偼偡傋偰捠偡偲
偟傑偡丅偙偙偱偼偦偺曽朄丒棟桼偵娭偟偰偼婥偵偟側偄偙偲偵偟傑偡丅

僱僢僩儚乕僋 A 偺儖乕僞偱丄師傪幚峴偟傑偡丅

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆ip tunnel add netb mode gre remote 172.19.20.21 local 172.16.17.18 ttl 255  劆
劆ip link set netb up                                                         劆
劆ip addr add 10.0.1.1 dev netb                                               劆
劆ip route add 10.0.2.0/24 dev netb                                           劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

偙偺撪梕偵偮偄偰彮乆愢柧偟傑偟傚偆丅1 峴栚偱偼僩儞僱儖僨僶僀僗傪捛壛偟
丄偦傟傪 netb 偲屇傇偙偲偵偟傑偟偨 (棟桼偼柧傜偐偱偟傚偆偑丄峴偒愭偺柤
慜偩偐傜偱偡)丅偝傜偵偙偙偱偼丄 GRE 僾儘僩僐儖傪梡偄傞偙偲 (mode gre)丄
儕儌乕僩傾僪儗僗偼 172.19.20.21 偱偁傞偙偲 (懠抂偺儖乕僞)丄僩儞僱儕儞僌
僷働僢僩偺敪怣尦偼 172.16.17.18 偱偁傞偙偲 (偙傟偵傛偭偰儖乕僞偵偼僱僢
僩儚乕僋 C 偺暋悢偺 IP 傾僪儗僗傪梌偊傞偙偲偑偱偒丄偦偺偆偪偺偳傟傪僩儞
僱儖偵梡偄傞偐傪寛掕偱偒傑偡)丄偦偟偰僷働僢僩偺 TTL 僼傿乕儖僪傪 255 偵
偡傞偙偲 (ttl 255)丄側偳傪巜掕偟偰偄傑偡丅

2 峴栚偱偼僨僶僀僗傪桳岠偵偟偰偄傑偡丅

3 峴栚偱偼丄怴偨偵惗傑傟偨僀儞僞乕僼僃乕僗 netb 偵丄傾僪儗僗 10.0.1.1
傪梌偊偰偄傑偡丅彫偝偄僱僢僩儚乕僋側傜偙傟偱 OK 偱偡偑丄偄傑偐傜峼嶳扵
専 (偨偔偝傫偺僩儞僱儖孈傝) 傪偼偠傔傛偆偲偟偰偄傞応崌偼丄僩儞僱儕儞僌
僀儞僞乕僼僃乕僗偵偼暿偺椞堟偺 IP 傾僪儗僗傪梌偊傞傎偆偑椙偄偐傕偟傟傑
偣傫 (偙偺椺側傜 10.0.3.0 偑巊偊傑偡)丅

4 峴栚偱偼丄僱僢僩儚乕僋 B 傊偺宱楬傪愝掕偟偰偄傑偡丅僱僢僩儚乕僋偺巜掕
偑堎側偭偰偄傞偙偲偵拲堄偟偰偔偩偝偄丅偙偺彂幃偵姷傟偰偄側偄恖偵丄娙扨
側尨棟傪愢柧偟傑偡: 僱僢僩儚乕僋傪 2 恑宍幃偱彂偒丄1 偺悢傪悢偊偰偔偩偝
偄丅傗傝曽偑傢偐傜側偗傟偽丄255.0.0.0 偑 /8丄 255.255.0.0 偑 /16丄
255.255.255.0 偑 /24 偱偁傞偲埫婰偟傑偟傚偆丅偁丄偦傟偐傜 255.255.254.0
偼 /23 偱偡丅擮偺偨傔丅

偙偙偼偙傟偱廫暘偱偟傚偆丅偱偼僱僢僩儚乕僋 B 偺儖乕僞偵峴偒傑偟傚偆丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆ip tunnel add neta mode gre remote 172.16.17.18 local 172.19.20.21 ttl 255  劆
劆ip link set neta up                                                         劆
劆ip addr add 10.0.2.1 dev neta                                               劆
劆ip route add 10.0.1.0/24 dev neta                                           劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
偦偟偰僩儞僱儖傪嶍彍偟偨偔側偭偨傜丄儖乕僞 A 偱:
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆ip link set netb down                                               劆
劆ip tunnel del netb                                                  劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
傕偪傠傫儖乕僞 B 偱偼 netb 傪 neta 偵抲偒姺偊偰偔偩偝偄丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

5.3.2. IPv6 僩儞僱儕儞僌

IPv6 傾僪儗僗偵娭偡傞愢柧偼 Section 6 傪尒偰偔偩偝偄丅

偱偼僩儞僱儖偵偮偄偰:

師偺傛偆側 IPv6 僱僢僩儚乕僋偑偁傞偲偟傑偡丅偦偟偰偙傟傪 6bone 傗桭払偺
僱僢僩儚乕僋偵愙懕偟偨偄偲偟傑偟傚偆丅

 
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆Network 3ffe:406:5:1:5:a:2:1/96                                     劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
IPv4 傾僪儗僗偼 172.16.17.18 偱丄6bone 儖乕僞偺 IPv4 傾僪儗僗偼
172.22.23.24 偲偟傑偡丅

 
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆ip tunnel add sixbone mode sit remote 172.22.23.24 local 172.16.17.18 ttl 255 劆
劆ip link set sixbone up                                                        劆
劆ip addr add 3ffe:406:5:1:5:a:2:1/96 dev sixbone                               劆
劆ip route add 3ffe::/15 dev sixbone                                            劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

愢柧偟傑偟傚偆丅1 峴栚偱偼丄 sixbone 偲偄偆柤慜偺僩儞僱儖僨僶僀僗傪惗惉
偟偰偄傑偡丅偙傟偵偼 mode sit (IPv6 傪 IPv4 偵僩儞僱儕儞僌偡傞) 傪梌偊
丄峴偒愭 (remote) 偲敪怣尦 (local) 傪巜掕偟偰偄傑偡丅 TTL 偼嵟戝偺 255
偵偟偰偄傑偡丅師偵丄偙偺僨僶僀僗傪傾僋僥傿僽偵偟偰偄傑偡 (up)丅偦偺屻丄
変乆偺僱僢僩儚乕僋偺傾僪儗僗傪捛壛偟丄 3ffe::/15 (尰嵼偺偲偙傠 6bone 偺
慡懱) 傊偺宱楬傪偙偺僩儞僱儖偵偟偰偄傑偡丅

GRE 僩儞僱儖偼尰嵼偺偲偙傠岲傫偱梡偄傜傟偰偄傞僩儞僱儕儞僌宍幃偱偡丅偙
傟偼 Linux 僐儈儏僯僥傿埲奜偱傕峀偔嵦梡偝傟偰偄傞昗弨偱丄傛偭偰椙偄傕偺
偱偁傞偲尵偊傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

5.4. 儐乕僓儔儞僪偺僩儞僱儖

僇乕僱儖奜偱偺僩儞僱儕儞僌偺幚憰傕丄暥帤捠傝偁傑偨懚嵼偟偰偄傑偡丅嵟傕
傛偔抦傜傟偰偄傞偺偼傕偪傠傫 PPP 偲 PPTP 偱偟傚偆偑丄懠偵傕偨偔偝傫偁傝
傑偡 (彜梡偺傕偺丄埨慡側傕偺丄IP 傪巊傢側偄傕偺偝偊偁傝傑偡)丅偨偩偟偙
傟傜偼偙偺 HOWTO 偺斖埻偐傜戝偒偔奜傟偰偄傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

Chapter 6. Cisco 傗 6bone 偲偺 IPv6 僩儞僱儖 

By Marco Davids <marco@sara.nl>

儊儞僥僫傊偺儊儌:

傢偨偟偺抦傞尷傝丄偙偺 IPv6-IPv4 僩儞僱儕儞僌偼 GRE 僩儞僱儕儞僌偺掕媊
偵偼摉偰偼傑傝傑偣傫丅 GRE 僩儞僱儖僨僶僀僗傪梡偄偰 IPv6 傪 IPv4 偵僩儞
僱儖偡傞偙偲偼偱偒傑偡 (GRE 偼乽側傫偱傕乿IPv4 偵捠偣傑偡) 偑丄偙偙偱梡
偄偰偄傞僨僶僀僗 ("sit") 偼 IPv6 偺傒傪 IPv4 偵捠偟傑偡偺偱丄偪傚偭偲堘
偄傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

6.1. IPv6 僩儞僱儕儞僌

偙傟偼 Linux 偺僩儞僱儕儞僌婡擻偺丄傑偨暿偺棙梡椺偱偡丅偙傟偼 IPv6 傪弶
婜偵摫擖偟偨恖 (偁傞偄偼乽愭嬱幰乿) 偨偪偵恖婥偑偁傝傑偡丅埲崀偱婰弎偝
傟偰偄傞乽幚慔揑乿側愢柧偼丄傕偪傠傫 IPv6 僩儞僱儕儞僌傪幚尰偡傞桞堦偺
曽朄偲偄偆傢偗偱偼偁傝傑偣傫丅偟偐偟偙傟偼丄IPv6 婡擻傪帩偭偨 Cisco 儖
乕僞偲 Linux 偲傪僩儞僱儖偡傞偺偵傛偔梡偄傜傟傞曽朄偱偡偟丄変乆偺宱尡偵
傛傟偽丄懡偔偺恖乆偑廬偭偰偄傞傗傝曽偱傕偁傝傑偡丅偙傟偑偁側偨偵傕摉偰
偼傑傞偱偁傠偆偙偲偼丄傑偢娫堘偄側偄偲巚偄傑偡偹 ;-)

IPv6 傾僪儗僗偵娭偟偰彮乆:

IPv6 傾僪儗僗偼丄IPv4 偺傾僪儗僗偵斾傋傞偲丄旕忢偵嫄戝 (128 價僢僩懳 32
價僢僩) 偱偡丅偙傟偵傛偭偰丄変乆偺朷傓傕偺偑採嫙偝傟傑偡丅偡側傢偪丄偨
偔偝傫偺丄偨偔偝傫偺 IP 傾僪儗僗丄惓妋偵尵偊偽
340,2822,6692,0938,4634,6337,4607,4317,6821,1465 屄偺傾僪儗僗偱偡丅偙傟
埲奜偵傕丄IPv6 (偁傞偄偼 IPng: IP Next Generation) 偱偼丄僀儞僞乕僱僢僩
偺僶僢僋儃乕儞儖乕僞偵偍偗傞宱楬僥乕僽儖偑彫偝偔側傝丄婡婍偺愝掕偑傛傝
扨弮偵側傝丄IP 儗儀儖偱偺僙僉儏儕僥傿偑傛傝寴屌偵側傞偲婜懸偝傟偰偄傑偡
丅

椺: 2002:836b:9820:0000:0000:0000:836b:9886

IPv6 傪偡傋偰彂偒壓偡偺偼丄偐側傝偺廳壸偱偡丅傛偭偰丄惗妶傪妝偵偡傞偨傔
偺婯懃偑偄偔偮偐偁傝傑偡丅

 

 丒 愭摢偐傜懕偔 0 偼巊偄傑偣傫丅IPv4 偲摨偠偱偡丅 
   
 丒 16 價僢僩偛偲 (2 僶僀僩偛偲) 偵僐儘儞偱嬫愗傝傑偡丅 
   
 丒 0 偑偨偔偝傫楢懕偡傞偲偙傠偼 :: 偺傛偆偵彂偗傑偡丅偨偩偟偙傟偑峴偊
    傞偺偼傾僪儗僗偺偆偪偺堦売強偩偗偱丄傑偨 16 價僢僩偺扨埵偵懳偟偰偺
    傒巊偊傑偡丅
   
 

傾僪儗僗 2002:836b:9820:0000:0000:0000:836b:9886 偼丄 2002:836b:9820::
836b:9886 偺傛偆偵傕彂偗傑偡丅屻幰偺傎偆偑偪傚偭偲偼恊偟傒傗偡偄偱偟傚
偆丅

暿偺椺丄傾僪儗僗 3ffe:0000:0000:0000:0000:0020:34A1:F32C 偼 3ffe::20:
34A1:F32C 偲傕彂偗傑偡丅偢偭偲抁偄偱偡偹丅

IPv6 偼尰嵼偺 IPv4 偺屻宲幰偲側傞傋偔奐敪偝傟傑偟偨丅偟偐偟 IPv6 偼傗傗
怴偟偄媄弍側偺偱丄傑偩悽奅婯柾偺僱僀僥傿僽側 IPv6 僱僢僩儚乕僋偼偁傝傑
偣傫丅 6bone 偼丄偙偺堏峴傪懍傗偐偵偡傞偨傔偵摫擖偝傟傑偟偨丅

僱僀僥傿僽側 IPv6 僱僢僩儚乕僋摨巑傪愙懕偡傞偺偵丄 IPv6 僾儘僩僐儖傪
IPv4 僷働僢僩偵僇僾僙儖偟丄婛懚偺 IPv4 僀儞僼儔傪捠偟偰丄憡庤偺 IPv6 僒
僀僩偵憲傞偺偱偡丅

偙偙偱傑偝偵僩儞僱儖傪棙梡偡傞偙偲偵側傞傢偗偱偡丅

IPv6 傪桳岠偵偡傞偵偼丄僇乕僱儖偺僒億乕僩偑昁梫偱偡丅偙傟偵偼懡偔偺椙幙
側暥彂偑懚嵼偟偰偄傑偡偑丄寢嬊偺偲偙傠偼偄偔偮偐偺抜奒偵暘妱偱偒傑偡丅

 丒 揔愗側 glibc 傪旛偊偨丄嵟嬤偺 Linux 僨傿僗僩儕價儏乕僔儑儞傪擖庤偟
    傑偡丅
   
 丒 嵟怴偺僇乕僱儖僜乕僗傪擖庤偟傑偡丅
   
弨旛偑惍偭偨傜丄IPv6 婡擻傪帩偮僇乕僱儖傪僐儞僷僀儖偟傑偡丅

 丒 /usr/src/linux 偵堏摦偟丄 "make menuconfig" 偲擖椡偟傑偡丅
   
 丒 "Networking Options" 傪慖傃傑偡丅
   
 丒 "The IPv6 protocol", "IPv6: enable EUI-64 token format", "IPv6:
    disable provider based addresses" 傪慖戰偟傑偡丅
   
僸儞僩: 儌僕儏乕儖偵偼偟側偄傎偆偑偄偄偱偟傚偆丅偆傑偔偄偐側偄偙偲偑傛
偔偁傝傑偡丅

暿偺尵偄曽傪偡傟偽丄IPv6 傪僇乕僱儖偺乽慻傒崬傒乿偵偟偰偔偩偝偄丅懕偄偰
捠忢偺傛偆偵愝掕傪曐懚偟丄僇乕僱儖偺僐儞僷僀儖偵堏偭偰偔偩偝偄丅

僸儞僩: 偦偺慜偵丄Makefile 傪曇廤偟偰 EXTRAVERSION = -x ; --> ;
EXTRAVERSION = -x-IPv6 偺傛偆偵偟偰偍偔偲偄偄偐傕偟傟傑偣傫丅

僇乕僱儖偺僐儞僷僀儖偲僀儞僗僩乕儖偵偁偨偭偰偼椙偄暥彂偑偨偔偝傫偁傝傑
偡偑丄偙偺暥彂偼偦偙傑偱偼彂偒傑偣傫丅傕偟偙偺抜奒偱僩儔僽儖偑惗偠偨傜
丄帺暘偱愝掕偟偨 Linux 僇乕僱儖偺僐儞僷僀儖偵娭偡傞暥彂傪扵偟偰撉傫偱偔
偩偝偄丅嵟弶偼 /usr/src/linux/README 僼傽僀儖偐傜尒偰傒傞偲偄偄偱偟傚偆
丅

偙傟傜偑偡傫偩傜丄怴偟偄僇乕僱儖偱嵞婲摦偟偰偔偩偝偄丅偙偙偱 '/sbin/
ifconfig -a' 偲偡傞偲丄'sit0' 偲偄偆怴偟偄僨僶僀僗偑偱偒偰偄傞偙偲偵婥
偯偔偱偟傚偆丅 SIT 偼 Simple Internet Transition 傪堄枴偟傑偡丅帺暘傪梍
傔偰偁偘傑偟傚偆丅偁側偨偼師悽戙偺 IP 傊偲岦偐偆丄戝偒側堦曕傪偄傑摜傒
弌偟偨偺偱偡丅

偱偼師偺堦曕偵岦偐偄傑偟傚偆丅帺暘偺儂僗僩 (偁傞偄偼 LAN 慡懱) 傪 IPv6
婡擻傪帩偭偨暿偺僱僢僩儚乕僋偵愙懕偟傑偡丅偙偺憡庤偼丄偙偺栚揑偺偨傔偵
摿暿偵愝掕偝傟偨 "6bone" 偲側傞偱偟傚偆丅

偁側偨偺 IPv6 僱僢僩儚乕僋偑 3ffe:604:6:8::/64 偱丄 6bone (偁傞偄偼桭
恖) 偵愙懕偡傞偙偲傪堄恾偟偰偄傞偲偟傑偡丅偙偙偱 /64 偲偄偆僒僽僱僢僩昞
婰偼丄捠忢偺 IP 傾僪儗僗偺応崌偲偪傚偆偳摨偠傛偆側堄枴傪帩偪傑偡丅

偁側偨偺帩偭偰偄傞 IPv4 傾僪儗僗偼 145.100.24.181 偱丄 6bone 儖乕僞偺
IPv4 傾僪儗僗偼 145.100.1.5 偩偲偟傑偟傚偆丅

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# ip tunnel add sixbone mode sit remote 145.100.1.5 [local 145.100.24.181 ttl 255]  劆
劆# ip link set sixbone up                                                            劆
劆# ip addr add 3FFE:604:6:7::2/126 dev sixbone                                       劆
劆# ip route add 3ffe::0/16 dev sixbone                                               劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

愢柧偟傑偟傚偆丅嵟弶偺峴偱偼 sixbone 偲偄偆柤慜偺僩儞僱儖僨僶僀僗傪惗惉
偟偰偄傑偡丅偙傟偵偼 mode sit (IPv6 傪 IPv4 偵僩儞僱儕儞僌偡傞) 傪梌偊
丄峴偒愭 (remote) 偲敪怣尦 (local) 傪巜掕偟偰偄傑偡丅 TTL 偼嵟戝偺 255
偵偟偰偄傑偡丅

師偵丄偙偺僨僶僀僗傪傾僋僥傿僽偵偟偰偄傑偡 (up)丅偦偺屻丄変乆偺僱僢僩儚
乕僋偺傾僪儗僗傪捛壛偟丄 3ffe::/15 (尰嵼偺偲偙傠 6bone 偺慡懱) 傊偺宱楬
傪偙偺僩儞僱儖偵偟偰偄傑偡丅傕偟偙傟傪幚峴偟偨儅僔儞偑丄偁側偨偺 IPv6
僎乕僩僂僃僀側傜丄師偺撪梕傪幚峴偡傞偲偄偄偱偟傚偆丅

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# echo 1 >/proc/sys/net/ipv6/conf/all/forwarding                    劆
劆# /usr/local/sbin/radvd                                             劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

擇斣栚偺峴偺 radvd 偼 (zebra 偺傛偆側) 儖乕僞峀曬僨乕儌儞偱丄 IPv6 偺帺
摦愝掕婡擻傪僒億乕僩偟偰偄傑偡丅昁梫側傜丄偍岲傒偺専嶕僄儞僕儞偱挷傋偰
傒偰偔偩偝偄丅偱偼師偺傛偆偵偟偰僠僃僢僋傪峴偄傑偟傚偆丅

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# /sbin/ip -f inet6 addr                                            劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

radvd 偑 IPv6 僎乕僩僂僃僀偱摦嶌偟偰偍傝丄 IPv6 婡擻傪帩偭偨 Linux 偑
LAN 忋偺儅僔儞偱婲摦偟偰偄傟偽丄 IPv6 帺摦愝掕偺壎宐傪妝偟傔傞偼偢偱偡
丅

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# /sbin/ip -f inet6 addr                                                      劆
劆1: lo: <LOOPBACK,UP> mtu 3924 qdisc noqueue inet6 ::1/128 scope host          劆
劆                                                                              劆
劆3: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 100          劆
劆inet6 3ffe:604:6:8:5054:4cff:fe01:e3d6/64 scope global dynamic                劆
劆valid_lft forever preferred_lft 604646sec inet6 fe80::5054:4cff:fe01:e3d6/10  劆
劆scope link                                                                    劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

偱偼堷偒懕偒 IPv6 傾僪儗僗偵懳偟偰 bind 偺愝掕傪峴偄傑偟傚偆丅 A 僞僀僾
偼 IPv6 偱偼 AAAA 偲側傝傑偡丅 in-addr.arpa 偼 ip.int 偲側傝傑偡丅偙偺
榖戣偵娭偟偰偼丄偨偔偝傫偺忣曬偑摼傜傟傞偱偟傚偆丅

IPv6 偑巊偊傞傾僾儕働乕僔儑儞偺悢偼憹偊懕偗偰偄傑偡丅 secure shell,
telnet, inetd, Mozilla 僽儔僂僓, webserver Apache, 傎偐偵傕偨偔偝傫偁傝
傑偡丅偟偐偟偦傟偼丄偙偺乽宱楬乿偵娭偡傞暥彂偺斖醗傪挻偊偰偄傑偡 :-)

Cisco 懁偱偺愝掕偼丄師偺傛偆側姶偠偵側傝傑偡丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆!                                                                   劆
劆interface Tunnel1                                                   劆
劆description IPv6 tunnel                                             劆
劆no ip address                                                       劆
劆no ip directed-broadcast                                            劆
劆ipv6 address 3FFE:604:6:7::1/126                                    劆
劆tunnel source Serial0                                               劆
劆tunnel destination 145.100.24.181                                   劆
劆tunnel mode ipv6ip                                                  劆
劆!                                                                   劆
劆ipv6 route 3FFE:604:6:8::/64 Tunnel1                                劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
傕偟巚偄捠傝偵側傞 Cisco 偑側偗傟偽丄僀儞僞乕僱僢僩偵偨偔偝傫偁傞 IPv6
僩儞僱儖僽儘乕僇乕偺偳傟偐傪帋偟偰傒傑偟傚偆丅偒偭偲 Cisco 偺愝掕傪峴偄
丄偁側偨梡偺僩儞僱儖傪孈偭偰偔傟傞偱偟傚偆丅偨偄偰偄偺応崌偼丄巊偄傗偡
偄 web 僀儞僞乕僼僃乕僗偑偁傞偼偢偱偡丅偍岲傒偺専嶕僄儞僕儞偱丄"ipv6
tunnel broker" 傪僉乕儚乕僪偵偟偰扵偟偰傒偰偔偩偝偄丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

Chapter 7. IPSEC: 僀儞僞乕僱僢僩墇偟偺埨慡側 IP

 嵟嬤偺 Linux 偵偼 2 庬椶偺 IPSEC 偑懚嵼偟傑偡丅 2.2 偲 2.4 偵偼 FreeS/
WAN 偑偁傝丄偙傟偑嵟弶偺儊僕儍乕側幚憰偱偟偨丅岞幃僒僀僩 <http://
www.freeswan.org/>偲旕岞幃僒僀僩 <http://www.freeswan.ca> 偑偁傝丄妶敪
偵儊儞僥僫儞僗偝傟偰偄傑偡丅FreeS/WAN 偼條乆側棟桼偐傜丄偙傟傑偱儊僀儞
偺僇乕僱儖偵偼儅乕僕偝傟偰偒傑偣傫偱偟偨丅嵟傕椙偔尵媦偝傟偰偒偨偺偼傾
儊儕僇恖奐敪幰偺乽惌帯揑乿側棟桼偱丄埫崋壔偵娭偟偰嶌嬈偡傞偲桝弌婯惂偑
偐偐偭偰偟傑偆偐傜偱偟偨丅偝傜偵 FreeS/WAN 偼 Linux 僇乕僱儖偵偁傑傝偆
傑偔摑崌偡傞偙偲偑偱偒偢丄幚嵺偺儅乕僕偵偁偨偭偰丄椙偄岓曗偵偼側傝傑偣
傫偱偟偨丅

傑偨丄僐乕僪偺昳幙偵娭偟偰傕懡偔偺 <http://www.edlug.ed.ac.uk/archive/
Sep2002/msg00244.html> 抍懱偐傜寽擮偺惡 <http://lists.freeswan.org/
pipermail/design/2002-November/003901.html> 偑偁偘傜傟傑偟偨丅 FreeS/
WAN 偺愝掕偵娭偟偰偼丄懡偔偺暥彂 <http://www.freeswan.ca/docs/
freeswan-1.99/doc/index.html> 偑棙梡偱偒傑偡 <http://www.freeswan.org/
doc.html>丅

Linux 2.5.47 偺崰偵偼丄僇乕僱儖偺僱僀僥傿僽側 IPSEC 幚憰偑懚嵼偟偰偄傑
偟偨丅偙傟偼 Alexey Kuznetsov 偲 Dave Miller 偵傛傞傕偺偱丄 USAGI IPv6
僌儖乕僾偺惉壥偐傜巋寖傪庴偗偨傕偺偱偟偨丅偙偺儅乕僕偵偁偨偭偰偼丄James
Morris 偺 CryptoAPI 傕僇乕僱儖偺堦晹偲側傝傑偟偨 (偙傟偑幚嵺偺埫崋壔傪
峴偄傑偡)丅

偙偺 HOWTO 偱偼丄2.5+ 斉偺 IPSEC 偺傒傪埖偄傑偡丅 Linux 2.4 偺儐乕僓偵
偼丄尰嵼偺偲偙傠偼 FreeS/WAN 傪偍彠傔偟傑偡偑丄偙偺愝掕偼僱僀僥傿僽偺
IPSEC 偺傕偺偲偼堎側傝傑偡丅娭楢僯儏乕僗偱偡偑丄偄傑偱偼 FreeS/WAN 偺儐
乕僓嬻娫偺僐乕僪傪丄僱僀僥傿僽側 Linux IPSEC 偲摦嶌偝偣傞偨傔偺僷僢僠
<http://gondor.apana.org.au/~herbert/freeswan/> 偑偁傞偦偆偱偡丅

2.5.49 偐傜偼丄IPSEC 偼僷僢僠傪昁梫偣偢偵摦嶌偱偒傞傛偆偵側傝傑偟偨丅

    Note: 儐乕僓嬻娫偺僣乕儖偼偙偪傜 <http://sourceforge.net/projects/
    ipsec-tools> 偐傜擖庤偱偒傑偡丅暋悢偺僾儘僌儔儉偑巊偊傑偡偑丄偙偙偱
    儕儞僋偟偨偺偼 Racoon 儀乕僗偺傕偺偱偡丅
   
    僇乕僱儖偺僐儞僷僀儖偵偁偨偭偰偼丄'PF_KEY', 'AH', 'ESP' 偦偺懠丄
    CryptoAPI 偺偡傋偰傪桳岠偵偟偰偔偩偝偄!
   
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆                              Warning                               劆
劌劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劎
劆偙偺復偺挊幰偼丄IPSEC 偵娭偟偰偼偳慺恖偱偡! 昁偢偁傞偱偁傠偆儈僗傪傕劆
劆偟尒偮偗偨傜丄偳偆偐 bert hubert <ahu@ds9a.nl> 偵儊乕儖偟偰偔偩偝偄 劆
劆丅                                                                  劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

傑偢嵟弶偵丄埨慡側捠怣傪 2 偮偺儂僗僩偺娫偱峴偆曽朄傪帵偟傑偡丅偙偺張棟
偺戝晹暘偼帺摦壔偱偒傑偡偑丄偙偙偱偼庤摦偱峴偭偰傒偰丄乽敔偺拞偱乿側偵
偑峴傢傟偰偄傞偺偐偵偮偄偰丄傛偔棟夝偡傞偙偲偵偟傑偟傚偆丅

帺摦偱偺尞張棟 (keying) 偵偩偗嫽枴偑偁傞偺偱偟偨傜丄師偺愡偼旘偽偟偰偔
偩偝偄丅偟偐偟庤摦偱偺尞張棟偵娭偡傞棟夝偼丄偒偭偲桳塿偱偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

7.1. 擖栧曇: 庤摦偱偺尞張棟

IPSEC 偼暋嶨側戣嵽偱偡丅偨偔偝傫偺忣曬偑僱僢僩儚乕僋忋偵偁傝傑偡偑丄偙
偺 HOWTO 偱偼摦嶌偱偒傞傛偆偵偡傞偙偲丄婎杮揑側尨棟傪愢柧偡傞偙偲偵廤拞
偟偨偄偲峫偊偰偄傑偡丅偡傋偰偺椺偼丄忋婰偺儕儞僋偵偁傞 Racoon 傪傕偲偵
偟偰偄傑偡丅

    Note: iptables 偺偨偄偰偄偺愝掕偱偼丄IPSEC 僷働僢僩傪棊偲偟偰偟傑偄
    傑偡! IPSEC 傪捠偡偵偼丄'iptables -A xxx -p 50 -j ACCEPT' 偲
    'iptables -A xxx -p 51 -j ACCEPT' 傪巊偭偰偔偩偝偄丅
   
IPSEC 偼僙僉儏儕僥傿偵桪傟偨僀儞僞乕僱僢僩僾儘僩僐儖偱偡丅偙偙偱偺乽僙
僉儏儕僥傿乿偵偼丄2 偮偺堄枴偑偁傝傑偡丅埫崋壔偍傛傃擣徹偱偡丅傢偐偭偰
側偄恖偼丄僙僉儏儕僥傿偡側傢偪埫崋壔偱偁傞偲峫偊偑偪偱偡偑丄偦傟偩偗偱
偼廫暘偱側偄偙偲偼娙扨偵帵偣傑偡丅捠怣偼埫崋壔偟偰偄偰傕丄捠怣愭偑帺暘
偺婜懸偟偰偄傞捠傝偐偳偆偐偺曐徹偑堦愗側偄偲偟偨傜偳偆偱偟傚偆偐?

IPSEC 偼埫崋壔偵偼 'Encapsulated Security Payload (ESP)' 傪丄偦偟偰儕儌
乕僩偺捠怣愭偺擣徹偵偼 'Authentication Header (AH)' 傪梡偄傑偡丅椉曽傪
巊偆傛偆偵傕愝掕偱偒傑偡偟丄曅曽偩偗傪巊偆偙偲傕偱偒傑偡丅

ESP 傕 AH 傕丄security assosiation (SA) 偵埶懚偟偰偄傑偡丅 SA 偼丄敪怣
尦丒憲怣愭丒庤懕偒偐傜側傝傑偡丅椺偊偽擣徹偺 SA 偼師偺傛偆偵側傝傑偡丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆          add 10.0.0.11 10.0.0.216 ah 15700 -A hmac-md5 "1234567890123456"; 劆
劆                                                                            劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
偙傟偼乽10.0.0.11 偐傜 10.0.0.216 偵岦偐偆僩儔僼傿僢僋偺偆偪 AH 傪昁梫
偲偡傞傕偺偼丄旈枾尞 123456789123456 傪梡偄偨 HMAC-MD5 偱彁柤偱偒傞乿偲
偄偆堄枴偱偡丅偙偺庤懕偒偵偼 SPI ('Security Parameter Index') 偺 id
15700 偑晅偗傜傟偰偄傑偡丅偙傟偵偮偄偰偼屻傎偳徻偟偔愢柧偟傑偡丅 SA 偺
嫽枴怺偄揰偼丄懳徧揑偩偲偄偆揰偵偁傝傑偡丅捠榖傪嫟桳偟偰偄傞椉抂偼丄傑
偭偨偔摨偠 SA 傪嫟桳偟丄懠抂偺嬀塮偵偼側傝傑偣傫丅偟偐偟側偑傜丄偙偙偱
偼 'autoreserve' 儖乕儖偑側偄偙偲偵拲堄偟傑偟傚偆丅偮傑傝偙偺 SA 偼丄
10.0.0.11 偐傜 10.0.0.216 傊偺擣徹偑壜擻偱偁傞偙偲偩偗傪帵偟偰偄傑偡丅
憃曽岦偺僩儔僼傿僢僋偵懳偟偰偼丄2 偮偺 SA 偑昁梫偲側傝傑偡丅

ESP SA 偺椺傪嫇偘傑偟傚偆丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆add 10.0.0.11 10.0.0.216 esp 15701 -E 3des-cbc "123456789012123456789012";  劆
劆                                                                            劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
偙傟偼乽10.0.0.11 偐傜 10.0.0.216 偵岦偐偆僩儔僼傿僢僋偺偆偪埫崋壔傪昁
梫偲偡傞傕偺偼丄尞 123456789012123456789012 傪梡偄偰埫崋壔偱偒傞乿偲偄
偆堄枴偱偡丅偙偺 SPI id 偼 '15701' 偱偡丅

偙偙傑偱偺偲偙傠丄SA 偑壜擻側庤懕偒傪婰弎偡傞偙偲傪尒偰偒傑偟偨偑丄偟偐
偟幚偼 SA 偼丄偄偮偦傟偑昁梫偵側傞偐偵娭偡傞億儕僔乕傪婰弎偟偰偄傑偣傫
丅幚嵺偺偲偙傠丄SPI id 偺傒偑堎側傞傎偲傫偳摨偠 SA 傪丄岲偒側偩偗抲偔偙
偲傕偱偒傞偺偱偡 (愭傎偳傕弎傋傑偟偨偑 SPI 偼 Security Parameter Index
偺堄枴偱偡)丅幚嵺偺埫崋壔傪峴偆偵偼丄億儕僔乕傪婰弎偟側偗傟偽側傝傑偣傫
丅偙偺億儕僔乕偵偼丄乽壜擻側傜 ipsec 傪巊偆乿偲偐乽ipsec 偑巊偊側偗傟偽
僩儔僼傿僢僋傪幪偰傞乿偲偐偄偭偨撪梕傪婰弎偱偒傑偡丅

揟宆揑偐偮娙扨側 Security Policy (SP) 偼師偺傛偆側傕偺偱偡丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆spdadd 10.0.0.216 10.0.0.11 any -P out ipsec                        劆
劆   esp/transport//require                                           劆
劆   ah/transport//require;                                           劆
劆                                                                    劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
儂僗僩 10.0.0.216 偱偙傟偑擖椡偝傟傞偲丄 10.0.0.11 偵岦偐偆偡傋偰偺僩儔
僼傿僢僋偼埫崋壔偝傟側偗傟偽側傜偢丄偐偮 AH (authenticating header: 擣
徹僿僢僟) 偱儔僢僾偝傟側偗傟偽側傝傑偣傫丅偨偩偟偙偙偱偼偳偺 SA 傪巊偆
傋偒偐偼婰弎偝傟偰偄傑偣傫丅偙傟傪寛掕偡傞偺偼僇乕僱儖偵巆偝傟偨巇帠側
偺偱偡丅

暿偺尵偄曽傪偡傟偽丄Security Policy 偼変乆偑乽壗傪乿昁梫偲偡傞偐傪巜掕
偡傞偺偱偡丅Security Association 偼偦傟傪乽偳偺傛偆偵乿昁梫偲偡傞偐傪婰
弎偟傑偡丅

憲傝弌偝傟傞僷働僢僩偼丄SA SPI (乽偳偺傛偆偵乿) 偱儔儀儖晅偗偝傟傑偡丅
僇乕僱儖偼偙傟傪巊偭偰埫崋壔偲擣徹傪峴偄丄儕儌乕僩偐傜偼偦傟偵懳墳偡傞
専徹偲暅崋壔偺庤懕偒傪挷傋傞偙偲偑偱偒傑偡丅

埲崀偵帵偡偺偼丄儂僗僩 10.0.0.216 偐傜 10.0.0.11 偵懳偟偰埫崋壔偲擣徹傪
梡偄偰捠怣偡傞応崌偺丄旕忢偵娙扨側愝掕偱偡丅偨偩偟嵟弶偺斉偱偼媡岦偒偼
暯暥偱偡偺偱丄偙傟偼幚嵺偵梡偄偰偼側傝傑偣傫丅

儂僗僩 10.0.0.216 偱偼:
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆#!/sbin/setkey -f                                                           劆
劆add 10.0.0.216 10.0.0.11 ah 24500 -A hmac-md5 "1234567890123456";           劆
劆add 10.0.0.216 10.0.0.11 esp 24501 -E 3des-cbc "123456789012123456789012";  劆
劆                                                                            劆
劆spdadd 10.0.0.216 10.0.0.11 any -P out ipsec                                劆
劆   esp/transport//require                                                   劆
劆   ah/transport//require;                                                   劆
劆                                                                            劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

儂僗僩 10.0.0.11 偱偼摨偠 Security Association 傪梡偄丄 Security Policy
偼巜掕偟傑偣傫丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆#!/sbin/setkey -f                                                           劆
劆add 10.0.0.216 10.0.0.11 ah 24500 -A hmac-md5 "1234567890123456";           劆
劆add 10.0.0.216 10.0.0.11 esp 24501 -E 3des-cbc "123456789012123456789012";  劆
劆                                                                            劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

埲忋偺愝掕傪峴偊偽 (偙傟傜偺僼傽僀儖偼 'setkey' 偑 /sbin 偵僀儞僗僩乕儖
偝傟偰偄傟偽幚峴偱偒傑偡)丄 10.0.0.126 偐傜峴偭偨 'ping 10.0.0.11' 偼丄
tcpdump 偱偼師偺傛偆偵尒偊傑偡丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆22:37:52 10.0.0.216 > 10.0.0.11: AH(spi=0x00005fb4,seq=0xa): ESP(spi=0x00005fb5,seq=0xa) (DF) 劆
劆22:37:52 10.0.0.11 > 10.0.0.216: icmp: echo reply                                             劆
劆                                                                                              劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
10.0.0.11 偐傜偺 ping 偺栠傝偑丄幚嵺偵暯暥偱尒偊傞偙偲偵拲栚丅僼僅儚乕
僪偺 ping 偼丄傕偪傠傫 tcpdump 偱偼尒偊傑偣傫丅偟偐偟 10.0.0.11 偵揱偊
偰偄傞 AH 偲 ESP 偺 Security Parameter Index丄偡側傢偪僷働僢僩偺擣徹妋
擣偲暋崋壔偺曽朄丄偼尒偊偰偄傑偡丅

偟偐偟丄偙偙偱偄偔偮偐偺揰偵怗傟偰偍偔昁梫偑偁傝傑偡丅忋婰偺愝掕偼丄懡
偔偺 IPSEC 偺椺偱帵偝傟偰偄傞傕偺偱偡偑丄旕忢偵婋尟側偺偱偡丅栤戣偼師偺
揰偵偁傝傑偡丅忋婰偵偍偗傞億儕僔乕偱偼丄 10.0.0.216 偑 10.0.0.11 偵岦偐
偆僷働僢僩傪偳偆庢傝埖偆偐偲丄 10.0.0.11 偑偙傟傜偺僷働僢僩傪偳偆埖偆偐
偼掕傔偰偄傑偡偑丄偟偐偟 10.0.0.11 偑擣徹偱偒側偄/暋崋壔偱偒側偄僩儔僼
傿僢僋傪偳偺傛偆偵幪偰傞偐傪帵偟偰偄側偄偺偱偡!

偙傟偱偼丄扤偐偑搑拞偱僷働僢僩傪搻傒丄姰慡偵暋崋壔偝傟偨僷働僢僩偱抲偒
姺偊傞偲丄 10.0.0.11 偼偦傟傪庴偗擖傟偰偟傑偄傑偡丅偙傟傪旔偗傞偵偼丄摓
拝僷働僢僩偵懳偡傞 Security Policy 偑 10.0.0.11 偵昁梫偱偡丅師偺傛偆偵
偟傑偡丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆#!/sbin/setkey -f                                                   劆
劆spdadd 10.0.0.216 10.0.0.11 any -P IN ipsec                         劆
劆   esp/transport//require                                           劆
劆   ah/transport//require;                                           劆
劆                                                                    劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
偙傟偼 10.0.0.11 偵懳偟偰丄 10.0.0.216 偐傜棃偨僩儔僼傿僢僋偵懳偟偰丄惓
偟偄 ESP 偲 AH 偑昁梫偱偁傞丄偲巜掕偟偰偄傑偡丅

偝偰丄愝掕傪姰椆偡傞偵偼丄傕偪傠傫婣傝偺僩儔僼傿僢僋偵傕摨條側埫崋壔丒
擣徹偑昁梫偱偡丅 10.0.0.216 偵偍偗傞姰慡側愝掕偼:
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆#!/sbin/setkey -f                                                           劆
劆flush;                                                                      劆
劆spdflush;                                                                   劆
劆                                                                            劆
劆# AH                                                                        劆
劆add 10.0.0.11 10.0.0.216 ah 15700 -A hmac-md5 "1234567890123456";           劆
劆add 10.0.0.216 10.0.0.11 ah 24500 -A hmac-md5 "1234567890123456";           劆
劆                                                                            劆
劆# ESP                                                                       劆
劆add 10.0.0.11 10.0.0.216 esp 15701 -E 3des-cbc "123456789012123456789012";  劆
劆add 10.0.0.216 10.0.0.11 esp 24501 -E 3des-cbc "123456789012123456789012";  劆
劆                                                                            劆
劆spdadd 10.0.0.216 10.0.0.11 any -P out ipsec                                劆
劆           esp/transport//require                                           劆
劆           ah/transport//require;                                           劆
劆                                                                            劆
劆spdadd 10.0.0.11 10.0.0.216 any -P in ipsec                                 劆
劆           esp/transport//require                                           劆
劆           ah/transport//require;                                           劆
劆                                                                            劆
劆                                                                            劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

偦偟偰 10.0.0.11 偱偼:
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆#!/sbin/setkey -f                                                           劆
劆flush;                                                                      劆
劆spdflush;                                                                   劆
劆                                                                            劆
劆# AH                                                                        劆
劆add 10.0.0.11 10.0.0.216 ah 15700 -A hmac-md5 "1234567890123456";           劆
劆add 10.0.0.216 10.0.0.11 ah 24500 -A hmac-md5 "1234567890123456";           劆
劆                                                                            劆
劆# ESP                                                                       劆
劆add 10.0.0.11 10.0.0.216 esp 15701 -E 3des-cbc "123456789012123456789012";  劆
劆add 10.0.0.216 10.0.0.11 esp 24501 -E 3des-cbc "123456789012123456789012";  劆
劆                                                                            劆
劆                                                                            劆
劆spdadd 10.0.0.11 10.0.0.216 any -P out ipsec                                劆
劆           esp/transport//require                                           劆
劆           ah/transport//require;                                           劆
劆                                                                            劆
劆spdadd 10.0.0.216 10.0.0.11 any -P in ipsec                                 劆
劆           esp/transport//require                                           劆
劆           ah/transport//require;                                           劆
劆                                                                            劆
劆                                                                            劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

偙偺椺偱偼丄摨堦偺尞傪椉曽岦偺僩儔僼傿僢僋偵梡偄偰偄傑偡丅偟偐偟偙傟偼
丄昁梫忦審偱偼傑偭偨偔偁傝傑偣傫丅

偄傑峴偭偨愝掕傪妋擣偡傞偵偼丄 setkey -D 傪幚峴偟偰 Security
Association 傪昞帵偡傞偐丄 setkey -DP 傪幚峴偟偰愝掕偝傟偨億儕僔乕傪昞
帵偟偰偔偩偝偄丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

7.2. 帺摦偱偺尞張棟

堦偮慜偺愡偱偼丄埫崋壔偼扨弮側嫟桳尞偵傛偭偰峴傢傟傑偟偨丅偟偨偑偭偰丄
埨慡傪妋曐偡傞偵偼丄偙偺埫崋壔愝掕傪怣棅偱偒傞宱楬偱揮憲偟側偗傟偽偄偗
傑偣傫丅儕儌乕僩偺儂僗僩傪 telnet 偱愝掕偟側偗傟偽側傜側偄傛偆側応崌偵
偼丄戞嶰幰偵偙偺嫟桳尞偑擿偗偰偟傑偆偺偱丄偦偺愝掕偑埨慡偱偁傞偲偼尵偊
傑偣傫丅

偝傜偵丄尞偑嫟桳偝傟偰偄傞偲偄偆偙偲偼丄旈摻惈偑側偄偲偄偆偙偲偱偡丅儕
儌乕僩偼偙偺尞傪梡偄偰傕偨偄偟偨埆偝偼偱偒傑偣傫偑丄偟偐偟暿乆偺憡庤偲
捠怣偡傞嵺偵偼丄昁偢偦傟偧傟暿乆偺尞傪巊偆昁梫偑偁傝傑偡丅偙傟偵偼尞偺
悢偑旕忢偵偨偔偝傫昁梫偱偡丅傕偟 10 慻偺僷乕僩僫乕傪慻傓側傜丄嵟掅 50
庬椶偺尞偑昁梫偱偡 (栿拲 10_C_2 側傜 45 偩偲巚偄傑偡偑乧)丅

懳徧尞偺栤戣偵壛偊丄尞偺峏怴偵傕栤戣偑偁傝傑偡丅戞嶰幰偑廫暘側検偺僩儔
僼傿僢僋傪搻挳偡傞偲丄尞傪儕僶乕僗僄儞僕僯傾儕儞僌偡傞偙偲偑晄壜擻偱偼
側偔側傝傑偡丅偙傟偼帪乆尞傪怴偟偔偡傞偙偲偵傛偭偰旔偗傜傟傑偡偑丄偙傟
偼帺摦壔偑昁梫側張棟偱偡丅

傕偆傂偲偮偺栤戣偲偟偰丄慜弎偟偨傛偆側庤摦偺尞張棟偱偼丄傾儖僑儕僘儉偲
尞偺挿偝傪惓妋偵掕媊偟側偗傟偽側傜偢丄儕儌乕僩偲偺挷惍偺庤娫偑偐偐傝傑
偡丅傕偭偲暆峀偄尞億儕僔乕傪婰弎偱偒傞傎偆偑朷傑偟偄偱偡丅椺偊偽乽偙偪
傜偱偼 3DES 偲 Blowfish 偑巊偊偰丄尞偺挿偝偵偼師偺傛偆側偺偑巊偊傑偡乿
偺傛偆偵丅

偙傟傜偺栤戣傪夝寛偡傞偨傔偵丄IPSEC 偱偼 Internet Key Exchange 偑巊偊傑
偡丅偙傟偼傾儖僑儕僘儉偺徻嵶傪僱僑僔僄乕僩偟偰丄儔儞僟儉偵惗惉偝傟偨尞
傪帺摦揑偵岎姺偟丄旕懳徧埫崋壔媄弍傪梡偄偰尞傪揮憲偟傑偡丅

Linux 2.5 偺 IPSEC 幚憰偱偼丄KAME 偺 'racoon' IKE 僨乕儌儞偑摦嶌偟傑偡
丅 11 寧 9 擔 (栿拲: 2002 擭) 偺抜奒偱偼丄Alexey 偺 iptools 攝晍偵擖偭
偰偄傞 racoon 偼丄僐儞僷僀儖偼偱偒傑偡偑丄2 偮偺僼傽僀儖偱 #include
<net/route.h> 傪嶍彍偡傞昁梫偑偁傝傑偡丅傑偨偼丄巹傕僐儞僷僀儖嵪僶僀僫
儕 <http://ds9a.nl/ipsec/racoon.bz2> 傪採嫙偟偰偄傑偡丅

    Note: IKE 偼 UDP 億乕僩 500 偵傾僋僙僗偱偒傞昁梫偑偁傝傑偡丅
    iptables 偱僽儘僢僋偟偰偄側偄偙偲傪妋擣偟傑偟傚偆丅
   
劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

7.2.1. 棟榑

愭偵愢柧偟偨捠傝丄帺摦尞張棟偱偼懡偔偺嶌嬈傪偟偰偔傟傑偡丅摿偵丄
Security Associations 傪摦嶌偺搑拞偱惗惉偟偰偔傟傑偡丅偟偐偟億儕僔乕偺
愝掕偼丄婓朷偡傞傛偆偵偼峴偭偰偔傟傑偣傫丅

傛偭偰丄IKE 偺壎宐傪嫕庴偡傞偵偼丄億儕僔乕偼愝掕偟偰丄 SA 偼愝掕偟側偄
丄偲偄偆偙偲偵側傝傑偡丅僇乕僱儖偼 SA 偺柍偄 IPSEC 億儕僔乕傪敪尒偡傞偲
偦傟傪 IKE 僨乕儌儞偵抦傜偣丄偦偟偰僨乕儌儞偑僱僑僔僄乕僔儑儞偺嶌嬈傪奐
巒偟傑偡丅

孞傝曉偟傑偡偑丄Security Policy 偼変乆偑乽壗傪乿昁梫偲偡傞偐偺巜掕偱偡
丅 Security Association 偼丄偦傟傪乽偳偺傛偆偵乿幚尰偡傞偐傪婰弎偟傑偡
丅帺摦尞張棟傪梡偄傟偽丄変乆偼壗傪偟偨偄偐偩偗傪巜掕偡傟偽傛偔側傞偺偱
偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

7.2.2. 椺

Kame 偺 racoon 偵偼旕忢偵偨偔偝傫偺僆僾僔儑儞偑偁傝傑偡偑丄偦偺傎偲傫偳
偼丄僨僼僅儖僩偑旕忢偵椙偔峫偊傜傟偨抣偵側偭偰偄傑偡丅傛偭偰傎偲傫偳偼
曄峏偡傞昁梫偑偁傝傑偣傫丅慜弎偺傛偆偵丄僆儁儗乕僞偼 Security Policy 傪
掕媊偡傟偽傛偔丄 Security Associations 偼昁梫偁傝傑偣傫丅僱僑僔僄乕僔儑
儞偼 IKE 僨乕儌儞偵擟偣傑偡丅

偙偺椺偱偼丄嵞傃 10.0.0.11 偲 10.0.0.216 偑埨慡側捠怣傪妋棫偟傛偆偲偟偰
偄傑偡丅偟偐偟崱夞偼 racoon 偺彆偗傪庁傝傑偡丅娙扨偺偨傔偵丄偙偺愝掕偵
偼帠慜偵嫟桳偟偨丄寵傢傟幰偺乽嫟桳埫崋尞乿偑偁傞偲偟傑偟傚偆丅 X.509 擣
徹偼暿偺愡偱媍榑偟傑偡丅 Section 7.2.3 傪傒偰偔偩偝偄丅

傎傏僨僼僅儖僩偺愝掕偱偄偒傑偟傚偆丅椉曽偺儂僗僩偱摨偠偱偡丅

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆path pre_shared_key "/usr/local/etc/racoon/psk.txt";                劆
劆                                                                    劆
劆remote anonymous                                                    劆
劆{                                                                   劆
劆        exchange_mode aggressive,main;                              劆
劆        doi ipsec_doi;                                              劆
劆        situation identity_only;                                    劆
劆                                                                    劆
劆        my_identifier address;                                      劆
劆                                                                    劆
劆        lifetime time 2 min;   # sec,min,hour                       劆
劆        initial_contact on;                                         劆
劆        proposal_check obey;    # obey, strict or claim             劆
劆                                                                    劆
劆        proposal {                                                  劆
劆                encryption_algorithm 3des;                          劆
劆                hash_algorithm sha1;                                劆
劆                authentication_method pre_shared_key;               劆
劆                dh_group 2 ;                                        劆
劆        }                                                           劆
劆}                                                                   劆
劆                                                                    劆
劆sainfo anonymous                                                    劆
劆{                                                                   劆
劆        pfs_group 1;                                                劆
劆        lifetime time 2 min;                                        劆
劆        encryption_algorithm 3des ;                                 劆
劆        authentication_algorithm hmac_sha1;                         劆
劆                compression_algorithm deflate ;                     劆
劆}                                                                   劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

偨偔偝傫偺愝掕偑偁傝傑偡偹丅僨僼僅儖僩偺愝掕偵偝傜偵嬤偯偗傟偽丄傕偆偪
傚偭偲尭傜偣傞偲巚偄傑偡偑丅偄偔偮偐拲栚偡傋偒揰傪丅 anonymous (摻柤)
愝掕傪 2 偮峴偭偰偄傑偡偑丄偙傟偼偡傋偰偺儕儌乕僩偵揔梡偝傟丄埲崀偺愝掕
偑娙扨偵側傝傑偡丅儂僗僩偛偲偺婰弎偼丄摿偵昁梫偲偟側偗傟偽丄彂偐側偔偰
偐傑偄傑偣傫丅

偝傜偵丄偙偺愝掕偱偼帺暘帺恎偺巜掕偼 IP 傾僪儗僗偵傛偭偰峴偆
('my_identifier address') 傛偆偵巜掕偟傑偟偨丅傑偨偙偪傜偱峴偊傞偺偼
3des, sha1 偱丄 psk.txt 偵偁傞帠慜嫟桳尞傪巊偆丄偲愰尵偟偰偄傑偡丅

psk.txt 偵偼 2 偮偺僄儞僩儕傪愝掕偟偰偍偒傑偡丅偙傟偼奺儂僗僩偱堎側傝傑
偡丅10.0.0.11 偱偼:
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆10.0.0.216      password2                                           劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
10.0.0.216 偱偼:
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆10.0.0.11       password2                                           劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
偙傟傜偺僼傽僀儖偼 root 偺強桳偵偟丄儌乕僪傪 0600 偵偡傞偙偲傪朰傟偢偵
丅偝傕側偄偲 racoon 偼偙偺僼傽僀儖偺撪梕傪怣梡偟傑偣傫丅偙傟傜偺僼傽僀
儖偼偦傟偧傟偺嬀塮懳徧偵側偭偰偄傑偡偹丅

偙傟偱朷傓億儕僔乕傪愝掕偡傞弨旛偑偱偒傑偟偨丅偙傟傕娙扨偱丄10.0.0.216
偱偼:
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆#!/sbin/setkey -f                                                   劆
劆flush;                                                              劆
劆spdflush;                                                           劆
劆                                                                    劆
劆spdadd 10.0.0.216 10.0.0.11 any -P out ipsec                        劆
劆        esp/transport//require;                                     劆
劆                                                                    劆
劆spdadd 10.0.0.11 10.0.0.216 any -P in ipsec                         劆
劆        esp/transport//require;                                     劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
偦偟偰 10.0.0.11 偱偼:
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆#!/sbin/setkey -f                                                   劆
劆flush;                                                              劆
劆spdflush;                                                           劆
劆                                                                    劆
劆spdadd 10.0.0.11 10.0.0.216 any -P out ipsec                        劆
劆        esp/transport//require;                                     劆
劆                                                                    劆
劆spdadd 10.0.0.216 10.0.0.11 any -P in ipsec                         劆
劆        esp/transport//require;                                     劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
偙偙傕丄偙傟傜偺億儕僔乕偼嬀塮偵側偭偰偄傑偡丅

偙傟偱 racoon 傪婲摦偡傞弨旛偑偱偒傑偟偨! 堦搙婲摦偡傟偽丄10.0.0.11 偐
傜 10.0.0.216 偵 telnet 偟傛偆偲偟偨偲偒丄偁傞偄偼懠偺愙懕傪帋傒偨偲偒
丄racoon 偼僱僑僔僄乕僔儑儞傪奐巒偟傑偡:
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆12:18:44: INFO: isakmp.c:1689:isakmp_post_acquire(): IPsec-SA                       劆
劆  request for 10.0.0.11 queued due to no phase1 found.                              劆
劆12:18:44: INFO: isakmp.c:794:isakmp_ph1begin_i(): initiate new                      劆
劆  phase 1 negotiation: 10.0.0.216[500]<=>10.0.0.11[500]                             劆
劆12:18:44: INFO: isakmp.c:799:isakmp_ph1begin_i(): begin Aggressive mode.            劆
劆12:18:44: INFO: vendorid.c:128:check_vendorid(): received Vendor ID:                劆
劆  KAME/racoon                                                                       劆
劆12:18:44: NOTIFY: oakley.c:2037:oakley_skeyid(): couldn't find                      劆
劆  the proper pskey, try to get one by the peer's address.                           劆
劆12:18:44: INFO: isakmp.c:2417:log_ph1established(): ISAKMP-SA                       劆
劆  established 10.0.0.216[500]-10.0.0.11[500] spi:044d25dede78a4d1:ff01e5b4804f0680  劆
劆12:18:45: INFO: isakmp.c:938:isakmp_ph2begin_i(): initiate new phase 2              劆
劆  negotiation: 10.0.0.216[0]<=>10.0.0.11[0]                                         劆
劆12:18:45: INFO: pfkey.c:1106:pk_recvupdate(): IPsec-SA established:                 劆
劆  ESP/Transport 10.0.0.11->10.0.0.216 spi=44556347(0x2a7e03b)                       劆
劆12:18:45: INFO: pfkey.c:1318:pk_recvadd(): IPsec-SA established:                    劆
劆  ESP/Transport 10.0.0.216->10.0.0.11 spi=15863890(0xf21052)                        劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

偙偙偱 setkey -D 傪幚峴偟偰 Security Associations 傪昞帵偡傞偲丄幚嵺偵
懚嵼偟偰偄傞偙偲偑傢偐傝傑偡:
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆10.0.0.216 10.0.0.11                                                        劆
劆        esp mode=transport spi=224162611(0x0d5c7333) reqid=0(0x00000000)    劆
劆        E: 3des-cbc  5d421c1b d33b2a9f 4e9055e3 857db9fc 211d9c95 ebaead04  劆
劆        A: hmac-sha1  c5537d66 f3c5d869 bd736ae2 08d22133 27f7aa99          劆
劆        seq=0x00000000 replay=4 flags=0x00000000 state=mature               劆
劆        created: Nov 11 12:28:45 2002   current: Nov 11 12:29:16 2002       劆
劆        diff: 31(s)     hard: 600(s)    soft: 480(s)                        劆
劆        last: Nov 11 12:29:12 2002      hard: 0(s)      soft: 0(s)          劆
劆        current: 304(bytes)     hard: 0(bytes)  soft: 0(bytes)              劆
劆        allocated: 3    hard: 0 soft: 0                                     劆
劆        sadb_seq=1 pid=17112 refcnt=0                                       劆
劆10.0.0.11 10.0.0.216                                                        劆
劆        esp mode=transport spi=165123736(0x09d79698) reqid=0(0x00000000)    劆
劆        E: 3des-cbc  d7af8466 acd4f14c 872c5443 ec45a719 d4b3fde1 8d239d6a  劆
劆        A: hmac-sha1  41ccc388 4568ac49 19e4e024 628e240c 141ffe2f          劆
劆        seq=0x00000000 replay=4 flags=0x00000000 state=mature               劆
劆        created: Nov 11 12:28:45 2002   current: Nov 11 12:29:16 2002       劆
劆        diff: 31(s)     hard: 600(s)    soft: 480(s)                        劆
劆        last:                           hard: 0(s)      soft: 0(s)          劆
劆        current: 231(bytes)     hard: 0(bytes)  soft: 0(bytes)              劆
劆        allocated: 2    hard: 0 soft: 0                                     劆
劆        sadb_seq=0 pid=17112 refcnt=0                                       劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
Security Policy 偼愝掕偟偨偲偍傝偱偡:
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆10.0.0.11[any] 10.0.0.216[any] tcp                                  劆
劆        in ipsec                                                    劆
劆        esp/transport//require                                      劆
劆        created:Nov 11 12:28:28 2002 lastused:Nov 11 12:29:12 2002  劆
劆        lifetime:0(s) validtime:0(s)                                劆
劆        spid=3616 seq=5 pid=17134                                   劆
劆        refcnt=3                                                    劆
劆10.0.0.216[any] 10.0.0.11[any] tcp                                  劆
劆        out ipsec                                                   劆
劆        esp/transport//require                                      劆
劆        created:Nov 11 12:28:28 2002 lastused:Nov 11 12:28:44 2002  劆
劆        lifetime:0(s) validtime:0(s)                                劆
劆        spid=3609 seq=4 pid=17134                                   劆
劆        refcnt=3                                                    劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

7.2.2.1. 栤戣偲婛抦偺寚娮

偙傟偑摦嶌偟側偄偲偒偼丄愝掕僼傽僀儖偑偡傋偰 root 偺強桳偱偁傞偐丄 root
偐傜偟偐撉傔側偄傛偆偵側偭偰偄傞偐傪妋擣偟偰偔偩偝偄丅 racoon 傪僼僅傾
僌儔僂儞僪偱婲摦偡傞偵偼 '-F' 傪梡偄傑偡丅僐儞僷僀儖帪偵愝掕偝傟偨僼傽
僀儖偺戙傢傝偵摿掕偺愝掕僼傽僀儖傪撉傒崬傑偣傞偵偼丄'-f' 傪梡偄傑偡丅徻
嵶偵偮偄偰偙偲嵶偐偵抦傝偨偗傟偽丄racoon.conf 偵 'log debug' 偲偄偆峴傪
捛壛偟偰偔偩偝偄丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

7.2.3. X.509 徹柧彂傪梡偄偨帺摦偱偺尞張棟

愭偵愢柧偟偨捠傝丄嫟桳尞偺棙梡偵偼擄偟偄揰偑偁傝傑偡丅嫟桳偼柺搢偱丄偦
傟偵堦搙嫟桳偝傟偰偟傑偆偲偦傟偼傕偆旈枾偱偼側偄偐傜偱偡丅偁傝偑偨偄偙
偲偵丄旕懳徧埫崋媄弍傪棙梡偡傟偽偙偺栤戣傪夝寛偱偒傑偡丅

IPSEC 傊偺奺嶲壛幰偑岞奐尞偲旈枾尞傪嶌傟偽丄捠怣偺椉幰偑岞奐尞傪敪峴偟
丄億儕僔乕傪愝掕偡傟偽丄埨慡側捠怣傪妋棫偱偒傑偡丅

尞偺惗惉偼妱偵娙扨偱偡偑丄偟偐偟懡彮偺嶌嬈偑昁梫偱偡丅埲壓偱偼
'openssl' 偺僣乕儖傪傕偲偵偟偨嶌嬈傪愢柧偟傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

7.2.3.1. 帺暘偺儂僗僩偺 X.509 徹柧彂傪嶌傞

OpenSSL 偵偼尞偵娭偡傞朿戝側僀儞僼儔僗僩儔僋僠儍偑偁傝丄 CA 偵傛傞彁柤
傪峴偆偙偲傕峴傢側偄偙偲傕偱偒傑偡丅偙偙偱偼僀儞僼儔偺戝晹暘偼夞旔偟丄
CA 柍偟偱嵪傑偣傞丄偍撻愼傒偺偄傫偪偒僙僉儏儕僥傿傪揔梡偟傑偟傚偆丅

傑偢巹偨偪偺儂僗僩偺乽徹柧惪媮彂 (certificate request)乿傪敪峴偟傑偡丅
柤慜偼 'laptop' 偲偟傑偡丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆$ openssl req -new -nodes -newkey rsa:1024 -sha1 -keyform PEM -keyout \ 劆
劆  laptop.private -outform PEM -out request.pem                          劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
偡傞偲偄偔偮偐幙栤偝傟傑偡丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆Country Name (2 letter code) [AU]:NL                                      劆
劆State or Province Name (full name) [Some-State]:.                         劆
劆Locality Name (eg, city) []:Delft                                         劆
劆Organization Name (eg, company) [Internet Widgits Pty Ltd]:Linux Advanced 劆
劆Routing & Traffic Control                                                 劆
劆Organizational Unit Name (eg, section) []:laptop                          劆
劆Common Name (eg, YOUR name) []:bert hubert                                劆
劆Email Address []:ahu@ds9a.nl                                              劆
劆                                                                          劆
劆Please enter the following 'extra' attributes                             劆
劆to be sent with your certificate request                                  劆
劆A challenge password []:                                                  劆
劆An optional company name []:                                              劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
偳偺偔傜偄傑偠傔偵摎偊傞偐偼丄偁側偨偺敾抐偱偡丅僙僉儏儕僥傿偺昁梫偵墳
偠偰丄偙偙偵儂僗僩柤傪擖傟傞偙偲傪朷傓恖傕丄朷傑側偄恖傕偄傞偱偟傚偆丅
偙偺椺偱偼擖傟偰偁傝傑偡丅

偙偙偱偙偺惪媮彂偵丄乽帺屓彁柤乿偟傑偡:
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆$ openssl x509 -req -in request.pem -signkey laptop.private -out \  劆
劆  laptop.public                                                     劆
劆Signature ok                                                        劆
劆subject=/C=NL/L=Delft/O=Linux Advanced Routing & Traffic \          劆
劆  Control/OU=laptop/CN=bert hubert/Email=ahu@ds9a.nl                劆
劆Getting Private key                                                 劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
偙傟偱 'request.pem' 僼傽僀儖偼幪偰偰偐傑偄傑偣傫丅

偙偺庤懕偒傪尞偺昁梫側儂僗僩偺偡傋偰偱孞傝曉偟傑偡丅偙偺 '.public' 尞偼
栤戣側偔攝晍偱偒傑偡偑丄'.private' 尞偺曽偼旈摻偟偰偍偔傛偆偵!

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

7.2.3.2. 愝掕偲婲摦

儂僗僩偺岞奐尞丒旈枾尞偑偱偒偨傜丄偙傟傜傪巊偆傛偆 racoon 偵揱偊傑偡丅

愭傎偳偺愝掕偵栠傝傑偟傚偆丅 2 偮偺儂僗僩傪 10.0.0.11 ('upstairs') 偲
10.0.0.216 ('laptop') 偲偟傑偡丅

10.0.0.11 偺 racoon.conf 僼傽僀儖偵丄埲壓傪捛壛偟傑偡:
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆path certificate "/usr/local/etc/racoon/certs";                     劆
劆                                                                    劆
劆remote 10.0.0.216                                                   劆
劆{                                                                   劆
劆        exchange_mode aggressive,main;                              劆
劆        my_identifier asn1dn;                                       劆
劆        peers_identifier asn1dn;                                    劆
劆                                                                    劆
劆        certificate_type x509 "upstairs.public" "upstairs.private"; 劆
劆                                                                    劆
劆        peers_certfile "laptop.public";                             劆
劆        proposal {                                                  劆
劆                encryption_algorithm 3des;                          劆
劆                hash_algorithm sha1;                                劆
劆                authentication_method rsasig;                       劆
劆                dh_group 2 ;                                        劆
劆        }                                                           劆
劆}                                                                   劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
偙傟偼 racoon 偵 /usr/local/etc/racoon/certs/ 偵偁傞徹柧傪梡偄傞傛偆巜
帵偟偰偄傑偡丅偝傜偵 10.0.0.216 梡偺愝掕崁栚傕娷傑傟偰偄傑偡丅

偙偙偺 'asn1dn' 偺峴偼丄儘乕僇儖丒儕儌乕僩椉懁偺幆暿巕偲偟偰偼丄岞奐尞
偐傜庢傝弌偝傟偨傕偺傪梡偄傞傛偆丄racoon 偵揱偊偰偄傑偡丅偙傟偼慜弎偺
'subject=/C=NL/L=Delft/O=Linux Advanced Routing & Traffic Control/OU=
laptop/CN=bert hubert/Email=ahu@ds9a.nl' 偲偄偆弌椡偱偡丅

certificate_type 偺峴偼丄儘乕僇儖偺岞奐尞丒旈枾尞傪愝掕偟偰偄傑偡丅 
peers_certfile 暥偼丄儕儌乕僩偺愙懕愭偺岞奐尞傪 laptop.public 偲偄偆僼
傽僀儖偐傜撉傒崬傓傛偆 racoon 偵揱偊偰偄傑偡丅

proposal 僽儘僢僋偼愭傎偳偺傕偺偲曄傢偭偰偄傑偣傫丅偨偩偟崱夞偼 
authentication_method 偑 rsasig 偵側偭偰偍傝丄擣徹偵 RSA 岞奐尞/旈枾尞
傪梡偄傞偙偲偑帵偟偰偁傝傑偡丅

10.0.0.216 偺愝掕傊偺捛壛傕偩偄偨偄摨偠偱丄偨偩偟偄偮傕偺捠傝嬀塮偺娭學
偵偁傝傑偡丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆path certificate "/usr/local/etc/racoon/certs";                     劆
劆                                                                    劆
劆remote 10.0.0.11                                                    劆
劆{                                                                   劆
劆        exchange_mode aggressive,main;                              劆
劆        my_identifier asn1dn;                                       劆
劆        peers_identifier asn1dn;                                    劆
劆                                                                    劆
劆        certificate_type x509 "laptop.public" "laptop.private";     劆
劆                                                                    劆
劆        peers_certfile "upstairs.public";                           劆
劆                                                                    劆
劆        proposal {                                                  劆
劆                encryption_algorithm 3des;                          劆
劆                hash_algorithm sha1;                                劆
劆                authentication_method rsasig;                       劆
劆                dh_group 2 ;                                        劆
劆        }                                                           劆
劆}                                                                   劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

椉曽偺儂僗僩偵偙傟傜偺暥傪捛壛偟偨傜丄偁偲偼尞傪偦偺応強偵抲偔偩偗偱偡
丅'upstairs' 儅僔儞偱偼丄 /usr/local/etc/racoon/certs 偵
upstairs.private, upstairs.public, laptop.public 偑昁梫偱偡丅偙偺僨傿儗
僋僩儕偑 root 偺曐桳偵側偭偰偍傝丄儌乕僪偑 0700 偵側偭偰偄傞偙偲傪妋擣
偺偙偲丅偝傕側偄偲 racoon 偼撉傒崬傒傪峴偄傑偣傫!

儅僔儞 'laptop' 偱偼丄 /usr/local/etc/racoon/certs 偵 laptop.private,
laptop.public, upstairs.public 偑昁梫偱偡丅梫偡傞偵丄奺儂僗僩偱偼帺暘偺
岞奐尞偲旈枾尞丄偝傜偵儕儌乕僩偺岞奐尞傪昁梫偲偟傑偡丅

Security Policy 偑愝掕偝傟偰偄傞偙偲傪妋擣偟傑偡 (Section 7.2.2 偺
'spdadd' 峴傪幚峴)丅懕偄偰 racoon 傪婲摦偡傟偽丄偡傋偰摦嶌偡傞偼偢偱偡
丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

7.2.3.3. 僩儞僱儖傪埨慡偵愝掕偡傞偵偼

儕儌乕僩偺愙懕愭偲偺娫偱埨慡側捠怣傪峴偆偵偼丄岞奐尞傪岎姺偟側偗傟偽側
傝傑偣傫丅岞奐尞偦偺傕偺偼旈摻偟偰偍偐側偔偰椙偄偺偱偡偑丄堦曽丄偦偺尞
偑杮摉偵夵鈧偝傟偰偄側偄尞偱偁傞曐徹偑旕忢偵戝愗偱偡丅梫偡傞偵丄乽搑拞
偺搝乿偑偄側偄偙偲偑妋偐偱側偗傟偽側傝傑偣傫丅

偙偺嶌嬈傪娙扨偵偡傞偨傔丄OpenSSL 偵偼 'digest' 僐儅儞僪偑偁傝傑偡丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆$ openssl dgst upstairs.public                                      劆
劆MD5(upstairs.public)= 78a3bddafb4d681c1ca8ed4d23da4ff1              劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

偙傟偱丄儕儌乕僩偺僷乕僩僫乕偲偺娫偱丄僟僀僕僃僗僩偑摨偠偱偁傞偙偲傪妋
擣偡傞偩偗偱偡傒傑偡丅偙傟傪峴偆偵偼幚嵺偵夛偆偐丄偁傞偄偼揹榖傪偡傟偽
偄偄偱偟傚偆丅儕儌乕僩懁偱偺偙偺斣崋偑丄幚偼尞偲摨偠儊乕儖偱憲傜傟偰棃
偨丄偲偄偆偺偱偼僟儊偱偡傛!

偙傟傪峴偆傕偆堦偮偺曽朄偼丄CA 傪峴偭偰偄傞怣棅偱偒傞戞嶰幰 (Trusted
Third Party) 傪梡偄傞偙偲偱偡丅偙偺 CA 偵丄(愭傎偳偼帺暘偨偪偱峴偭偨)
彁柤傪偟偰傕傜偆偺偱偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

7.3. IPSEC 僩儞僱儖

偙傟傑偱偺偲偙傠偼丄捠怣偺椉抂偑捈愙 IPSEC 傪棟夝偟偰偄傞丄偄傢備傞
IPSEC 偺乽揮憲 (transport)乿儌乕僪偺傒傪尒偰偒傑偟偨丅偟偐偟捠忢偼
IPSEC 傪棟夝偡傞儅僔儞偽偐傝偱偼側偄偺偱丄儖乕僞偺傒偵 IPSEC 傪挐傜偣丄
偦偺屻傠偵偁傞僱僢僩儚乕僋偺嶌嬈傪尐戙傢傝偝偣傞偙偲偑昁梫偲側傝傑偡丅
偙偪傜偼乽僩儞僱儖儌乕僪乿偲屇偽傟偰偄傑偡丅

偙偺愝掕偼偲偰傕娙扨偱偡丅10.0.0.216 偐傜 130.161.0.0/16 傊岦偐偆僩儔僼
傿僢僋傪偡傋偰 10.0.0.11 宱桼偱僩儞僱儖偝偣傞偵偼丄埲壓傪 10.0.0.216 偱
幚峴偡傞偩偗偱偡丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆#!/sbin/setkey -f                                                   劆
劆flush;                                                              劆
劆spdflush;                                                           劆
劆                                                                    劆
劆add 10.0.0.216 10.0.0.11 esp 34501                                  劆
劆        -m tunnel                                                   劆
劆        -E 3des-cbc "123456789012123456789012";                     劆
劆                                                                    劆
劆spdadd 10.0.0.0/24 130.161.0.0/16 any -P out ipsec                  劆
劆           esp/tunnel/10.0.0.216-10.0.0.11/require;                 劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
偙偙偱偼 '-m tunnel' 偵拲栚偟偰偔偩偝偄丅偙傟偑嵟廳梫偺晹暘偱偡丅偙傟偼
嵟弶偵 ESP 埫崋壔偝傟偨 SA 傪僩儞僱儖偺椉抂偱愝掕偟傑偡丅

師偵幚嵺偺僩儞僱儖傪愝掕偟傑偡丅偙傟偼僇乕僱儖偵懳偟丄 10.0.0.24 偐傜
130.161.0.0 偵岦偐偆宱楬偺僩儔僼傿僢僋傪埫崋壔偡傞傛偆巜掕偟偰偄傑偡丅
偝傜偵丄懕偄偰偙偺僩儔僼傿僢僋偼 10.0.0.11 偵弌壸偝傟傞偺偱偡丅

10.0.0.11 偱傕彮乆愝掕偑昁梫偱偡丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆#!/sbin/setkey -f                                                   劆
劆flush;                                                              劆
劆spdflush;                                                           劆
劆                                                                    劆
劆add 10.0.0.216 10.0.0.11 esp 34501                                  劆
劆        -m tunnel                                                   劆
劆        -E 3des-cbc "123456789012123456789012";                     劆
劆                                                                    劆
劆spdadd 10.0.0.0/24 130.161.0.0/16 any -P in ipsec                   劆
劆           esp/tunnel/10.0.0.216-10.0.0.11/require;                 劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
偙傟偼丄'-P out' 偑 '-P in' 偵曄傢偭偨偙偲傪彍偗偽丄傑偭偨偔摨偠傕偺偱
偡丅偙傟傑偱偺椺偲摨條丄偙偙偱偺椺傕堦曽岦偺僩儔僼傿僢僋偺傒傪愝掕偟傑
偟偨丅僩儞僱儖偺斀懳曽岦傪姰惉偝偣傞偺偼丄撉幰偺壽戣偲偟偰偍偒傑偡丅

偙偺愝掕偼暿柤乽戙棟 ESP乿偲傕屇偽傟偰偄傑偡丅偙偪傜偺傎偆偑彮乆傢偐傝
傗偡偄偱偟傚偆偐丅

    Note: IPSEC 僩儞僱儖偵偼丄僇乕僱儖偱 IP Forwarding 傪桳岠偵偟偰偍偔
    昁梫偑偁傝傑偡!
   
劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

7.4. 懠偺 IPSEC 僜僼僩僂僃傾

Thomas Walpuski 偼丄OpenBSD 偺 isakpmd 傪 Linux 2.5 IPSEC 偱摦嶌偡傞傛
偆偵偟偨僷僢僠傪彂偄偨偲曬崘偟偰偔傟傑偟偨丅偝傜偵丄尰嵼偼 isakpmd 偺儊
僀儞偺 CVS 儕億僕僩儕偵偙偺僐乕僪偑擖偭偰偄傑偡丅斵偺儁乕僕 <http://
bender.thinknerd.de/~thomas/IPsec/isakmpd-linux.html> 偵傕婰弎偑偁傝傑
偡丅

isakpmd 偼慜弎偺 racoon 偲偼偐側傝堘偄傑偡偑丄偙偪傜傪岲傓恖傕偨偔偝傫
偄傑偡丅偙偪傜 <http://www.openbsd.org/cgi-bin/cvsweb/src/sbin/isakmpd
/> 偐傜擖庤偱偒傑偡丅傛傝徻偟偔偼丄 OpenBSD CVS <http://www.openbsd.org
/anoncvs.html> 傪尒偰偔偩偝偄丅 Thomas 偼 CVS 傗僷僢僠偑柺搢側恖岦偗偵 
tarball <http://bender.thinknerd.de/~thomas/IPsec/isakmpd.tgz> 傕梡堄偟
偰偔傟偰偄傑偡丅

偝傜偵丄FreeS/WAN 偺儐乕僓嬻娫偺僣乕儖傪 Linux 2.5 偺僱僀僥傿僽側 IPSEC
偱巊偊傞傛偆偵偡傞僷僢僠傕偁傝傑偡丅偙偪傜 <http://gondor.apana.org.au/
~herbert/freeswan/> 偵偁傝傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

7.5. 懠偺僔僗僥儉偲偺 IPSEC 偺憡屳塣梡

FIXME: 彂偄偰偔偩偝偄丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

7.5.1. Windows

Andreas Jellinghaus <aj@dungeon.inka.de> 偺儗億乕僩偵傛傟偽: 乽win2k:
摦嶌偟傑偡丅ip 傾僪儗僗偲帠慜嫟桳尞傪慻傒崌傢偣偨擣徹偑巊偊傑偡
(windows 偼 fqdn 傗 userfqdn 暥帤楍偼僒億乕僩偟偰偄側偄偲巚偄傑偡)丅徹
柧彂傕偮偐偊傞偲巚偄傑偡偑丄帋偟偰偄傑偣傫乿

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

Chapter 8. 儅儖僠僉儍僗僩偺儖乕僥傿儞僌

FIXME: 曇廤幰偑偄傑偣傫!

Multicast-HOWTO 偼 (偁偊偰尵偊偽) 屆戙偺傕偺偱丄偦偺偨傔奺強偵晄惓妋側
晹暘傗娫堘偄偑偁傝傑偡丅

偳偺傛偆側傕偺偱偁傟丄儅儖僠僉儍僗僩儖乕僥傿儞僌傪峴偆慜偵偼丄僇乕僱儖
傪愝掕偟偰峴偄偨偄儖乕僥傿儞僌偺僞僀僾傪僒億乕僩偝偣傞昁梫偑偁傝傑偡丅
偙傟偼媡偵丄偳偺傛偆側儅儖僠僉儍僗僩儖乕僥傿儞僌傪巊偆偺偐偼丄帺暘偱寛
傔側偗傟偽側傜側偄丄偲偄偆偙偲偱傕偁傝傑偡丅乽捠忢乿偺僞僀僾偼丄婎杮揑
偵 4 偮偁傝傑偡丅 DVMRP (RIP 儐僯僉儍僗僩僾儘僩僐儖偺儅儖僠僉儍僗僩斉)
丄 MOSPF (摨偠偔 OSPF 偺儅儖僠僉儍僗僩斉)丄 PIM-SM ("Protocol
Independent Multicasting - Sparse Mode": 儅儖僠僉儍僗僩僌儖乕僾偺儐乕僓
偑廤拞偟偰偍傜偢丄暘嶶偟偰偄傞偲壖掕偟偰偄傑偡)丄 PIM-DM (忋婰偺 "Dense
Mode" 偱丄摨偠儅儖僠僉儍僗僩僌儖乕僾偵懏偡傞儐乕僓偼丄偁傞掱搙傑偲傑偭
偰偄傞偲壖掕偟偰偄傑偡)丄偱偡丅

Linux 僇乕僱儖偵偼丄偙傟傜偺慖戰巿偼搊応偟傑偣傫丅僾儘僩僐儖偦偺傕偺偼
丄Zebra, mrouted, pimd 側偳偺儖乕僥傿儞僌傾僾儕働乕僔儑儞偑埖偆偐傜偱偡
丅偟偐偟偦傟偱傕丄偳傟傪梡偄傞偐偼偟偭偐傝寛傔偰偍偐側偄偲丄僇乕僱儖偱
惓偟偄僆僾僔儑儞傪慖傇偙偲偑偱偒傑偣傫丅

偡傋偰偺儅儖僠僉儍僗僩儖乕僥傿儞僌偵偍偄偰丄傑偢壗偼偍偄偰傕
"multicasting" 偲 "multicast routing" 偼昁偢桳岠偵偟偰偍偐側偗傟偽側傝
傑偣傫丅 DVMRP 偲 MOSPF 偱偼丄偙傟偩偗偱 OK 偱偡丅 PIM 傪梡偄傞偮傕傝側
傜丄愙懕偟偰偄傞僱僢僩儚乕僋偵偍偗傞 PIM 偺僶乕僕儑儞偵墳偠偰丄PIMv1 偐
PIMv2 偐偺偳偪傜偐傕桳岠偵偟偰偍偐側偗傟偽側傝傑偣傫丅

慜弎偺慖戰傪峴偭偨傜丄怴偟偄 Linux 僇乕僱儖傪僐儞僷僀儖偟傑偡丅偡傞偲僽
乕僩帪偵 IP 僾儘僩僐儖偑儕僗僩偝傟丄偙偙偱偼 IGMP 偑娷傑傟偰偄傞偼偢偱
偡丅偙傟偼儅儖僠僉儍僗僩僌儖乕僾傪娗棟偡傞僾儘僩僐儖偱偡丅偙傟傪彂偄偰
偄傞尰嵼偱偼丄Linux 偼 IGMP 偺僶乕僕儑儞 1 偲 2 偩偗偟偐僒億乕僩偟偰偄
傑偣傫偑丄僶乕僕儑儞 3 傕婛偵懚嵼偟丄暥彂壔偝傟偰偄傑偡丅偟偐偟僶乕僕儑
儞 3 偼偐側傝怴偟偔丄 IGMPv3 偺奼挘婡擻偼偦傟傎偳棙梡偝傟偰偄側偄偺偱丄
偙傟偼偁傑傝戝偒側栤戣偵偼側傝傑偣傫丅 IGMP 偼僌儖乕僾傪埖偆偺偱丄僌儖
乕僾慡懱偺偆偪丄嵟傕僔儞僾儖側僶乕僕儑儞偺 IGMP 偵偍偗傞婡擻偩偗偑梡偄
傜傟傞偙偲偵側傝傑偡丅傎偲傫偳偺応崌偙傟偼 IGMPv2 偵側傞偱偟傚偆偑丄
IGMPv1 偵側傞偙偲傕傑偩偁傞偱偟傚偆丅

偙偙傑偱偼偄偄偱偡偹丅儅儖僠僉儍僗僥傿儞僌傪桳岠偵偱偒傑偟偨丅偝偰丄儖
乕僥傿儞僌傪奐巒偡傞偵偼儅儖僠僉儍僗僩偱幚嵺偵壗傜偐偺嶌嬈傪峴偆傛偆
Linux 僇乕僱儖偵揱偊傞昁梫偑偁傝傑偡丅偙傟偼丄儅儖僠僉儍僗僩壖憐僱僢僩
儚乕僋傪宱楬僥乕僽儖偵捛壛偡傞偙偲傪堄枴偟傑偡丅

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆ip route add 224.0.0.0/4 dev eth0                                   劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

(摉慠偱偡偑丄偙偙偱偼儅儖僠僉儍僗僥傿儞僌傪 eth0 偱峴偭偰偄傞偲偟偰偄傑
偡! 傎偐偺僨僶僀僗傪巊偄偨偐偭偨傜偙偙傪抲偒姺偊偰偔偩偝偄丅)

偱偼丄僷働僢僩傪僼僅儚乕僪偡傞傛偆巜帵偟傑偟傚偆乧

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆echo 1 > /proc/sys/net/ipv4/ip_forward                              劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

偙偙傑偱偺偲偙傠偱丄偙傟偑偄偭偨偄壗傪峴偆偺偐丄晄巚媍偵巚偭偰偄傞偐傕
偟傟傑偣傫丅偦偙偱丄愙懕僥僗僩偲偟偰丄僨僼僅儖僩偺僌儖乕僾 224.0.0.1 偵
ping 偟偰丄扤偐偑惗偒偰偄傞偐尒偰傒傞偙偲偵偟傑偟傚偆丅儅儖僠僉儍僗僩傪
桳岠偵偟偨 LAN 偺儅僔儞偼偡傋偰墳摎偡傞偼偢偱偡偑丄傎偐偵偼壗傕婲偙傝傑
偣傫丅偳偺儅僔儞傕 224.0.0.1 偲偄偆 IP 傾僪儗僗偼帩偭偰偄傑偣傫丅側傫偲
晄巚媍側偙偲偱偟傚偆! :) 偙傟偼僌儖乕僾傾僪儗僗 (峸撉幰傊偺乽僽儘乕僪僉
儍僗僩乿)偱偁偭偰丄僌儖乕僾偺偡傋偰偺儅僔儞偼丄僌儖乕僾傾僪儗僗偱偼側偔
丄偡傋偰帺暘帺恎偺傾僪儗僗偱墳摎偡傞偺偱偡丅

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆ping -c 2 224.0.0.1                                                 劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

偙傟偱丄幚嵺偺儅儖僠僉儍僗僩儖乕僥傿儞僌傪峴偆弨旛偑偱偒傑偟偨丅偝偰丄2
偮偺僱僢僩儚乕僋偑偁傝丄偙偺娫偱儖乕僥傿儞僌傪峴偄偨偄偲偟傑偟傚偆丅

(懕偔!)

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

Chapter 9. 僉儏乕僀儞僌婯懃偲僶儞僪暆娗棟

偝偰丄傢偨偟偑偙傟偵婥偯偄偨偲偒偵偼丄傎傫偲偆偵偨傑偘傑偟偨丅 Linux
2.2/2.4 偵偼丄僴僀僄儞僪偺愱梡僔僗僥儉偵斾尐偡傞傎偳偺丄條乆側僶儞僪暆
娗棟婡擻偑娷傑傟偰偄傞偺偱偡丅

Linux 偼僼儗乕儉儕儗乕傗 ATM 傛傝傕偢偭偲恑傫偩張棟傪峴偊傑偡丅

崿棎傪旔偗傞偨傔丄tc 偵偍偗傞僶儞僪暆偺巜掕偱偼丄埲壓偺婯懃傪梡偄傞偙偲
偵偟傑偡丅

mbps = 1024 kbps = 1024 * 1024 bps => byte/s                           
mbit = 1024 kbit => kilo bit/s.                                        
mb = 1024 kb = 1024 * 1024 b => byte                                   
mbit = 1024 kbit => kilo bit.                                          

撪晹偱偼丄悢抣偼 bps 偍傛傃 b 偱曐帩偝傟偰偄傑偡丅

偟偐偟 tc 偑懍搙傪昞帵偡傞偲偒偵偼丄埲壓傪梡偄傑偡丅

1Mbit = 1024 Kbit = 1024 * 1024 bps => byte/s                          

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

9.1. 僉儏乕偍傛傃僉儏乕僀儞僌婯懃偺愢柧

僉儏乕僀儞僌傪梡偄傞偲丄僨乕僞傪偳偺傛偆偵乽憲傞乿偐傪寛掕偱偒傑偡丅戝
愗側偺偼丄変乆偑曄峏偱偒傞偺偼憲怣僨乕僞偩偗丄偲偄偆擣幆偱偡丅

僀儞僞乕僱僢僩偺摦嶌尨棟偐傜偟偰丄懠偺恖偑憲偭偰偔傞撪梕傪捈愙惂屼偡傞
偙偲偼偱偒傑偣傫丅偙傟偼偁側偨偺帺戭偺 (暔棟揑側!) 梄曋敔偵偪傚偭偲帡偰
偄傑偡丅悽偺拞傪曄峏偟偰丄憲傜傟偰偔傞梄曋暔偺検偵塭嬁傪梌偊傞偙偲偼偱
偒傑偣傫 (慡堳偵楢棈傪庢傟偽暿偱偡偑)丅

偟偐偟側偑傜丄Internet 偺戝晹暘偼 TCP/IP 偱摦嶌偟偰偄傞偺偱丄偙偺偄偔偮
偐偺婡擻偑棙梡偱偒傑偡丅 TCP/IP 偼 2 偮偺儂僗僩娫偺僱僢僩儚乕僋偺梕検傪
抦傞曽朄傪帩偨側偄偺偱丄扨偵奐巒帪偵僨乕僞傪偩傫偩傫懍偔憲傠偆偲偟
('slow start')丄憲怣偱偒傞尷奅傪墇偊偰僷働僢僩偑儘僗僩偟巒傔偨偲偒偵丄
尭懍偟傑偡丅幚嵺偼偙偺愢柧傛傝傕偆彮偟尗偄偺偱偡偑丄偦傟傜偵偮偄偰偼傑
偨屻傎偳怗傟傑偡丅

偙傟偼偮傑傝丄摓拝偡傞梄曋偺敿暘傪撉傑偢偵幪偰丄偦傟埲忋憲偭偰偙側偄傛
偆婩傞偺偲摨偠偱偡丅僀儞僞乕僱僢僩偱偼偆傑偔偄偔丄偲偄偆偲偙傠偑堘偄傑
偡偑 :-)

帺暘偺僱僢僩儚乕僋偺偁傞儂僗僩偵懳偟偰丄偁傑傝崅懍偵僟僂儞儘乕僪偱偒側
偄傛偆偵偟偨偄応崌傪峫偊傑偟傚偆 (偦偺僱僢僩儚乕僋偺儖乕僞傕偁傞偲偟傑
偡)丅偙偺応崌偼儖乕僞偺乽撪懁乿偺僀儞僞乕僼僃乕僗丄偡側傢偪僐儞僺儏乕僞
偵僨乕僞傪憲傞偲偙傠丄偱懷堟惂尷傪峴偄傑偡丅

愙懕偺儃僩儖僱僢僋偺晹暘偱惂屼傪峴偆傛偆偵偡傞偙偲傕廳梫偱偡丅 NIC 偑
100Mbit 偱丄儖乕僞偺愙懕偑 256kbit 偩偭偨傜丄儖乕僞偑張棟偱偒傞埲忋偺僨
乕僞偼憲傜側偄傛偆偵偟側偗傟偽側傝傑偣傫丅偝傕側偄偲丄愙懕傪惂屼偟僶儞
僪暆傪峣傞偺偼偦偺儖乕僞丄偲偄偆偙偲偵側傝傑偡丅変乆偼丄尵偆側傟偽乽帺
慜偺僉儏乕乿偑昁梫側傢偗偱丄偦傟偼楢嵔偺側偐偱嵟傕抶偄夞慄偵懚嵼偟側偗
傟偽偄偗傑偣傫丅偁傝偑偨偄偙偲偵丄偙傟偼娙扨偵壜擻偲側傝傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

9.2. 僔儞僾儖側丄僋儔僗儗僗偺僉儏乕僀儞僌婯懃

婛偵弎傋偨傛偆偵丄僉儏乕僀儞僌婯懃傪梡偄傞偲丄僨乕僞偺憲怣偺偝傟曽傪曄
峏偱偒傑偡丅僋儔僗偺側偄 (僋儔僗儗僗側) 僉儏乕僀儞僌婯懃偲偼丄偍偍傓偹
僨乕僞傪庴怣偟丄偦傟傪嵞僗働僕儏乕儖丒抶墑丒攋婞偡傞傛偆側傕偺偱偡丅

偙傟傪梡偄傞偲丄嵞暘妱 (subdivision) 傪梡偄偢偵丄僀儞僞乕僼僃乕僗慡懱偺
僩儔僼傿僢僋傪峣傟傑偡丅僋儔僗偺偁傞 (僋儔僗僼儖側) 乽qdisc 傪娷傓
qdisc乿偵恑傓慜偵丄偙偺晹暘傪棟夝偟偰偍偔偙偲偼偲偰傕戝愗偱偡丅

偙傟傑偱偺偲偙傠丄嵟傕峀偔梡偄傜傟偰偄傞婯懃偼 pfifo_fast qdisc 偱偡
(偙傟偑僨僼僅儖僩偱偡)丅偙傟偼丄側偤偙傟傜偺愭恑揑側婡擻偺怣棅惈偑偙傟
傎偳崅偄偺偐傕愢柧偟偰偔傟傑偡丅偙傟傜偼乽傂偲偮梋暘偺僉儏乕乿埲忋偺傕
偺偱偼側偄偺偱偡丅

偙傟傜偺僉儏乕偵偼丄偦傟偧傟挿強偲抁強偑偁傝傑偡丅偙傟傜偺偡傋偰偑丄姰
慡偵僥僗僩偝傟偰偄傞偲偄偆傢偗偱偼偁傝傑偣傫丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

9.2.1. pfifo_fast

偙偺僉儏乕偼丄柤慜偐傜傢偐傞偲偍傝丄乽愭擖傟愭弌偟 (First In, First
Out)乿偱丄偮傑傝偳偺庴怣僷働僢僩傕摿庩側埖偄偼 (彮側偔偲傕偦傟傎偳偼)
偝傟傑偣傫丅偙偺僉儏乕偵偼 3 偮偺偄傢備傞乽僶儞僪乿偑偁傝傑偡丅奺僶儞僪
偵偼 FIFO 偺儖乕儖偑揔梡偝傟傑偡丅偟偐偟丄僶儞僪 0 偵懸偪僷働僢僩偑偁傞
偲丄僶儞僪 1 偼張棟偝傟傑偣傫丅僶儞僪 1 偲僶儞僪 2 傕摨偠娭學偵偁傝傑偡
丅

僇乕僱儖偼丄僷働僢僩偺偄傢備傞乽僒乕價僗偺僞僀僾 (Type of Service)乿僼
儔僌傪懜廳偟丄乽嵟彫抶墑 (minimum delay)乿僷働僢僩傪僶儞僪 0 偵擖傟傞傛
偆寁傜偄傑偡丅

偙偺僋儔僗儗僗偐偮僔儞僾儖側 qdisc 傪丄僋儔僗僼儖側 PRIO qdisc 偲崿摨偟
側偄偙偲丅椉幰偼摨偠傛偆偵摦嶌偟傑偡偑丄pfifo_fast 偼僋儔僗儗僗偱偡偐傜
丄 tc 僐儅儞僪偱懠偺 qdisc 傪捛壛偡傞偙偲偼偱偒傑偣傫丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

9.2.1.1. 僷儔儊乕僞偲巊偄曽

pfifo_fast qdisc 偼弌棃崌偄偺僨僼僅儖僩偱偡偐傜丄儐乕僓偵傛傞愝掕偼偱偒
傑偣傫丅偙偙偱偼僨僼僅儖僩偱偳偺傛偆偵愝掕偝傟偰偄傞偐傪帵偟傑偡丅

priomap
   
    僷働僢僩偺桪愭嬶崌偑丄僇乕僱儖偵傛偭偰丄偳偺僶儞僪偵懳墳晅偗傜傟傞
    偐傪寛傔傑偡丅懳墳晅偗偼僷働僢僩偺 TOS 偵廬偭偰寛傑傝傑偡丅TOS 偼埲
    壓偺傛偆側傕偺偱偡丅
   
     
    劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
    劆   0     1     2     3     4     5     6     7          劆
    劆+-----+-----+-----+-----+-----+-----+-----+-----+       劆
    劆|                 |                       |     |       劆
    劆|   PRECEDENCE    |          TOS          | MBZ |       劆
    劆|                 |                       |     |       劆
    劆+-----+-----+-----+-----+-----+-----+-----+-----+       劆
    劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
     
   
    TOS 偺 4 價僢僩 (乽TOS 僼傿乕儖僪乿) 偼師偺傛偆偵掕媊偝傟偰偄傑偡丅
    劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
    劆Binary Decimcal  Meaning                                劆
    劆-----------------------------------------               劆
    劆1000   8         Minimize delay (md)                    劆
    劆0100   4         Maximize throughput (mt)               劆
    劆0010   2         Maximize reliability (mr)              劆
    劆0001   1         Minimize monetary cost (mmc)           劆
    劆0000   0         Normal Service                         劆
    劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
     
   
    偙偺 4 價僢僩偺塃偵偼傕偆 1 價僢僩偁傝傑偡偐傜丄 TOS 僼傿乕儖僪偺幚
    嵺偺抣偼偙傟傜偺 TOS 價僢僩偐傜寛傑傞抣偺 2 攞偵側傝傑偡丅 tcpdump
    -v -v 偲偟偨偲偒偼丄偙偺 4 價僢僩楍偺抣偱偼側偔丄 TOS 僼傿乕儖僪慡
    懱偺抣傪昞帵偟傑偡丅偙傟偼丄師偺昞偺戞堦楍偵偁傞抣偵側傝傑偡丅
   
     
    劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
    劆TOS     Bits  Means                    Linux Priority    Band 劆
    劆------------------------------------------------------------  劆
    劆0x0     0     Normal Service           0 Best Effort     1    劆
    劆0x2     1     Minimize Monetary Cost   1 Filler          2    劆
    劆0x4     2     Maximize Reliability     0 Best Effort     1    劆
    劆0x6     3     mmc+mr                   0 Best Effort     1    劆
    劆0x8     4     Maximize Throughput      2 Bulk            2    劆
    劆0xa     5     mmc+mt                   2 Bulk            2    劆
    劆0xc     6     mr+mt                    2 Bulk            2    劆
    劆0xe     7     mmc+mr+mt                2 Bulk            2    劆
    劆0x10    8     Minimize Delay           6 Interactive     0    劆
    劆0x12    9     mmc+md                   6 Interactive     0    劆
    劆0x14    10    mr+md                    6 Interactive     0    劆
    劆0x16    11    mmc+mr+md                6 Interactive     0    劆
    劆0x18    12    mt+md                    4 Int. Bulk       1    劆
    劆0x1a    13    mmc+mt+md                4 Int. Bulk       1    劆
    劆0x1c    14    mr+mt+md                 4 Int. Bulk       1    劆
    劆0x1e    15    mmc+mr+mt+md             4 Int. Bulk       1    劆
    劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
     
   
    偨偔偝傫悢帤偑暲傫偱偄傑偡偹丅戞擇楍偼丄偙傟傜偵懳墳偡傞 4 偮偺 TOS
    價僢僩楍偺抣偱偡丅懕偄偰偦傟傜偺堄枴偡傞撪梕偑帵偝傟偰偄傑偡丅椺偊
    偽 15 偼丄偙偺僷働僢僩偼 Minimal Monetary Cost, Maximum
    Reliability, Maximum Throughput, Minimum Delay 偺偡傋偰傪婜懸偟偰偄
    傞僷働僢僩傪堄枴偟偰偄傑偡丅巹偼偙傟傪乽嫮梸側僷働僢僩 (Dutch
    Packet)乿偲屇傃偨偄偲巚偄傑偡丅 [栿拲: 挊幰偺 Hubert 偝傫傕僆儔儞僟
    恖 :-)]
   
    戞 4 楍偼 Linux 僇乕僱儖偵傛傞 TOS 價僢僩楍偺夝庍偱偡丅偳偺桪愭搙偵
    儅僢僾偝傟傞偐傪帵偟偰偄傑偡丅
   
    嵟屻偺楍偼丄僨僼僅儖僩偺桪愭搙儅僢僾 (priomap) 偺寢壥偱偡丅僐儅儞僪
    儔僀儞偱偼丄僨僼僅儖僩偺桪愭搙儅僢僾偼師偺傛偆偵側傝傑偡丅
    劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
    劆1, 2, 2, 2, 1, 2, 0, 0 , 1, 1, 1, 1, 1, 1, 1, 1         劆
    劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
     
   
    偮傑傝椺偊偽桪愭搙 4 偺僷働僢僩偼丄僶儞僪斣崋 1 傊偲儅僢僾偝傟傑偡
    (栿拲: 桪愭搙偼 0 偐傜巒傑傞偙偲偵拲堄)丅桪愭搙儅僢僾偱偼崅偄桪愭搙
    (> 7) 傪儕僗僩偡傞偙偲傕偱偒傑偡丅偙傟傜偼 TOS 儅僢僺儞僌偵偼懳墳偟
    偰偄傑偣傫偑丄懠偺曽朄偵傛偭偰愝掕偱偒傑偡丅
   
    偙偺昞偼 RFC1349 (徻嵶偼捈愙偙偪傜傪) 偐傜庢偭偨傕偺偱丄奺傾僾儕働
    乕僔儑儞偑偳偺傛偆偵 TOS 價僢僩傪愝掕偡傞偲椙偄偐偵偮偄偰帵偟偰偁傝
    傑偡丅
    劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
    劆TELNET                   1000           (minimize delay)          劆
    劆FTP                                                               劆
    劆        Control          1000           (minimize delay)          劆
    劆        Data             0100           (maximize throughput)     劆
    劆                                                                  劆
    劆TFTP                     1000           (minimize delay)          劆
    劆                                                                  劆
    劆SMTP                                                              劆
    劆        Command phase    1000           (minimize delay)          劆
    劆        DATA phase       0100           (maximize throughput)     劆
    劆                                                                  劆
    劆Domain Name Service                                               劆
    劆        UDP Query        1000           (minimize delay)          劆
    劆        TCP Query        0000                                     劆
    劆        Zone Transfer    0100           (maximize throughput)     劆
    劆                                                                  劆
    劆NNTP                     0001           (minimize monetary cost)  劆
    劆                                                                  劆
    劆ICMP                                                              劆
    劆        Errors           0000                                     劆
    劆        Requests         0000 (mostly)                            劆
    劆        Responses        <same as request> (mostly)               劆
    劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
     
   
txqueuelen
   
    偙偺僉儏乕偺挿偝偼僀儞僞乕僼僃乕僗偺愝掕偐傜寛傑傝傑偡丅僀儞僞乕僼
    僃乕僗愝掕偼 ifconfig 傗 ip 偱墈棗丒愝掕偱偒傑偡丅僉儏乕偺挿偝傪 10
    偵偡傞偵偼丄 "ifconfig eth0 txqueuelen 10" 偲幚峴偟傑偡丅
   
    偙偺僷儔儊乕僞偼 tc 偱偼愝掕偱偒傑偣傫丅
   
劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

9.2.2. 僩乕僋儞僶働僣僼傿儖僞 (Token Bucket Filter)

僩乕僋儞僶働僣僼傿儖僞 (Token Bucket Filter: TBF) 偼扨弮側 qdisc 偱丄娗
棟幰偑愝掕偟偨懍搙傪墇偊側偄斖埻偱摓拝僷働僢僩傪捠偟傑偡丅偨偩偟抁偄帪
娫偺撍敪揑側傕偺側傜丄偙偺抣傪墇偊傞偙偲傪嫋偡壜擻惈偑偁傝傑偡丅

TBF 偼旕忢偵惓妋偱丄僱僢僩儚乕僋偲僾儘僙僢僒傊偺晧壸傕寉偄偱偡丅扨弮偵
僀儞僞乕僼僃乕僗偺懍搙傪棊偲偟偨偄偲巚偭偨偲偒偵偼丄傑偢嵟弶偵偙偺棙梡
傪峫偊偰傒傞傋偒偱偡丅

TBF 偺幚憰偼僶僢僼傽 (僶働僣) 偱偁傝丄偙傟偼掕婜揑偵壖憐揑側忣曬偺抐曅
(僩乕僋儞偲屇偽傟傑偡) 偵傛偭偰丄堦掕偺妱崌 (僩乕僋儞懍搙) 偱枮偨偝傟偰
偄偒傑偡丅僶働僣偺嵟傕廳梫側僷儔儊乕僞偼僒僀僘偱丄曐帩偱偒傞僩乕僋儞偺
悢傪堄枴偟傑偡丅

僶働僣偵擖偭偨奺僩乕僋儞偼丄偦傟偧傟傂偲偮偺庴怣僨乕僞僷働僢僩傪僨乕僞
僉儏乕偐傜廍偄丄偦偟偰僶働僣偐傜偼嶍彍偝傟傑偡丅偙偺 2 偮偺棳傟 (僩乕僋
儞偲僨乕僞) 偐傜側傞傾儖僑儕僘儉偵偼丄 3 偮偺僔僫儕僆偑峫偊傜傟傑偡丅

 

 丒 僩乕僋儞偲乽摨偠乿妱崌偱丄TBF 偵僨乕僞偑摓拝偡傞丅偙偺応崌奺庴怣僷
    働僢僩偼丄偦傟偧傟懳墳偡傞僩乕僋儞偑偁傞偺偱丄抶墑偡傞偙偲側偟偵僉
    儏乕傪捠夁偡傞丅 
   
 丒 僩乕僋儞偺懍搙傛傝傕乽抶偄乿妱崌偱丄TBF 偵僨乕僞偑摓拝偡傞丅僉儏乕
    偵擖偭偨庴怣僨乕僞僷働僢僩偺弌椡偵墳偠偰嶍彍偝傟傞僩乕僋儞偼堦晹暘
    偺傒側偺偱丄僩乕僋儞偼僶働僣僒僀僘堦攖偵傑偱棴傑偭偰偄偔丅巊傢傟側
    偐偭偨僩乕僋儞偼丄撍敪揑側僨乕僞偺僶乕僗僩偑婲偙偭偨傛偆側応崌偵棙
    梡偱偒丄僩乕僋儞偺昗弨棳擖懍搙傪墇偊偨僨乕僞偑憲怣偱偒傞丅 
   
 丒 僩乕僋儞偺懍搙傛傝傕乽戝偒偄乿妱崌偱丄TBF 偵僨乕僞偑摓拝偡傞丅偙偺
    応崌丄僶働僣偺僩乕僋儞偼偡偖偵嬻偵側偭偰偟傑偄丄 TBF 偼偟偽傜偔偺娫
    擖椡傪峣傞丅偙傟偼乽夁晧壸忬懺 (overlimit situation)乿偲屇偽傟傞丅
    僷働僢僩偑偦偺傑傑擖傝懕偗偰偔傞応崌偵偼丄僷働僢僩偼攋婞偝傟巒傔傞
    丅
   
 

屻傠偺 2 僔僫儕僆偑偲偰傕廳梫偱偡丅偙傟傜偼丄偙偺僼傿儖僞傪捠夁偡傞僨乕
僞偺僶儞僪暆傪丄娗棟幰偑惂屼偱偒傞偙偲傪堄枴偟偰偄傞偐傜偱偡丅

僩乕僋儞偑棴傑偭偰偄偔偲丄惂尷傪墇偊偨僨乕僞僶乕僗僩傕丄抁偄傕偺側傜儘
僗側偟偵捠夁偱偒傑偡偑丄夁晧壸忬懺偑懕偔偲僷働僢僩偼偩傫偩傫抶墑偟偰偄
偒丄偮偄偵偼攋婞偝傟傑偡丅

偨偩偟幚嵺偺幚憰偱偼丄僩乕僋儞偑懳墳偟偰偄傞偺偼僶僀僩偱偁傝丄僷働僢僩
偱偼偁傝傑偣傫丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

9.2.2.1. 僷儔儊乕僞偲巊偄曽

傎偲傫偳曄峏偺昁梫偼側偄偱偟傚偆偑丄 TBF 偵傕挷惍偮傑傒偼偮偄偰偄傑偡丅
傑偢丄偮偹偵巜掕偱偒傞僷儔儊乕僞偱偡:

limit 傑偨偼 latency
   
    limit 偼僩乕僋儞懸偪忬懺偱僉儏乕偵擖傟傞僶僀僩悢偺惂尷抣偱偡丅偙傟
    偼 latency 僷儔儊乕僞 (僷働僢僩偑 TBF 偵棷傑傟傞帪娫偺嵟戝抣) 傪愝
    掕偡傞偙偲偵傛偭偰傕巜掕偱偒傑偡丅偙偪傜傪寁嶼偡傞嵺偵偼丄僶働僣偺
    僒僀僘丄僩乕僋儞偺捛壛懍搙丄偍傛傃 (巜掕偝傟偰偄傟偽) 僺乕僋懍搙傪
    峫椂偟傑偡丅
   
burst/buffer/maxburst
   
    僶僀僩扨埵偺僶働僣偺僒僀僘偱偡丅偙傟偼偁傞弖娫偵棙梡偱偒傞僩乕僋儞
    偺嵟戝抣 (僶僀僩悢) 偱偡丅堦斒偵丄峣傝偨偄捠怣懍搙偑戝偒偄応崌偵偼
    丄戝偒側僶僢僼傽偑偄傝傑偡丅 Intel 偱 10mbit/s 傪巊偆応崌丄偙偺愝掕
    懍搙偵偡傞偵偼彮側偔偲傕 10kbyte 偺僶僢僼傽偑昁梫偱偡丅
   
    僶僢僼傽偑彫偝偡偓傞偲丄帪娫扨埵偁偨傝偵摓拝偡傞僩乕僋儞偩偗偱僶働
    僣偑堨傟偰偟傑偆偺偱丄僷働僢僩偑攋婞偝傟偰偟傑偆偐傕偟傟傑偣傫丅
   
mpu
   
    僒僀僘偑 0 偺僷働僢僩傕丄巊偆僶儞僪暆偼 0 偱偼偁傝傑偣傫丅僀乕僒僱
    僢僩偱偼丄64 僶僀僩埲壓偺僷働僢僩偼偁傝傑偣傫丅嵟彫僷働僢僩扨埵
    (Minimum Packet Unit) 偼丄傂偲偮偺僷働僢僩偑梡偄傞僩乕僋儞偺嵟彫抣
    傪掕傔傑偡丅
   
rate
   
    僗僺乕僪偮傑傒偱偡丅惂尷偵偮偄偰偼忋婰傪嶲徠偺偙偲丅
   
僶働僣偵僩乕僋儞偑擖偭偰偄偰丄偙傟傪嬻偵偡傞偙偲偑嫋偝傟傞偲偒丄僨僼僅
儖僩偱偼偙偺嶌嬈偼柍尷偺懍搙偱峴傢傟傑偡丅偙傟偑傑偢偄応崌偵偼丄埲壓偺
僷儔儊乕僞傪巊偭偰壓偝偄丅

peakrate
   
    僩乕僋儞偑巊偊傞忬懺偱僷働僢僩偑摓拝偡傞偲丄僨僼僅儖僩偱偼偦偺僷働
    僢僩偼偡偖偝傑丄偄偆側傜偽乽岝懍乿偱憲傝弌偝傟傑偡丅偙傟偼丄摿偵戝
    偒側僶働僣傪巊偭偰偄傞応崌偵偼丄朷傑偟偄偙偲偱偼側偄偐傕偟傟傑偣傫
    丅
   
    peakrate 偼丄僶働僣傪嬻偗傞嵺偵嫋偝傟傞懍偝傪寛傔傞偨傔偵梡偄傑偡丅
    偡傋偰偑杮偵彂偄偰偁傞捠傝側傜丄偙偺摦嶌偼乽僷働僢僩傪憲偭偰丄廫暘
    挿偄娫懸偭偰丄偦偟偰師偺僷働僢僩傪憲傞乿偙偲偵傛偭偰幚尰偝傟偰偄傑
    偡丅懸偪帪娫偼丄偪傚偆偳 peakrate 偱憲傜傟傞傛偆偵寁嶼偟偰偁傝傑偡
    丅
   
    偟偐偟側偑傜丄Unix 偱偺僨僼僅儖僩偺帪娫扨埵偼 10ms 側偺偱丄僷働僢僩
    僒僀僘偺暯嬒傪 10.000 價僢僩偲偡傞偲丄 peakrate 偼 1mbit/s 偵偟偐偱
    偒傑偣傫!
   
mtu/minburst
   
    1mbit/s 偺 peakrate 偼丄偙傟偑捠忢偺懍搙傛傝抶偗傟偽丄偁傑傝曋棙偲
    偼尵偊傑偣傫丅帪娫扨埵偛偲偵憲傟傞僷働僢僩偺悢傪憹傗偣偽丄傛傝
    peakrate 偼戝偒偔偱偒傑偡丅偙傟偼幚幙揑偵偼 2 斣栚偺僶働僣傪嶌傞偺
    偲摨偠偙偲偱偡丅
   
    偙偺 2 斣栚偺僶働僣偼丄僨僼僅儖僩偱偼 1 偮偺僷働僢僩偱偟偐側偔丄偮
    傑傝幚嵺偵偼僶働僣偱偼偁傝傑偣傫丅
   
    peakrate 偺嵟戝嫋梕抣傪寁嶼偡傞偵偼丄 mtu 偺愝掕抣偵 100 (偁傞偄偼
    惓妋偵偼 HZ丅偙傟偼 Intel 偱偼 100, Alpha 偱偼 1024) 傪偐偗偰偔偩偝
    偄丅
   
劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

9.2.2.2. 愝掕椺

僔儞僾儖偱偡偑丄偲偭偰傕曋棙側愝掕傪帵偟傑偡丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# tc qdisc add dev ppp0 root tbf rate 220kbit latency 50ms burst 1540 劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

偼偄丄側偤曋棙側偺偐愢柧偟傑偟傚偆丅 DSL 儌僨儉傗働乕僽儖儌僨儉偺傛偆偵
丄僉儏乕偺戝偒側僱僢僩儚乕僋僨僶僀僗偑偁傞偲偟偰丄偦偺僨僶僀僗偵偼 (僀
乕僒僱僢僩僀儞僞乕僼僃乕僗偺傛偆側) 崅懍側僨僶僀僗偱捠怣偟偰偄傞偲偟傑
偟傚偆丅偡傞偲傾僢僾儘乕僪偺嵺偵丄懳榖捠怣偑姰慡偵僟儊偵側偭偰偟傑偄傑
偡丅

偙偺棟桼偼丄傾僢僾儘乕僪偑儌僨儉偺僉儏乕傪堦攖偵偟偰偟傑偆偐傜偱偡丅偙
偺僉儏乕偼偍偦傜偔旕忢偵戝偒偔丄幚嵺偙傟偵傛偭偰傾僢僾儘乕僪偺僗儖乕僾
僢僩偑岦忋偟偰偄傑偡丅偟偐偟偙傟偼朷傑偟偄偙偲偱偼側偄偱偟傚偆丅僉儏乕
傪偁傑傝戝偒偔偣偢偵偍偄偰丄僨乕僞偺憲怣帪偵傕懠偺偙偲偑偱偒傞傛偆丄懳
榖捠怣傪壜擻偲偟偰偍偒偨偄偙偲偑懡偄偼偢偱偡丅

忋婰偺幚峴椺偱偼丄儌僨儉偺僉儏乕偑昁梫側偄掱搙偵傑偱丄憲怣懍搙傪棊偲偟
偰偄傑偡丅偙傟偱僉儏乕偼 Linux 忋偵偁傝丄偙傟偵懳偟偰惂尷傪壽偡偙偲偑偱
偒傑偡丅

220kbit 偼丄偁側偨偺娐嫬偺乽幚嵺偺乿懍搙 (儅僀僫僗悢僷乕僙儞僩) 偵偟偰
偔偩偝偄丅庤帩偪偺儌僨儉偑旕忢偵崅懍側傜丄'burst' 傪彮乆憹傗偟偰偔偩偝
偄丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

9.2.3. 妋棪揑晄曃僉儏乕僀儞僌 (Stochastic Fairness Queueing)

妋棪揑晄曃僉儏乕僀儞僌 (Stochastic Fairness Queueing: SFQ) 偼丄晄曃僉儏
乕僀儞僌偺傾儖僑儕僘儉傪僔儞僾儖偵幚憰偟偨傕偺偱偡丅偙傟偼懠偺傕偺傎偳
惓妋偱偼偁傝傑偣傫偑丄偁傑傝寁嶼検偑昁梫側偔丄偦傟偱偄偰旕忢偵岞暯偱偡
丅

SFQ 偱偺僉乕儚乕僪偼乽夛榖 (傑偨偼棳傟)乿偱丄偙傟偼 TCP 僙僢僔儑儞傗
UDP 僗僩儕乕儉偲傎偲傫偳摨偠堄枴偱偡丅僩儔僼傿僢僋偼偐側傝懡偄悢偺 FIFO
僉儏乕偵暘妱偝傟丄奺僉儏乕偑偦傟偧傟偺夛榖偵懳墳偟傑偡丅偦偟偰僩儔僼傿
僢僋偼儔僂儞僪儘價儞揑偵憲傜傟傑偡丅偡側傢偪僨乕僞傪憲傞婡夛偑奺僙僢僔
儑儞偵弴斣偵梌偊傜傟傑偡丅

偙傟偼旕忢偵岞暯側摦嶌偵偮側偑傝丄偁傞摿掕偺夛榖偑巆傝傪偐偒徚偟偰偟傑
偆傛偆側偙偲偼側偔側傝傑偡丅 SFQ 偵偼乽妋棪揑乿偲柤慜偑偮偄偰偄傑偡偑丄
偙傟偼 SFQ 偑幚嵺偵偼奺僙僢僔儑儞偛偲偵僉儏乕傪妱傝摉偰傞偺偱偼側偔丄僩
儔僼傿僢僋傪偁傞尷傜傟偨悢偺僉儏乕偵丄僴僢僔儏傾儖僑儕僘儉傪巊偭偰暘妱
偡傞偐傜偱偡丅

偙偺僴僢僔儏偺偨傔丄暋悢偺僙僢僔儑儞偑摨偠僶働僣偵擖傞偙偲傕偁傝摼傑偡
丅奺僙僢僔儑儞偑僷働僢僩傪憲怣偡傞婡夛傪埇偭偰偄傞偺偼偙偺僶働僣側偺偱
丄幚岠揑側懍搙偼敿暘偵側偭偰偟傑偄傑偡丅偙偺忬嫷偑栚棫偮偺傪杊偖偨傔偵
丄 SFQ 偼僴僢僔儏傾儖僑儕僘儉傪嬌傔偰昿斏偵曄峏偟丄偁傞僙僢僔儑儞摨巑偺
徴撍偑丄抁偄帪娫偟偐懕偐側偄傛偆偵偟偰偄傑偡丅

偙傟偼廳梫側億僀儞僩偱偡偑丄 SFQ 偑桳岠側偺偼丄幚嵺偺弌椡僀儞僞乕僼僃乕
僗偑丄杮摉偵堦攖堦攖偵側偭偰偄傞応崌偵尷傜傟傑偡丅偦偆偱側偗傟偽丄偁側
偨偺 linux 儅僔儞偺僉儏乕偼傎傏嬻偭傐偱丄傛偭偰壗偺岠壥傕帩偪傑偣傫丅
SFQ 傪懠偺 qdisc 偲慻傒崌傢偣丄乽椉曽偵偄偄婄傪偟偨偄乿忬嫷傪幚尰偡傞偨
傔偺曽朄偵偮偄偰偼屻傎偳媍榑偟傑偡丅

摿偵丄働乕僽儖儌僨儉傗 DSL 儖乕僞偵岦偐偆僀乕僒僱僢僩偵懳偟偰 SFQ 傪愝
掕偡傞偺偼丄懠偺惂尷傪峴傢側偄側傜偽揑奜傟偱偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

9.2.3.1. 僷儔儊乕僞偲巊偄曽

SFQ 偼傎偲傫偳僠儏乕僯儞僌偺昁梫偑偁傝傑偣傫丅

perturb
   
    僴僢僔儏僐乕僪偺嵞愝掕傪峴偆帪娫娫妘丅愝掕偟側偄偲僴僢僔儏偼曄峏偝
    傟傑偣傫偑丄偙傟偼偍姪傔偱偒傑偣傫丅偨傇傫 10 昩偱椙偄偱偟傚偆丅
   
quantum
   
    師偺僉儏乕偵弴斣傪夞偡傑偊偵丄偁傞僗僩儕乕儉偺僉儏乕偐傜揻偒弌偡僨
    乕僞偺僶僀僩検丅僨僼僅儖僩偼嵟傕戝偒側僒僀僘 (MTU 僒僀僘) 偺僷働僢
    僩 1 偮暘偱偡丅 MTU 傛傝傕彫偝側抣偵偼偟側偄傛偆偵!
   
limit
   
    偙偺 SFQ 偑僉儏乕僀儞僌偡傞僷働僢僩偺憤悢 (偙傟傪墇偊傞偲僷働僢僩傪
    棊偲偟巒傔傑偡)丅
   
劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

9.2.3.2. 愝掕椺

愙懕懍搙偲幚岠懍搙偲偑摨偠僨僶僀僗 (揹榖慄偺儌僨儉) 偵懳偟偰偼丄偙偺愝
掕傪峴偆偲岞暯惈偺岦忋偑婜懸偱偒傑偡:
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# tc qdisc add dev ppp0 root sfq perturb 10                                     劆
劆# tc -s -d qdisc ls                                                             劆
劆qdisc sfq 800c: dev ppp0 quantum 1514b limit 128p flows 128/1024 perturb 10sec  劆
劆 Sent 4812 bytes 62 pkts (dropped 0, overlimits 0)                              劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

800c: 偲偄偆偺偼丄帺摦揑偵妱傝摉偰傜傟傞僴儞僪儖斣崋偱偡丅 limit 偼丄偙
偺僉儏乕偱偼 128 屄偺僷働僢僩偑懸婡偱偒傞偙偲傪堄枴偟偰偄傑偡丅 1024 屄
偺僴僢僔儏僶働僣偑妱傝怳傝偵棙梡偱偒丄偦偺偆偪摨帪偵傾僋僥傿僽偵側傟傞
偺偼 128 屄偱偡 (偙傟埲忋偺悢偼僉儏乕偵擖傟傑偣傫!)丅 10 昩偛偲偵僴僢僔
儏偑嵞愝掕偝傟傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

9.3. 偄偮偳傫側僉儏乕傪巊偆傋偒偐

傑偲傔傞偲丄偙傟傜偼扨弮側僉儏乕偱丄幚嵺偵僷働僢僩傪暲傃姺偊偨傝丄抶墑
丒攋婞偟偨傝偟偰僩儔僼傿僢僋傪娗棟偡傞傕偺偱偟偨丅

埲壓偵丄偳偺僉儏乕傪梡偄傞傋偒偐偺慖戰偵偁偨偭偰彆偗偲側傞僐僣傪帵偟傑
偡丅偙偙偱偼丄 Chapter 14 偺復偱夝愢偝傟偰偄傞 qdisc 傕娷傑傟偰偄傑偡丅

 丒 扨偵憲怣偝傟傞僩儔僼傿僢僋傪抶偔偟偨偗傟偽丄僩乕僋儞僶働僣僼傿儖僞
    傪梡偄傑偟傚偆丅僶働僣偺戝偒偝傪挷愡偡傟偽丄旕忢偵戝偒側僶儞僪暆偵
    懳偟偰傑偱巊偊傑偡丅
   
 丒 尰嵼偺愙懕偑傎傏堦攖偱丄摿掕偺僙僢僔儑儞偑弌椡僶儞僪暆傪巟攝偟側偄
    傛偆偵偟偨偄応崌偼丄妋棪揑晄曃僉儏乕僀儞僌傪梡偄傑偟傚偆丅
   
 丒 僶僢僋儃乕儞偑戝偒偔丄栚揑偑偼偭偒傝偟偰偄傞側傜丄儔儞僟儉弶婜専抦
    (崅搙側僼傿儖僞偺復傪尒偰偔偩偝偄) 傪専摙偟傑偟傚偆丅
   
 丒 僼僅儚乕僪偟側偄摓拝僩儔僼傿僢僋傪乽峣傝乿偨偗傟偽丄擖岥娔帇惂尷
    (Ingress Policer) 傪巊偄傑偟傚偆丅側偍丄摓拝僩儔僼傿僢僋傪峣傞応崌
    偵偼乽娔帇惂尷 (policing)乿偲偄偆尵梩偑巊傢傟傑偡丅
   
 丒 僷働僢僩傪僼僅儚乕僪偡傞応崌偼丄僨乕僞偺僼僅儚乕僪愭僀儞僞乕僼僃乕
    僗偱 TBF 傪巊偄傑偟傚偆丅偨偩偟暋悢偺僀儞僞乕僼僃乕僗偵岦偐偄偆傞僩
    儔僼傿僢僋傪峣傝偨偄 (偦偺応崌嫟捠梫慺偼摓拝僀儞僞乕僼僃乕僗偩偗偵
    側傝傑偡) 応崌偼暿偱丄偦偺嵺偵偼擖岥娔帇惂尷傪巊偄傑偟傚偆丅
   
 丒 懷堟惂尷偼峴偄偨偔側偄偑丄僀儞僞乕僼僃乕僗偺晧壸偑崅偄偐 (僉儏乕偑
    昁梫偐偳偆偐) 傪娔帇偟偨偄応崌偼丄pfifo 僉儏乕 (pfifo_fast 偱偼偁傝
    傑偣傫) 傪巊偄傑偟傚偆丅偙傟偵偼撪晹偺僶儞僪偼偁傝傑偣傫偑丄僷働僢
    僩偺僒僀僘傪婰榐偟傑偡丅
   
 丒 嵟屻偵 - 乽幮夛揑懷堟惂尷乿傕峴偊傞偼偢偱偡丅偮偹偵朷傒偺忬懺傪幚尰
    偱偒傞媄弍偑棙梡偱偒傞偲偼尷傝傑偣傫丅傑偨儐乕僓偼媄弍揑側惂尷傪揋
    帇偡傞傕偺偱偡丅恊愗側尵梩偼丄僶儞僪暆偺揔愗側暘攝偵傕栶棫偮偱偟傚
    偆!
   
劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

9.4. 梡岅愢柧

傛傝暋嶨側愝掕傪惓偟偔棟夝偡傞偵偼丄偄偔偮偐偺奣擮傪愭偵愢柧偟偰偍偔昁
梫偑偁傞偱偟傚偆丅偙偺僥乕儅偼崬傒擖偭偰偄偰丄傑偨斾妑揑怴偟偄偨傔丄幚
偼摨偠奣擮偵堎側傞尵梩偑梡偄傜傟傞偙偲偑懡乆偁傝傑偡丅

埲壓偱偼 An Informal Management Model for Diffserv Routers
(draft-ietf-diffserv-model-06.txt) 傪彮乆嶲峫偵偟偰偄傑偡丅偙偪傜
<http://www.ietf.org/internet-drafts/draft-ietf-diffserv-model-06.txt>
偵偁傝傑偡丅

梡岅偺惓妋側掕媊傪抦傝偨偄応崌偼丄偙偺尨杮傕撉傫偱偔偩偝偄丅

僉儏乕僀儞僌婯懃 (Queueing Discipline: qdisc)
   
    擖椡懁 (ingress: 擖岥)丄弌椡懁 (egress: 弌岥) 偄偢傟偐偺僨僶僀僗偺
    僉儏乕傪娗棟偡傞傾儖僑儕僘儉偺偙偲丅
   
root qdisc
   
    僨僶僀僗偵捈愙妱傝摉偰傜傟偨 qdisc 偺偙偲丅
   
僋儔僗儗僗側 qdisc (classless qdisc)
   
    愝掕壜擻側撪晹偺嵞暘攝儖乕儖偑懚嵼偟側偄 qdisc 偺偙偲丅
   
僋儔僗僼儖側 qdisc (classful qdisc)
   
    僋儔僗僼儖側 qdisc 偵偼暋悢偺僋儔僗偑娷傑傟傑偡丅偙傟傜偺僋儔僗偺偄
    偔偮偐偼偝傜偵 qdisc 傪曐帩偟丄偦傟偑傑偨僋儔僗僼儖偱偁傞偙偲傕偁傝
    傑偡 (偦偆偱側偄偙偲傕偁傝傑偡)丅尩枾側掕媊偱偼丄pfifo_fast 偼僋儔
    僗僼儖偱偡丅側偤側傜 3 偮偺僶儞僪偑娷傑傟丄偙傟傜偼幚偼僋儔僗偩偐傜
    偱偡丅偟偐偟丄儐乕僓愝掕偲偄偆柺偐傜尒傞偲丄偙傟傜偺僋儔僗偼 tc 僣
    乕儖偱曄峏偱偒側偄偺偱僋儔僗儗僗偱偡丅
   
僋儔僗 (class)
   
    僋儔僗僼儖側 qdisc 偼懡偔偺僋儔僗傪帩偮偙偲偑偱偒丄偦傟傜偺僋儔僗偼
    偦偺 qdisc 偺撪晹偵懏偟傑偡丅傑偨僋儔僗傕丄帺傜偵懏偡傞暋悢偺僋儔僗
    傪帩偮偙偲偑偁傝傑偡丅偟偨偑偭偰僋儔僗偼恊偲偟偰 qdisc 偐暿偺僋儔僗
    偐傪帩偪傑偡丅
   
    梩僋儔僗 (leaf class) 偼巕偺僋儔僗傪帩偨側偄僋儔僗偱偡丅偙偺僋儔僗
    偵偼 qdisc 偑傂偲偮強懏偟傑偡丅偙偺 qdisc 偼偦偺僋儔僗偐傜偺僨乕僞
    憲怣傪寛掕偟傑偡丅僋儔僗傪嶌傞偲丄fifo qdisc 偑強懏偟傑偡丅巕僋儔僗
    傪捛壛偡傞偲丄偙偺 qdisc 偼嶍彍偝傟傑偡丅梩僋儔僗偺偙偺 fifo qdisc
    偼丄傛傝揔愗側懠偺 qdisc 偲抲偒姺偊壜擻偱偡丅偙偺 qdisc 傪僋儔僗僼
    儖側 qdisc 偲抲偒姺偊傟偽丄偝傜偵僋儔僗傪捛壛偡傞偙偲傕偱偒傑偡丅
   
僋儔僗慖暿婍 (classifier)
   
    僋儔僗僼儖側 qdisc 偱偼丄偳偺僋儔僗偵僷働僢僩傪憲傞偐傪寛傔傞昁梫偑
    偁傝傑偡丅偙傟偼僋儔僗慖暿婍傪梡偄偰峴傢傟傑偡丅
   
僼傿儖僞 (filter)
   
    僋儔僗慖暿偼僼傿儖僞傪梡偄偰峴偆偙偲傕偱偒傑偡丅僼傿儖僞偵偼懡悢偺
    忦審偑娷傑傟丄偙傟傜偺偳傟偐偵儅僢僠偡傞偲丄僼傿儖僞偑儅僢僠偟偨偙
    偲偵側傝傑偡丅
   
僗働僕儏乕儕儞僌 (scheduling)
   
    僋儔僗慖暿婍傪梡偄傞偲丄 qdisc 偼摿掕偺僷働僢僩傪懠傛傝愭偵憲怣偡傞
    傛偆側寛掕傪壓偡偙偲偑偱偒傑偡丅偙偺張棟偼僗働僕儏乕儕儞僌偲屇偽傟
    丄椺偊偽慜偵徯夘偟偨 pfifo_fast qdisc 偱峴傢傟偰偄偨傕偺偱偡丅僗働
    僕儏乕儕儞僌偼乽暲傃姺偊 (reordering)乿偲屇偽傟傞偙偲傕偁傝傑偡偑丄
    偙傟偼傗傗暣傜傢偟偄偱偡丅
   
懷堟惂尷 (shaping)
   
    僷働僢僩傪憲怣慜偵抶墑偝偣丄僩儔僼傿僢僋偑愝掕偝傟偨嵟崅懍搙傪墇偊
    側偄傛偆偵偡傞張棟偺偙偲偱偡丅懷堟惂尷偼弌岥偱峴傢傟傑偡丅榖偟尵梩
    偱偼丄僷働僢僩傪攋婞偟偰僩儔僼傿僢僋傪抶偔偡傞偙偲傕丄懷堟惂尷偲屇
    偽傟傞偙偲偑懡偄偱偡丅
   
娔帇惂尷 (policing)
   
    僷働僢僩傪抶墑傑偨偼攋婞偟偰丄僩儔僼傿僢僋傪愝掕偟偨僶儞僪暆偵廂傔
    傞偙偲偱偡丅 Linux 偵偍偗傞娔帇惂尷偱偼僷働僢僩偺攋婞偺傒偑壜擻偱丄
    抶墑偼偱偒傑偣傫丅乽擖岥僉儏乕乿偼懚嵼偟側偄偺偱偡丅
   
張棟曐懚揑 (Work-Conserving)
   
    張棟曐懚揑側 qdisc 偱偼丄壜擻側応崌偵偼偮偹偵僷働僢僩傪攝憲偟傑偡丅
    偮傑傝丄僱僢僩儚乕僋傾僟僾僞偑憲怣壜擻 (弌椡 qdisc 偺応崌) 側忬懺偵
    偁傟偽丄寛偟偰僷働僢僩傪抶墑偝偣傑偣傫丅
   
張棟旕曐懚揑 (non-Work-Conserving)
   
    椺偊偽僩乕僋儞僶働僣僼傿儖僞偺傛偆偵丄僷働僢僩傪偁傞帪娫曐帩偟偰僶
    儞僪暆傪惂尷偡傞傛偆側僉儏乕傕偁傝傑偡丅偙傟偼偮傑傝丄壜擻側応崌偱
    偁偭偰傕僷働僢僩偺堷偒搉偟傪嫅斲偡傞傛偆側偙偲傕偁傞丄偲偄偆偙偲偱
    偡丅
   
偱偼偙偙偱偙傟傜偺梡岅傪惍棟偡傞偨傔丄偙傟傜偑偳偺応強偵偁傞偺偐傪尒偰
傒傞偙偲偵偟傑偟傚偆丅

 
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆                Userspace programs                                  劆
劆                     ^                                              劆
劆                     |                                              劆
劆     +---------------+-----------------------------------------+    劆
劆     |               Y                                         |    劆
劆     |    -------> IP Stack                                    |    劆
劆     |   |              |                                      |    劆
劆     |   |              Y                                      |    劆
劆     |   |              Y                                      |    劆
劆     |   ^              |                                      |    劆
劆     |   |  / ----------> Forwarding ->                        |    劆
劆     |   ^ /                           |                       |    劆
劆     |   |/                            Y                       |    劆
劆     |   |                             |                       |    劆
劆     |   ^                             Y          /-qdisc1-\   |    劆
劆     |   |                            Egress     /--qdisc2--\  |    劆
劆  --->->Ingress                       Classifier ---qdisc3---- | -> 劆
劆     |   Qdisc                                   \__qdisc4__/  |    劆
劆     |                                            \-qdiscN_/   |    劆
劆     |                                                         |    劆
劆     +----------------------------------------------------------+   劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
偙偺 ASCII 恾偼 Jamal Hadi Salim 偵傛傞傕偺偱偡丅

戝偒側僽儘僢僋偼僇乕僱儖傪昞偟偰偄傑偡丅堦斣嵍偵偁傞栴報偼丄僱僢僩儚乕
僋偐傜偙偺儅僔儞偵擖偭偰偒偨僩儔僼傿僢僋偱偡丅偙傟偼傑偢擖岥 (ingress)
偺 qdisc 偵擖傝傑偡丅偙偙偱偼僷働僢僩偵僼傿儖僞傪揔梡偟丄攋婞偡傞偐偳偆
偐傪寛掕偱偒傑偡丅偙傟偼乽娔帇惂尷乿偲屇偽傟傑偡丅

偙傟偼旕忢偵弶婜偺抜奒偱丄僇乕僱儖偺戝晹暘偑僷働僢僩傪尒傞慜偱偡丅偱偡
偺偱丄CPU 僷儚乕傪偁傑傝巊傢偢偵僩儔僼傿僢僋傪偛偔弶婜偵幪偰偨偗傟偽丄
偙偙偑旕忢偵椙偄応強偱偡丅

宲懕張棟傪嫋偝傟偨僷働僢僩偵偼丄儘乕僇儖側傾僾儕働乕僔儑儞偵岦偐偆傕偺
偑偁傝傑偡丅偙偺応崌偦偺僷働僢僩偼張棟偺偨傔偵 IP 僗僞僢僋偵擖傝丄儐乕
僓嬻娫偺僾儘僌儔儉偵搉偝傟傑偡丅僷働僢僩偼傾僾儕働乕僔儑儞偵偼擖傜偢偵
僼僅儚乕僪偝傟傞偙偲傕偁傝丄偙偺応崌偼弌岥 (egress) 偵岦偐偄傑偡丅儐乕
僓乕嬻娫偺僾儘僌儔儉偑僨乕僞傪攝憲偡傞偙偲傕偁傝傑偡偑丄偙偺僨乕僞偼専
嵏偝傟丄弌岥偺僋儔僗慖暿婍傊偲僼僅儚乕僪偝傟傑偡丅

偙偙偱僷働僢僩偼挷嵏偝傟丄偨偔偝傫偁傞 qdisc 偺偄偢傟偐傊僉儏乕偝傟傑偡
丅愝掕偝傟偰偄側偄僨僼僅儖僩偱偼丄傂偲偮偺弌岥 qdisc 偩偗偑僀儞僗僩乕儖
偝傟偰偄傑偡丅偙傟偼 pfifo_fast 偱丄偙傟偑忢偵僷働僢僩傪庴怣偟傑偡丅偙
傟偼乽僄儞僉儏乕僀儞僌 (enqueueing)乿偲屇偽傟傑偡丅

偙偙偱僷働僢僩偼 qdisc 偵廂傑傝丄僱僢僩儚乕僋僀儞僞乕僼僃乕僗傪捠偟偰憲
怣偡傞傛偆僇乕僱儖偑巜椷偡傞偺傪懸偪傑偡丅偙偺傛偆偵憲怣偝傟傞偙偲偼乽
僨僉儏乕僀儞僌 (dequeueing)乿偲屇偽傟傑偡丅

偙偺奊偼僱僢僩儚乕僋傾僟僾僞偑傂偲偮偟偐側偄応崌偱傕惉棫偟傑偡丅僇乕僱
儖傪弌擖傝偟偰偄傞栴報偼丄偦偺傑傑奊偺捠傝偵偼庢傜側偄偱壓偝偄丅奺僱僢
僩儚乕僋傾僟僾僞偵偼丄擖岥偲弌岥椉曽偺僼僢僋偑偁傞偺偱偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

9.5. 僋儔僗僼儖側僉儏乕僀儞僌婯懃

僋儔僗僼儖側 qdisc 偼丄堎側偭偨庬椶偺僩儔僼傿僢僋偵懳偟偰堎側傞庢傝埖偄
偑昁梫側応崌偵旕忢偵曋棙偱偡丅僋儔僗僼儖側 qdisc 偺傂偲偮偵丄'CBQ
(Class Based Queueing)' 偲偄偆傕偺偑偁傝傑偡丅偙傟偼旕忢偵峀偔徯夘偝傟
偰偄傞偺偱丄僋儔僗偺偁傞僉儏乕僀儞僌偲尵偊偽 CBQ 偩偲巚偭偰偄傞恖傕懡偄
偺偱偡偑丄偙傟偼恀幚偱偼偁傝傑偣傫丅

CBQ 偼扨偵嵟傕屆偔偐傜偁偭偨傕偺偵偡偓傑偣傫 (偦偟偰丄嵟傕暋嶨側傕偺偱
傕偁傞偺偱偡偑)丅偮偹偵偙傟偑朷傒偺摦嶌傪偡傞偲偼尷傝傑偣傫丅偙傟偼乽
sendmail 尰徾乿偵偩傑偝傟丄暥彂壔偝傟偰偄側偄暋嶨側媄弍偑擖庤偱偒傞堦斣
椙偄傕偺偩丄偲巚偭偰偄傞恖偨偪偵偼僔儑僢僋偐傕偟傟傑偣傫丅

CBQ 偲偦偺戙懼昳偵偮偄偰丄傕偆偪傚偭偲愢柧偟偰偄偒傑偟傚偆丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

9.5.1. 僋儔僗僼儖側 qdiscs 偲僋儔僗偵偍偗傞棳傟

僋儔僗僼儖側 qdisc 偵擖偭偨僩儔僼傿僢僋偼丄偦偺撪晹偵偁傞僋儔僗偺偄偢傟
偐偵憲傜側偗傟偽側傝傑偣傫丅傛偭偰僩儔僼傿僢僋偵乽僋儔僗慖暿乿傪揔梡偡
傞昁梫偑偁傝傑偡丅僷働僢僩偵懳偟偰壗傪峴偆偐傪寛傔傞嵺偵偼丄偄傢備傞乽
僼傿儖僞乿偵栤偄崌傢偣偑偄偒傑偡丅偙偙偱戝帠側偺偼丄僼傿儖僞偼 qdisc 偺
撪晹偐傜屇偽傟傞偺偱偁偭偰丄懠偐傜屇偽傟傞偙偲偼偁傝偊側偄丄偲偄偆偙偲
偱偡丅

偦偺 qdisc 偵懏偟偰偄傞僼傿儖僞偼丄寛掕傪曉偟傑偡丅偡傞偲 qdisc 偼偦傟
傪梡偄偰僷働僢僩傪僋儔僗偺偳傟偐傂偲偮偵僄儞僉儏乕偟傑偡丅僒僽僋儔僗偑
偁傞偲丄偝傜偵摦嶌傪揔梡偡傞偐偳偆偐尒傞偨傔偵丄懠偺僼傿儖僞偑揔梡偝傟
傞偙偲傕偁傝傑偡丅僒僽僋儔僗偑側偗傟偽丄偦偺僋儔僗偼僷働僢僩傪帺暘偺帩
偮 qdisc 偵僄儞僉儏乕偟傑偡丅

懡偔偺僋儔僗僼儖側 qdisc 偼丄懠偺僋儔僗傪帩偮偩偗偱側偔丄懷堟惂尷傕峴偄
傑偡丅偙傟偼僷働僢僩偺僗働僕儏乕儕儞僌 (椺偊偽 SFQ) 偲懍搙惂屼偺椉曽傪
峴偆偺偵曋棙偱偡丅崅懍偺僀儞僞乕僼僃乕僗 (椺偊偽僀乕僒僱僢僩) 偺愭偵掅
懍側僨僶僀僗 (働乕僽儖儌僨儉) 傪偮側偖応崌側偳偵偼丄偙傟偑昁梫偵側傝傑
偡丅

SFQ 偩偗傪巊偆偩偗偱偼丄壗傕婲偙傝傑偣傫丅僷働僢僩偼偦偺儖乕僞偵擖傝丄
抶墑偣偢偵弌偰峴偔偩偗偩偐傜偱偡 (弌椡僀儞僞乕僼僃乕僗偑幚嵺偺儕儞僋懍
搙傛傝偢偭偲懍偄偐傜偱偡)丅偙偺応崌僗働僕儏乕儖懳徾偲側傞僉儏乕偼懚嵼偟
傑偣傫丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

9.5.2. qdisc 僼傽儈儕: 儖乕僩丒僴儞僪儖丒孼掜丒恊

奺僀儞僞乕僼僃乕僗偼弌岥乽儖乕僩 (root) qdisc乿傪傂偲偮帩偪傑偡丅偙傟偼
僨僼僅儖僩偱偼丄愭偵徯夘偟偨 pfifo_fast 僉儏乕僀儞僌婯懃偱偡丅奺 qdisc
偲僋儔僗偵偼僴儞僪儖 (handle) 偑妱傝摉偰傜傟丄屻偱峴偆愝掕暥偐傜偙偺
qdisc 傪嶲徠偡傞嵺偵偼偙偺僴儞僪儖偑梡偄傜傟傑偡丅僀儞僞乕僼僃乕僗偵偼
弌岥 qdisc 偩偗偱側偔擖岥 qdisc 傕偁傝丄偙偙偱偼摓拝僩儔僼傿僢僋偺娔帇
惂尷偑偱偒傑偡丅

偙傟傜偺 qdisc 偺僴儞僪儖偼丄儊僕儍乕 (major) 斣崋偲儅僀僫乕 (minor) 斣
崋偺 2 偮偐傜側傝丄<major>:<minor> 偺傛偆偵婰弎偟傑偡丅廗姷揑偵儖乕僩
qdisc 偵偼 '1:' 偲偄偆柤慜偑晅偔偙偲偵側偭偰偄傑偡丅偙傟偼 '1:0' 偲摨偠
偱偡丅qdisc 偺儅僀僫乕斣崋偼偮偹偵 0 偱偡丅

僋儔僗偼丄恊偲摨偠儊僕儍乕斣崋傪帩偨側偗傟偽側傝傑偣傫丅儊僕儍乕斣崋偼
丄弌岥丒擖岥偺愝掕偺撪晹偱丄懠偲廳側偭偰偼偄偗傑偣傫丅儅僀僫乕斣崋偼丄
qdisc 偍傛傃偦偺僋儔僗偺撪晹偱丄懠偲廳側偭偰偼偄偗傑偣傫丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

9.5.2.1. 僼傿儖僞偵傛傞僩儔僼傿僢僋偺僋儔僗慖暿

傑偲傔傞偲丄傛偔偁傞奒憌恾偼師偺傛偆偵側傝傑偡:
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆                     1:   root qdisc                                劆
劆                      |                                             劆
劆                     1:1    child class                             劆
劆                   /  |  \                                          劆
劆                  /   |   \                                         劆
劆                 /    |    \                                        劆
劆                 /    |    \                                        劆
劆              1:10  1:11  1:12   child classes                      劆
劆               |      |     |                                       劆
劆               |     11:    |    leaf class                         劆
劆               |            |                                       劆
劆               10:         12:   qdisc                              劆
劆              /   \       /   \                                     劆
劆           10:1  10:2   12:1  12:2   leaf classes                   劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

偟偐偟丄偩傑偝傟側偄偱偔偩偝偄丅僇乕僱儖偑偙偺傛偆側媡岦偒偺栘峔憿 (偁
傞偄偼屻傎偳弌偰偔傞栐栚峔憿) 偺傕偲偵偁傞偲峫偊偰偼偄偗傑偣傫丅偦傟偼
惓偟偔偁傝傑偣傫丅僷働僢僩偼儖乕僩 qdisc 偵僄儞僉儏乕偝傟丄僨僉儏乕偝傟
傞偺偱偁偭偰丄僇乕僱儖偼偙偺晹暘偲偟偐懳榖偟側偄偺偱偡丅

僷働僢僩偼椺偊偽師偺傛偆側僠僃僀儞偵増偭偰僋儔僗慖暿偝傟傑偡丅

1: -> 1:1 -> 1:12 -> 12: -> 12:2

偙傟偱偙偺僷働僢僩偼丄僋儔僗 12:2 偵懏偡傞 qdisc 偵廂傑傝傑偟偨丅偙偺椺
偱偼丄僼傿儖僞偼栘偺偦傟偧傟偺乽愡 (node)乿偵懏偟偰偍傝丄偙傟傜偺僼傿儖
僞偑師偵偳偪傜偺巬偵岦偐偆偐傪寛掕偟傑偡丅偙傟偼傢偐傝傗偡偄偱偡偹丅偟
偐偟側偑傜丄師偺傛偆側傕偺傕壜擻偱偡:

1: -> 12:2

偙偺応崌偼丄儖乕僩偵懏偡傞僼傿儖僞偑丄僷働僢僩傪捈愙 12:2 偵憲傞傛偆偵
寛傔偨偺偱偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

9.5.2.2. 僴乕僪僂僃傾傊僷働僢僩傪僨僉儏乕偡傞

僇乕僱儖偑僷働僢僩傪庢傝弌偟偰僀儞僞乕僼僃乕僗偵憲傞偙偲傪寛傔傞偲丄儖
乕僩 qdisc 偱偁傞 1: 偼僨僉儏乕梫媮傪庴偗庢傝丄偙傟偼 1:1 偵搉偝傟傑偡
丅偙傟偼懕偄偰 10:, 11:, 12: 傊偲搉偝傟傑偡丅偙傟傜偼偦傟偧傟孼掜偵栤偄
崌傢偣傪峴偄丄帺暘偐傜 dequeue() 傪峴偍偆偲偟傑偡丅偙偺応崌僷働僢僩偼
12:2 偵偟偐側偄偺偱丄栘偺慡懱傪扝偭偰偄偐側偗傟偽側傝傑偣傫丅

梫偡傞偵丄僱僗僩偝傟偨僋儔僗偼恊偺 qdisc 偲捠怣偡傞偩偗偱丄僀儞僞乕僼僃
乕僗偲偼捠怣偟側偄偺偱偡丅僇乕僱儖偵傛偭偰僨僉儏乕偝傟傞偺偼儖乕僩
qdisc 偩偗側偺偱偡!

寢壥揑偵丄偁傞僋儔僗偑偦偺恊傛傝愭偵僨僉儏乕偡傞偙偲偼偁傝偊傑偣傫丅偙
傟偼変乆偺朷傓偙偲偦偺傕偺偱偡: 偙偺傛偆偵偡傟偽 SFQ 傪撪懁偺僋儔僗偲偟
丄懷堟惂尷偼峴傢偢偵僗働僕儏乕儕儞僌偩偗傪偝偣丄惂尷梡偺 qdisc 傪偦偺奜
偵抲偔偙偲偑壜擻偲側傝傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

9.5.3. PRIO qdisc

PRIO qdisc 偼幚嵺偺懷堟惂尷偼峴傢偢丄僼傿儖僞偺愝掕偵廬偭偰僩儔僼傿僢僋
偺暘妱偺傒傪峴偄傑偡丅 PRIO qdisc 偼丄偁傞庬偺戝偒側 pfifo_fast 偩偲峫
偊傞偙偲偑偱偒傑偡丅偨偩偟奺僶儞僪偼扨側傞 FIFO 偱偼側偔丄暿乆偺僋儔僗
偵側傝傑偡丅

僷働僢僩偑 PRIO qdisc 偵僄儞僉儏乕偝傟傞偲丄梌偊偨僼傿儖僞僐儅儞僪偵婎
偯偄偰丄偁傞僋儔僗偑慖暿偝傟傑偡丅僨僼僅儖僩偱偼 3 偮偺僋儔僗偑惗惉偝傟
傑偡丅偙傟傜偺僋儔僗偼僨僼僅儖僩偱偼弮悎側 FIFO qdisc 偺傒傪娷傒丄撪晹
峔憿偼帩偪傑偣傫丅偟偐偟偙傟傜偼暿偺 qdisc 偲抲偒姺偊壜擻偱偡丅

僷働僢僩偺僨僉儏乕傪梫媮偝傟傞偲丄僋儔僗 :1 偑嵟弶偵帋偝傟傑偡丅悢抣偺
戝偒側僋儔僗偼丄偦傟傛傝彫偝側僶儞僪偺偳傟偐傜傕僷働僢僩傪庢傝弌偡偙偲
偑偱偒側偐偭偨応崌偵偺傒梡偄傜傟傑偡丅

TOS 僼儔僌偩偗偱側偔丄tc 僼傿儖僞偺擻椡偡傋偰傪梡偄偰僩儔僼傿僢僋偺庬椶
傪桪愭晅偗偟偨偄応崌偵丄偙偺 qdisc 偼偲偰傕曋棙偱偡丅僨僼僅儖僩偱掕媊偝
傟偰偄傞 3 偮偺僋儔僗偵偝傜偵暿偺 qdisc 傪捛壛偡傞偙偲傕偱偒傑偡
(pfifo_fast 偼扨弮側 fifo qdisc 偟偐埖偊傑偣傫)丅

偙傟偼幚嵺偺懷堟惂尷偼峴傢側偄偺偱丄 SFQ 偵懳偡傞傕偺偲摨偠拲堄偑奩摉偟
傑偡丅偙傟傪梡偄傞偺偼丄暔棟揑側儕儞僋偑堦攖偵側偭偰偄傞応崌偐丄傑偨偼
幚嵺偺懷堟惂尷傪峴偆僋儔僗僼儖側 qdisc 偺撪晹偱偵偡傋偒偱偡丅屻幰偼傎偲
傫偳偺働乕僽儖儌僨儉傗 DSL 僨僶僀僗偵奩摉偟傑偡丅

岞幃偺尵梩偱尵偆偲丄PRIO qdisc 偼張棟曐懚揑側僗働僕儏乕儔側偺偱偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

9.5.3.1. PRIO 偺僷儔儊乕僞偲巊偄曽

tc 偼埲壓偺僷儔儊乕僞傪擣幆偟傑偡:

bands
   
    惗惉偡傞僶儞僪偺僋儔僗丅奺僶儞僪偼幚嵺偵偼僋儔僗偱偡丅偙偺斣崋傪曄
    峏偡傞応崌偵偼丄師偺崁栚傕曄峏偡傞昁梫偑偁傝傑偡:
   
priomap
   
    僩儔僼傿僢僋傪慖暿偡傞 tc 僼傿儖僞傪梌偊側偄偲丄 PRIO qdisc 偼
    TP_PRIO 桪愭搙傪嶲徠偟偰丄偳偺傛偆偵僩儔僼傿僢僋傪僄儞僉儏乕偡傞偐
    傪寛掕偟傑偡丅
   
    偙傟偼埲慜偵徯夘偟偨 pfifo_fast qdisc 偲傑偭偨偔摨偠傛偆偵摦嶌偟傑
    偡丅徻嵶偼偦偪傜傪尒偰偔偩偝偄丅
   
奺僶儞僪偼僋儔僗偱丄僨僼僅儖僩偱偼 major:1 偐傜 major:3 傑偱偺柤慜偑晅
偒傑偡丅傛偭偰 PRIO qdisc 偺柤慜偑 12: 側傜丄tc 偼 12:1 傊偺僩儔僼傿僢
僋偵嵟傕崅偄桪愭搙傪梌偊傞傛偆偵僼傿儖僞偟傑偡丅

孞傝曉偟傑偡偑丄僶儞僪 0 偺儅僀僫乕斣崋偑 1 偱偡! 摨條偵丄僶儞僪 1 偼儅
僀僫乕斣崋 2 偲側傝傑偡 (埲壓摨條)丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

9.5.3.2. 愝掕椺

偙偺栘傪嶌傞偙偲傪峫偊傑偟傚偆:
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆          1:   root qdisc                                           劆
劆         / | \                                                      劆
劆       /   |   \                                                    劆
劆       /   |   \                                                    劆
劆     1:1  1:2  1:3    classes                                       劆
劆      |    |    |                                                   劆
劆     10:  20:  30:    qdiscs    qdiscs                              劆
劆     sfq  tbf  sfq                                                  劆
劆band  0    1    2                                                   劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

僶儖僋揮憲偺僩儔僼傿僢僋偼 30: 傊憲傝丄懳榖揑側僩儔僼傿僢僋偼 20: 傑偨
偼 10: 傊憲傝傑偡丅

僐儅儞僪儔僀儞偱偡:
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# tc qdisc add dev eth0 root handle 1: prio                                           劆
劆## 偙傟偵傛偭偰捈偪偵僋儔僗 1:1, 1:2, 1:3 偑偱偒傑偡丅                                劆
劆                                                                                      劆
劆# tc qdisc add dev eth0 parent 1:1 handle 10: sfq                                     劆
劆# tc qdisc add dev eth0 parent 1:2 handle 20: tbf rate 20kbit buffer 1600 limit 3000  劆
劆# tc qdisc add dev eth0 parent 1:3 handle 30: sfq                                     劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

偱偼丄偄傑嶌偭偨撪梕傪尒偰傒傑偟傚偆:
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# tc -s qdisc ls dev eth0                                           劆
劆qdisc sfq 30: quantum 1514b                                         劆
劆 Sent 0 bytes 0 pkts (dropped 0, overlimits 0)                      劆
劆                                                                    劆
劆 qdisc tbf 20: rate 20Kbit burst 1599b lat 667.6ms                  劆
劆 Sent 0 bytes 0 pkts (dropped 0, overlimits 0)                      劆
劆                                                                    劆
劆 qdisc sfq 10: quantum 1514b                                        劆
劆 Sent 132 bytes 2 pkts (dropped 0, overlimits 0)                    劆
劆                                                                    劆
劆 qdisc prio 1: bands 3 priomap  1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1     劆
劆 Sent 174 bytes 3 pkts (dropped 0, overlimits 0)                    劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
偍傢偐傝偺傛偆偵丄僶儞僪 0 偵偼婛偵僩儔僼傿僢僋偑擖偭偰偄傑偡丅偦偟偰偙
偺僐儅儞僪偺幚峴拞偵丄僷働僢僩偑傂偲偮憲傜傟傑偟偨!

偙偙偱 TOS 僼儔僌傪揔愗偵愝掕偡傞傛偆側僣乕儖傪梡偄偰僶儖僋揮憲僩儔僼傿
僢僋傪棳偟丄嵞傃尒偰傒傑偟傚偆丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# scp tc ahu@10.0.0.11:./                                                       劆
劆ahu@10.0.0.11's password:                                                       劆
劆tc                   100% |*****************************|   353 KB    00:00     劆
劆# tc -s qdisc ls dev eth0                                                       劆
劆qdisc sfq 30: quantum 1514b                                                     劆
劆 Sent 384228 bytes 274 pkts (dropped 0, overlimits 0)                           劆
劆                                                                                劆
劆 qdisc tbf 20: rate 20Kbit burst 1599b lat 667.6ms                              劆
劆 Sent 2640 bytes 20 pkts (dropped 0, overlimits 0)                              劆
劆                                                                                劆
劆 qdisc sfq 10: quantum 1514b                                                    劆
劆 Sent 2230 bytes 31 pkts (dropped 0, overlimits 0)                              劆
劆                                                                                劆
劆 qdisc prio 1: bands 3 priomap  1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1                 劆
劆 Sent 389140 bytes 326 pkts (dropped 0, overlimits 0)                           劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
偍傢偐傝偺傛偆偵丄偡傋偰偺僩儔僼傿僢僋偼僴儞僪儖 30: 偵岦偐偄傑偟偨丅堄
恾偟偨偲偍傝丄偙傟偑嵟傕桪愭搙偺掅偄僶儞僪偱偡丅偱偼丄懳榖揑側僩儔僼傿
僢僋偑傛傝桪愭偝傟傞偐妋擣偡傞偨傔偵丄偦偺傛偆側僩儔僼傿僢僋傪惗惉偟偰
傒傑偟傚偆:

 
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# tc -s qdisc ls dev eth0                                           劆
劆qdisc sfq 30: quantum 1514b                                         劆
劆 Sent 384228 bytes 274 pkts (dropped 0, overlimits 0)               劆
劆                                                                    劆
劆 qdisc tbf 20: rate 20Kbit burst 1599b lat 667.6ms                  劆
劆 Sent 2640 bytes 20 pkts (dropped 0, overlimits 0)                  劆
劆                                                                    劆
劆 qdisc sfq 10: quantum 1514b                                        劆
劆 Sent 14926 bytes 193 pkts (dropped 0, overlimits 0)                劆
劆                                                                    劆
劆 qdisc prio 1: bands 3 priomap  1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1     劆
劆 Sent 401836 bytes 488 pkts (dropped 0, overlimits 0)               劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

偆傑偔偄偭偰偄傑偡丅捛壛偟偨僩儔僼傿僢僋偼偡傋偰 10: 傊丄偮傑傝嵟傕桪愭
搙偺崅偄 qdisc 傊峴偭偰偄傑偡丅愭偵 scp 傪庴偗偲偭偨丄桪愭搙偺掅偄僶儞
僪傊偼堦愗岦偐偭偰偄傑偣傫丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

9.5.4. (桳柤側) CBQ qdisc

婛偵弎傋偨傛偆偵丄CBQ 偼尰嵼偁傞拞偱嵟傕暋嶨側丄嵟傕偡偛偄丄偦偟偰嵟傕
棟夝偝傟偰偍傜偢丄偍偦傜偔偼惓偟偔摦嶌偝偣傞偺偵嵟傕庤偑偐偐傞 qdisc 偱
偡丅偙傟偼嶌幰偑埆鐓偩偭偨傝柍擻偩偭偨傢偗偱偼慡慠側偔丄扨偵 CBQ 傾儖僑
儕僘儉偑檣挔柺側傕偺偱側偔丄傑偨 Linux 偺摦嶌偲偺憡惈偑埆偄偐傜側偺偱偡
丅

僋儔僗僼儖偱偁傞偲偄偆埲奜偵丄CBQ 偼懷堟惂尷偺摦嶌傕峴偄傑偡丅偦偟偰偆
傑偔摦偐側偄偺偼丄傑偝偵偙偺揰偵偁傞偺偱偡丅椺偊偽 10mbit/s 偺愙懕傪
1mbit/s 偵峣傝偨偄応崌丄慡帪娫偺 90% 偺偁偄偩夞慄偼傾僀僪儖偵側傞偼偢偱
偡丅偦偆偱側偗傟偽丄偦偆側傞傛偆偵峣傞昁梫偑偁傝傑偡丅

偙傟傪應掕偡傞偺偼偐側傝擄偟偄偺偱丄戙傢傝偵 CBQ 偼丄僴乕僪僂僃傾憌偐傜
偺僨乕僞梫媮偺娫妘傪儅僀僋儘昩扨埵偱應掕偟丄偦偙偐傜傾僀僪儖帪娫傪摫弌
偟傛偆偲偟傑偡丅偙傟傪梡偄傞偲丄愙懕偑偳偺偔傜偄堦攖偐丄嬻偄偰偄傞偐傪
奣嶼偱偒傑偡丅

偙傟偼偳偪傜偐偲偄偆偲傕偭偰傑傢偭偨傗傝曽偱丄偮偹偵惓偟偄寢壥偵側傞偲
偼尷傝傑偣傫丅椺偊偽丄僀儞僞乕僼僃乕僗偺幚嵺偺懍搙偑丄 (偍偦傜偔偼僪儔
僀僶偺幚憰偑埆偄偨傔偵) 100mbit/s 偺僨乕僞傪僼儖偵偼捠偣側偄偲偟偨傜偳
偆偱偟傚偆? PCMCIA 偺僱僢僩儚乕僋僇乕僪傕丄僶僗偺愝寁忋 100mbit/s 偵払
偡傞偙偲偼偁傝摼傑偣傫丅偙傟傜偺応崌丄傾僀僪儖帪娫偼偳偺傛偆偵峫偊傟偽
偄偄偺偱偟傚偆偐?

PPP over Ethernet, PPTP over TCP/IP 偺傛偆側丄幚嵺偺僨僶僀僗偱偼側偄僱
僢僩儚乕僋僨僶僀僗傪峫偊傞偲丄偝傜偵忬嫷偼埆偔側傝傑偡丅偙傟傜偺傛偆側
応崌偺幚岠揑側僶儞僪暆偼丄偍偦傜偔儐乕僓嬻娫偺僷僀僾偺岠棪偵傛偭偰寛傑
傝傑偡丅偙傟偼旕忢偵戝偒偔側傞偱偟傚偆丅

應掕傪峴偭偨恖偨偪偼丄CBQ 偑昁偢偟傕忢偵惓妋偱偁傞偲偼尷傜偢丄偲偒偵偼
巜掕偲傑偭偨偔堎側傞寢壥偲側傞偙偲偵婥偯偄偰偄傑偡丅

偟偐偟丄懡偔偺娐嫬偱偼 CBQ 偼偆傑偔摦嶌偟傑偡丅偙偙偵採嫙偟偨婰弎傪梡偄
傟偽丄傎偲傫偳偺応崌丄偆傑偔摦嶌偡傞傛偆側愝掕偑壜擻偩偲巚偄傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

9.5.4.1. CBQ 偵傛傞懷堟惂尷偺徻嵶

愭偵弎傋偨傛偆偵丄CBQ 偺摦嶌偱偼丄偪傚偆偳幚嵺偺僶儞僪暆偑愝掕偟偨懍搙
偵棊偪傞傛偆丄愙懕傪揔愗側帪娫傾僀僪儖偵偟傑偡丅偙傟傪峴偆偨傔丄CBQ 偱
偼暯嬒揑側僷働僢僩傪搉偡嵺偺帪娫娫妘傪寁嶼偟傑偡丅

摦嶌拞丄幚岠揑側傾僀僪儖帪娫偼丄巜悢廳傒晅偗堏摦暯嬒 (Exponential
Weighted Moving Average: EWMA) 傪梡偄偰應掕偝傟傑偡丅偙傟偼嵟嬤偺僷働僢
僩傪丄夁嫀偺僷働僢僩偵斾傋偰丄巜悢娭悢偺廳傒偱傛傝廳梫偩偲峫偊傞傕偺偱
偡丅UNIX 偺暯嬒晧壸傕丄偙偺曽朄偱寁嶼偝傟偰偄傑偡丅

寁嶼偟偨傾僀僪儖帪娫傪丄偙偺 EWMA 應掕抣偐傜嵎偟堷偄偨丄偦偺寢壥偺悢抣
傪 'avgidle' 偲屇傃傑偡丅晧壸偱堦攖偺愙懕偵偍偗傞 avgidle 偼僛儘偱偡丅
偙偺偲偒僷働僢僩偼丄傑偝偵寁嶼偝傟偨娫妘偵偮偒傂偲偮偢偮摓拝偟偰偄傑偡
丅

夁晧壸偺愙懕偱偼 avgidle 偼晧偺抣偵側傝傑偡丅晧偵側傝偡偓傞偲 CBQ 偼偟
偽傜偔幷抐偟丄'overlimit' 忬懺偵側傝傑偡丅

媡偵丄傾僀僪儖側愙懕偱偼戝検偺 avgidle 偑拁愊偝傟丄悢帪娫捑栙偟偨屻偺僶
儞僪暆偼柍尷戝偵側偭偰偟傑偄傑偡丅偙傟傪杊偖偨傔丄avgidle 偵偼 maxidle
偲偄偆忋尷偑愝偗傜傟偰偄傑偡丅

overlimit 偵側傞偲丄尨棟揑偵偼丄 CBQ 偼帺暘帺恎傪偪傚偆偳僷働僢僩憲怣娫
妘偺寁嶼抣偺娫偩偗峣傝傑偡丅偦偟偰僷働僢僩傪傂偲偮偩偗憲傝丄嵞傃峣傝傑
偡丅偨偩偟埲壓偺 'minburst' 僷儔儊乕僞傕嶲徠偟偰偔偩偝偄丅

埲崀偵丄懷堟惂尷傪愝掕偡傞偨傔偵巜掕偱偒傞僷儔儊乕僞傪帵偟傑偡:

avpkt
   
    僷働僢僩偺暯嬒僒僀僘 (僶僀僩扨埵)丅 maxidle 傪 maxburst 偐傜寁嶼偡
    傞嵺偵昁梫偱偡 (maxburst 偼僷働僢僩扨埵偱巜掕偝傟傑偡)丅
   
bandwidth
   
    僨僶僀僗偺暔棟揑側僶儞僪暆丅傾僀僪儖帪娫偺寁嶼偵昁梫偱偡丅
   
cell
   
    僷働僢僩傪僨僶僀僗傪捠偟偰憲怣偡傞偺偵偐偐傞帪娫偼丄僷働僢僩偺僒僀
    僘偵墳偠偰偄偔偮偐堎側傞抣偵側傞偙偲偑偁傝傑偡丅椺偊偽僒僀僘偑 800
    偲 806 偺僷働僢僩傪憲傞偺偵偐偐傞帪娫偑偪傚偆偳摨偠偩偭偨偲偡傞偲丄
    偙傟偑棻搙傪寛傔傑偡丅捠忢偼 8 傪巜掕偟傑偡丅2 偺惍悢傋偒偱巜掕偟側
    偗傟偽側傝傑偣傫丅
   
maxburst
   
    maxidle 偺寁嶼帪偵丄偙偺僷働僢僩悢偑梡偄傜傟傑偡丅 avgidle 偑
    maxidle 偐傜 0 偵側傞偲偒丄暯嬒揑側僒僀僘偺僷働僢僩傪偙偺悢偩偗僶乕
    僗僩憲怣偱偒傞丄偲偄偆偺偑忦審偵側傝傑偡丅偙偺悢傪戝偒偔偡傞偲丄傛
    傝僶乕僗僩偵懳偡傞懴惈偑崅傑傝傑偡丅 maxidle 傪捈愙愝掕偡傞偙偲偼偱
    偒偢丄偙偺僷儔儊乕僞傪捠偟偰挷惍偡傞偟偐偁傝傑偣傫丅
   
minburst
   
    慜弎偺捠傝丄CBQ 偼 overlimit 偺嵺偵峣傝摦嶌偑昁梫偱偡丅偙偺嵺偺棟憐
    揑側摦嶌偼丄偪傚偆偳寁嶼偝傟偨傾僀僪儖帪娫偩偗峣傝丄偦偟偰 1 偮偺僷
    働僢僩傪捠偡偙偲偱偡丅偟偐偟 UNIX 僇乕僱儖偼丄10ms 傛傝抁偄娫妘偱僀
    儀儞僩傪僗働僕儏乕儖偡傞偙偲偼擄偟偄偺偱丄彮乆挿偄娫妘峣傝丄偦偟偰
    minburst 暘偺僷働僢僩傪堦搙偵捠偟丄偦偟偰 minburst 傪偐偗偨帪娫偩偗
    僗儕乕僾偡傞曽偑傛傝椙偔摦嶌偟傑偡丅
   
    偙偺懸偪帪娫偼 offtime 偲屇偽傟偰偄傑偡丅 minburst 偺抣傪戝偒偔偡傞
    偲丄挿偄栚偱偼惓妋側懷堟惂尷偵偮側偑傝傑偡偑丄儈儕昩偺僞僀儉僗働乕
    儖偱偼傛傝戝偒側僶乕僗僩偑婲偒傞偙偲偵側傝傑偡丅
   
minidle
   
    avgidle 偑 0 埲壓偵側傞偲 overlimit 忬懺偲側傝丄 avgidle 偑 1 偮偺
    僷働僢僩偺憲怣傪嫋偡抣偵傑偱戝偒偔側傞偺傪懸偨側偗傟偽側傝傑偣傫丅
    愙懕傪挿偄帠幷抐偟偨偁偲偵丄撍慠戝偒側僶乕僗僩偑惗偠傞偺傪杊偖偵偼
    丄 avgidle 偑彫偝偔側傝偡偓偨偲偒丄偙傟傪 minidle 偵儕僙僢僩偟側偗
    傟偽側傝傑偣傫丅
   
    minidle 偼晧偺儅僀僋儘昩偱巜掕偟傑偡丅偟偨偑偭偰 10 傪巜掕偡傞偲丄
    avgidle 偺壓尷傪 -10us 偲偟偨偙偲偵側傝傑偡丅
   
mpu
   
    嵟彫僷働僢僩僒僀僘 (Minimum Packet Size) 偱偡丅僨乕僞僒僀僘偑 0 偺
    僷働僢僩偱傕僀乕僒僱僢僩偱偼 64 僶僀僩偲側傝丄憲怣偵偁傞帪娫偑偐偐
    傞偺偱丄偙偺抣偑昁梫偱偡丅 CBQ 偑傾僀僪儖帪娫傪惓妋偵寁嶼偡傞偵偼丄
    偙偺抣傪抦偭偰偄傞昁梫偑偁傝傑偡丅
   
rate
   
    偙偺 qdisc 偐傜憲怣偝傟傞僩儔僼傿僢僋偺懍搙偺愝掕抣丅偙傟偼乽僗僺乕
    僪偮傑傒乿偱偡丅
   
撪晹揑偵偼丄CBQ 偵偼偨偔偝傫偺旝挷惍傪偟偰偄傑偡丅椺偊偽僄儞僉儏乕偝傟
偨僨乕僞傪帩偭偰偄側偄偙偲偑傢偐偭偰偄傞僋儔僗偵偼丄栤偄崌傢偣偼峴偒傑
偣傫丅overlimit 偺僋儔僗偵偼儁僫儖僥傿偑偮偒丄幚岠揑側桪愭搙偑壓偑傝傑
偡丅旕忢偵尗偔偐偮暋嶨偵側偭偰偄傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

9.5.4.2. CBQ 偺僋儔僗僼儖摦嶌

CBQ 偼懷堟惂尷偩偗偱側偔丄愭偵徯夘偟偨傾僀僪儖帪娫偺嬤帡傪梡偄偰 PRIO
僉儏乕偺傛偆側摦嶌傕偱偒傑偡丅偮傑傝僋儔僗偵堎側傞桪愭搙傪梌偊丄桪愭搙
偺悢抣偑彫偝偄曽傪丄戝偒側曽傛傝愭偵億乕儕儞僌偱偒傞偺偱偡丅

僴乕僪僂僃傾憌偐傜僷働僢僩傪僱僢僩儚乕僋偵憲怣偡傞傛偆梫媮偝傟傞偲丄廳
傒晅偒儔僂儞僪儘價儞 (Weighted Round Robin: WRR) 僾儘僙僗偑丄桪愭搙偺悢
抣偑彫偝偄僋儔僗偐傜奐巒偝傟傑偡丅

偙傟傜偼僌儖乕僾壔偝傟偰偍傝丄僨乕僞偑偁傞偐栤偄崌傢偣傪庴偗丄僨乕僞偑
偁傟偽偦傟傪曉偟傑偡丅偁傞僋儔僗偑偁傞僶僀僩悢偺僨僉儏乕傪嫋偝傟傞偲丄
偦偺桪愭搙偵偁傞暿偺僋儔僗偑帋峴傪庴偗傑偡丅

偙偺 WRR 僾儘僙僗偼丄埲崀偺僷儔儊乕僞偵傛偭偰惂屼偝傟傑偡丅

allot
   
    奜晹偺 CBQ 偑僷働僢僩傪僀儞僞乕僼僃乕僗偵憲傞傛偆埶棅偝傟傞偲丄偙偺
    埶棅偼 (僋儔僗偵懏偡傞) 撪晹偺 qdisc 傊丄'priority' 僷儔儊乕僞偺弴
    偵憲傜傟傑偡丅帺暘偺弴斣偑棃偨僋儔僗偼丄偁傞惂尷偝傟偨検偺僨乕僞傪
    憲怣偱偒傑偡丅'Allot' 偼偙偺検偺扨埵偲側傞検偱偡丅傛傝徻偟偔偼
    'weight' 僷儔儊乕僞傪尒偰偔偩偝偄丅
   
prio
   
    CBQ 偼 PRIO 僨僶僀僗偺傛偆偵摦嶌偱偒傑偡丅桪愭搙偺崅偄撪晹僋儔僗偑
    愭偵帋峴偝傟丄偙傟傜偑僩儔僼傿僢僋傪曐帩偟偰偄傟偽丄懠偺僋儔僗偼億
    乕儕儞僌偝傟傑偣傫丅
   
weight
   
    weight 偼廳傒晅偗儔僂儞僪儘價儞僾儘僙僗偺曗彆傪偟傑偡丅奺僋儔僗偼丄
    憲怣偺婡夛傪弴偵梌偊傜傟傑偡丅偁傞僋儔僗偑丄懠偵斾傋偰柧傜偐偵戝偒
    側僶儞僪暆傪帩偮応崌丄偙偺僋儔僗偵偼丄1 夞偁偨傝偵傛傝懡偔偺僨乕僞
    憲怣傪嫋偡偺偑懨摉偱偟傚偆丅
   
    CBQ 偼僋儔僗埲壓偺 weight 傪慡偰懌偟偰偙傟傜傪惓婯壔偟傑偡丅偟偨偑
    偭偰擟堄偺悢傪梡偄傞偙偲偑偱偒丄斾棪偩偗偑栤戣偵側傝傑偡丅偨偄偰偄
    偺恖偼丄偍偍傛偦 'rate/10' 傪栚埨偵偟偰偄傞傛偆偱丄偙傟偱偩偄偨偄偆
    傑偔峴偭偰偄傞傛偆偱偡丅惓婯壔偝傟偨 weight 偵偼 'allot' 僷儔儊乕僞
    偑偐偗傜傟丄 1 儔僂儞僪偁偨傝偵憲怣偱偒傞僨乕僞検偑寛掕偝傟傑偡丅
   
偁傞 CBQ 奒憌偵懏偡傞僋儔僗偼丄偡傋偰摨偠儊僕儍乕斣崋傪帩偨側偗傟偽側傜
側偄偙偲偵拲堄偟偰偔偩偝偄丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

9.5.4.3. 愙懕嫟桳丒戄庁傪寛傔傞 CBQ 僷儔儊乕僞

偁傞庬偺僩儔僼傿僢僋傪弮悎偵惂屼偡傞偩偗偱側偔丄偳偺僋儔僗偑懠偺僋儔僗
偐傜夞慄梕検傪庁傝傜傟傞偐丄傑偨媡偵僶儞僪暆傪戄偣傞偐丄偲偄偆偙偲傕
CBQ 偱偼巜掕偱偒傑偡丅

isolated/sharing
   
    僋儔僗傪 'isolated' 偲愝掕偡傞偲丄偦偺僋儔僗偼孼掜僋儔僗傊偺僶儞僪
    暆偺戄偟弌偟偑偱偒側偔側傝傑偡丅偁傞夞慄傪丄儔僀僶儖娭學偵偁傞 (偁
    傞偄偼屳偄偵拠偺埆偄) 慻怐偑巊梡偟偰偄偰丄梋忚傪屳偄偵梈捠偝偣偨偔
    側偄傛偆偱偁傟偽丄偙傟傪梡偄偰偔偩偝偄丅
   
    惂屼僾儘僌儔儉偱偁傞 tc 偱偼丄'isolated' 偺媡堄偱偁傞 'sharing' 傕
    巊偊傑偡丅
   
bounded/borrow
   
    僋儔僗偼 'bounded' 偵偡傞偙偲傕偱偒傑偡丅偙偆偡傞偲孼掜僋儔僗偐傜僶
    儞僪暆傪庁傝傛偆偲偼偟側偔側傝傑偡丅 tc 偱偼 'bounded' 偺媡堄偱偁傞
    'borrow' 傕巊偊傑偡丅
   
揟宆揑側忬嫷偼丄夞慄傪 2 偮偺慻怐偑巊梡偟偰偄偰丄偦偺椉曽偑 'isolated'
偐偮 'bounded' 偱偁傞傛偆側応崌偱偟傚偆丅偙偺応崌偼椉幰偲傕偦傟偧傟偵妱
傝摉偰傜傟偨懍搙偵棷傑傝丄偍屳偄偵戄偟庁傝傕峴偄傑偣傫丅

偙偺傛偆側慻怐僋儔僗偺撪晹偵偼丄僶儞僪暆傪戄偟庁傝偡傞傛偆側懠偺僋儔僗
孮偑抲偐傟傞偙偲傕偁傞偱偟傚偆丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

9.5.4.4. 愝掕椺

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆               1:           root qdisc                              劆
劆               |                                                    劆
劆              1:1           child class                             劆
劆             /   \                                                  劆
劆            /     \                                                 劆
劆          1:3     1:4       leaf classes                            劆
劆           |       |                                                劆
劆          30:     40:       qdiscs                                  劆
劆         (sfq)   (sfq)                                              劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

偙偺愝掕偱偼 web 僒乕僶偺僩儔僼傿僢僋傪 5mbit 偵丄 SMTP 僩儔僼傿僢僋傪
3mbit 偵惂尷偟傑偡丅椉幰偺崌寁偼 6mbit 傪墇偊側偄傕偺偲偟傑偡丅僴乕僪僂
僃傾偼 100mbit NIC 偱丄偙傟傜偺僋儔僗偼屳偄偵僶儞僪暆傪戄偟庁傝偱偒傞傕
偺偲偟傑偡丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# tc qdisc add dev eth0 root handle 1:0 cbq bandwidth 100Mbit         \ 劆
劆  avpkt 1000 cell 8                                                     劆
劆# tc class add dev eth0 parent 1:0 classid 1:1 cbq bandwidth 100Mbit  \ 劆
劆  rate 6Mbit weight 0.6Mbit prio 8 allot 1514 cell 8 maxburst 20      \ 劆
劆  avpkt 1000 bounded                                                    劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
偙偺晹暘偱偼 root 偍傛傃偄偮傕偺 1:1 僋儔僗傪僀儞僗僩乕儖偟偰偄傑偡丅偙
偺 1:1 僋儔僗偼 bounded 側偺偱丄崌寁偺僶儞僪暆偼 6mbit 傪墇偊傑偣傫丅

慜弎偺捠傝丄CBQ 偱偼旕忢偵偨偔偝傫偺偮傑傒傪挷惍偟側偗傟偽側傝傑偣傫丅
偟偐偟偙傟傜偺僷儔儊乕僞偼丄偡傋偰偙傟傑偱偵愢柧偟偰偁傝傑偡丅偙傟偵懳
墳偡傞 HTB 偱偺愝掕 (屻弎) 偼丄傕偭偲偢偭偲扨弮偵側傝傑偡丅

 
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# tc class add dev eth0 parent 1:1 classid 1:3 cbq bandwidth 100Mbit  \ 劆
劆  rate 5Mbit weight 0.5Mbit prio 5 allot 1514 cell 8 maxburst 20      \ 劆
劆  avpkt 1000                                                            劆
劆# tc class add dev eth0 parent 1:1 classid 1:4 cbq bandwidth 100Mbit  \ 劆
劆  rate 3Mbit weight 0.3Mbit prio 5 allot 1514 cell 8 maxburst 20      \ 劆
劆  avpkt 1000                                                            劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

偙傟傜偼 2 偮偺梩僋儔僗偵側傝傑偡丅愝掕偟偨偄懍搙偵懳偟偰丄廳傒傪偳偺傛
偆偵偐偗偰偄傞偐偵拲栚偟偰偔偩偝偄丅偙傟傜椉僋儔僗偼 bounded 偱偼偁傝傑
偣傫偑丄bounded 偱偁傞僋儔僗 1:1 偵愙懕偟偰偄傑偡丅傛偭偰偙傟傜 2 僋儔
僗偺崌寁僶儞僪暆偼丄寛偟偰 6mbit 傪墇偊傑偣傫丅偲偙傠偱丄僋儔僗 id 偺儊
僕儍乕斣崋偼丄恊偺 qdisc 偲摨偠偱側偗傟偽側傝傑偣傫!

 
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# tc qdisc add dev eth0 parent 1:3 handle 30: sfq                   劆
劆# tc qdisc add dev eth0 parent 1:4 handle 40: sfq                   劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

椉僋儔僗偼丄僨僼僅儖僩偱偼 FIFO qdisc 傪帩偭偰偄傑偡丅偟偐偟偙偙偱偼丄
偙傟傜傪 SFQ 偱抲偒姺偊丄椉僨乕僞僼儘乕偑摨偠傛偆偵埖傢傟傞傛偆偵偟傑偡
丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# tc filter add dev eth0 parent 1:0 protocol ip prio 1 u32 match ip \ 劆
劆  sport 80 0xffff flowid 1:3                                          劆
劆# tc filter add dev eth0 parent 1:0 protocol ip prio 1 u32 match ip \ 劆
劆  sport 25 0xffff flowid 1:4                                          劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

偙傟傜偺僐儅儞僪偱偼丄捈愙 root 偵捛壛偟偰偍傝丄僩儔僼傿僢僋傪惓偟偄
qdisc 偵憲傝傑偡丅

偙偙偱偼 'tc class add' 傪丄qdisc 撪晹偵僋儔僗傪乽惗惉乿偡傞偨傔偵梡偄
偰偄傑偡丅堦曽 'tc qdisc add' 偼丄偙傟傜偺僋儔僗偵 qdisc 傪暥帤捠傝捛壛
偡傞偺偵梡偄偰偄傑偡丅

偙傟傜 2 偮偺婯懃偱僋儔僗慖暿偱偒側偄僩儔僼傿僢僋偑棃偨傜偳偆側傞偱偟傚
偆偐丅偙偺応崌偼丄僨乕僞偼 1:0 偺撪晹偱張棟偝傟傞偺偱丄惂尷傪庴偗傑偣傫
丅

web 偲 SMTP 偑椉曽崌傢偣偰 6mbit/s 傪墇偊偦偆偵側偭偨偲偒偼丄僶儞僪暆偼
weight 僷儔儊乕僞偵斾椺偡傞偐偨偪偱暘妱偝傟傑偡丅偮傑傝 5/8 偑 web 僒乕
僶偵丄3/8 偑儊乕儖僒乕僶偵岦偐偄傑偡丅

傑偨偙偺愝掕偐傜偼丄web 僒乕僶偺僩儔僼傿僢僋偲偟偰丄嵟掅 5/8 * 6 mbit =
3.75 mbit 偑忢偵曐徹偝傟傞偙偲傕傢偐傝傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

9.5.4.5. 懠偺 CBQ 僷儔儊乕僞: split 偲 defmap

愭偵弎傋偨偲偍傝丄僋儔僗僼儖側 qdisc 偱偼丄偳偺僋儔僗偵僷働僢僩傪僄儞僉
儏乕偡傞偐傪寛傔傞偨傔偵僼傿儖僞傪屇傇昁梫偑偁傝傑偡丅

僼傿儖僞傪屇傇傎偐偵丄CBQ 偵偼懠偺慖戰巿傕偁傝傑偡丅偦傟偑 defmap 偲
split 偱偡丅偙傟偼嬌傔偰棟夝偡傞偺偑柺搢偱丄傑偨偦傟傎偳廳梫偱傕偁傝傑
偣傫丅偟偐偟懠偵 defmap 偲 split 傪揔愗偵愢柧偟偰偄傞偲偙傠傪抦傝傑偣傫
偺偱丄挊幰側傝偵嵟慞傪恠偔偟偰傒偨偄偲巚偄傑偡丅

Type of Service 僼傿乕儖僪偺傒偱僼傿儖僞傪峴偄偨偄嬊柺偑懡偄偨傔丄摿庩
側暥朄偑採嫙偝傟偰偄傑偡丅CBQ 偼僷働僢僩偺僄儞僉儏乕愭傪寛傔傞偲偒丄偙
偺僲乕僪偑 'split' 僲乕僪偱偁傞偐偳偆偐傪僠僃僢僋偟傑偡丅傕偟偦偺傛偆側
応崌偵偼丄僒僽偺 qdisc 偺傂偲偮偼丄偁傞愝掕偝傟偨桪愭搙 (偙傟偼 TOS 僼
傿乕儖僪偐傜寛傑傞偱偟傚偆) 傗丄偁傞偄偼傾僾儕働乕僔儑儞偐傜愝掕偝傟偨
僜働僢僩僆僾僔儑儞傪帩偮丄偡傋偰偺僷働僢僩傪庴怣偡傞傛偆巜帵偝傟偰偄傑
偡丅

偦偺僷働僢僩偺桪愭搙價僢僩楍偼 defmap 僼傿乕儖僪偲 and 墘嶼偝傟丄儅僢僠
偟偨偐偳偆偐偑敾抐偝傟傑偡丅偮傑傝偙傟偼丄偁傞桪愭搙偵偩偗儅僢僠偡傞丄
旕忢偵崅懍側僼傿儖僞傪庤寉偵嶌傞曽朄側偺偱偡丅 ff (16 恑) 偲偄偆 defmap
偼偡傋偰偵儅僢僠偟丄0 偼壗偵傕儅僢僠偟傑偣傫丅愝掕椺傪尒傟偽丄彮偟偼傢
偐傝傗偡偄偱偟傚偆:

 
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# tc qdisc add dev eth1 root handle 1: cbq bandwidth 10Mbit allot 1514 \  劆
劆  cell 8 avpkt 1000 mpu 64                                                劆
劆                                                                          劆
劆# tc class add dev eth1 parent 1:0 classid 1:1 cbq bandwidth 10Mbit    \  劆
劆  rate 10Mbit allot 1514 cell 8 weight 1Mbit prio 8 maxburst 20        \  劆
劆  avpkt 1000                                                              劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
昗弨揑側 CBQ 偺弶婜抜奒愝掕偱偡丅偟偐偟偙偺愝掕僷儔儊乕僞偺懡偝偵偼丄偳
偆偁偭偰傕姷傟傞偙偲偼偁傝傑偣傫偹!

defmap 偼 TCP_PRIO 價僢僩楍傪嶲徠偟傑偡丅偙傟偼埲壓偺傛偆偵掕媊偝傟偰偄
傑偡丅

 
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆TC_PRIO..          Num  Corresponds to TOS                          劆
劆-------------------------------------------------                   劆
劆BESTEFFORT         0    Maximize Reliablity                         劆
劆FILLER             1    Minimize Cost                               劆
劆BULK               2    Maximize Throughput (0x8)                   劆
劆INTERACTIVE_BULK   4                                                劆
劆INTERACTIVE        6    Minimize Delay (0x10)                       劆
劆CONTROL            7                                                劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

TC_PRIO.. 偺悢抣偼塃偐傜悢偊偨價僢僩楍偵懳墳偟偰偄傑偡丅 TOS 價僢僩偺桪
愭搙傊偺曄姺偵娭偡傞徻嵶偼丄 pfifo_fast 偺愡傪尒偰偔偩偝偄丅

偱偼懳榖揑側僋儔僗偲僶儖僋揮憲偺僋儔僗偱偡:

 
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# tc class add dev eth1 parent 1:1 classid 1:2 cbq bandwidth 10Mbit     \ 劆
劆  rate 1Mbit allot 1514 cell 8 weight 100Kbit prio 3 maxburst 20        \ 劆
劆  avpkt 1000 split 1:0 defmap c0                                          劆
劆                                                                          劆
劆# tc class add dev eth1 parent 1:1 classid 1:3 cbq bandwidth 10Mbit     \ 劆
劆  rate 8Mbit allot 1514 cell 8 weight 800Kbit prio 7 maxburst 20        \ 劆
劆  avpkt 1000 split 1:0 defmap 3f                                          劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

偙偺 split qdisc 偼 1:0 偱丄偙偙偱慖暿偑側偝傟傑偡丅 C0 偼 2 恑偱
11000000 偱丄3F 偼 00111111 偱偡丅傛偭偰偙傟傜 2 偮傪偁傢偣傞偲丄偡傋偰
偵儅僢僠偟傑偡丅嵟弶偺僋儔僗偼價僢僩 7 偲 6 偵儅僢僠偟丄傛偭偰乽懳榖揑
乿偐偮乽惂屼乿僩儔僼傿僢僋偵儅僢僠偟傑偡丅擇斣栚偺僋儔僗偼巆傝偵儅僢僠
偟傑偡丅

偙傟偱僲乕僪 1:0 偼丄師偺傛偆側僥乕僽儖傪帩偮偙偲偵側傝傑偡丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆priority        send to                                             劆
劆0               1:3                                                 劆
劆1               1:3                                                 劆
劆2               1:3                                                 劆
劆3               1:3                                                 劆
劆4               1:3                                                 劆
劆5               1:3                                                 劆
劆6               1:2                                                 劆
劆7               1:2                                                 劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

傕偆偪傚偭偲梀傃偨偄恖偼丄'change mask' 傪搉偡偙偲傕偱偒傑偡丅偙傟偼曄
峏偟偨偄桪愭搙傪尩枾偵巜掕偡傞傕偺偱偡丅偙傟傪巊偆昁梫偑偁傞偺偼丄'tc
class change' 傪幚峴偡傞応崌偩偗偱偡丅椺偊偽 best effort 僩儔僼傿僢僋傪
1:2 偵捛壛偡傞偵偼丄師偺傛偆偵偡傟偽偱偒傑偡丅

 
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# tc class change dev eth1 classid 1:2 cbq defmap 01/01             劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

偙傟偱 1:0 偺桪愭搙儅僢僾偼師偺傛偆偵側傝傑偡:

 
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆priority        send to                                             劆
劆0               1:2                                                 劆
劆1               1:3                                                 劆
劆2               1:3                                                 劆
劆3               1:3                                                 劆
劆4               1:3                                                 劆
劆5               1:3                                                 劆
劆6               1:2                                                 劆
劆7               1:2                                                 劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

FIXME: 'tc class change' 偼僜乕僗傪尒偨偩偗偱帋偟偰傑偣傫丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

9.5.5. 奒憌揑僩乕僋儞僶働僣 (Hierarchical Token Bucket: HTB)

Martin Devera (<devik>) 偼惓偟偔傕丄 CBQ 偑暋嶨偱丄懡偔偺忬嫷偵偍偄偰嵟
揔側傕偺偱偼側偝偦偆偩丄偲偄偆擣幆偵帄傝傑偟偨丅斵偺奒憌揑側傾僾儘乕僠
偼丄屌掕偝傟偨僶儞僪暆偑偁傝丄偦傟傪暿乆偺栚揑偵暘妱偟丄奺栚揑偵僶儞僪
暆傪曐徹偟丄傑偨偳偺偔傜偄偺僶儞僪暆傪庁傝傞偙偲傪掕媊偱偒傞傛偆偵偟偨
偄丄偲偄偆傛偆側応崌偵揔偟偰偄傑偡丅

HTB 偼 CBQ 偲摨偠傛偆偵摦嶌偟傑偡偑丄懷堟惂尷偵傾僀僪儖帪娫偺寁嶼傪昁梫
偲偟傑偣傫丅偦偺偐傢傝丄HTB 偼僋儔僗僼儖側僩乕僋儞僶働僣僼傿儖僞偵側偭
偰偄傑偡 (偡側傢偪偙傟偑柤慜偺桼棃)丅僷儔儊乕僞偼悢屄偱丄斵偺僒僀僩
<http://luxik.cdi.cz/~devik/qos/htb/> 偱椙偔暥彂壔偝傟偰偄傑偡丅

愝掕傪暋嶨偵偟偨偄偲偒傕丄HTB 偼偪傖傫偲懳墳偟偰偔傟傑偡丅 CBQ 偱偼丄僔
儞僾儖側僋儔僗偺愝掕傕婛偵暋嶨偱偟偨! HTB3 (HTB 偺僶乕僕儑儞偵偮偄偰偼 
HTB 偺儂乕儉儁乕僕 <http://luxik.cdi.cz/~devik/qos/htb/> 傪尒偰偔偩偝
偄) 偼丄岞幃偺僇乕僱儖僜乕僗偺堦晹偵側偭偰偄傑偡 (2.4.20-pre1 媦傃
2.5.31 埲崀)丅偟偐偟丄HTB3 僷僢僠偺摉偨偭偨 'tc' 傪擖庤偡傞昁梫偑偁傞偐
傕偟傟傑偣傫丅 HTB 偺僇乕僱儖偲儐乕僓嬻娫偺晹暘偲偼丄摨偠儊僕儍乕斣崋偱
側偗傟偽側傝傑偣傫丅偝傕側偄偲 'tc' 偼 HTB 偵懳偟偰摦嶌偟傑偣傫丅 

嵟嬤偺僇乕僱儖傪帩偭偰偄傞恖丄偁傞偄偼僇乕僱儖偵僷僢僠偱偒傞棫応偺恖偼
丄偤傂偲傕 HTB 偺棙梡傪峫偊傑偟傚偆丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

9.5.5.1. 愝掕椺

慜弎偺 CBQ 偺愝掕椺偲丄婡擻揑偵偼傎傏摨堦偺傕偺偱偡:

 
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# tc qdisc add dev eth0 root handle 1: htb default 30                               劆
劆                                                                                    劆
劆# tc class add dev eth0 parent 1: classid 1:1 htb rate 6mbit burst 15k              劆
劆                                                                                    劆
劆# tc class add dev eth0 parent 1:1 classid 1:10 htb rate 5mbit burst 15k            劆
劆# tc class add dev eth0 parent 1:1 classid 1:20 htb rate 3mbit ceil 6mbit burst 15k 劆
劆# tc class add dev eth0 parent 1:1 classid 1:30 htb rate 1kbit ceil 6mbit burst 15k 劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

懕偄偰丄偙傟傜偺僋儔僗偺壓偵 SFQ 傪抲偔偲椙偄偱偟傚偆丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# tc qdisc add dev eth0 parent 1:10 handle 10: sfq perturb 10       劆
劆# tc qdisc add dev eth0 parent 1:20 handle 20: sfq perturb 10       劆
劆# tc qdisc add dev eth0 parent 1:30 handle 30: sfq perturb 10       劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

僩儔僼傿僢僋傪揔愗側僋儔僗偵岦偗傞僼傿儖僞傪捛壛偟傑偡:
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# U32="tc filter add dev eth0 protocol ip parent 1:0 prio 1 u32"    劆
劆# $U32 match ip dport 80 0xffff flowid 1:10                         劆
劆# $U32 match ip sport 25 0xffff flowid 1:20                         劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
偙傟偱偍偟傑偄丅傢偐傝偵偔偔丄愢柧偝傟偰偄側偄悢抣傕側偗傟偽丄暥彂壔偝
傟偰偄側偄僷儔儊乕僞傕偁傝傑偣傫丅

HTB 偼幚偵偡偽傜偟偔尒偊傑偡丅10: 偲 20: 偺椉曽偑曐徹偝傟偨僶儞僪暆傪庢
傝丄偦偟偰傑偩巆傝偑偁傟偽丄偙傟傜偺僋儔僗偼偦偺巆傝傪 5:3 偺斾棪偱庁傝
傞偙偲偵側傝傑偡丅偙傟偼婜懸偟偨捠傝偺摦嶌偱偟傚偆丅

僋儔僗晅偗偝傟側偐偭偨僩儔僼傿僢僋偼 30: 偵岦偐偄傑偡丅偙偺僋儔僗偼帺暘
帺恎偺僶儞僪暆偼傎偲傫偳帩偭偰偄傑偣傫偑丄梋偭偰偄傞暘偼偡傋偰庁傝傞偙
偲偑偱偒傑偡丅撪晹偱 SFQ 傪棙梡偡傞傛偆偵偟偨偺偱丄岞暯惈傕僞僟偱幚尰偱
偒偰偄傑偡!

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

9.6. 僼傿儖僞偵傛傞僷働僢僩偺僋儔僗慖暿

偁傞僷働僢僩傪偳偺僋儔僗偑張棟偡傋偒偐傪寛傔傞偵偼丄偄傢備傞乽僋儔僗慖
暿僠僃僀儞乿偑偦偺搙偛偲偵屇傃弌偝傟傑偡丅偙偺僠僃僀儞偼丄偦偺寛抐傪峴
偆僋儔僗僼儖側 qdisc 偵懏偡傞偡傋偰偺僼傿儖僞偐傜側傝傑偡丅

偱偼傑偨栘傪丅幚嵺偵偼栘偱偼側偄偺偱偡偑丅

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆                    root 1:                                         劆
劆                      |                                             劆
劆                    _1:1_                                           劆
劆                   /  |  \                                          劆
劆                  /   |   \                                         劆
劆                 /    |    \                                        劆
劆               10:   11:   12:                                      劆
劆              /   \       /   \                                     劆
劆           10:1  10:2   12:1  12:2                                  劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

僷働僢僩偺僄儞僉儏乕僀儞僌傪偡傞嵺丄偦傟偧傟偺巬偱偳偺傛偆側柦椷傪偡傋
偒偐丄僼傿儖僞僠僃僀儞偵栤偄崌傢偣偑偄偒傑偡丅傛偔偁傞愝掕偼丄1:1 偺僼
傿儖僞偑僷働僢僩傪 12: 偵岦偗丄 12: 偺僼傿儖僞偑偦偺僷働僢僩傪 12:2 偵
憲傞丄偲偄偭偨傛偆側傕偺偱偡丅

偙偺屻幰偺婯懃傪捈愙 1:1 偵強懏偝偣傞偙偲傕偱偒傑偡偑丄傛傝摿庩側僥僗僩
偼僠僃僀儞偺愭偵抲偔曽偑丄岠棪揑偵側傝傑偡丅

側偍丄僷働僢僩傪乽忋岦偒乿偵僼傿儖僞偡傞偙偲偼偱偒傑偣傫丅傑偨 HTB 偱偼
丄偡傋偰偺僼傿儖僞偼 root 偵強懏偝偣側偗傟偽側傝傑偣傫丅

傕偆堦搙丅僷働僢僩偺僄儞僉儏乕偼壓偵岦偐偭偰偺傒峴傢傟傑偡丅偦傟傜偺僷
働僢僩偑僨僉儏乕偝傟傞嵺偵偼丄僀儞僞乕僼僃乕僗偺偁傞忋偺曽偵忋偑偭偰偄
偔傢偗偱偡丅巬偺愭偺曽偵峴偭偰傕僱僢僩儚乕僋傾僟僾僞偼偁傝傑偣傫丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

9.6.1. 僔儞僾儖側僼傿儖僞偺椺

僋儔僗慖暿婍偺復偱愢柧偡傞捠傝丄旕忢偵暋嶨側暥朄偑棙梡偱偒丄暥帤捠傝偁
傜備傞傕偺偵儅僢僠偑壜擻偱偡丅傑偢偼丄傢偐傝傗偡偄椺偐傜巒傔傑偟傚偆丅
岾偄偙傟傜偼娙扨偱偡丅

偙偙偱偼 '10:' 偲偄偆 PRIO qdisc 偑偁傞偲偄傑偡丅偙偙偵偼 3 偮偺僋儔僗
偑偁傝丄億乕僩 22 偐傜偺僩儔僼傿僢僋傪嵟傕桪愭搙偺崅偄僶儞僪偵妱傝摉偰
偨偄偲偟傑偟傚偆丅偙偺偲偒偺僼傿儖僞偼師偺傛偆偵側傝傑偡丅

 
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# tc filter add dev eth0 protocol ip parent 10: prio 1 u32 match \  劆
劆  ip dport 22 0xffff flowid 10:1                                    劆
劆# tc filter add dev eth0 protocol ip parent 10: prio 1 u32 match \  劆
劆  ip sport 80 0xffff flowid 10:1                                    劆
劆# tc filter add dev eth0 protocol ip parent 10: prio 2 flowid 10:2  劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

壗傪傗偭偰傞偺偱偟傚偆偐? 偙偙偱偼: eth0 偺 node 10: 偵丄桪愭搙 1 偺
u32 僼傿儖僞傪壛偊偰偄傑偡丅偙偺僼傿儖僞偼 IP 憲怣愭億乕僩偑 22 (偩偗)
偵儅僢僠偟丄僶儞僪 10:1 傊憲傝傑偡丅師偺峴偱偼敪怣尦億乕僩偑 80 偺僷働
僢僩偵偮偄偰摨偠偙偲傪傗偭偰偄傑偡丅嵟屻偺峴偱偼丄儅僢僠偟側偐偭偨傕偺
偼偡傋偰丄師偵桪愭搙偺崅偄僶儞僪 10:2 偵憲偭偰偄傑偡丅 (栿拲: 0xffff 偼
儅僢僠偺慜偵庢傞 AND 儅僗僋偱偡)

偙偙偵偼 'eth0' 傑偨偼偦偺僀儞僞乕僼僃乕僗偺柤慜偑昁梫偱偡丅奺僀儞僞乕
僼僃乕僗偼丄偦傟偧傟懠偲廳側傜側偄偐偨偪偱妱傝摉偰傜傟偨丄僴儞僪儖偺柤
慜嬻娫傪曐帩偟偰偄傞偐傜偱偡丅

IP 傾僪儗僗偱慖暿偡傞偵偼丄師偺傛偆偵偟傑偡丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# tc filter add dev eth0 parent 10:0 protocol ip prio 1 u32 \       劆
劆  match ip dst 4.3.2.1/32 flowid 10:1                               劆
劆# tc filter add dev eth0 parent 10:0 protocol ip prio 1 u32 \       劆
劆  match ip src 1.2.3.4/32 flowid 10:1                               劆
劆# tc filter add dev eth0 protocol ip parent 10: prio 2      \       劆
劆  flowid 10:2                                                       劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

偙傟偼 4.3.2.1 傊偺僩儔僼傿僢僋偲丄1.2.3.4 偐傜偺僩儔僼傿僢僋偵嵟崅偺桪
愭搙偺僉儏乕偵擖傟丄偦偺懠傪 2 斣栚偺僉儏乕偵擖傟偰偄傑偡丅

儅僢僠忦審偼楢寢偱偒傑偡丅1.2.3.4 偺億乕僩 80 偐傜棃偨僩儔僼傿僢僋偵儅
僢僠偝偣傞偵偼丄師偺傛偆偵偟傑偡丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# tc filter add dev eth0 parent 10:0 protocol ip prio 1 u32 match ip src 4.3.2.1/32 \ 劆
劆  match ip sport 80 0xffff flowid 10:1                                                劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

9.6.2. 捠忢昁梫側僼傿儖僞僐儅儞僪偡傋偰

偙偙偱愢柧偡傞懷堟惂尷僐儅儞僪偼丄偨偄偰偄偙偺慜抲偒偐傜巒傑偭偰偄傑偡:
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# tc filter add dev eth0 parent 1:0 protocol ip prio 1 u32 ..       劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
偙傟傜偼偄傢備傞 'u32' 儅僢僠偱丄僷働僢僩偺偳偺晹暘偵傕儅僢僠偟傑偡丅

敪怣尦/憲怣愭傾僪儗僗偵傛傞儅僢僠
   
    敪怣尦儅僗僋偼 'match ip src 1.2.3.0/24'丄憲怣愭儅僗僋偼 'match ip
    src 4.3.2.0/24' 偱偡丅扨堦偺儂僗僩偵儅僢僠偝偣傞偵偼丄/32 傪梡偄傞
    偐儅僗僋傪徣棯偟傑偡丅
   
敪怣尦/憲怣愭億乕僩偵傛傞儅僢僠 (ip 僾儘僩僐儖偼栤傢側偄)
   
    敪怣尦偼 'match ip sport 80 0xffff'丄憲怣愭偼 'match ip dport
    0xffff'丅
   
ip 僾儘僩僐儖 (tcp, udp, icmp, gre, ipsec)
   
    /etc/protocols 偺斣崋傪梡偄傑偡丅椺偊偽 icmp 偼 1 偱偡偐傜丄'match
    ip protocol 1 0xff'丅
   
fwmark 偵傛傞儅僢僠
   
    ipchains 偐 iptables 偱僷働僢僩偵報傪晅偗偰丄偦偺報傪僀儞僞乕僼僃乕
    僗娫偺儖乕僥傿儞僌偱棙梡偡傞偙偲傕偱偒傑偡丅偙傟偼椺偊偽丄eth0 偐傜
    擖偭偰偒偨僷働僢僩偩偗傪 eth1 偱峣傞応崌側偳偵偲偰傕曋棙偱偡丅暥朄
    偼師偺捠傝:
    劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
    劆# tc filter add dev eth1 protocol ip parent 1:0 prio 1 handle 6 fw flowid 1:1 劆
    劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
    偙傟偼 u32 儅僢僠偱偼側偄偙偲偵拲堄丅
   
    報傪晅偗傞偵偼師偺傛偆偵偟傑偡丅
    劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
    劆# iptables -A PREROUTING -t mangle -i eth0 -j MARK --set-mark 6 劆
    劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
    偙偺斣崋 6 偼擟堄偵曄峏偱偒傑偡丅
   
    tc 僼傿儖僞偺暥朄慡晹傪棟夝偡傞偺偑柺搢側傜丄 iptables 傪巊偆偙偲偵
    偟偰丄fwmark 偵傛傞慖暿偩偗傪妎偊偰偔偩偝偄丅
   
TOS 僼傿乕儖僪偵傛傞儅僢僠
   
    懳榖揑側丄minimum delay 偺僩儔僼傿僢僋傪慖暿偡傞偵偼:
    劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
    劆# tc filter add dev ppp0 parent 1:0 protocol ip prio 10 u32 \ 劆
    劆      match ip tos 0x10 0xff \                                劆
    劆     flowid 1:4                                               劆
    劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
    僶儖僋僩儔僼傿僢僋偵偼 0x08 0xff 傪梡偄傑偡丅
   
僼傿儖僞僐儅儞僪偵偮偄偰傕偭偲抦傝偨偄恖偼丄崅搙側僼傿儖僞偺復傪尒偰偔
偩偝偄丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

9.7. 拞娫僉儏乕僀儞僌僨僶僀僗 (Intermediate queueing device :IMQ)

拞娫僉儏乕僨僶僀僗偼 qdisc 偱偼側偄偺偱偡偑丄偦偺棙梡朄偼 qdisc 偲怺偔
娭楢偟偰偄傑偡丅 linux 偱偼 qdisc 偼僱僢僩儚乕僋僨僶僀僗偵懏偟偰偍傝丄
僨僶僀僗偵僉儏乕偝傟偨傕偺偼丄偡傋偰偙偺 qdisc 偵僉儏乕偝傟傑偡丅偙偺僐
儞僙僾僩偵偼丄2 偮偺尷奅偑偁傝傑偡丅

1. 弌岥偱偺懷堟惂尷偟偐偱偒側偄 (擖岥 qdisc 傕偁傝傑偡偑丄僋儔僗僼儖側
qdisc 偵斾傋傞偲旕忢偵婡擻偑尷傜傟偰偄傑偡)丅

2. 偁傞 qdisc 偼傂偲偮偺僀儞僞乕僼僃乕僗偵偍偗傞僩儔僼傿僢僋偟偐尒側偄
偺偱丄僌儘乕僶儖側惂尷傪抲偔偙偲偼偱偒傑偣傫丅

IMQ 偼偙傟傜 2 偮偺惂尷傪夝寛偡傞偨傔偵偁傞偺偱偡丅娙扨偵偄偆偲丄qdisc
偱慖傫偩傕偺偡傋偰傪 IMQ 偵抲偗傞偺偱偡丅愱梡偺報偑偮偄偨僷働僢僩偼
netfilter 偺 NF_IP_PRE_ROUTING 偲 NF_IP_POST_ROUTING 奺僼僢僋偱妱傝崬傒
傪庴偗丄 imq 僨僶僀僗偵懏偡傞 qdisc 傊偲搉偝傟傑偡丅僷働僢僩偵報傪晅偗
傞偵偼丄iptables 偺僞乕僎僢僩傪梡偄傑偡丅

偙傟偵傛偭偰丄偮傑傝偁傞応強偐傜棃偨僷働僢僩偵報傪晅偗偰擖岥偱偺懷堟惂
尷傕偱偒傑偡偟丄傑偨暋悢偺僀儞僞乕僼僃乕僗傪僋儔僗偲傒側偟偰僌儘乕僶儖
側惂尷傪愝掕偱偒傑偡丅懠偵傕椺偊偽 http 僩儔僼傿僢僋傪 qdisc 偵擖傟偨傝
丄怴偟偄愙懕梫媮傪 qdisc 偵擖傟偨傝丄側偳偄傠偄傠側偙偲偑偱偒傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

9.7.1. 愝掕椺

嵟弶偵巚偄晜偐傇偺偼丄擖岥偱偺懷堟惂尷傪梡偄偰妋幚偵曐徹偝傟偨僶儞僪暆
傪巊偊傞傛偆偵偡傞偙偲偱偟傚偆 ;) 愝掕偼懠偺僀儞僞乕僼僃乕僗偱偺傕偺偲
帡偰偄傑偡丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆tc qdisc add dev imq0 root handle 1: htb default 20                   劆
劆                                                                      劆
劆tc class add dev imq0 parent 1: classid 1:1 htb rate 2mbit burst 15k  劆
劆                                                                      劆
劆tc class add dev imq0 parent 1:1 classid 1:10 htb rate 1mbit          劆
劆tc class add dev imq0 parent 1:1 classid 1:20 htb rate 1mbit          劆
劆                                                                      劆
劆tc qdisc add dev imq0 parent 1:10 handle 10: pfifo                    劆
劆tc qdisc add dev imq0 parent 1:20 handle 20: sfq                      劆
劆                                                                      劆
劆tc filter add dev imq0 parent 10:0 protocol ip prio 1 u32 match \     劆
劆                ip dst 10.0.0.230/32 flowid 1:10                      劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
偙偺椺偱偼 u32 傪僋儔僗慖暿偵梡偄偰偄傑偡丅懠偺僋儔僗慖暿婍傕丄婜懸捠傝
偵摦嶌偟傑偡丅師偵丄僩儔僼傿僢僋傪慖暿偟偰 imq0 偵僄儞僉儏乕偝傟傞傛偆
報傪晅偗傑偡丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆iptables -t mangle -A PREROUTING -i eth0 -j IMQ --todev 0           劆
劆                                                                    劆
劆ip link set imq0 up                                                 劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

iptables 偺 IMQ 僞乕僎僢僩偼丄mangle 僥乕僽儖偺 PREROUTING 僠僃僀儞偲
POSTROUTING 僠僃僀儞偱巊偊傑偡丅暥朄偼埲壓偺捠傝:
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆IMQ [ --todev n ]       n : imq 僨僶僀僗偺斣崋                      劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
ip6tables 僞乕僎僢僩傕採嫙偝傟偰偄傑偡丅

僩儔僼傿僢僋偑僄儞僉儏乕偝傟傞偺偼丄僞乕僎僢僩偵摉偨偭偨偲偒偱偼側偔丄
偦傟埲崀偵側傝傑偡丅幚嵺偵僩儔僼傿僢僋偑 imq 僨僶僀僗偵擖傞応強偼丄僩儔
僼傿僢僋偺曽岦 (in/out) 偵傛偭偰堎側傝傑偡丅偙傟傜偼 iptables 偱梡偄傜
傟傞丄掕媊嵪傒偺 netfilter 僼僢僋偱偡丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆enum nf_ip_hook_priorities {                                        劆
劆        NF_IP_PRI_FIRST = INT_MIN,                                  劆
劆        NF_IP_PRI_CONNTRACK = -200,                                 劆
劆        NF_IP_PRI_MANGLE = -150,                                    劆
劆        NF_IP_PRI_NAT_DST = -100,                                   劆
劆        NF_IP_PRI_FILTER = 0,                                       劆
劆        NF_IP_PRI_NAT_SRC = 100,                                    劆
劆        NF_IP_PRI_LAST = INT_MAX,                                   劆
劆};                                                                  劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

擖岥僩儔僼傿僢僋偱偼丄imq 偼帺暘帺恎傪 NF_IP_PRI_MANGLE + 1 偺桪愭搙傪
帩偮偲偟偰搊榐偟傑偡丅偮傑傝僷働僢僩偼丄 mangle 僥乕僽儖偺 PREROUTING
僠僃僀儞傪捠夁偟偨屻偵丄捈愙 imq 僨僶僀僗偵擖傞偺偱偡丅

弌岥偺 imq 偱偼丄NF_IP_PRI_LAST 傪梡偄傑偡丅偮傑傝丄filter 僥乕僽儖偑攋
婞偟偨僷働僢僩偼僶儞僪暆傪愯桳偡傋偒偱側偄丄偲偄偆帠忣傪懜廳偟偰偄傑偡
丅

僷僢僠偲傗傗徻偟偄忣曬偑丄 imq 偺僒僀僩 <http://luxik.cdi.cz/~patrick/
imq/> 偵偁傝傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

Chapter 10. 暋悢偺僀儞僞乕僼僃乕僗傪梡偄偨晧壸暘嶶

偙傟傪幚尰偡傞曽朄偼偄偔偮偐懚嵼偟傑偡丅娙扨偱捈滲揑側偺偼丄'TEQL' -
"True" (傑偨偼 "trivial") link equalizer 偱偡丅僉儏乕僀儞僌偵棈傓傕偺偼
偨偄偰偄偦偆偱偡偑丄晧壸暘嶶傕椉曽岦偵摦嶌偟傑偡丅姰慡側岠壥傪摼傞偵偼
丄愙懕偺椉抂偺娭梌偑昁梫偱偡丅

偙偺傛偆側忬嫷傪峫偊偰偔偩偝偄丅

 
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆                 +-------+   eth1   +-------+                       劆
劆                 |       |==========|       |                       劆
劆 'network 1' ----|   A   |          |   B   |---- 'network 2'       劆
劆                 |       |==========|       |                       劆
劆                 +-------+   eth2   +-------+                       劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

A 偲 B 偼儖乕僞偱丄偄傑偼椉曽偱 Linux 偑摦嶌偟偰偄傞偲偟傑偟傚偆丅僩儔
僼傿僢僋偑 network 1 偐傜 network 2 偵岦偐偆偲丄儖乕僞 A 偼 B 偵岦偐偆
2 偮偺愙懕偵丄僷働僢僩傪暘嶶偝偣傞昁梫偑偁傝傑偡丅儖乕僞 B 偱偼丄偙傟傪
庴怣偱偒傞傛偆側愝掕偑昁梫偱偡丅媡曽岦偵偮偄偰傕摨偠偱丄僷働僢僩偑
network 2 偐傜 network 1 偵岦偐偆偲偒丄儖乕僞 B 偼偦傟傜偺僷働僢僩傪
eth1 偲 eth2 偺椉曽傪巊偭偰憲傞昁梫偑偁傝傑偡丅

偙偺暘嶶偝偣傞晹暘偑丄'TEQL' 僨僶僀僗偵傛偭偰側偝傟傑偡丅師偺傛偆偵側傝
傑偡 (偄偪偽傫娙扨側愝掕):

 
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# tc qdisc add dev eth1 root teql0                                  劆
劆# tc qdisc add dev eth2 root teql0                                  劆
劆# ip link set dev teql0 up                                          劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

嵟屻偺 'ip link set up' 僐儅儞僪傪朰傟側偄偙偲!

偙傟偼椉曽偺儂僗僩偱幚峴偡傞昁梫偑偁傝傑偡丅偙偺僨僶僀僗 teql0 偼丄憲怣
偡傞僷働僢僩傪丄婎杮揑偵儔僂儞僪儘價儞偱 eth1 偲 eth2 偵暘嶶偝偣傑偡丅
僨乕僞偑 teql 僨僶僀僗偐傜擖偭偰偔傞偙偲偼寛偟偰偁傝傑偣傫丅僨乕僞偼 '
惗 (raw)' 偺 eth1 偲 eth2 偵摓拝偟傑偡丅

傑偩僨僶僀僗偑偱偒偨偩偗偱偡偐傜丄偙傟傜偵揔愗側儖乕僥傿儞僌愝掕偑昁梫
偱偡丅偙傟傪峴偆曽朄偺傂偲偮偼丄/31 偺僱僢僩儚乕僋傪椉愙懕偵妱傝摉偰丄
teql 僨僶僀僗偵傕摨偠傛偆偵 /31 偺僱僢僩儚乕僋傪妱傝摉偰傞傗傝曽偱偡:

儖乕僞 A 偵偰:
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# ip addr add dev eth1 10.0.0.0/31                                  劆
劆# ip addr add dev eth2 10.0.0.2/31                                  劆
劆# ip addr add dev teql0 10.0.0.4/31                                 劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

儖乕僞 B 偵偰:
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# ip addr add dev eth1 10.0.0.1/31                                  劆
劆# ip addr add dev eth2 10.0.0.3/31                                  劆
劆# ip addr add dev teql0 10.0.0.5/31                                 劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

偙傟偱儖乕僞 A 偼 10.0.0.1, 10.0.0.3, 10.0.0.5 偵懳偟丄 2 偮偺幚嵺偺愙
懕偲丄1 偮偺 TEQL 僨僶僀僗宱桼偱 ping 偱偒傞傛偆偵側偭偨偼偢偱偡丅儖乕
僞 B 傕丄 10.0.0.0, 10.0.0.2, 10.0.0.4 偵偙傟傜偺愙懕宱桼偱 ping 偱偒傞
偼偢偱偡丅

偙偙傑偱偑摦嶌偟偨傜丄儖乕僞 A 偱偼 10.0.0.5 傪 network 2 偵岦偐偆宱楬
偵偟丄儖乕僞 B 偱偼 10.0.0.4 傪 network 1 偵岦偐偆宱楬偵偟傑偡丅摿庩側
応崌偲偟偰丄network 1 偑帺戭偺僱僢僩儚乕僋丄 network 2 偑僀儞僞乕僱僢僩
偲偟傑偡偲丄儖乕僞 A 偱偼 10.0.0.5 傪帺暘偺僨僼僅儖僩僎乕僩僂僃僀偵側傞
傛偆偵偟傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

10.1. 拲堄

壗帠傕尒偰偔傟傎偳娙扨偱偼偁傝傑偣傫丅儖乕僞 A, B 椉曽偱丄eth1 偲 eth2
偺 return path filtering (栠傝宱楬偵傛傞僼傿儖僞儕儞僌) 偼柍岠偵偟側偗
傟偽側傝傑偣傫丅偙偆偟側偄偲丄偙傟傜偺僀儞僞乕僼僃乕僗偼帺暘帺恎埲奜偵
岦偐偭偰偄傞 ip 僷働僢僩傪棊偲偟偰偟傑偄傑偡丅

 
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# echo 0 > /proc/sys/net/ipv4/conf/eth1/rp_filter                   劆
劆# echo 0 > /proc/sys/net/ipv4/conf/eth2/rp_filter                   劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

偝偰丄師偵偼僷働僢僩偺暲傃懼偊 (reordering) 偵娭偡傞柺搢側栤戣偑偁傝傑
偡丅壖偵 6 偮偺僷働僢僩傪 A 偐傜 B 偵憲傜側偗傟偽側傜側偄偲偟傑偟傚偆丅
儖乕僞 B 偑偙傟傪弴斣偳偍傝偵 1, 2, 3, 4, 5, 6 偲庴偗庢傟偽棟憐揑偱偡丅
偟偐偟幚嵺偵偼丄僇乕僱儖偑偙傟傪 2, 1, 4, 3, 6, 5 偺傛偆偵庴偗庢傞壜擻
惈傕旕忢偵崅偄偺偱偡丅栤戣偼丄偙傟偵傛偭偰 TCP/IP 偑崿棎偟偰偟傑偆丄偲
偄偆偙偲偱偡丅偨偔偝傫偺 TCP/IP 僙僢僔儑儞傪暿乆偵塣傫偱偄傞夞慄偱偼栤
戣偵側傝傑偣傫偑丄暋悢偺夞慄傪傑偲傔偰丄傂偲偮偺僼傽僀儖偺 ftp 傪崅懍壔
偡傞偙偲偼偱偒傑偣傫丅偨偩偟庴怣偐憲怣傪峴偭偰偄傞 OS 偑 Linux 側傜暿偱
丄 Linux 偼扨弮側暲傃懼偊偱偼娙扨偵偼崿棎偟傑偣傫丅

偄偢傟偵偟偰傕丄懡偔偺傾僾儕働乕僔儑儞偱偼丄夞慄偺晧壸暘嶶偼旕忢偵椙偄
峫偊偱偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

10.2. 懠偺壜擻惈

William Stearns 偼丄崅搙側僩儞僱儖愝掕傪梡偄偰丄暋悢偺憡娭偺側偄僀儞僞
乕僱僢僩愙懕傪岠棪揑偵棙梡偟偰偄傑偡丅傗傝曽偼斵偺僩儞僱儕儞僌儁乕僕
<http://www.stearns.org/tunnel/> 偵彂偐傟偰偄傑偡丅

偙偺 HOWTO 偱傕丄彨棃偙傟偵偮偄偰庢傝忋偘傞偐傕偟傟傑偣傫丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

Chapter 11. Netfilter 偲 iproute 偱僷働僢僩偵報傪晅偗傞

偙偙傑偱丄iproute 偑偳偺傛偆偵摦嶌偡傞偐偵偮偄偰尒偰偒傑偟偨偑丄
netfilter 偵偮偄偰傕壗夞偐尵媦偟傑偟偨丅偙偺偁偨傝偱丄Rusty's
Remarkably Unreliable Guides <http://netfilter.samba.org/
unreliable-guides/> 傪捠偟偰挱傔偰偍偔偲偄偄偐傕偟傟傑偣傫丅 netfilter
偦偺傕偺偼偙偪傜 <http://netfilter.filewatcher.org/> 偵偁傝傑偡丅

netfilter 傪梡偄傞偲僷働僢僩傪僼傿儖僞偟偨傝丄僿僢僟傪彂偒姺偊偨傝偱偒
傑偡丅摿庩側婡擻偲偟偰丄僷働僢僩偵悢抣偺報傪晅偗傞偙偲傕偱偒傑偡丅偙傟
偵偼 --set-mark 僆僾僔儑儞傪巊偄傑偡丅

椺偲偟偰丄埲壓偺僐儅儞僪偼億乕僩 25 偵岦偗偨丄憲怣儊乕儖偺僷働僢僩偵偡
傋偰報傪晅偗偰偄傑偡丅

 
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# iptables -A PREROUTING -i eth0 -t mangle -p tcp --dport 25 \      劆
劆 -j MARK --set-mark 1                                               劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

偄傑暋悢偺夞慄偑偁傞偲偟偰丄傂偲偮偼崅懍偱偡偑廬検惂偱崅偔丄傕偆傂偲偮
偼掅懍偱偡偑掕妟偱埨偄偲偟傑偟傚偆丅傎偲傫偳偺応崌丄憲怣儊乕儖偼埨偄傎
偆偺宱楬偱憲傝偨偄偱偟傚偆丅

婛偵僷働僢僩偵偼 '1' 偲偄偆報傪晅偗傑偟偨丅偱偼偙偙偱宱楬億儕僔乕僨乕僞
儀乕僗偵丄偙偺傛偆側摦嶌傪偡傞傛偆巜帵偟傑偟傚偆丅

 
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# echo 201 mail.out >> /etc/iproute2/rt_tables                      劆
劆# ip rule add fwmark 1 table mail.out                               劆
劆# ip rule ls                                                        劆
劆0:      from all lookup local                                       劆
劆32764:  from all fwmark        1 lookup mail.out                    劆
劆32766:  from all lookup main                                        劆
劆32767:  from all lookup default                                     劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

偙偙偱 mail.out 僥乕僽儖偵丄抶偄偑埨偄夞慄偵岦偐偆宱楬傪嶌傝傑偡丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# /sbin/ip route add default via 195.96.98.253 dev ppp0 table mail.out劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

偙傟偱廔傢傝偱偡丅椺奜傪愝偗偨偄応崌丄傗傝曽偼偨偔偝傫偁傝傑偡丅
netfilter 偺暥傪廋惓偟偰摿掕偺儂僗僩傪彍奜偟偰傕偄偄偱偡偟丄彍奜儂僗僩
偵懳偟偰丄main 僥乕僽儖傪巜偡傛偆側丄桪愭搙偑崅偄儖乕儖傪憓擖偡傞曽朄傕
偁傝傑偡丅

偙偺婡擻偼丄TOS 價僢僩傪懜廳偡傞偺偵傕巊偊傑偡丅 Type of Service 偺堘偄
偵傛偭偰僷働僢僩偵報傪晅偗丄偦傟傜偵懳偟偰嶌梡偡傞儖乕儖傪嶌傟偽傛偄偺
偱偡丅偙偆偡傟偽丄椺偊偽 ISDN 愙懕傪丄懳榖揑側僙僢僔儑儞愱梡偵偡傞偙偲
傕偱偒傑偡丅

尵偆傑偱傕偁傝傑偣傫偑丄偙傟偼 NAT (儅僗僇儗乕僪) 傪峴偭偰偄傞儂僗僩偱
傕栤戣側偔摦嶌偟傑偡丅

廳梫: 僷働僢僩傊偺報晅偗偼丄彮側偔偲傕 MASQ 偲 SNAT 偲偵徴撍偟偰偟傑偆
丄偲偄偆曬崘傪庴偗傑偟偨丅偙傟偵娭偡傞 Rusty Russell 偺愢柧偼偙偺搳峞
<http://lists.samba.org/pipermail/netfilter/2000-November/006089.html>
偱梌偊傜傟偰偄傑偡丅惓偟偔摦嶌偝偣傞偵偼丄reverse path filter 傪柍岠偵
偟偰偔偩偝偄丅

拲堄: 僷働僢僩偵報傪晅偗傞偵偼丄偄偔偮偐偺僇乕僱儖僆僾僔儑儞傪桳岠偵偡
傞昁梫偑偁傝傑偡丅

 
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆IP: advanced router (CONFIG_IP_ADVANCED_ROUTER) [Y/n/?]                     劆
劆IP: policy routing (CONFIG_IP_MULTIPLE_TABLES) [Y/n/?]                      劆
劆IP: use netfilter MARK value as routing key (CONFIG_IP_ROUTE_FWMARK) [Y/n/?]劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

僋僢僋僽僢僋偺 Section 15.5 傕嶲徠偟偰偔偩偝偄丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

Chapter 12. 崅搙側僼傿儖僞偵傛傞僷働僢僩偺僋儔僗(嵞)慖暿

僋儔僗僼儖側僉儏乕僀儞僌婯懃偺愡偱愢柧偟偨傛偆偵丄僷働僢僩傪慖暿偟偰僒
僽僉儏乕偵憲傞嵺偵偼僼傿儖僞偑昁梫偱偡丅偙傟傜偺僼傿儖僞偼僋儔僗僼儖側
qdisc 偺撪晹偐傜屇偽傟傑偡丅

晄姰慡偱偼偁傝傑偡偑丄棙梡偱偒傞僋儔僗慖暿婍偺儕僗僩偱偡丅

fw
   
    僼傽僀傾僂僅乕儖偑僷働僢僩傪偳偺傛偆偵報晅偗偟偨偐偵婎偯偄偰寛掕傪
    峴偄傑偡丅 tc 僼傿儖僞偺暥朄傪曌嫮偟偨偔側偄恖偵偼丄埨堈側夝寛朄偱
    偡丅徻嵶偼僉儏乕僀儞僌偺復傪尒偰偔偩偝偄丅
   
u32
   
    僷働僢僩撪晹偺僼傿乕儖僪 (敪怣尦 IP 傾僪儗僗側偳) 偵婎偯偄偰寛掕傪
    峴偄傑偡丅
   
route
   
    僷働僢僩偑捠傞偙偲偵側傞宱楬偵婎偯偄偰寛掕傪峴偄傑偡丅
   
rsvp, rsvp6
   
    RSVP <http://www.isi.edu/div7/rsvp/overview.html> 偵婎偯偄偰僷働僢
    僩傪儖乕僥傿儞僌偟傑偡丅偙傟偑桳梡側偺偼娗棟壓偵偁傞僱僢僩儚乕僋偩
    偗偱偡丅僀儞僞乕僱僢僩偼 RSVP 傪偪傖傫偲尒傑偣傫丅
   
tcindex
   
    DSMARK qdisc 偱梡偄傜傟傑偡丅娭楢偡傞愡傪尒偰偔偩偝偄丅
   
僷働僢僩偺僋儔僗慖暿傪峴偆曽朄偼堦斒偵偼壗庬椶偐懚嵼偟丄偦偺偳傟傪梡偄
傞偐偼丄捠忢偼岲傒偺栤戣偵婣拝偟傑偡丅

僋儔僗慖暿婍偼偨偄偰偄丄偄偔偮偐偺嫟捠側堷偒悢傪庢傝傑偡丅嶲峫偺偨傔偵
偙偙偵儕僗僩偟偰偍偒傑偡丅

protocol
   
    偙偺僋儔僗慖暿婍偑庴偗晅偗傞僾儘僩僐儖丅捠忢偼 IP 僩儔僼傿僢僋偩偗
    傪庴偗晅偗傞偙偲偵側傞偱偟傚偆丅昁恵偱偡丅
   
parent
   
    偙偺僋儔僗慖暿婍偑懏偟偰偄傞僴儞僪儖丅偙偺僴儞僪儖偼丄偡偱偵懚嵼偟
    偰偄傞僋儔僗偱側偗傟偽側傝傑偣傫丅昁恵偱偡丅
   
prio
   
    僋儔僗慖暿婍偺桪愭搙丅彫偝偄悢抣偑愭偵僥僗僩偝傟傑偡丅
   
handle
   
    僼傿儖僞傪堦堄偵幆暿偡傞偨傔偺傕偺偱偡丅
   
埲崀偺愡偱偼丄HostA 偵岦偐偆僩儔僼傿僢僋傪峣傞偙偲傪峫偊傑偡丅儖乕僩僋
儔僗偼 1: 偲愝掕偝傟偰偄偰丄慖暿偝傟偨僩儔僼傿僢僋偺憲傝愭偲側傞僋儔僗
偼 1:1 偱偁傞偲偟傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

12.1. u32 僋儔僗慖暿婍

U32 僼傿儖僞偼尰嵼幚憰偝傟偰偄傞拞偱偼嵟傕崅搙側僼傿儖僞偱偡丅偙偺僼傿
儖僞慡懱偼僴僢僔儏僥乕僽儖偵婎偯偄偰偍傝丄懡偔偺僼傿儖僞儖乕儖偑偁傞帪
偱傕妋幚側摦嶌傪偟傑偡丅

嵟傕僔儞僾儖側宍偱偼丄U32 僼傿儖僞偼儗僐乕僪偺儕僗僩偱偁傝丄奺儗僐乕僪
偼 2 偮偺僼傿乕儖僪丄僙儗僋僞偲傾僋僔儑儞偐傜側傝傑偡丅僙儗僋僞偼 (埲崀
偱徻弎偟傑偡偑)丄尰嵼張棟偟偰偄傞 IP 僷働僢僩偲斾妑偝傟丄嵟弶偵儅僢僠偟
偨傕偺偵娭楢晅偗傜傟偨傾僋僔儑儞偑幚峴偝傟傑偡丅嵟傕僔儞僾儖側傾僋僔儑
儞偼僷働僢僩傪掕媊嵪傒偺僋儔僗偵岦偗傞傕偺偱偡丅

僼傿儖僞傪愝掕偡傞偵偼丄僐儅儞僪儔僀儞偐傜 tc filter 傪幚峴偟傑偡丅偙傟
偼 3 偮偺晹暘偐傜側傝傑偡丅僼傿儖僞巜掕晹丄僙儗僋僞丄傾僋僔儑儞偱偡丅僼
傿儖僞巜掕晹偼師偺傛偆偵掕媊偝傟傑偡:

 
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆tc filter add dev IF [ protocol PROTO ]                             劆
劆                     [ (preference|priority) PRIO ]                 劆
劆                     [ parent CBQ ]                                 劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

protocol 僼傿乕儖僪偼僼傿儖僞偑揔梡偝傟傞僾儘僩僐儖傪帵偟傑偡丅埲崀偱偼
ip 偺応崌偵偮偄偰偺傒夝愢偟傑偡丅 preference 僼傿乕儖僪偼丄偙偙偱掕媊偡
傞僼傿儖僞偺桪愭搙傪巜掕偟傑偡 (priority 傕摨偠堄枴偱巊偊傑偡)丅奺僼傿
儖僞偼儖乕儖偺儕僗僩偲偄偆宍傪庢傝傑偡偑丄暋悢偺僼傿儖僞傪偄傠偄傠側桪
愭搙偱愝掕偱偒傞偺偱丄偙偺悢抣偼廳梫偱偡丅奺儕僗僩偱偼儖乕儖偑捛壛偝傟
偨弴偵搉偝傟丄儕僗僩慡懱偼桪愭搙偺彫偝偄 (preference 偺悢抣偑戝偒偄) 傕
偺偐傜張棟偝傟傑偡丅 parent 僼傿乕儖僪偼丄僼傿儖僞偺懏偡傞僣儕乕偺僩僢
僾 (椺偊偽 1:0) 傪巜掕偟傑偡丅

偙傟傜偺僆僾僔儑儞偼丄U32 偵尷傜偢丄偡傋偰偺僼傿儖僞偵揔梡偝傟傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

12.1.1. U32 僙儗僋僞

U32 僙儗僋僞偵偼僷僞乕儞掕媊偑娷傑傟偰偍傝丄偙傟偑尰嵼張棟偟偰偄傞僷働
僢僩偵儅僢僠偟傑偡丅惓妋偵偼偙傟偼丄偳偺價僢僩偑僷働僢僩僿僢僟偵儅僢僠
偡傞偐偱偁偭偰丄偦傟埲忋偺傕偺偱偼偁傝傑偣傫丅偟偐偟偙偺扨弮側曽朄偼旕
忢偵嫮椡偱偡丅埲崀偺椺傪偛棗偵側偭偰壓偝偄丅偙傟傜偼幚嵺偵懚嵼偟偰偄傞
丄嬌傔偰暋嶨側僼傿儖僞偐傜捈愙嵦偭偨傕偺偱偡丅

 
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# tc filter add dev eth0 protocol ip parent 1:0 pref 10 u32 \       劆
劆  match u32 00100000 00ff0000 at 0 flowid 1:10                      劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

偙偙偱偼丄嵟弶偺峴偼婥偵偟側偄偱偔偩偝偄丅偙傟傜偺僷儔儊乕僞偼丄偡傋偰
僼傿儖僞偺僴僢僔儏僥乕僽儖傪婰弎偡傞傕偺偱偡丅 match 僉乕儚乕僪傪娷傓丄
僙儗僋僞偺峴偵拲栚偟傑偟傚偆丅偙偺僙儗僋僞偼丄2 斣栚偺僶僀僩偑 0x10
(0010) 偱偁傞 IP 僿僢僟偵儅僢僠偟傑偡丅偛憐憸偺捠傝丄師偺 00ff 偲偄偆悢
抣偼儅僢僠偺儅僗僋偱丄偳偺價僢僩偑杮摉偵儅僢僠偟側偗傟偽側傜側偄偐傪巜
掕偟傑偡丅偙偙偱偼儅僗僋偼 0xff 側偺偱丄幚嵺偵 0x10 偱偁傞僶僀僩偺傒偑
儅僢僠偟傑偡丅 at 僉乕儚乕僪偼丄偙偺儅僢僠傪巒傔傞偺偑巜掕偟偨僆僼僙僢
僩 (僶僀僩扨埵) 偐傜偱偁傞偙偲傪帵偟偰偄傑偡丅偙偺応崌偼僷働僢僩偺愭摢
偱偡丅埲忋傪恖娫偺尵梩偵東栿偡傞偲丄偙偺僙儗僋僞偼 Type of Service 僼傿
乕儖僪偱 'low delay' 價僢僩偩偗偑棫偭偰偄傞僷働僢僩偵儅僢僠偟傑偡丅暿偺
婯懃傕夝愅偟偰傒傑偟傚偆丅

 
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# tc filter add dev eth0 protocol ip parent 1:0 pref 10 u32 \       劆
劆  match u32 00000016 0000ffff at nexthdr+0 flowid 1:10              劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

nexthdr 僆僾僔儑儞偼丄偙偺 IP 僷働僢僩偵僇僾僙儖偝傟偰偄傞暿偺僿僢僟
(next 僿僢僟)丄偮傑傝忋憌僾儘僩僐儖偺僿僢僟傪堄枴偟傑偡丅偙偺儅僢僠儞僌
傕丄next 僿僢僟偺愭摢偐傜奐巒偝傟偰偄傑偡丅儅僢僠偼偦偺僿僢僟偺 2 斣栚
偺 32 價僢僩儚乕僪偵懳偟偰峴傢傟傑偡丅 TCP 偲 UDP 奺僾儘僩僐儖偱偼丄偙
偺僼傿乕儖僪偵偼僷働僢僩偺憲怣愭億乕僩偑娷傑傟傑偡丅悢抣偼 big 僄儞僨傿
傾儞宍幃 (戝偒偄寘偑愭) 偱梌偊傜傟偰偄傑偡丅傛偭偰 0x0016 偼偦偺傑傑 10
恑悢偱 22 偲側傝傑偡偐傜丄偙傟偑 TCP 側傜 SSH 僒乕價僗傪昞偟偰偄傑偡丅
偼偄丄偙偺儅僢僠偼慜採偑側偄偲堦堄偱側偄偱偡偹丅偙偺揰偵偮偄偰偼傑偨屻
傎偳愢柧偟傑偡丅

埲忋傪偛棟夝偄偨偩偗偰偄傟偽丄師偺僙儗僋僞傕娙扨偵撉傔傞偱偟傚偆乽match
c0a80100 ffffff00 at 16乿偙偙偱偼 IP 僿僢僟偺愭摢偐傜 17 斣栚埲崀偺 3
僶僀僩暘傪儅僢僠偝偣偰偄傑偡丅偙傟偼憲怣愭傾僪儗僗偑 192.168.1/24 偺僱
僢僩儚乕僋偺偳偙偐偵側偭偰偄傞傕偺偱偡丅埲忋丄偄偔偮偐椺傪夝愅偟偨偲偙
傠偱丄妛傫偩偙偲傪傑偲傔偰傒傞偙偲偵偟傑偟傚偆丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

12.1.2. 斈梡僙儗僋僞 (general selector)

斈梡僙儗僋僞偼丄僷僞乕儞丄儅僗僋丄僷働僢僩偱偦偺僷僞乕儞傪儅僢僠偝偣傞
晹暘偺僆僼僙僢僩丄傪掕媊偟傑偡丅偙偺斈梡僙儗僋僞傪梡偄傞偲丄傎傏 IP 僿
僢僟 (偍傛傃忋憌偺僿僢僟) 偺偳傫側價僢僩偵傕儅僢僠偑壜擻偱偡丅偨偩偟偙
傟傜偼丄師偱愢柧偡傞摿庩僙儗僋僞偵斾傋傞偲丄撉傒彂偒偑柺搢偱偡丅斈梡僙
儗僋僞偺暥朄偼埲壓偺捠傝:

 
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆match [ u32 | u16 | u8 ] PATTERN MASK [ at OFFSET | nexthdr+OFFSET] 劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

僉乕儚乕僪 u32, u16 u8 偼偳傟偐傂偲偮傪巜掕偟丄僷僞乕儞偺挿偝傪價僢僩扨
埵偱昞偟傑偡丅 PATTERN 偲 MASK 偼丄偙偺僉乕儚乕僪偱巜掕偟偨挿偝偱側偗傟
偽側傝傑偣傫丅 OFFSET 僷儔儊乕僞偼僶僀僩扨埵偺僆僼僙僢僩偱丄儅僢僠摦嶌
傪巒傔傞埵抲偱偡丅 nexthdr+ 僉乕儚乕僪偑巜掕偝傟傞偲丄僆僼僙僢僩偼忋憌
僿僢僟偺愭摢偐傜偺憡懳埵抲偵側傝傑偡丅

偄偔偮偐椺傪帵偟傑偡丅師偺椺偱偼 Time to Live (TTL) 偑 64 偱偁傞僷働僢
僩偑儅僢僠偟傑偡丅 TTL 僼傿乕儖僪偼 IP 僿僢僟偺 8 斣栚偺僶僀僩偺捈屻偐
傜巒傑傝傑偡丅

 
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# tc filter add dev ppp14 parent 1:0 prio 10 u32 \                  劆
劆     match u8 64 0xff at 8 \                                        劆
劆     flowid 1:4                                                     劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

師偺椺偼 ACK 價僢僩偑愝掕偝傟偰偄傞偡傋偰偺 TCP 僷働僢僩偵儅僢僠偟傑偡:

 
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# tc filter add dev ppp14 parent 1:0 prio 10 u32 \                  劆
劆     match ip protocol 6 0xff \                                     劆
劆     match u8 0x10 0xff at nexthdr+13 \                             劆
劆     flowid 1:3                                                     劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

64 僶僀僩傛傝彫偝偄僷働僢僩偺 ACK 偵儅僢僠偝偣偨偄偲偒偼師傪梡偄傑偟傚
偆:

 
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆## match acks the hard way,                                         劆
劆## IP protocol 6,                                                   劆
劆## IP header length 0x5(32 bit words),                              劆
劆## IP Total length 0x34 (ACK + 12 bytes of TCP options)             劆
劆## TCP ack set (bit 5, offset 33)                                   劆
劆# tc filter add dev ppp14 parent 1:0 protocol ip prio 10 u32 \      劆
劆            match ip protocol 6 0xff \                              劆
劆            match u8 0x05 0x0f at 0 \                               劆
劆            match u16 0x0000 0xffc0 at 2 \                          劆
劆            match u8 0x10 0xff at 33 \                              劆
劆            flowid 1:3                                              劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

偙偺婯懃偼丄ACK 價僢僩偑僙僢僩偝傟偰偄偰丄偦偺懠偵儁僀儘乕僪偼帩偨側偄
傛偆側 TCP 僷働僢僩偵偺傒儅僢僠偟傑偡丅偙傟偼暋悢偺僙儗僋僞傪巊偆椺偵側
偭偰偄傑偡丅嵟廔揑側寢壥偼丄偙傟傜偺寢壥偺榑棟愊偵側傝傑偡丅 TCP 僿僢僟
偺僟僀傾僌儔儉傪尒傞偲丄ACK 價僢僩偼 TCP 僿僢僟偺 14 僶僀僩栚 (at
nexthdr+13) 偺戞擇價僢僩 (0x10) 偵側偭偰偄傑偡丅嵟弶偺僙儗僋僞偼丄傕偟
擄偟偄曽偑偍岲傒側傜丄屌桳僙儗僋僞 (specific selector) 傪巊偭偰 ip
protocol 6 0xff 偲彂偔戙傢傝偵丄 match u8 0x06 0xff at 9 偲傕彂偗傑偡丅
6 偼 TCP 偺僾儘僩僐儖斣崋偱丄偙傟偼 IP 僿僢僟偺 10 斣栚偺僶僀僩偵彂偐傟
傑偡丅堦曽媡偵偙偺椺偱偼丄巐斣栚偺儅僢僠偵偼屌桳僙儗僋僞傪巊偭偰偄傑偣
傫丅偙傟偼扨偵丄TCP ACK 價僢僩偵儅僢僠偡傞屌桳僙儗僋僞偑懚嵼偟側偄偐傜
偱偡丅

師偺僼傿儖僞偼丄偙偺僼傿儖僞偺廋惓斉偱偡丅堘偄偼 ip 僿僢僟偺挿偝傪僠僃
僢僋偟偰偄側偄揰偱偡丅棟桼? 慜弎偺僿僢僟偼丄32 價僢僩僔僗僥儉偱偟偐摦嶌
偟側偄偐傜偱偡丅

 
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆tc filter add dev ppp14 parent 1:0 protocol ip prio 10 u32 \        劆
劆     match ip protocol 6 0xff \                                     劆
劆     match u8 0x10 0xff at nexthdr+13 \                             劆
劆     match u16 0x0000 0xffc0 at 2 \                                 劆
劆     flowid 1:3                                                     劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

12.1.3. 屌桳僙儗僋僞 (specific selector)

師偺昞偼丄偙偺愡偺挊幰偑 tc 僾儘僌儔儉偺僜乕僗僐乕僪偐傜敪尒偟偨丄偡傋
偰偺屌桳僙儗僋僞傪儕僗僩偟偨傕偺偱偡丅偙傟傜偼扨偵僼傿儖僞愝掕偺壜撉惈
傪憹偟丄曢傜偟傪妝偵偡傞偨傔偺傕偺偱偡丅

FIXME: 昞偼偙偙偵: 尰嵼昞偼暿僼傽僀儖 "selector.html" 偵偁傝傑偡丅

FIXME: 傑偩偙偺僼傽僀儖偼億乕儔儞僪岅偱偡 :-(

FIXME: sgml 壔傕昁梫偱偡丅

偄偔偮偐椺傪帵偟傑偡:

 
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# tc filter add dev ppp0 parent 1:0 prio 10 u32 \                   劆
劆     match ip tos 0x10 0xff \                                       劆
劆     flowid 1:4                                                     劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

FIXME: tcp dport 偺儅僢僠偼丄埲崀偱愢柧偝傟偰偄傞傛偆偵偼摦嶌偟傑偣傫丅

偙偺儖乕儖偼 TOS 僼傿乕儖僪偑 0x10 偵側偭偰偄傞僷働僢僩偵儅僢僠偟傑偡丅
TOS 僼傿乕儖僪偼僷働僢僩偺戞擇僶僀僩偐傜巒傑傝丄戝偒偝偼 1 僶僀僩偱偡丅
傛偭偰摍壙側斈梡僙儗僋僞偼 match u8 0x10 0xff at 1 偲彂偗傑偡丅偙傟偼
U32 僼傿儖僞偺撪晹傪奯娫尒偣偰偔傟傑偡丅偮傑傝屌桳側儖乕儖偼忢偵斈梡儖
乕儖偵彂偒姺偊傜傟丄偦偟偰僇乕僱儖偺儊儌儕偵偼偙偺偐偨偪偱曐懚偝傟傞偺
偱偡丅偙偙偐傜暿偺寢榑傕摫偗傑偡丅偡側傢偪 tcp 偲 udp 偼傑偭偨偔摨偠偱
丄偙傟偑 match tcp dport 53 0xffff 偲偄偆 1 偮偺僙儗僋僞偩偗偱偼丄偙偺
億乕僩偵憲傜傟偨 TCP 僷働僢僩偵儅僢僠偱偒側偄棟桼側偺偱偡 (偙偺億乕僩偵
憲傜傟偨 UDP 僷働僢僩偵傕儅僢僠偟偰偟傑偄傑偡)丅摨帪偵僾儘僩僐儖傕巜掕
偟側偗傟偽側傜側偄偙偲傪妎偊偹偽側傝傑偣傫丅寢嬊嵟廔揑偵偼師偺傛偆側儖
乕儖偵側傝傑偡丅

 
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# tc filter add dev ppp0 parent 1:0 prio 10 u32 \                   劆
劆        match tcp dport 53 0xffff \                                 劆
劆        match ip protocol 0x6 0xff \                                劆
劆        flowid 1:2                                                  劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

12.2. route 僋儔僗慖暿婍

偙偺僋儔僗慖暿婍偼丄宱楬僥乕僽儖偺寢壥偵婎偯偄偰僼傿儖僞摦嶌傪偟傑偡丅
僷働僢僩偑僋儔僗娫傪慗堏偟偰 "route" 僼傿儖僞偱儅乕僋偝傟偨僋儔僗偵摓払
偡傞偲丄偙偺僼傿儖僞偼宱楬僥乕僽儖偺忣曬偵婎偯偄偰僷働僢僩傪怳傝暘偗傑
偡丅

 
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# tc filter add dev eth1 parent 1:0 protocol ip prio 100 route      劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

偙偙偱偼 route 僋儔僗慖暿婍傪恊僲乕僪 1:0 偵 priority 100 偱捛壛偟偰偄
傑偡丅僷働僢僩偑偙偺僲乕僪偵摓払偡傞偲 (偙偙偱偼 root 側偺偱偡偖偵摓払
偟傑偡)丄偙偺慖暿婍偼宱楬僥乕僽儖傪尒傑偡丅儅僢僠偟偨傜偙偺僷働僢僩偼巜
掕偝傟偨僋儔僗偵憲傜傟丄 priority 100 偑梌偊傜傟傑偡丅懕偄偰丄偙傟傪摦
嶌偝偣傞偨傔偵丄揔愗側儖乕僥傿儞僌僄儞僩儕傪捛壛偟傑偡丅

偙偙偱偼丄憲怣愭傑偨偼敪怣尦偵傛偭偰 'realm' 傪掕媊偟傑偡丅傗傝曽偼丄椺
偊偽師偺傛偆偵側傝傑偡丅

 
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# ip route add Host/Network via Gateway dev Device realm RealmNumber劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

椺偊偽丄憲怣愭偺僱僢僩儚乕僋偑 192.168.10.0 偺応崌偵 realm 斣崋 10 傪梌
偊傞偵偼師偺傛偆偵偟傑偡:

 
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# ip route add 192.168.10.0/24 via 192.168.10.1 dev eth1 realm 10   劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

route 僼傿儖僞傪捛壛偡傞嵺偵偼丄僱僢僩儚乕僋傗儂僗僩傪堄枴偡傞 realm 斣
崋偑棙梡偱偒丄偙傟偵傛偭偰宱楬傪僼傿儖僞偵偳偺傛偆偵儅僢僠偝偣傞偐傪巜
掕偱偒傑偡丅

 
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# tc filter add dev eth1 parent 1:0 protocol ip prio 100 \          劆
劆  route to 10 classid 1:10                                          劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

偙偺儖乕儖偼丄僱僢僩儚乕僋 192.168.10.0 偵岦偐偆僷働僢僩偵儅僢僠偟丄 id
偑 1:10 偺僋儔僗偵憲傝傑偡丅

route 僼傿儖僞偼宱楬偺敪怣尦傪梡偄偰傕儅僢僠偱偒傑偡丅椺偊偽 Linux 儖乕
僞偺 eth2 偵僒僽僱僢僩儚乕僋偑愙懕偝傟偰偄傞偲偟傑偡丅

 
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# ip route add 192.168.2.0/24 dev eth2 realm 2                      劆
劆# tc filter add dev eth1 parent 1:0 protocol ip prio 100 \          劆
劆  route from 2 classid 1:2                                          劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

偙偺僼傿儖僞偱偼 192.168.2.0 僒僽僱僢僩儚乕僋偐傜棃偨 (realm 2) 僷働僢
僩偵儅僢僠偟丄id 偑 1:2 偺僋儔僗偵憲傝傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

12.3. 娔帇惂尷 (policing) 僼傿儖僞

偝傜偵暋嶨側愝掕傪壜擻偵偡傞偨傔丄偁傞僶儞僪暆傪墇偊偨応崌偵儅僢僠偡傞
僼傿儖僞傪摫擖偡傞偙偲傕偱偒傑偡丅偁傞懍搙傪墇偊偨傜堦愗儅僢僠傪傗傔偰
偟傑偆傛偆側僼傿儖僞傪愰尵偡傞偙偲傕丄偁傞偄偼偁傞懍搙傪墇偊偨暘偵懳偟
偰偺傒儅僢僠偝偣側偄傛偆偵傕偱偒傑偡丅

偮傑傝娔帇惂尷傪 4mbit/s 偲偟偨偲偒偵 5mbit/s 偺僩儔僼傿僢僋偑偁偭偨応
崌丄 5mbit/s 慡晹偵懳偟偰儅僢僠偝偣側偄偙偲傕偱偒傑偡偟丄偁傞偄偼 1mbit
/s 偵偺傒儅僢僠偝偣偢 4mbit/s 暘偼愝掕偝傟偨僋儔僗偵憲傞傛偆偵偡傞偙偲
傕偱偒傑偡丅

僶儞僪暆偑愝掕懍搙傪墇偊偨応崌偺慖戰巿偲偟偰偼丄僷働僢僩傪攋婞偡傞丄嵞
僋儔僗慖暿偡傞丄暿偺僼傿儖僞偵儅僢僠傪帋傒偝偣傞丄側偳偑偁傝傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

12.3.1. 娔帇惂尷偺傗傝曽

娔帇惂尷偺傗傝曽偼丄婎杮揑偵 2 偮偁傝傑偡丅僇乕僱儖偵乽昡壙婍
(estimator)乿傪慻傒崬傓偲丄偦偺僇乕僱儖偼奺僼傿儖僞偺埶棅傪庴偗丄捠夁偝
偣偨僩儔僼傿僢僋検偑懡偄偐彮側偄偐傪應掕偱偒傑偡丅偙傟傜偺昡壙婍偼 CPU
偱偼旕忢偵梕堈偱丄堦昩偵 25 夞偢偮丄捠夁偟偨僨乕僞検傪應掕偟偰偦傟傜偺
價僢僩儗乕僩傪寁嶼偟傑偡丅

暿偺曽朄偱偼丄嵞傃僩乕僋儞僶働僣僼傿儖僞偑搊応偟傑偡丅偙傫偳偼僼傿儖僞
偺撪晹偵抲偔傢偗偱偡丅 TBF 偼丄愝掕偟偨僶儞僪暆傑偱偺僩儔僼傿僢僋偵儅僢
僠偟傑偡丅偦傟埲忋偺僷働僢僩偑偔傞偲丄墇偊偨暘偩偗偑丄惂尷墇偊偵懳偟偰
愝掕偟偨摦嶌偺懳徾偲側傝傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

12.3.1.1. 僇乕僱儖昡壙婍傪梡偄傞

偙傟偼偲偰傕僔儞僾儖偱丄僷儔儊乕僞偼 avrate 偺傂偲偮偩偗偱偡丅棳検偑
avrate 埲撪偵棷傑偭偰偄傞偲丄僼傿儖僞偼偙偺僩儔僼傿僢僋傪愝掕偝傟偨
classid 偵僋儔僗慖暿偟傑偡丅棳検偑偙傟傪墇偊傞偲丄巜掕偝傟偨摦嶌 (偙偺
僨僼僅儖僩偼乽嵞僋儔僗慖暿 (reclassify)乿) 傪峴偄傑偡丅

僇乕僱儖偼僶儞僪暆偵巜悢廳傒晅偗堏摦暯嬒傪梡偄傑偡丅偙傟偼抁婜娫偺僶乕
僗僩偵偼偁傑傝晀姶偱偼偁傝傑偣傫丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

12.3.1.2. 僩乕僋儞僶働僣僼傿儖僞傪梡偄傞

師偺僷儔儊乕僞傪梡偄傑偡:

 丒 burst/buffer/maxburst
   
 丒 mtu/minburst
   
 丒 mpu
   
 丒 rate
   
 

偙傟傜偺摦嶌偼丄僩乕僋儞僶働僣僼傿儖僞偺愡偱愢柧偟偨傕偺偲傎傏摨偠偱偡
丅偟偐偟拲堄偟偰傎偟偄偺偱偡偑丄TBF 惂尷婍偺 mtu 傪彫偝偔偟偡偓傞偲丄傑
偭偨偔僷働僢僩偑捠傝傑偣傫丅偙傟偵懳偟丄弌岥 (egress) 偱偺 TBF qdisc 偱
偼丄僷働僢僩偺捠夁傪抶偔偡傞偩偗偱偡丅

暿偺堘偄偼丄惂尷婍偱偼僷働僢僩傪捠偡偐攋婞偡傞偐偟偐偱偒側偄偙偲偱偡丅
僷働僢僩傪曐帩偟偰抶墑偝偣傞偙偲偼偱偒傑偣傫丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

12.3.2. 惂尷傪墇偊偨偲偒偺摦嶌

惂尷傪墇偊偨偲敾抐偡傞偲丄僼傿儖僞偼巜掕偝傟偨乽摦嶌乿傪峴偄傑偡丅尰嵼
4 偮偺摦嶌偑棙梡偱偒傑偡丅

continue
   
    偙偺僼傿儖僞偼儅僢僠偟傑偣傫偑丄懠偺僼傿儖僞偵儅僢僠傪帋傒偝偣傑偡
    丅
   
drop
   
    偙傟偼嬌傔偰尩偟偄慖戰巿偱丄偁傞懍搙傪墇偊偨僩儔僼傿僢僋傪扨偵攋婞
    偟傑偡丅偙傟偼擖岥偺娔帇惂尷偱椙偔梡偄傜傟丄棙梡傪惂尷偟傑偡丅椺偊
    偽丄5mbit/s 傪墇偊傞僷働僢僩傪憲傞偲棊偪偰偟傑偆傛偆側僱乕儉僒乕僶
    偑偁傞応崌丄擖岥僼傿儖僞傪梡偄傟偽丄偙傟埲忋偺僷働僢僩傪憲傜側偄傛
    偆偵偱偒傑偡丅
   
Pass/OK
   
    僩儔僼傿僢僋傪栤戣側偔捠偟傑偡丅暋嶨側僼傿儖僞傪柍岠偵偟偨偄偗傟偳
    傕丄偦偺傑傑攝抲偼偟偰偍偒偨偄応崌偵巊偄傑偡丅
   
reclassify
   
    傎偲傫偳偺応崌偼儀僗僩僄僼僅乕僩偺嵞僋儔僗慖暿偵側傝傑偡丅偙傟偑僨
    僼僅儖僩偺摦嶌偱偡丅
   
劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

12.3.3. 椺

尰嵼抦傜傟偰偄傞桞堦偺幚椺偼丄儂僗僩傪 SYN 僼儔僢僪偐傜庣傞偺愡偱愢柧偟
偰偄傑偡丅 

摓拝偡傞 icmp 僩儔僼傿僢僋傪 2kbit 偵惂尷偟丄偙傟傪墇偊偨僷働僢僩傪抲偲
偟傑偡丅

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆tc filter add dev $DEV parent ffff: \                               劆
劆    protocol ip prio 20 \                                           劆
劆    u32 match ip protocol 1 0xff \                                  劆
劆    police rate 2kbit buffer 10k drop \                             劆
劆    flowid :1                                                       劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

僷働僢僩偺僒僀僘傪揔摉側抣偵惂尷偟傑偡 (偙偙偱偼 84 僶僀僩傛傝戝偒側僷
働僢僩偼偡傋偰棊偲偟傑偡)丅

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆tc filter add dev $DEV parent ffff: \                               劆
劆   protocol ip prio 20 \                                            劆
劆   u32 match tos 0 0 \                                              劆
劆   police mtu 84 drop \                                             劆
劆   flowid :1                                                        劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

偙偺曽朄傪梡偄傞偲丄偡傋偰偺僷働僢僩傪棊偲偣傑偡丅

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆tc filter add dev $DEV parent ffff: \                               劆
劆   protocol ip prio 20 \                                            劆
劆   u32 match ip protocol 1 0xff \                                   劆
劆   police mtu 1 drop \                                              劆
劆   flowid :1                                                        劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

偙傟偼幚嵺偵偼 1 僶僀僩傛傝戝偒側 icmp 僷働僢僩傪棊偲偟傑偡丅僒僀僘 1
僶僀僩偺僷働僢僩偼棟榑揑偵偼偁傝摼傑偡偑丄幚嵺偺僱僢僩儚乕僋偱偼傑偢懚
嵼偟側偄偱偟傚偆丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

12.4. 僴僢僔儏僼傿儖僞: 挻崅懍戝検僼傿儖僞儕儞僌

偨偔偝傫偺僋儔僀傾儞僩傗僐儞僺儏乕僞偑偁偭偰悢愮傕偺儖乕儖傪昁梫偲偟丄
偦偺偡傋偰偵暿乆偺 QoS 巜掕傪峴偆偲丄僇乕僱儖偼偙傟傜偺儖乕儖傊偺儅僢僠
偵丄懡偔偺帪娫傪旓傗偡偙偲偵側傞偱偟傚偆丅

僨僼僅儖僩偱偼丄偡傋偰偺僼傿儖僞偼傂偲偮偺戝偒側僠僃僀儞偵嫟懚偟偰偍傝
丄 priority 偺弴偵儅僢僠偝傟偰偄偒傑偡丅1000 偺儖乕儖偑偁偭偨傜丄僷働僢
僩偵懳偟偰壗傪峴偆偐寛傔傞偵偼丄 1000 夞偺僠僃僢僋偑昁梫偲側傞偐傕偟傟
傑偣傫丅

偦傟偧傟 4 偮偺儖乕儖偐傜側傞 256 屄偺僠僃僀儞偺傎偆偑丄儅僢僠偺懍搙偼
偢偭偲慺憗偔側傝傑偡丅偨偩偟僷働僢僩傪丄偙傟傜 256 偺僠僃僀儞偆偪丄揔愗
側儖乕儖偑偁傞傕偺偵暘嶶偝偣傞偙偲偑昁梫偵側傝傑偡丅

偙傟偼僴僢僔儏傪梡偄傞偲壜擻偵側傝傑偡丅偄傑働乕僽儖儌僨儉偺屭媞偑僱僢
僩儚乕僋偵 1024 柤偄傞偲偟傑偟傚偆丅IP 傾僪儗僗偼 1.2.0.0 偐傜
1.2.3.255 傑偱偱丄偦傟偧傟 'lite', 'regular', 'premium' 側偳偺丄暿乆偺
僇僥僑儕偵懏偟偰偄傞傕偺偲偟傑偡丅偙偺応崌偼埲壓偺傛偆側 1024 偺儖乕儖
偑昁梫偵側傞偱偟傚偆丅

 
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# tc filter add dev eth1 parent 1:0 protocol ip prio 100 match ip src \ 劆
劆  1.2.0.0 classid 1:1                                                   劆
劆# tc filter add dev eth1 parent 1:0 protocol ip prio 100 match ip src \ 劆
劆  1.2.0.1 classid 1:1                                                   劆
劆...                                                                     劆
劆# tc filter add dev eth1 parent 1:0 protocol ip prio 100 match ip src \ 劆
劆  1.2.3.254 classid 1:3                                                 劆
劆# tc filter add dev eth1 parent 1:0 protocol ip prio 100 match ip src \ 劆
劆  1.2.3.255 classid 1:2                                                 劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

IP 傾僪儗僗偺枛旜晹暘傪乽僴僢僔儏僉乕乿偲偟偰棙梡偡傟偽丄偙傟傪崅懍壔偱
偒傑偡丅偙偆偡傞偲 256 偺僥乕僽儖偑偱偒丄偦偺嵟弶偺傕偺偼偙偺傛偆偵側傝
傑偡丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# tc filter add dev eth1 parent 1:0 protocol ip prio 100 match ip src \ 劆
劆  1.2.0.0 classid 1:1                                                   劆
劆# tc filter add dev eth1 parent 1:0 protocol ip prio 100 match ip src \ 劆
劆  1.2.1.0 classid 1:1                                                   劆
劆# tc filter add dev eth1 parent 1:0 protocol ip prio 100 match ip src \ 劆
劆  1.2.2.0 classid 1:3                                                   劆
劆# tc filter add dev eth1 parent 1:0 protocol ip prio 100 match ip src \ 劆
劆  1.2.3.0 classid 1:2                                                   劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

師偺僥乕僽儖偼偙偺傛偆偵側傝傑偡丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# tc filter add dev eth1 parent 1:0 protocol ip prio 100 match ip src \ 劆
劆  1.2.0.1 classid 1:1                                                   劆
劆...                                                                     劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

偙偺傛偆偵偟偰丄嵟戝偱 4 偮偺僠僃僢僋丄暯嬒偱 2 偮偺僠僃僢僋偟偐昁梫側
偔側傝傑偡丅

愝掕偼嬌傔偰暋嶨偱偡偑丄偙傟偩偗懡偔偺儖乕儖偑偁傞傛偆側忬嫷偱偼丄廫暘
嶌嬈偵尒崌偄傑偡丅傑偢 root 偵僼傿儖僞傪嶌傝丄 256 偺僄儞僩儕偑偁傞僥乕
僽儖傪嶌傝傑偡丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# tc filter add dev eth1 parent 1:0 prio 5 protocol ip u32                      劆
劆# tc filter add dev eth1 parent 1:0 prio 5 handle 2: protocol ip u32 divisor 256劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

偙偙偱偄傑嶌偭偨僥乕僽儖偺僄儞僩儕偵偄偔偮偐儖乕儖傪捛壛偟傑偡丅

 
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# tc filter add dev eth1 protocol ip parent 1:0 prio 5 u32 ht 2:7b: \ 劆
劆        match ip src 1.2.0.123 flowid 1:1                             劆
劆# tc filter add dev eth1 protocol ip parent 1:0 prio 5 u32 ht 2:7b: \ 劆
劆        match ip src 1.2.1.123 flowid 1:2                             劆
劆# tc filter add dev eth1 protocol ip parent 1:0 prio 5 u32 ht 2:7b: \ 劆
劆        match ip src 1.2.3.123 flowid 1:3                             劆
劆# tc filter add dev eth1 protocol ip parent 1:0 prio 5 u32 ht 2:7b: \ 劆
劆        match ip src 1.2.4.123 flowid 1:2                             劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
偙傟偼僄儞僩儕 123 偱丄1.2.0.123, 1.2.1.123, 1.2.2.123, 1.2.3.123 傊偺
儅僢僠傪娷傫偱偍傝丄偦傟偧傟傪 1:1, 1:2, 1:3, 1:2 偵憲傝傑偡丅偙偙偱僴
僢僔儏僶働僣偼 16 恑悢偱巜掕偟側偗傟偽側傜側偄偙偲偵偛拲堄偔偩偝偄丅
0x7b 偼 123 偱偡丅

師偵乽僴僢僔儏僼傿儖僞乿傪嶌傝傑偡丅偙傟偼僩儔僼傿僢僋傪丄僴僢僔儏僥乕
僽儖偺惓偟偄僄儞僩儕偵岦偗傑偡丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# tc filter add dev eth1 protocol ip parent 1:0 prio 5 u32 ht 800:: \ 劆
劆        match ip src 1.2.0.0/16 \                                     劆
劆        hashkey mask 0x000000ff at 12 \                               劆
劆        link 2:                                                       劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
偼偄丄偙偙偱悢帤偺偄偔偮偐偵偮偄偰偼愢柧偑昁梫偱偟傚偆丅僨僼僅儖僩偺僴
僢僔儏僥乕僽儖偼 800:: 偲偄偆柤慜偵側傝傑偡丅偡傋偰偺僼傿儖僞偼偙偙偐傜
巒傑傝傑偡丅師偵 IP 僿僢僟偺 12, 13, 14, 15 僶僀僩栚偵偁傞敪怣尦傾僪儗
僗傪慖傃丄偙偺嵟屻偺晹暘偵偺傒拲栚偟偰偄傞偙偲傪巜掕偟偰偄傑偡丅偙傟偼
愭偵嶌偭偨僴僢僔儏僥乕僽儖 2: 偵憲偭偰偄傑偡丅

偐側傝暋嶨偱偡偑丄幚嵺偵摦嶌偟傑偡偟惈擻岦忋偼嬃堎揑偱偡丅偙偺椺偼偝傜
偵夵椙偑壜擻偱丄棟憐揑偵偼奺僠僃僀儞偵 1 偮偺僼傿儖僞偟偐擖偭偰偄側偄忬
嫷偵偱偒傑偡!

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

12.5. IPv6 僩儔僼傿僢僋偺僼傿儖僞儕儞僌

12.5.1. 側偤 IPv6 偱偼 tc 僼傿儖僞偑摦偐側偄偺偐

Linux 僇乕僱儖偱偼丄宱楬億儕僔乕僨乕僞儀乕僗 (Routing Policy Database:
RPDB) 偑 IPv4 偺儖乕僥傿儞僌丒傾僪儗僢僔儞僌峔憿傪抲偒姺偊丄偙偺 HOWTO
偱愢柧偟偰偄傞慺惏傜偟偄婡擻偺尮偲側偭偰偄傑偡丅巆擮側偑傜丄Linux 偱偺
IPv6 峔憿偼丄僐傾偺峔憿偺奜懁偱幚憰偝傟偰偄傑偡丅嫟桳偟偰偄傞婡擻傕偁傞
偺偱偡偑丄婎杮揑偵偼 RPDB 偺峔憿偼丄 IPv6 偺儖乕僥傿儞僌丒傾僪儗僢僔儞
僌峔憿偲偼暿乆側偺偱偡丅

偙偺忬嫷偼傕偪傠傫曄傢傞偱偟傚偆丅彮乆懸偰偽椙偄偩偗偱偡丅

FIXME: 婛偵嶌嬈偟偰偄傞恖偑偄傟偽丄壗偐傾僀僨傾偼? 寁夋偼?

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

12.5.2. IPv6 僷働僢僩偵 ip6tables 偱報傪晅偗傞

ipv6tables 偼僷働僢僩偵報傪晅偗丄悢抣傪妱傝摉偰傞偙偲偑偱偒傑偡丅

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# ip6tables -A PREROUTING -i eth0 -t mangle -p tcp -j MARK --mark 1 劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

偟偐偟偙偆偟偰傕丄偙偺僷働僢僩偼 RPDB 峔憿偵偼搉偝傟側偄偺偱丄栶偵棫偪
傑偣傫丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

12.5.3. u32 慖暿婍傪巊偭偰 IPv6 僷働僢僩偵儅僢僠偝偣傞

IPv6 偼捠忢 SIT 僩儞僱儖偵僇僾僙儖偝傟偰 IPv4 僱僢僩儚乕僋傪桝憲偝傟傑
偡丅偙偺傛偆側僩儞僱儖偺愝掕偵偮偄偰偼丄IPv6 僩儞僱儕儞僌偺愡傪嶲徠偟偰
偔偩偝偄丅偙偺応崌丄IPv6 僷働僢僩傪儁僀儘乕僪偵帩偮 IPv4 僷働僢僩偵懳偟
偰丄僼傿儖僞傪揔梡偡傞偙偲偑壜擻偱偡丅

師偺僼傿儖僞偼丄IPv6 傪僇僾僙儖偟偨 IPv4 僷働僢僩偡傋偰偵儅僢僠偟傑偡丅

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# tc filter add dev $DEV parent 10:0 protocol ip prio 10 u32 \      劆
劆            match ip protocol 41 0xff flowid 42:42                  劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

偙偺曽岦偱偡偡傔傑偟傚偆丅IPv6 僷働僢僩偑 IPv4 宱桼偱憲怣偝傟偨偲偟丄偙
傟傜偺僷働僢僩偵偼壗偺僆僾僔儑儞傕僙僢僩偝傟偰偄側偄偲偟傑偡丅師偺僼傿
儖僞傪梡偄傞偲丄僆僾僔儑儞偺側偄丄 IPv4 拞偺 IPv6 拞偺 ICMPv6 偵儅僢僠
偟傑偡丅 0x3a (58) 偼 ICMPv6 偺 next 僿僢僟僞僀僾偱偡丅

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# tc filter add dev $DEV parent 10:0 protocol ip prio 10 u32 \      劆
劆           match ip protocol 41 0xff \                              劆
劆           match u8 0x05 0x0f at 0 \                                劆
劆           match u8 0x3a 0xff at 26 \                               劆
劆           flowid 42:42                                             劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

憲怣愭 IPv6 傾僪儗僗偵儅僢僠偝偣傞偵偼丄傕偆彮乆嶌嬈偑昁梫偱偡丅師偺僼
傿儖僞偼憲怣愭傾僪儗僗偑 3ffe:202c:ffff:32:230:4fff:fe08:358d: 偱偁傞応
崌偵儅僢僠偟傑偡丅

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# tc filter add dev $DEV parent 10:0 protocol ip prio 10 u32 \      劆
劆            match ip protocol 41 0xff \                             劆
劆            match u8 0x05 0x0f at 0 \                               劆
劆            match u8 0x3f 0xff at 44 \                              劆
劆            match u8 0xfe 0xff at 45 \                              劆
劆            match u8 0x20 0xff at 46 \                              劆
劆            match u8 0x2c 0xff at 47 \                              劆
劆            match u8 0xff 0xff at 48 \                              劆
劆            match u8 0xff 0xff at 49 \                              劆
劆            match u8 0x00 0xff at 50 \                              劆
劆            match u8 0x32 0xff at 51 \                              劆
劆            match u8 0x02 0xff at 52 \                              劆
劆            match u8 0x30 0xff at 53 \                              劆
劆            match u8 0x4f 0xff at 54 \                              劆
劆            match u8 0xff 0xff at 55 \                              劆
劆            match u8 0xfe 0xff at 56 \                              劆
劆            match u8 0x08 0xff at 57 \                              劆
劆            match u8 0x35 0xff at 58 \                              劆
劆            match u8 0x8d 0xff at 59 \                              劆
劆            flowid 10:13                                            劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

摨偠僥僋僯僢僋偼僒僽僱僢僩傊偺儅僢僠偵傕巊偊傑偡丅椺偊偽 2001:: 偺応崌
偼師偺傛偆偵側傝傑偡丅

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# tc filter add dev $DEV parent 10:0 protocol ip prio 10 u32 \      劆
劆            match ip protocol 41 0xff \                             劆
劆            match u8 0x05 0x0f at 0 \                               劆
劆            match u8 0x20 0xff at 28 \                              劆
劆            match u8 0x01 0xff at 29 \                              劆
劆            flowid 10:13                                            劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

Chapter 13. 僇乕僱儖偺僱僢僩儚乕僋僷儔儊乕僞

僇乕僱儖偵偼偨偔偝傫偺僷儔儊乕僞偑偁傝丄娐嫬偵墳偠偰挷惍偱偒傑偡丅偙傟
傑偱偺捠傝丄99% 偼僨僼僅儖僩偺僷儔儊乕僞偱傑偭偨偔栤戣側偄偺偱偡偑丄偟
偐偟偙偺暥彂偼偩偰偵 Advanced HOWTO 偲柤忔偭偰偄傞傢偗偱偼偁傝傑偣傫!

偙偙偱偺嫽枴偺懳徾偼 /proc/sys/net 偱偡丅偪傚偭偲偛棗偵側偭偰傒偰偔偩偝
偄丅偙偺偡傋偰偑嵟弶偐傜偙偙偱慡偰暥彂壔偱偒傞傢偗偱偼偁傝傑偣傫偑丄嶌
嬈偼宲懕偟偰偄偔偮傕傝偱偡丅

偦傟傑偱偺娫偼丄Linux 偺僇乕僱儖僜乕僗傪偛棗偵側傝丄 Documentation/
filesystems/proc.txt 傪撉傫偱偔偩偝偄丅傎偲傫偳偺婡擻偼偙偺僼傽僀儖偱愢
柧偝傟偰偄傑偡丅

(FIXME)

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

13.1. 栠傝宱楬僼傿儖僞 (Reverse Path Filtering)

僨僼僅儖僩偱偼丄儖乕僞偼偡傋偰傪儖乕僥傿儞僌偟傑偡丅僷働僢僩偑乽柧傜偐
偵乿帺暘偺僱僢僩儚乕僋偵偼懏偟偰偄側偔偰傕偱偡丅傛偔偁傞椺偼丄僾儔僀儀
乕僩偺 IP 嬻娫偑僀儞僞乕僱僢僩偵楻傟偰偟傑偆栤戣偱偡丅 195.96.96.0/24
偵岦偐偆宱楬偑偁傞僀儞僞乕僼僃乕僗偵懳偟偰偼丄 212.64.94.1 偐傜敪偟偨僷
働僢僩偼丄杮棃摓拝偟側偄偼偢偱偡丅

傎偲傫偳偺恖偼偙偺婡擻傪柍岠偵偟偨偄偲巚偆偼偢偱偡偐傜丄僇乕僱儖僴僢僇
乕払偼偙傟傪娙扨偱偒傞傛偆偵偟偰偔傟傑偟偨丅 /proc 埲壓偵偁傞僼傽僀儖傪
巊偆偲丄僇乕僱儖偵懳偟偰偙偺巜帵偑偱偒傑偡丅偙偺曽朄偼栠傝宱楬僼傿儖僞
(Reverse Path Filtering) 偲屇偽傟偰偄傑偡丅婎杮揑偵偼丄偁傞僷働僢僩偵懳
偡傞曉怣偑丄偦偺僷働僢僩偺擖偭偰偒偨僀儞僞乕僼僃乕僗偵岦偐傢側偄応崌丄
偙偺僷働僢僩偼僀儞僠僉偩偲傒側偝傟偰柍帇偝傟傞偙偲偵側傝傑偡丅

埲壓偺僐儅儞僪傪巊偆偲丄尰嵼懚嵼偡傞僀儞僞乕僼僃乕僗 (偲彨棃嶌傜傟傞僀
儞僞乕僼僃乕僗) 偡傋偰偵懳偟偰丄偙偺婡擻傪桳岠偵偱偒傑偡丅

 
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# for i in /proc/sys/net/ipv4/conf/*/rp_filter ; do                 劆
劆>  echo 2 > $i                                                      劆
劆> done                                                              劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

忋婰偺椺傪幚峴偟偰偍偔偲丄Linux 儖乕僞偺 ISP 懁僀儞僞乕僼僃乕僗偵摓拝偟
偨僷働僢僩偑丄僆僼傿僗偐傜傗偭偰棃偨傛丄偲徧偟偰偄傞偲丄偦偺僷働僢僩偼
攋婞偝傟傑偡丅摨條偵丄僆僼傿僗偺僒僽僱僢僩偐傜偒偨僷働僢僩偑丄僼傽僀傾
僂僅乕儖偺奜懁偐傜傗偭偰棃偨丄偲徧偟偰偄傞偲丄偦傟傕摨偠傛偆偵攋婞偝傟
傑偡丅

偙傟偼姰慡側栠傝宱楬僼傿儖僞偱偡丅僨僼僅儖僩偱偼丄捈愙愙懕偟偰偄傞僱僢
僩儚乕僋偺 IP 偩偗偵婎偯偄偰僼傿儖僞傪峴偄傑偡丅姰慡側僼傿儖僞傪峴偆偲
丄旕懳徧側儖乕僥傿儞僌偱栤戣偑弌傞偐傜偱偡 (僷働僢僩偺擖偭偰偔傞宱楬偲
弌偰峴偔宱楬偑堘偆応崌偱偡丅椺偊偽塹惎捠怣傗丄摦揑 (bgp, ospf, rip) 宱
楬偑僱僢僩儚乕僋偵偁傞応崌側偳丅塹惎偺僷儔儃儔偐傜傗偭偰棃偨僨乕僞偵偼
丄捠忢偺抧忋夞慄傪捠偟偰曉怣偡傞偙偲偵側傝傑偡)丅

傕偟偙偺椺奜偑偁側偨偺娐嫬偵摉偰偼傑傞 (幚嵺偵偦偆偐偼丄偍偦傜偔偛懚偠
偱偟傚偆) 応崌偼丄塹惎僨乕僞偑傗偭偰棃傞僀儞僞乕僼僃乕僗偱 rp_filter 傪
柍岠偵偡傟偽椙偄偱偡丅僷働僢僩偑攋婞偝傟偰偄傞偐傪妋擣偟偨偗傟偽丄摨偠
僨傿儗僋僩儕偵偁傞 log_martians 僼傽僀儖傪巊偭偰丄偦傟傜偺僀儀儞僩傪
syslog 偵婰榐偡傞傛偆僇乕僱儖偵揱偊傑偡丅

 
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# echo 1 >/proc/sys/net/ipv4/conf/<interfacename>/log_martians      劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

FIXME: conf/{default,all}/* 僼傽僀儖偵愝掕偡傞偩偗偱偄偄偺偐? - martijn

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

13.2. 偁傑傝抦傜傟偰偄側偄愝掕

偼偄丄曄峏偱偒傞僷儔儊乕僞偼偲偰傕偨偔偝傫偁傝傑偡丅偙偙偱偼偦傟傜偡傋
偰傪儕僗僩偟偨偄偲峫偊偰偄傑偡丅堦晹偼 Documentation/ip-sysctl.txt 偱傕
愢柧偝傟偰偄傑偡丅

僇乕僱儖偺僐儞僷僀儖帪偵 'Configure as router and not host' 偵 'Yes' 偲
摎偊偰偄傞偲丄偙傟傜偺愝掕偺僨僼僅儖僩偑丄偙偙偵帵偡傕偺偲偼堎側偭偰偄
傞偐傕偟傟傑偣傫丅

Oskar Andreasson 傕丄偙傟傜偺僼儔僌偵娭偡傞儁乕僕傪岞奐偟偰偄傑偡丅偙偙
偺傕偺傛傝椙偄傛偆偵巚偊傑偡偺偱丄斵偺儁乕僕 <http://
ipsysctl-tutorial.frozentux.net/> 傕僠僃僢僋偟偰傒偰偔偩偝偄丅

栿拲: 偙偺晹暘偺栿弌偵偁偨偭偰偼丄 2.2 僇乕僱儖晅懏暥彂 proc.txt 偺東栿
<http://www.linux.or.jp/JF/JFdocs/kernel-docs-2.2/proc.txt.html> 傪嶲峫
偵偝偣偰偄偨偩偒傑偟偨丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

13.2.1. ipv4 慡懱

堦斒揑側拲堄偱偡偑丄傎偲傫偳偺懍搙惂尷婡擻偼 loopback 偵懳偟偰偼岠偒傑
偣傫丅偱偡偺偱丄儘乕僇儖偱偺僥僗僩偼偟側偄偱偔偩偝偄丅惂尷偼 'jiffies'
扨埵偱梌偊傜傟丄愭偵徯夘偟偨僩乕僋儞僶働僣僼傿儖僞偵傛偭偰揔梡偝傟偰偄
傑偡丅

僇乕僱儖撪晹偺帪寁偼丄1 昩偁偨傝 'HZ' 崗傒 (偁傞偄偼 'jiffies') 偱摦嶌
偟傑偡丅 Intel 偱偼 'HZ' 偼戝掞偺応崌 100 偱偡丅傛偭偰 *_rate 僼傽僀儖
傪丄椺偊偽 50 偲愝掕偡傞偲丄堦昩摉偨傝 2 僷働僢僩傪嫋壜偡傞偙偲偵側傝傑
偡丅僩乕僋儞僶働僣僼傿儖僞偼丄廫暘側僩乕僋儞偑棴傑偭偨応崌丄嵟戝 6 僷働
僢僩傑偱偺僶乕僗僩傪嫋偡傛偆側愝掕偵側偭偰偄傑偡丅

埲壓偺儕僗僩偺堦晹偼丄Alexey Kuznetsov <kuznet@ms2.inr.ac.ru> 偲 Andi
Kleen <ak@muc.de> 偵傛傞 /usr/src/linux/Documentation/networking/
ip-sysctl.txt 偐傜僐僺乕偟偰偒偨傕偺偱偡丅

/proc/sys/net/ipv4/icmp_destunreach_rate
   
    僇乕僱儖偼丄僷働僢僩傪攝憲偱偒側偄偲敾抐偡傞偲丄偦偺僷働僢僩傪攋婞
    偟傑偡丅偦偟偰偦偺僷働僢僩偺敪怣尦偵丄ICMP 儊僢僙乕僕傪偙偺懍搙偱憲
    傝傑偡丅
   
/proc/sys/net/ipv4/icmp_echo_ignore_all
   
    echo 僷働僢僩偵堦愗斀墳偟傑偣傫丅偙傟偼僨僼僅儖僩偱偼愝掕偟側偄偱偔
    偩偝偄丅偟偐偟 DoS 峌寕偺拞宲偵棙梡偝傟偰偟傑偭偨応崌偵偼桳梡偱偡丅
   
/proc/sys/net/ipv4/icmp_echo_ignore_broadcasts [曋棙]
   
    僱僢僩儚乕僋偺僽儘乕僪僉儍僗僩傾僪儗僗偵 ping 偡傞偲丄偡傋偰偺儂僗
    僩偑斀墳偡傞偙偲偵側偭偰偄傑偡丅偙傟傪巊偆偲煭棊偨棙梡晄擻峌寕僣乕
    儖偵側傝傑偡丅偺偱丄偙傟偼 1 偵偟偰丄偙偺傛偆側僽儘乕僪僉儍僗僩儊僢
    僙乕僕偼柍帇偟偰偔偩偝偄丅
   
/proc/sys/net/ipv4/icmp_echoreply_rate
   
    偁傞 1 偮偺栚揑抧偵懳偡傞 echo 儕僾儔僀偺憲怣懍搙丅
   
/proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
   
    偙傟傪愝掕偡傞偲丄僱僢僩儚乕僋忋偺儂僗僩偑丄僽儘乕僪僉儍僗僩傾僪儗
    僗岦偗偲傒側偟偨僼儗乕儉偵懳偟偰晄惓偵斀墳偟偨偨傔偵敪偟偨 ICMP
    error 傪柍帇偟傑偡丅
   
/proc/sys/net/ipv4/icmp_paramprob_rate
   
    偁傑傝抦傜傟偰偄側偄 ICMP 儊僢僙乕僕偱偡偑丄 IP 側偄偟 TCP 僿僢僟偑
    夡傟偰偄傞丄晄惓側僷働僢僩偵懳偡傞曉怣偲偟偰憲傜傟傑偡丅偙偺僼傽僀
    儖傪梡偄傞偲丄偙偺儊僢僙乕僕偺憲怣懍搙傪惂屼偱偒傑偡丅
   
/proc/sys/net/ipv4/icmp_timeexceed_rate
   
    偙傟偼 traceroute 偵偍偗傞乽Solaris 偺恀傫拞偺 *乿偺尨場偲偟偰桳柤
    偱偡丅 ICMP Time Exceeded 儊僢僙乕僕偺憲怣懍搙傪惂尷偟傑偡丅
   
/proc/sys/net/ipv4/igmp_max_memberships
   
    偙偺儂僗僩偱懸偪庴偗偡傞 igmp (儅儖僠僉儍僗僩) 僜働僢僩偺嵟戝悢丅
    FIXME: 惓偟偄偐?
   
/proc/sys/net/ipv4/inet_peer_gc_maxtime
   
    FIXME: inet peer storage 偵偮偄偰彮乆愢柧傪捛壛? 僈儀乕僕僐儗僋僔儑
    儞傪峴偆嵟戝娫妘丅偙偺娫妘偼丄僾乕儖忋偺儊儌儕晧壸偑掅偄 (偁傞偄偼
    柍偄) 応崌偵岠椡傪帩偪傑偡丅 jiffies 扨埵偱偡丅
   
/proc/sys/net/ipv4/inet_peer_gc_mintime
   
    僈儀乕僕僐儗僋僔儑儞傪峴偆嵟彫娫妘丅偙偺娫妘偼丄僾乕儖忋偺儊儌儕晧
    壸偑崅偄応崌偵岠椡傪帩偪傑偡丅 jiffies 扨埵偱偡丅
   
/proc/sys/net/ipv4/inet_peer_maxttl
   
    僄儞僩儕偺 time-to-live 偺嵟戝抣丅巊傢傟側偐偭偨僄儞僩儕偼丄僾乕儖
    偵儊儌儕晧壸偑側偄応崌 (偮傑傝僾乕儖偺僄儞僩儕悢偑旕忢偵彫偝偄応崌)
    丄偙偺婜娫偑偡偓傞偲婜尷愗傟偲側傝傑偡丅 jiffies 扨埵偱偡丅
   
/proc/sys/net/ipv4/inet_peer_minttl
   
    僄儞僩儕偺 time-to-live 偺嵟彫抣丅僷働僢僩偺嵞峔惉傪峴偆懁偱偼丄僼
    儔僌儊儞僩偺 time-to-live 傪僇僶乕偱偒傞廫暘側戝偒偝偵偟側偗傟偽側
    傝傑偣傫丅偙偺 time-to-live 偺嵟彫抣偼丄僾乕儖偺僒僀僘偑
    inet_peer_threshold 傛傝彫偝偄応崌偵曐徹偝傟傑偡丅 jiffies 扨埵偱偡
    丅
   
/proc/sys/net/ipv4/inet_peer_threshold
   
    INET peer storage 偺奣嶼僒僀僘偱偡丅偙偺鑷抣傪墇偊傞偲丄僄儞僩儕偼
    愊嬌揑偵嶍彍偝傟巒傔傑偡丅偙偺鑷抣偼丄僄儞僩儕偺 time-to-live 偲丄
    僈儀乕僕僐儗僋僔儑儞偺娫妘偵傕塭嬁偟傑偡丅僄儞僩儕偑懡偔側傞偲丄
    time-to-live 偼抁偔側傝丄GC 偺娫妘傕抁偔側傝傑偡丅
   
/proc/sys/net/ipv4/ip_autoconfig
   
    偙偺儂僗僩偑 IP 愝掕傪 RARP, BOOTP, DHCP 側偳偺婡峔偱庢摼偟偨応崌丄
    偙偺僼傽僀儖偺撪梕偼 1 偵側傝傑偡丅偦偆偱側偗傟偽 0 偱偡丅
   
/proc/sys/net/ipv4/ip_default_ttl
   
    僷働僢僩偺 Time To Live 抣偱偡丅 64 偵偟偰偍偗偽埨慡偱偟傚偆丅嫄戝
    側僱僢僩儚乕僋偱偼憹傗偟偰偔偩偝偄丅偨偩偟嫽枴偩偗偱偦偆偟側偄傛偆
    偵丅宱楬偺儖乕僾偑偁偭偨応崌偺旐奞偑戝偒偔側傝傑偡丅応崌偵傛偭偰偼
    尭傜偡偙偲傪峫偊偰傕傛偄偱偟傚偆丅
   
/proc/sys/net/ipv4/ip_dynaddr
   
    僀儞僞乕僼僃乕僗傾僪儗僗偑摦揑偵寛傑傞僟僀儎儖僆儞僨儅儞僪傪梡偄偰
    偄傞応崌偼偙傟傪愝掕偟偰偍偔昁梫偑偁傝傑偡丅僆儞僨儅儞僪偺僀儞僞乕
    僼僃乕僗偑婲摦偡傞偲丄曉怣傪尒偰偄側偐偭偨儘乕僇儖偺 TCP 僜働僢僩偑
    丄惓偟偄傾僪儗僗偵僶僀儞僪偟側偍偟傑偡丅偙傟偵傛偭偰僀儞僞乕僼僃乕
    僗傪婲摦偝偣偨愙懕偑摦嶌偟側偄偑丄擇斣栚偐傜偼戝忎晇偵側傞丄偲偄偆
    栤戣偑夝寛偟傑偡丅
   
/proc/sys/net/ipv4/ip_forward
   
    僇乕僱儖偵僷働僢僩偺僼僅儚乕僪傪偝偣偨偄偐偳偆偐丅僨僼僅儖僩偱偼柍
    岠偵側偭偰偄傑偡丅
   
/proc/sys/net/ipv4/ip_local_port_range
   
    奜偵岦偐偆愙懕偵偍偗傞丄儘乕僇儖億乕僩偺斖埻丅幚嵺偺僨僼僅儖僩偼嬌
    傔偰彫偝偔丄1024 偐傜 4999 偱偡丅
   
/proc/sys/net/ipv4/ip_no_pmtu_disc
   
    Path MTU discovery 傪柍岠偵偟偨偗傟偽偙傟傪愝掕偟偰偔偩偝偄丅偙傟偼
    宱楬偺 Maximum Transfer Unit 偺嵟戝抣傪寛掕偡傞曽朄偱偡丅僋僢僋僽僢
    僋偺復偵偍偗傞 Path MTU discovery 偺愡傕偛棗偔偩偝偄丅
   
/proc/sys/net/ipv4/ipfrag_high_thresh
   
    IP 僼儔僌儊儞僩傪嵞峔惉偡傞嵺偵梡偄傞嵟戝儊儌儕丅
    ipfrag_high_thresh 僶僀僩偺儊儌儕偑偙偺栚揑偵妱傝摉偰傜傟傞偲丄僼儔
    僌儊儞僩僴儞僪儔偼 ipfrag_low_thresh 偵側傞傑偱僷働僢僩傪搳偘崬傒傑
    偡丅
   
/proc/sys/net/ipv4/ip_nonlocal_bind
   
    傾僾儕働乕僔儑儞傪帺暘偺僔僗僥儉偵偼懏偟偰偄側偄僨僶僀僗偵僶僀儞僪
    偝偣偨偗傟偽丄偙傟傪愝掕偟偰偔偩偝偄丅偙傟偼儅僔儞偺愙懕偑塱懕揑偱
    側偄 (偁傞偄偼摦揑側) 応崌丄愙懕偑愗傟偨偲偒偵傕僒乕價僗偑婲摦偟偰
    摿掕偺傾僪儗僗偵僶僀儞僪偱偒傞傛偆偵偡傞偺偵曋棙偱偡丅
   
/proc/sys/net/ipv4/ipfrag_low_thresh
   
    IP 僼儔僌儊儞僩偺嵞峔惉偵梡偄傜傟傞儊儌儕偺嵟彫抣丅
   
/proc/sys/net/ipv4/ipfrag_time
   
    IP 僼儔僌儊儞僩傪儊儌儕偵曐帩偡傞帪娫 (昩扨埵)丅
   
/proc/sys/net/ipv4/tcp_abort_on_overflow
   
    僽乕儖抣偺僼儔僌偱丄愙懕梫媮偑偨偔偝傫棃偨偲偒偺摦嶌傪惂屼偟傑偡丅
    桳岠偵側偭偰偄傞偲丄僒乕價僗偑夁晧壸偵側偭偨偲偒丄僇乕僱儖偼愊嬌揑
    偵 RST 僷働僢僩傪憲傞傛偆偵側傝傑偡丅
   
/proc/sys/net/ipv4/tcp_fin_timeout
   
    僜働僢僩傪偙偪傜懁偐傜僋儘乕僘偟偨偲偒偵丄FIN-WAIT-2 忬懺偵曐偮帪娫
    丅捠怣愭偑夡傟偰偄傞偲丄愭曽偱偺僋儘乕僘傪偢偭偲峴傢側偐偭偨傝丄偁
    傞偄偼梊婜偟側偄宍偱巰傫偱偟傑偆偐傕偟傟傑偣傫丅僨僼僅儖僩偺抣偼 60
    昩偱偡丅2.2 偱梡偄傜傟偰偄偨捠忢偺抣偼 180 昩偱丄偙偪傜偵偡傞偙偲傕
    偱偒傑偡偑丄儅僔儞偑 (昁偢偟傕晧壸偑崅偔側偔偰傕) WEB 僒乕僶偩偭偨
    傝偡傞偲丄朿戝側 FIN-WAIT-2 僜働僢僩偺偣偄偱儊儌儕偑堨傟傞婋尟傕偁
    傝傑偡丅 FIN-WAIT-2 僜働僢僩偼 1.5K 偺儊儌儕偟偐怘傢側偄偺偱
    FIN-WAIT-1 傎偳婋尟偱偼偁傝傑偣傫偑丄偟偐偟挿偔惗偒傞孹岦偑偁傝傑偡
    丅嶲徠: tcp_max_orphans 
   
/proc/sys/net/ipv4/tcp_keepalive_time
   
    keepalive 偑桳岠偵側偭偰偄傞偲偒丄 TCP 偑 keepalive 儊僢僙乕僕傪憲
    傞昿搙丅僨僼僅儖僩偼 2 帪娫偱偡丅
   
/proc/sys/net/ipv4/tcp_keepalive_intvl
   
    僾儘乕僽偵懳偡傞妋擣偑曉怣偝傟側偐偭偨偲偒偵僾儘乕僽傪嵞憲偡傞昿搙
    丅僨僼僅儖僩偼 75 昩偱偡丅
   
/proc/sys/net/ipv4/tcp_keepalive_probes
   
    TCP 偑 keepalive 僾儘乕僽傪憲傞悢丅偙偺悢偵払偡傞偲丄偦偺愙懕偑夡傟
    偨偲傒側偟傑偡丅僨僼僅儖僩偺抣偼 9 偱偡丅偙偺抣偵
    tcp_keepalive_intvl 傪偐偗傞偲丄偁傞 keepalive 偑憲傜傟偨屻偵嫋偝傟
    傞柍斀墳帪娫偑摼傜傟傑偡丅
   
/proc/sys/net/ipv4/tcp_max_orphans
   
    僔僗僥儉偑丄偳偺儐乕僓僼傽僀儖僴儞僪儖偵傕傾僞僢僠偟偰偄側偄 TCP 僜
    働僢僩傪曐桳偱偒傞嵟戝悢丅偙偺悢傪墇偊傞偲丄傒側偟偛偺愙懕偼捈偪偵
    儕僙僢僩偝傟丄寈崘偑昞帵偝傟傑偡丅偙偺惂尷偼扨弮側 DoS 峌寕傪杊偖偨
    傔偵偁傝傑偡丅偙偺婡擻偵棅傝偡偓偨傝丄傢偞偲惂尷傪彫偝偔偟偨傝偟偰
    偼偄偗傑偣傫丅僱僢僩儚乕僋偺忬嫷偵傛偭偰昁梫側応崌偼丄 (偱偒傟偽儊
    儌儕傪捛壛偟偰偐傜) 僨僼僅儖僩傛傝憹傗偡偺偼偐傑偄傑偣傫丅傑偨丄偖
    偢偖偢偡傞僱僢僩儚乕僋僒乕價僗傪挷惍偟偰丄偦偺傛偆側忬懺傪愊嬌揑偵
    嶦偡傛偆偵偟偰偔偩偝偄丅嵞搙嫮挷偟偰偍偒傑偡偑丄傒側偟偛偺愙懕偼丄
    偦傟偧傟僗儚僢僾晄壜擻側儊儌儕傪嵟戝 64K 徚旓偡傞偺偱偡丅
   
/proc/sys/net/ipv4/tcp_orphan_retries
   
    偙偪傜懁偐傜僋儘乕僘偟偨 TCP 僐僱僋僔儑儞傪廔椆偡傞慜偺嵞憲夞悢丅僨
    僼僅儖僩抣偼 7 偱丄偙傟偼 RTO 偵傛傝傑偡偑丄50 昩偐傜 16 暘偱偡丅儅
    僔儞偱 WEB 僒乕僶傪摦嶌偟偰偄傞応崌丄偙偺傛偆側僜働僢僩偼儕僜乕僗傪
    挊偟偔徚旓偡傞偐傕偟傟側偄偺偱丄偙偺抣傪掅偔偡傞偙偲傪峫偊偰偔偩偝
    偄丅嶲徠: tcp_max_orphans
   
/proc/sys/net/ipv4/tcp_max_syn_backlog
   
    憲怣偟偨愙懕梫媮偺偆偪丄傑偩愙懕愭偐傜 ACK 傪庴偗庢偭偰偄側偄傕偺傪
    婰壇偟偰偍偔嵟戝悢偱偡丅僨僼僅儖僩抣偼丄128Mb 埲忋偺儊儌儕傪搵嵹偟
    偰偄傞儅僔儞偱 1024丄儊儌儕偺彮側偄儅僔儞偱偼 128 偱偡丅僒乕僶偑夁
    晧壸偵嬯偟傫偱偄傞応崌偼丄偙偺悢傪憹壛偝偣偰傒偰偔偩偝偄丅寈崘!
    1024 埲忋偵偡傞応崌偼丄 include/net/tcp.h 偺 TCP_SYNQ_HSIZE 傪曄峏
    偟偰 TCP_SYNQ_HSIZE*16<=tcp_max_syn_backlog 偑枮懌偝傟傞傛偆偵偟丄
    僇乕僱儖傪嵞僐儞僷僀儖偟偨曽偑偄偄偱偟傚偆丅
   
/proc/sys/net/ipv4/tcp_max_tw_buckets
   
    僔僗僥儉偑摨帪偵曐帩偡傞 time-wait 僜働僢僩偺嵟戝悢丅偙偺悢傪墇偊傞
    偲丄time-wait 僜働僢僩偼捈偪偵攋婞偝傟丄寈崘偑昞帵偝傟傑偡丅偙偺惂
    尷偼扨弮側 DoS 峌寕傪杊偖偨傔偵偁傝傑偡丅傢偞偲惂尷傪彫偝偔偟偰偼偄
    偗傑偣傫丅僱僢僩儚乕僋偺忬嫷偵傛偭偰昁梫側応崌偼丄 (偱偒傟偽儊儌儕
    傪捛壛偟偰偐傜) 僨僼僅儖僩傛傝憹傗偡偺偼偐傑偄傑偣傫丅
   
/proc/sys/net/ipv4/tcp_retrans_collapse
   
    栤戣偺偁傞僾儕儞僞偺僶僌-僶僌屳姺惈傪曐偮偨傔偺傕偺丅摿掕偺 TCP 僗
    僞僢僋偺僶僌偵懳張偡傞偨傔丄嵞憲帪偵戝偒側僷働僢僩傪憲傝傑偡丅
   
/proc/sys/net/ipv4/tcp_retries1
   
    嵞憲夞悢偱丄偙偺悢傪墇偊傞偲壗偐栤戣偑偁傞偲敾抐偟丄偦偺媈偄傪僱僢
    僩儚乕僋憌偵曬崘偡傞昁梫偑偁傝傑偡丅 RFC 偱偺嵟彫抣偼 3 偱丄偙傟偑
    僨僼僅儖僩偱偡丅 RTO 偵傛傝傑偡偑丄3 昩偐傜 8 暘偵憡摉偟傑偡丅
   
/proc/sys/net/ipv4/tcp_retries2
   
    愙懕拞偺 TCP 僙僢僔儑儞傪嶦偡傑偊偵嵞憲傪帋傒傞夞悢丅 RFC 1122
    <http://www.ietf.org/rfc/rfc1122.txt> 偵傛傟偽丄偙偺帪娫偼 100 昩埲
    忋偵側傜側偗傟偽偄偗傑偣傫丅偙傟偼幚嵺偵偼抁偡偓傞丅僨僼僅儖僩抣偼
    15 偱丄RTO 偺抣偵傛傝傑偡偑 13-30 暘偵憡摉偟傑偡丅
   
/proc/sys/net/ipv4/tcp_rfc1337
   
    偙偺僽乕儖抣偼 RFC1337 偱愢柧偝傟偰偄傞 'time-wait assassination
    hazards in tcp' 偺廋惓偱偡丅桳岠偵側偭偰偄傞偲丄僇乕僱儖偼
    time-wait 忬懺偵偁傞僜働僢僩傊偺 RST 僷働僢僩傪攋婞偟傑偡丅
   
/proc/sys/net/ipv4/tcp_sack
   
    Selective ACK 傪梡偄傑偡丅摿掕偺僷働僢僩偑幐傢傟偰偄傞偐傪挷嵏偱偒
    丄傛偭偰夞暅偑懍傗偐偵側傝傑偡丅
   
/proc/sys/net/ipv4/tcp_stdurg
   
    TCP urg 億僀儞僞僼傿乕儖僪傪丄Host requirements 偵廬偭偰夝庍偟傑偡
    丅懡偔偺儂僗僩偼屆偄 BSD 偺夝庍傪巊偭偰偄傞偺偱丄 Linux 偱偙傟傪僙
    僢僩偡傞偲惓偟偔捠怣偑偱偒側偄偐傕偟傟傑偣傫丅婛掕抣: FALSE
   
/proc/sys/net/ipv4/tcp_syn_retries
   
    怴偟偄愙懕傪奐巒偡傞偲偒丄僇乕僱儖偼偙偺夞悢 SYN 僷働僢僩傪憲偭偰傕
    懯栚側傜偽偁偒傜傔傑偡丅
   
/proc/sys/net/ipv4/tcp_synack_retries
   
    愙懕傪庴晅懁偲偟偰僆乕僾儞偡傞偲偒丄僇乕僱儖偼 SYN 偵 ACK 傪媗傔崬
    傫偱憲傝丄愭偵庴偗偲偭偨 SYN 傪妋擣偟傑偡丅偙傟偼 3 曽岦僴儞僪僔僃
    乕僋偺 2 斣栚偺晹暘偱偡丅偙偺愝掕偼丄僇乕僱儖偑愙懕傪偁偒傜傔傞傑偱
    偵憲傞丄 SYN+ACK 僷働僢僩偺嵞憲悢傪巜掕偟傑偡丅
   
/proc/sys/net/ipv4/tcp_timestamps
   
    僞僀儉僗僞儞僾偼丄摿偵丄僔乕働儞僗斣崋偺廳側傝傪杊偖偨傔偵巊梡偝傟
    傑偡丅 1 僊僈價僢僩偺愙懕偱偼丄偍偦傜偔弴彉捠傝偱側偄丄屆偄僔乕働儞
    僗斣崋偵弌偔傢偡偙偲偑偁傝傑偡 (慜偺悽戙偺斣崋偱偁傞偨傔)丅僞僀儉僗
    僞儞僾傪梡偄傞偲丄偙傟傪乽愄偺僷働僢僩乿偲擣幆偱偒傑偡丅僔乕僋僄儞
    僗斣崋偑僆乕僶乕僼儘乕偟偰丄傑偨0偐傜巒傑傞偙偲傪尵偭偰傞? --> 
   
/proc/sys/net/ipv4/tcp_tw_recycle
   
    TIME-WAIT 僜働僢僩傪崅懍偵儕僒僀僋儖偱偒傞傛偆偵偟傑偡丅僨僼僅儖僩
    抣偼 1 偱偡丅偙傟偼愱栧媄弍幰偺傾僪僶僀僗偐梫媮偑側偗傟偽丄曄峏偡傋
    偒偱偼偁傝傑偣傫丅
   
/proc/sys/net/ipv4/tcp_window_scaling
   
    捠忢 TCP/IP 偱偼丄嵟戝 65535 僶僀僩偺僂傿儞僪僂偑壜擻偱偡丅杮摉偵崅
    懍側僱僢僩儚乕僋偱偼丄偙傟偱偼廫暘偱側偄偐傕偟傟傑偣傫丅僂傿儞僪僂
    奼戝僆僾僔儑儞傪梡偄傞偲丄傎傏僊僈僶僀僩偺僂傿儞僪僂偑棙梡偱偒傑偡
    丅偙傟偼僶儞僪暆偲抶墑帪娫偺愊偑戝偒偄傛偆側惢昳偵揔偟偰偄傑偡丅
   
劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

13.2.2. 僨僶僀僗偛偲偺愝掕

DEV 偼幚嵺偺僀儞僞乕僼僃乕僗偐丄偁傞偄偼 'all' 傑偨偼 'default' 傪昞偟
傑偡丅 default 偼丄傑偩嶌惉偝傟偰偄側偄僀儞僞乕僼僃乕僗偺愝掕偵傕塭嬁偟
傑偡丅

/proc/sys/net/ipv4/conf/DEV/accept_redirects
   
    儖乕僞偼丄帺暘偑娫堘偭偨栚揑偱棙梡偝傟偰偄傞 (偮傑傝庴偗偲偭偨僷働
    僢僩傪摨偠僀儞僞乕僼僃乕僗偵嵞憲偟側偗傟偽側傜側偄) 偲敾抐偡傞偲丄
    偦偺僷働僢僩偺敪怣尦偵 ICMP Redirect 傪憲怣偟傑偡丅偟偐偟偙傟偼彮乆
    僙僉儏儕僥傿忋偺栤戣偑偁傞偺偱丄偙偺庴怣傪嫅斲偟偨傝丄偁傞偄偼埨慡
    側儕僟僀儗僋僩傪棙梡偱偒傑偡丅
   
/proc/sys/net/ipv4/conf/DEV/accept_source_route
   
    傕偆偁傑傝梡偄傜傟傑偣傫丅埲慜偼僷働僢僩偵丄搑拞偱朘傟傞傋偒 IP 傾
    僪儗僗偺儕僗僩傪梌偊傞偙偲偑壜擻偱偟偨丅 Linux 偼偙偺 IP 僆僾僔儑儞
    傪懜廳偡傞傛偆側摦嶌偑壜擻偱偡丅
   
/proc/sys/net/ipv4/conf/DEV/bootp_relay
   
    敪怣尦傾僪儗僗偑 0.b.c.d 偱丄憲怣愭偑偙偺儂僗僩偱側偄僷働僢僩傪丄儘
    乕僇儖側僷働僢僩偲偟偰嫋壜偟傑偡丅偙傟偼 BOOTP 儕儗乕僨乕儌儞偑丄偦
    偺傛偆側僷働僢僩傪庴怣丒僼僅儚乕僪偟偰偄傞偺偩偲峫偊傜傟傑偡丅
   
    偙偺婡擻偼傑偩 (僇乕僱儖僶乕僕儑儞 2.2.12 偱偼) 幚憰偝傟偰偄側偄偺
    偱丄僨僼僅儖僩偼 0 偱偡丅
   
/proc/sys/net/ipv4/conf/DEV/forwarding
   
    偙偺僀儞僞乕僼僃乕僗偱偺 IP 僼僅儚乕僨傿儞僌傪桳岠/柍岠偵偟傑偡丅
   
/proc/sys/net/ipv4/conf/DEV/log_martians
   
    栠傝宱楬僼傿儖僞 (Reverse Path Filtering) 偺愡傪尒偰偔偩偝偄丅
   
/proc/sys/net/ipv4/conf/DEV/mc_forwarding
   
    偙偺僀儞僞乕僼僃乕僗偱儅儖僠僉儍僗僩僼僅儚乕僨傿儞僌傪峴偆偐偳偆偐
    偱偡丅
   
/proc/sys/net/ipv4/conf/DEV/proxy_arp
   
    偙傟傪 1 偵偡傞偲丄偙偺僀儞僞乕僼僃乕僗偼僇乕僱儖偑宱楬傪抦偭偰偄傞
    傾僪儗僗偵懳偡傞 ARP 梫媮偵曉怣偟傑偡丅乽媈帡 ip 僽儕僢僕乿傪峔抸偡
    傞偺偵旕忢偵曋棙偵巊偊傑偡丅偙傟傪桳岠偵偡傞慜偵偼丄僱僢僩儅僗僋偑
    杮摉偵惓偟偄偐傪偟偭偐傝妋擣偟偰偔偩偝偄! 傑偨 rp_filter (暿偺偲偙
    傠偱徯夘偟偰偄傑偡) 偑丄 ARP 栤偄崌傢偣偵懳偟偰摦嶌偡傞偙偲傕妎偊偰
    偍偄偰偔偩偝偄!
   
/proc/sys/net/ipv4/conf/DEV/rp_filter
   
    栠傝宱楬僼傿儖僞 (Reverse Path Filtering) 偺愡傪尒偰偔偩偝偄丅
   
/proc/sys/net/ipv4/conf/DEV/secure_redirects
   
    ICMP redirect 儊僢僙乕僕傪丄僨僼僅儖僩僎乕僩僂僃僀偵儕僗僩偝傟偰偄
    傞僎乕僩僂僃僀偵懳偟偰偺傒嫋壜偟傑偡丅僨僼僅儖僩偱桳岠偱偡丅
   
/proc/sys/net/ipv4/conf/DEV/send_redirects
   
    偙偺儂僗僩偑忋弎偺 redirect 傪憲怣偡傞偐偳偆偐偱偡丅
   
/proc/sys/net/ipv4/conf/DEV/shared_media
   
    愝掕偝傟偰偄側偄偲丄僇乕僱儖偼偙偺僨僶僀僗偵偮側偑偭偰偄傞暿乆偺僒
    僽僱僢僩偼丄捈愙捠怣偱偒側偄偲傒側偟傑偡丅僨僼僅儖僩偺愝掕偼 'yes'
    偱偡丅
   
/proc/sys/net/ipv4/conf/DEV/tag
   
    FIXME: 偙偙傪杽傔偰偔偩偝偄丅
   
劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

13.2.3. 嬤椬億儕僔乕

DEV 偼幚嵺偺僀儞僞乕僼僃乕僗偐丄偁傞偄偼 'all' 傑偨偼 'default' 傪昞偟
傑偡丅 default 偼丄傑偩嶌惉偝傟偰偄側偄僀儞僞乕僼僃乕僗偺愝掕偵傕塭嬁偟
傑偡丅

/proc/sys/net/ipv4/neigh/DEV/anycast_delay
   
    嬤椬妋擣儊僢僙乕僕傊偺曉摎偺儔儞僟儉抶墑偺嵟戝抣 (jiffies [1/100
    昩] 扨埵)丅傑偩幚憰偝傟偰偄傑偣傫 (Linux 偼傑偩 anycast 傪僒億乕僩
    偟偰偄傑偣傫)丅
   
/proc/sys/net/ipv4/neigh/DEV/app_solicit
   
    儐乕僓儗儀儖偺 ARP 僨乕儌儞偵憲傞儕僋僄僗僩偺悢傪掕媊偟傑偡丅柍岠偵
    偡傞偵偼 0 偵偟傑偡丅
   
/proc/sys/net/ipv4/neigh/DEV/base_reachable_time
   
    RFC2461 偱婯掕偝傟偰偄傞儔儞僟儉摓払壜擻帪娫偺寁嶼偺儀乕僗偵側傞抣
    偱偡丅
   
/proc/sys/net/ipv4/neigh/DEV/delay_first_probe_time
   
    嬤椬偑摓払壜擻偐偳偆偐偺僾儘乕僽傪嵟弶偵峴偆傑偱偺抶墑帪娫偱偡
    (gc_stale_time 傪嶲徠)丅
   
/proc/sys/net/ipv4/neigh/DEV/gc_stale_time
   
    屆偄 ARP 僄儞僩儕傪偳偺掱搙偺昿搙偱僠僃僢僋偡傞偐傪寛傔傑偡丅屆偔側
    偭偨 ARP 僄儞僩儕偼嵞傃夝寛偝傟傑偡 (偙傟偼 IP 傾僪儗僗偑懠偺儅僔儞
    傊堏傞帪偵栶偵棫偪傑偡)丅 ucast_solicit 偑 0 傛傝戝偒偗傟偽丄傑偢婛
    抦偺儂僗僩偵捈愙 ARP 僷働僢僩傪憲怣偟傑偡丅偙傟偑幐攕偟偨傜丄
    mcast_solicit 偑 0 傛傝戝偒偗傟偽 ARP 梫媮傪僽儘乕僪僉儍僗僩偟傑偡
    丅
   
/proc/sys/net/ipv4/neigh/DEV/locktime
   
    ARP/嬤椬僄儞僩儕偼丄嵟掅偱傕 locktime 偩偗宱夁偟側偄偲怴偟偄傕偺偲
    抲偒姺偊偱偒傑偣傫丅偙傟偼 ARP 僉儍僢僔儏偺僗儔僢僔儞僌傪杊偓傑偡丅
   
/proc/sys/net/ipv4/neigh/DEV/mcast_solicit
   
    儅儖僠僉儍僗僩妋擣偺嵟戝嵞帋峴夞悢偱偡丅
   
/proc/sys/net/ipv4/neigh/DEV/proxy_delay
   
    戙棟 ARP 僄儞僩儕傪帩偭偰偄傞応崌偵丄偦偺 ARP 梫媮偵摎偊傞傑偱偺嵟
    戝帪娫偱偡丅幚嵺偺帪娫偼 0 埲忋 proxy_delay 埲壓偺棎悢偵側傝傑偡丅
    偁傞応崌偵偼丄偙傟偼僱僢僩儚乕僋偺堨傟傪杊偖偨傔偵巊梡偝傟傑偡丅
   
/proc/sys/net/ipv4/neigh/DEV/proxy_qlen
   
    抶墑偟偨戙棟 ARP 僞僀儅偺僉儏乕偺嵟戝挿偱偡 (proxy_delay 傪嶲徠)丅
   
/proc/sys/net/ipv4/neigh/DEV/retrans_time
   
    嬤椬妋擣儊僢僙乕僕傪嵞憲怣偡傞傑偱偺帪娫 (扨埵偼 jiffy = 1/100 昩)
    偱偡丅傾僪儗僗傪夝寛偟偨傝丄嬤椬偑摓拝晄擻偐偳偆偐傪妋擣偟偨傝偡傞
    嵺偵巊梡偟傑偡丅
   
/proc/sys/net/ipv4/neigh/DEV/ucast_solicit
   
    儐僯僉儍僗僩妋擣偺嵟戝嵞帋峴夞悢偱偡丅
   
/proc/sys/net/ipv4/neigh/DEV/unres_qlen
   
    懸偪忬懺偺 ARP 梫媮傪曐帩偡傞僉儏乕偺嵟戝挿偱偡丅 ARP 傾僪儗僗偑夝
    寛偝傟偰偄傞嵟拞偵丄懠偺憌偐傜偺梫媮僷働僢僩傪庴偗擖傟傞悢偱偡丅
   
劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

13.2.4. 儖乕僥傿儞僌愝掕

/proc/sys/net/ipv4/route/error_burst
   
    偙偺僷儔儊乕僞偲師偺 error_cost 偼儖乕僥傿儞僌偺僐乕僪偐傜僇乕僱儖
    偺儘僌偵彂偒弌偝傟傞寈崘儊僢僙乕僕偺惂尷偵巊梡偝傟傑偡丅 error_cost
    傪戝偒偔偡傞偲彂偒弌偝傟傞儊僢僙乕僕偼彮側偔側傝傑偡丅 error_burst
    偼儊僢僙乕僕傪幪偰傞嵺偺惂屼傪峴偄傑偡丅僨僼僅儖僩偱偼寈崘儊僢僙乕
    僕傪 5 昩娫偵堦夞傑偱偵惂尷偟偰偄傑偡丅
   
/proc/sys/net/ipv4/route/error_cost
   
    /proc/sys/net/ipv4/route/error_burst 偺崁傪嶲徠偟偰偔偩偝偄丅
   
/proc/sys/net/ipv4/route/flush
   
    偙偺僼傽僀儖偵彂偒崬傓偲儖乕僥傿儞僌僉儍僢僔儏傪僼儔僢僔儏偟傑偡丅
   
/proc/sys/net/ipv4/route/gc_elasticity
   
    儖乕僥傿儞僌僉儍僢僔儏偺僈儀乕僕僐儗僋僔儑儞偺昿搙偲摦嶌傪寛傔傞抣
    偱偡丅偙傟偼僼僃僀儖僆乕僶乕摦嶌偱廳梫偲側傝傑偡丅偁傞宱楬偑巰傫偩
    偲偒丄Linux 偑暿偺宱楬偵堏傞傑偱偵偼丄嵟掅 gc_timeout 昩偑宱夁偟側
    偗傟偽側傝傑偣傫丅僨僼僅儖僩偱偼 300 偵愝掕偟偰偁傝傑偡偑丄僼僃僀儖
    僆乕僶乕傪憗偔峴偄偨偗傟偽丄傕偭偲彫偝偄抣偵偡傞偲椙偄偱偟傚偆丅
   
    Ard van Breemen 偺偙偺搳峞 <http://mailman.ds9a.nl/pipermail/lartc/
    2002q1/002667.html> 傕嶲徠偟偰偔偩偝偄丅
   
/proc/sys/net/ipv4/route/gc_interval
   
    /proc/sys/net/ipv4/route/gc_elasticity 偺崁傪偛棗偔偩偝偄丅
   
/proc/sys/net/ipv4/route/gc_min_interval
   
    /proc/sys/net/ipv4/route/gc_elasticity 偺崁傪偛棗偔偩偝偄丅
   
/proc/sys/net/ipv4/route/gc_thresh
   
    /proc/sys/net/ipv4/route/gc_elasticity 偺崁傪偛棗偔偩偝偄丅
   
/proc/sys/net/ipv4/route/gc_timeout
   
    /proc/sys/net/ipv4/route/gc_elasticity 偺崁傪偛棗偔偩偝偄丅
   
/proc/sys/net/ipv4/route/max_delay
   
    儖乕僥傿儞僌僉儍僢僔儏偑僼儔僢僔儏偝傟傞傑偱偺嵟戝帪娫偱偡丅
   
/proc/sys/net/ipv4/route/max_size
   
    儖乕僥傿儞僌僉儍僢僔儏偺嵟戝僒僀僘偱偡丅僉儍僢僔儏偑偙偺僒僀僘偵払
    偡傞偲丄屆偄僄儞僩儕偼攋婞偝傟傑偡丅
   
/proc/sys/net/ipv4/route/min_adv_mss
   
    FIXME: 偙偙傪杽傔偰偔偩偝偄丅
   
/proc/sys/net/ipv4/route/min_delay
   
    儖乕僥傿儞僌僉儍僢僔儏偑僼儔僢僔儏偝傟傞傑偱偺嵟彫帪娫偱偡丅
   
/proc/sys/net/ipv4/route/min_pmtu
   
    FIXME: 偙偙傪杽傔偰偔偩偝偄丅
   
/proc/sys/net/ipv4/route/mtu_expires
   
    FIXME: 偙偙傪杽傔偰偔偩偝偄丅
   
/proc/sys/net/ipv4/route/redirect_load
   
    摿掕偺儂僗僩偵懳偟偰 ICMP 儕僟僀儗僋僩傪傛傝懡偔憲傞傋偒偐傪寛掕偡
    傞偨傔偺場巕偱偡丅晧壸偑偙偙偱巜掕偟偨悢偵払偟偨応崌偵偼丄偦傟埲忋
    偺儕僟僀儗僋僩偼憲怣偝傟傑偣傫丅
   
/proc/sys/net/ipv4/route/redirect_number
   
    /proc/sys/net/ipv4/route/redirect_load 偺崁栚傪嶲徠偟偰偔偩偝偄丅偙
    偪傜偼儕僟僀儗僋僩悢偺惂尷偱偡丅
   
/proc/sys/net/ipv4/route/redirect_silence
   
    儕僟僀儗僋僩偺帪娫愗傟丅晧壸傗儕僟僀儗僋僩悢偑惂尷偵払偟偰儕僟僀儗
    僋僩偑掆巭偝傟偰偄偨応崌偱傕丄偙偺婜娫偑夁偓傞偲儕僟僀儗僋僩傪嵞傃
    憲傝巒傔傑偡丅
   
劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

Chapter 14. 抦傜傟偞傞崅搙側僉儏乕僀儞僌婯懃

偙傟傑偱徯夘偟偰偒偨僉儏乕偱偼夝寛偱偒側偄梫朷偑偁傞恖偺偨傔偵丄偙偙偱
偼僇乕僱儖偵娷傑傟偰偄傞丄傛傝摿庩側僉儏乕傪徯夘偟傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

14.1. bfifo/pfifo

偙傟傜偺僋儔僗儗僗側僉儏乕偼丄pfifo_fast 偵斾傋偰傕僔儞僾儖偱偡丅撪晹僶
儞僪偑柍偔丄偡傋偰偺僩儔僼傿僢僋偑傑偭偨偔摍壙側偺偱偡丅偟偐偟偙傟傜偵
偼傂偲偮丄廳梫側棙揰偑偁傝傑偡丅摑寁偑庢傟傞偺偱偡丅傛偭偰懷堟惂尷傗桪
愭晅偗偑昁梫側偄応崌偱傕丄偙傟傜偺 qdisc 傪梡偄傞偲丄僀儞僞乕僼僃乕僗偺
backlog 傪寛掕偡傞偺偵栶棫偪傑偡丅

pfifo 偺挿偝偼僷働僢僩扨埵偱丄bfifo 偱偼僶僀僩扨埵偱巜掕偟傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

14.1.1. 僷儔儊乕僞偲巊偄曽

limit
   
    僉儏乕偺挿偝傪巜掕偟傑偡丅bfifo 偱偼僶僀僩扨埵丄pfifo 偱偼僷働僢僩
    扨埵偱偡丅僨僼僅儖僩偼 pfifo 偺応崌僀儞僞乕僼僃乕僗偺 txqueuelen 暘
    偺僷働僢僩偱丄 bfifo 偱偼 txqueuelen*mtu 僶僀僩偱偡 (txqueuelen 偵
    偮偄偰偼 pfifo_fast 偺復傪嶲徠)丅
   
劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

14.2. Clark-Shenker-Zhang 傾儖僑儕僘儉 (CSZ)

偙傟偼旕忢偵棟榑揑側偺偱丄Alexey (CBQ 偺庡梫側嶌幰) 偱偡傜棟夝偡傞偙偲
傪媮傔偰偄傑偣傫丅Alexey 偺僜乕僗偵偁偭偨嶲峫暥專偱偡:

    David D. Clark, Scott Shenker and Lixia Zhang Supporting Real-Time
    Applications in an Integrated Services Packet Network: Architecture
    and Mechanism.
   
    巹偺棟夝偱偼丄偙偺傾僀僨傿傾偺娞偼丄曐徹偡傞僒乕價僗偦傟偧傟偵 WFQ
    僼儘乕傪惗惉偟丄巆傝偺僶儞僪暆傪僟儈乕偺 flow-0 偵妱傝摉偰傞偲偙傠
    偵偁傝傑偡丅 flow-0 偼梊應揑僒乕價僗 (predictive services) 偲儀僗僩
    僄僼僅乕僩偺僩儔僼傿僢僋偲偐傜側傝傑偡丅偙傟偼桪愭搙僗働僕儏乕儔偵
    傛偭偰娗棟偝傟丄梊應揑僒乕價僗偵嵟傕崅偄桪愭搙偑妱傝摉偰傜傟傑偡丅
    巆傝偼儀僗僩僄僼僅乕僩偺僷働僢僩偵側傝傑偡丅
   
    CSZ 偼僶儞僪暆偺惂尷傪乽峴偄傑偣傫乿丅僼儘乕偼偡偱偵 QoS 僱僢僩儚乕
    僋偺嫬奅偱棳擖娗棟傪偝傟偨偲傒側偟偰偍傝丄偦傟埲忋偺懷堟惂尷偼峴偄
    傑偣傫丅宱楬搑拞 (intermediate hop) 偱丄僼儘乕傪岦忋偝偣偨傝僩乕僋
    儞僶働僣僼傿儖僞偵傛傞峣傝傪峴偍偆偲偡傞偲丄朷傑偟偔側偄抶墑偑婲偒
    偨傝丄僕僢僞乕偺尨場偵側傝傑偡丅
   
    尰嵼偺偲偙傠 CSZ 偼杮暔偺乽曐徹晅偒僒乕價僗乿傪採嫙偡傞桞堦偺僗働僕
    儏乕儔偱偡丅 (CBQ 傕娷傓) 懠偺婡峔偼丄曐徹晅偒抶墑傗儔儞僟儉側僕僢
    僞乕傪採嫙偟傑偣傫丅
   
    尰嵼偺偲偙傠偼丄愭偵徯夘偟偨婰帠傪撉傫偱棟夝偱偒側偄尷傝丄偁傑傝幚
    嵺偺棙梡偵偼岦偄偰偄側偄傛偆偱偡丅
   
劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

14.3. DSMARK

    Esteve Camps
   
    <marvin@grn.es>
   
    偙偺暥復偼丄2000 擭 9 寧偺巹偺榑暥 QoS Support in Linux 偐傜敳悎偟
    偨傕偺偱偡丅
   
尦偵側偭偨暥彂:

 丒 Draft-almesberger-wajhak-diffserv-linux-01.txt <ftp://
    icaftp.epfl.ch/pub/linux/diffserv/misc/dsid-01.txt.gz>.
   
 丒 iproute2 攝晍偵偁傞椺
   
 丒 White Paper-QoS protocols and architectures <http://
    www.qosforum.com/white-papers/qosprot_v3.pdf> and IP QoS Frequently
    Asked Questions <http://www.qosforum.com/docs/faq> both by Quality
    of Service Forum.
   
偙偺復偼 Esteve Camps <esteve@hades.udg.es> 偑幏昅偟傑偟偨丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

14.3.1. 偼偠傔偵

傑偢嵟弶偵丄偙偺僥乕儅偵偮偄偰彂偐傟偨 RFC (RFC2474, RFC2475, RFC2597,
RFC2598) 傪撉傓偙偲傪嫮偔偍彠傔偟傑偡丅偙傟傜偼 IETF DiffServ working
Group web site <http://www.ietf.org/html.charters/
diffserv-charter.html> 偍傛傃 Werner Almesberger web site <http://
diffserv.sf.net/> 偵偁傝傑偡 (斵偼 Linux 偱 Differentiated Services 偺
婡擻傪僒億乕僩偡傞僐乕僪傪彂偒傑偟偨)丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

14.3.2. Dsmark 偺懳徾

Dsmark 偼丄Differentiated Services (DiffServ 偲偐丄扨偵 DS 偲傕屇偽傟傑
偡) 偱昁梫偲側傞婡擻傪採嫙偡傞僉儏乕僀儞僌婯懃偱偡丅 DiffServ 偼 2 偮偁
傞幚嵺偺 QoS 婡峔偺偆偪偺傂偲偮 (傕偆傂偲偮偼 Integrated Services 偲屇
偽傟偰偄傑偡) 偱丄僷働僢僩偺 IP 僿僢僟偺 DS 僼傿乕儖僪偵娷傑傟偰偄傞抣
偵婎偯偄偰摦嶌偟傑偡丅

IP 偱丄壗傜偐偺 QoS 儗儀儖偺僒乕價僗傪摼傞偨傔偵愝寁偝傟偨嵟弶偺夝偼丄
IP 僿僢僟偺 Type of Service 僼傿乕儖僪 (TOS 僶僀僩) 偱偟偨丅偙偺抣傪曄
偊傞偙偲偵傛傝丄僗儖乕僾僢僩丒抶墑丒怣棅惈側偳偺儗儀儖偺崅掅傪慖戰偱偒
偨偺偱偟偨丅偟偐偟偙傟偼丄嵟嬤偺僒乕價僗 (儕傾儖僞僀儉傾僾儕働乕僔儑儞
丄懳榖揑傾僾儕働乕僔儑儞側偳) 偱昁梫偲偝傟傞丄廫暘側廮擃惈傪帩偭偰偄傑
偣傫偱偟偨丅偦偺屻丄怴偨側婡峔偑尰傟傑偟偨丅偦偺傂偲偮偑 DiffServ 偱丄
偙傟偼 TOS 偺奺價僢僩傪愯桳偟丄 DS 僼傿乕儖僪偲偟偰嵞掕媊偟偰巊梡偟傑偡
丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

14.3.3. Differentiated Services 偺僈僀僪儔僀儞

DiffServ 偼僌儖乕僾巜岦偱偡丅偮傑傝丄僼儘乕偵偮偄偰偼壗傕娭抦偟側偄偺偱
偡 (偙傟偼 Integrated Services 偺栚揑偲側傝傑偡)丅懳徾偵偡傞偺偼僼儘乕
偺廤崌偱丄僷働僢僩偑偳偺廤崌偵懏偟偰偄傞偐偵傛偭偰丄堎側傞摦嶌傪揔梡偡
傞偙偲偵側傝傑偡丅

僷働僢僩偑嫬奅僲乕僪 (DiffServ 僪儊僀儞偺僄儞僩儕僲乕僪) 偵摓拝偡傞偲丄
DiffServ 僪儊僀儞傊擖傞嵺偵丄偙傟傜偺僷働僢僩偵偼惂尷丒懷堟惂尷丒儅乕僉
儞僌側偳傪峴偆昁梫偑偁傝傑偡 (儅乕僉儞僌偲偼丄DS 僼傿乕儖僪偵抣傪戙擖偡
傞偙偲偱偡丅媿傒偨偄側傕傫偱偡 :-) )丅 DiffServ 僪儊僀儞偺撪晹 (僐傾)
僲乕僪偱丄偳偺傛偆側摦嶌傗 QoS 儗儀儖傪揔梡偡傞偐偼丄偙偺儅乕僋 (抣) 傪
尒偰敾抐偝傟傑偡丅

偛憐憸偺捠傝丄Differentiated Services 偵偼僪儊僀儞偑偁傝丄偡傋偰偺 DS
婯懃偼偙偙偱揔梡偝傟傑偡丅幚嵺丄僪儊僀儞偵擖偭偰偒偨偡傋偰偺僷働僢僩傪
僋儔僗慖暿偡傞丄偲峫偊傞偙偲傕壜擻偱偡丅僷働僢僩偼僪儊僀儞偵擖傞偲丄僋
儔僗慖暿婡峔偑柦偢傞婯懃偵廬偆偙偲偵側傝丄宱桼偡傞僲乕僪偺偡傋偰偱偦偺
QoS 儗儀儖偑揔梡偝傟傞偺偱偡丅

幚偺偲偙傠丄帺暘偺儘乕僇儖側僪儊僀儞偵偼帺慜偺惂尷傪揔梡偱偒傑偡偑丄懠
偺 DS 僪儊僀儞偲愙懕偡傞嵺偵偼丄 Service Level Agreements 傪峫椂偟側偗
傟偽側傝傑偣傫丅

偙偺抜奒偱偼丄偍偦傜偔偨偔偝傫偺媈栤偑偁傞偱偟傚偆丅 DiffServ 偼丄偙偙
偱愢柧偟偨埲忋偺撪梕傪娷傫偱偄傑偡丅 3 偮偺 RFC 傪 50 峴偱梫栺偡傞偺偑
晄壜擻偱偁傞偙偲偼丄棟夝偟偰偄偨偩偗傞偱偟傚偆 :-)

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

14.3.4. Dsmark 傪棙梡偡傞

DiffServe 偺暥專偑帵偡捠傝丄変乆偼嫬奅僲乕僪偲撪晹僲乕僪傪嵎暿壔偟傑偡
丅偙傟傜偼僩儔僼傿僢僋宱楬偺偆偪丄廳梫側 2 偮偺億僀儞僩偱偡丅偄偢傟偵偍
偄偰傕丄僷働僢僩偑摓拝偡傞偲僋儔僗慖暿偑峴傢傟傑偡丅偦偺寢壥偼丄DS 僾儘
僙僗偑僷働僢僩傪僱僢僩儚乕僋偵曻偮偵偁偨偭偰丄偳偙偐暿偺応強偱梡偄傜傟
傞偙偲偵側傞偱偟傚偆丅 diffserv 偺僐乕僪偵 skb->tc_index 偲偄偆僼傿乕儖
僪傪娷傓 sk_buff 偲偄偆峔憿懱偑偁傞偺偼丄梫偡傞偵偙偺偨傔側偺偱偡丅偙偙
偵偼弶婜僋儔僗慖暿偺寢壥偑曐懚偝傟丄偙傟偑 DS 張棟偺偄偔偮偐偺応強偱梡
偄傜傟傞偙偲偵側傝傑偡丅

嵟弶 skb->tc_index 偺抣偼丄偡傋偰偺摓拝僷働僢僩偺 IP 僿僢僟偺 DS 僼傿乕
儖僪偐傜拪弌偝傟丄 DSMARK qdisk 偵傛偭偰愝掕偝傟傑偡丅傑偨丄cls_tcindex
慖暿婍偼丄 skb->tcindex 偺慡懱傪撉傒丄偦偺寢壥傪僋儔僗慖暿偵梡偄傑偡丅

偟偐偟丄傑偢嵟弶偵丄DSMARK qdisc 偺僐儅儞僪偲僷儔儊乕僞傪尒偰傒傑偟傚偆
丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆... dsmark indices INDICES [ default_index DEFAULT_INDEX ] [ set_tc_index ] 劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
偙傟傜偺僷儔儊乕僞偺堄枴偡傞傕偺偼側傫偱偟傚偆偐?

 丒 indices: (mask,value) 儁傾偐傜側傞僥乕僽儖偺僒僀僘丅嵟戝抣偼 2^n
    (偨偩偟 n>=0) 偱偡丅
   
 丒 Default_index: 僋儔僗慖暿婍偑傑偭偨偔儅僢僠傪尒偮偗傜傟側偐偭偨応崌
    偺僨僼僅儖僩偲側傞丄僥乕僽儖僄儞僩儕偺僀儞僨僢僋僗丅
   
 丒 Set_tc_index: dsmark qdisc 偵丄DS 僼傿乕儖僪偺抣傪庢摼偟偰 skb->
    tc_index 傊曐懚偡傞傛偆巜帵偟傑偡丅
   
偱偼 DSMARK 偺僾儘僙僗傪尒偰傒傑偟傚偆丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

14.3.5. SCH_DSMARK 偺摦嶌

偙偺 qdisc 偼師偺傛偆側抜奒偐傜側傝傑偡:

 丒 qdisc 僐儅儞僪偱 set_tc_index 傪愰尵偟偰偄偨応崌偼丄 DS 僼傿乕儖僪
    偑拪弌偝傟偰 skb->tc_index 曄悢偵曐懚偝傟傞丅
   
 丒 僋儔僗慖暿婍偑婲摦偡傞丅偙偺僋儔僗慖暿婍偼僋儔僗 ID 傪曉偟丄偙傟偼
    skb->tc_index 曄悢偵曐懚偝傟傞丅儅僢僠偡傞僼傿儖僞偑尒偮偐傜側偄偲
    丄 default_index 僆僾僔儑儞傪尒偰丄偳偺 classID 傪曐懚偡傞偐寛傔傞
    丅 set_tc_index 偲 default_index 偺偄偢傟傕巜掕偟偰偄側偐偭偨応崌偺
    寢壥偼枹掕媊偲側傞丅
   
 丒 撪晹偺 qdisc 偵憲傜傟偨屻傕丄偙偺僼傿儖僞偺寢壥傪嵞棙梡偱偒傞丅撪晹
    qdisc 偑曉偟偨 classid 偼 skb->tc_index 偵曐懚偝傟傞丅偙偺抣偼丄彨
    棃 mask-value 僥乕僽儖偺僀儞僨僢僋僗偲偟偰棙梡偱偒傞丅嵟廔揑偵偙偺
    僷働僢僩偵揔梡偝傟傞寢壥偼丄師偱帵偡憖嶌偺寢壥偲側傞丅
    劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
    劆New_Ds_field = ( Old_DS_field & mask ) | value          劆
    劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
     
   
 丒 傛偭偰怴偨側抣偼丄 ds_field 偲儅僗僋抣偺 AND 傪庢傝丄懕偄偰偦偺寢壥
    傪 value 僷儔儊乕僞偲 OR 偟偨傕偺偵側傞丅偙偺僾儘僙僗傪棟夝偡傞偵偼
    師偺恾傪尒偰偔偩偝偄丅
   
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆                         skb->ihp->tos                                                  劆
劆- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - >     劆
劆     |                                                       |     ^                    劆
劆     | -- If you declare set_tc_index, we set DS             |     |  <-----May change  劆
劆     |    value into skb->tc_index variable                  |     |O       DS field    劆
劆     |                                                      A|     |R                   劆
劆   +-|-+      +------+    +---+-+    Internal   +-+     +---N|-----|----+               劆
劆   | | |      | tc   |--->|   | |-->  . . .  -->| |     |   D|     |    |               劆
劆   | | |----->|index |--->|   | |     Qdisc     | |---->|    v     |    |               劆
劆   | | |      |filter|--->| | | +---------------+ |   ---->(mask,value) |               劆
劆-->| O |      +------+    +-|-+--------------^----+  /  |  (.  ,  .)    |               劆
劆   | | |          ^         |                |       |  |  (.  ,  .)    |               劆
劆   | | +----------|---------|----------------|-------|--+  (.  ,  .)    |               劆
劆   | | sch_dsmark |         |                |       |                  |               劆
劆   +-|------------|---------|----------------|-------|------------------+               劆
劆     |            |         | <- tc_index -> |       |                                  劆
劆     |            |(read)   |    may change  |       |  <--------------Index to the     劆
劆     |            |         |                |       |                    (mask,value)  劆
劆     v            |         v                v       |                    pairs table   劆
劆- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ->      劆
劆                         skb->tc_index                                                  劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

儅乕僉儞僌偼偳偺傛偆偵峴偆偺偱偟傚偆偐丅扨偵嵞儅乕僋偟偨偄僋儔僗偺儅僗
僋偲抣傪曄偊傞偩偗偱偡丅師偺僐乕僪傪尒偰偔偩偝偄丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆tc class change dev eth0 classid 1:1 dsmark mask 0x3 value 0xb8     劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
偙傟偼僴僢僔儏僥乕僽儖偺 (mask,value) 儁傾傪曄峏偟丄 class 1:1 偵懏偟偰
偄傞僷働僢僩傪嵞儅乕僋偟傑偡丅 (mask,value) 偼嵟弶僨僼僅儖僩偺抣傪庢傞
(埲壓偺昞傪嶲徠) 偺偱丄偙偺抣偼乽曄峏乿偟側偗傟偽側傝傑偣傫丅

偙傟偱丄TC_INDEX 僼傿儖僞偺摦嶌偲丄偙傟傪偳偺傛偆偵棙梡偡傞偐傪愢柧偟傑
偟偨丅側偍傑偨丄TC_INDEX 僼傿儖僞偼 DS 僒乕價僗偵娷傑傟偰偄傞偺偲偼暿偺
愝掕偱梡偄傞偙偲傕壜擻偱偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

14.3.6. TC_INDEX 僼傿儖僞

TC_INDEX 僼傿儖僞傪愰尵偡傞婎杮揑側僐儅儞僪偼師偺捠傝偱偡:
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆... tcindex [ hash SIZE ] [ mask MASK ] [ shift SHIFT ]             劆
劆            [ pass_on | fall_through ]                              劆
劆            [ classid CLASSID ] [ police POLICE_SPEC ]              劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

師偵丄TC_INDEX 偺摦嶌儌乕僪傪愢柧偡傞椺傪帵偟傑偡丅嫮挷偝傟偨扨岅偵拲堄
偟偰偔偩偝偄:
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆tc qdisc add dev eth0 handle 1:0 root dsmark indices 64 set_tc_index                                                                                劆
劆                                                                                                                                                    劆
劆tc filter add dev eth0 parent 1:0 protocol ip prio 1 tcindex mask 0xfc  shift 2                                                                     劆
劆                                                                                                                                                    劆
劆tc qdisc add dev eth0 parent 1:0 handle 2:0 cbq bandwidth 10Mbit cell 8 avpkt 1000 mpu 64                                                           劆
劆                                                                                                                                                    劆
劆# EF 僩儔僼傿僢僋僋儔僗                                                                                                                             劆
劆                                                                                                                                                    劆
劆tc class add dev eth0 parent 2:0 classid 2:1 cbq bandwidth 10Mbit rate 1500Kbit avpkt 1000 prio 1 bounded isolated allot 1514 weight 1 maxburst 10  劆
劆                                                                                                                                                    劆
劆# EF 僩儔僼僢僋梡偺 pfifo qdisc                                                                                                                     劆
劆                                                                                                                                                    劆
劆tc qdisc add dev eth0 parent 2:1 pfifo limit 5                                                                                                      劆
劆                                                                                                                                                    劆
劆tc filter add dev eth0 parent 2:0 protocol ip prio 1 handle 0x2e tcindex classid 2:1 pass_on                                                        劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
(偙偺僐乕僪偼姰慡偱偼偁傝傑偣傫丅 iproute2 攝晍偵偁傞 EFCBQ 偺椺偐傜敳
悎偟偨傕偺偵偡偓傑偣傫)丅

傑偢丄EF 偲儅乕僋偝傟偨僷働僢僩偑摓拝偟偨偲偟傑偟傚偆丅 RFC2598 傪撉傓
偲丄EF 僩儔僼傿僢僋偵悇彠偝傟傞 DSCP 偺抣偼 101110 偱偡丅偮傑傝 DS 僼傿
乕儖僪偼 10111000 (TOS 僶僀僩偺嵟掅埵價僢僩偼 DS 偱偼梡偄傜傟側偄偙偲偵
拲堄)丄偁傞偄偼 16 恑偱偼 0xb8 偲側傝傑偡丅

 
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆              TC INDEX                                                            劆
劆              FILTER                                                              劆
劆   +---+      +-------+    +---+-+    +------+                +-+    +-------+    劆
劆   |   |      |       |    |   | |    |FILTER|  +-+    +-+    | |    |       |    劆
劆   |   |----->| MASK  | -> |   | | -> |HANDLE|->| |    | | -> | | -> |       |    劆
劆   |   |  .   | =0xfc |    |   | |    |0x2E  |  | +----+ |    | |    |       |    劆
劆   |   |  .   |       |    |   | |    +------+  +--------+    | |    |       |    劆
劆   |   |  .   |       |    |   | |                            | |    |       |    劆
劆-->|   |  .   | SHIFT |    |   | |                            | |    |       |--> 劆
劆   |   |  .   | =2    |    |   | +----------------------------+ |    |       |    劆
劆   |   |      |       |    |   |       CBQ 2:0                  |    |       |    劆
劆   |   |      +-------+    +---+--------------------------------+    |       |    劆
劆   |   |                                                             |       |    劆
劆   |   +-------------------------------------------------------------+       |    劆
劆   |                          DSMARK 1:0                                     |    劆
劆   +-------------------------------------------------------------------------+    劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

僷働僢僩偑摓拝偡傞偲丄DS 僼傿乕儖僪偵偼 0xb8 偲偄偆抣偑愝掕偝傟傑偡丅愭
偵愢柧偟偨捠傝丄1:0 偲偄偆 id 偺 dsmark qdisc 偼丄 DS 僼傿乕儖僪傪拪弌
偟偰 skb->tc_index 曄悢偵曐懚偟傑偡丅偙偺椺偵偍偗傞師偺抜奒偼丄偙偺
qdisc 偵娭楢晅偗傜傟偨僼傿儖僞偵懳墳偟傑偡 (椺偺 2 峴栚)丅偙傟偼師偺憖
嶌傪幚峴偟傑偡丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆Value1 = skb->tc_index & MASK                                       劆
劆Key = Value1 >> SHIFT                                               劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

偙偺椺偱偼 MASC=0xFC 偱 SHIFT=2 偱偡丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆Value1 = 10111000 & 11111100 = 10111000                             劆
劆Key = 10111000 >> 2 = 00101110 -> 0x2E (16 恑)                      劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

曉傝抣偼 qdisc 偺撪晹僼傿儖僞僴儞僪儖 (偙偺椺偱偼 id 偑 2:0 偺傕偺) 偵
懳墳偟傑偡丅偙偺 id 傪帩偭偨僼傿儖僞偑幚嵺偵懚嵼偡傟偽丄惂尷忦審偲應掕
忦審偑 (僼傿儖僞偵偙傟傜偑娷傑傟偰偄傟偽) 挷嵏偝傟丄 classid 偑曉偝傟
(変乆偺椺偱偼 2:1)丄 skb->tc_index 曄悢偵曐懚偝傟傑偡丅

偟偐偟偙偺 id 傪帩偮僼傿儖僞偑尒偮偐傜側偗傟偽丄寢壥偼 fall_through 僼
儔僌偺愰尵偵埶懚偟傑偡丅愰尵偝傟偰偄傟偽丄value 僉乕偑 class id 偲偟偰
曉偝傟傑偡丅愰尵偝傟偰偄側偄偲僄儔乕偑曉偝傟丄僾儘僙僗偼巆傝偺僼傿儖僞
傊懕偒傑偡丅 fall_through 僼儔僌偺棙梡偵偼拲堄偑昁梫偱偡丅 skb->
tc_index 曄悢偺抣偲僋儔僗 id 偺娫偵扨弮側娭學偑偁傟偽丄偙傟偼峴傢傟偰偟
傑偄傑偡丅

愢柧偑昁梫側巆傝偺僷儔儊乕僞偼丄hash 偲 pass_on 偱偟傚偆偐丅 hash 偼僴
僢僔儏僥乕僽儖僒僀僘偵娭楢偟偰偄傑偡丅 pass_on 偼丄偙偺僼傿儖僞偺寢壥偲
摍偟偄 class id 偑柍偄応崌偼師偺僼傿儖僞傪梡偄傞丄偲偄偆偙偲傪帵偡偨傔
偵梡偄傜傟傑偡丅僨僼僅儖僩偺摦嶌偼 fall_through 偱偡 (師昞傪嶲徠)丅

嵟屻偵丄TCINDEX 偺奺僷儔儊乕僞偵愝掕偱偒傞抣傪堦棗偟偰偍偒傑偟傚偆:
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆TC Name                 Value           Default                     劆
劆-----------------------------------------------------------------   劆
劆Hash                    1...0x10000     Implementation dependent    劆
劆Mask                    0...0xffff      0xffff                      劆
劆Shift                   0...15          0                           劆
劆Fall through / Pass_on  Flag            Fall_through                劆
劆Classid                 Major:minor     None                        劆
劆Police                  .....           None                        劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

偙偺僼傿儖僞偼旕忢偵嫮椡偱偡丅偁傜備傞壜擻惈傪扵傞偨傔偵偼丄偙偺椡偑昁
梫側偺偱偡丅偲偙傠偱丄偙偺僼傿儖僞偼 DiffServ 偺愝掕偱偺傒梡偄傜傟傞傢
偗偱偼側偔丄懠偺宍幃偵偍偗傞僼傿儖僞偲偟偰傕棙梡偱偒傑偡丅

iproute2 攝晍偵娷傑傟偰偄傞 DiffServ 偺椺傪偡傋偰尒偰偍偔偙偲傪偍彠傔偟
傑偡丅偙偙偺暥復傕丄偱偒傞偩偗憗偔曗姰偡傞偮傕傝偱偡丅偲偙傠偱丄偙偙偱
愢柧偟偨撪梕偼丄懡偔偺僥僗僩偺寢壥偱偡丅傕偟偳偙偐偱娫堘偭偰偄偨傜丄巜
揈偟偰偔偩偝傞偲岾偄偱偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

14.4. 擖岥 (ingress) qdisc

偙偙傑偱愢柧偟偰偒偨 qdisc 偼丄偡傋偰弌岥 (egress) qdisc 偱偡丅偟偐偟僀
儞僞乕僼僃乕僗偵偼擖岥 (ingress) qdisc 傪帩偨偣傞偙偲傕偱偒傑偡丅偙傟偼
丄僷働僢僩傪僱僢僩儚乕僋傾僟僾僞偵憲傞偺偱偼側偔丄傾僟僾僞傪宱桼偟偰摓
拝偟偨僷働僢僩偵 tc 僼傿儖僞傪偐偗傞偨傔偺傕偺偱偡丅僷働僢僩偑儘乕僇儖
埗偺傕偺偐丄僼僅儚乕僪偝傟傞傕偺偐偼栤傢傟傑偣傫丅

tc 僼傿儖僞偵偼僩乕僋儞僶働僣僼傿儖僞偑姰慡偵幚憰偝傟偰偍傝丄傑偨僇乕僱
儖偺棳検昡壙婍偵傛偭偰儅僢僠傪峴偆偙偲傕偱偒傑偡偐傜丄偨偔偝傫偺婡擻偑
幚尰壜擻偱偡丅幚嵺偵丄棳擖僩儔僼傿僢僋傪 IP 僗僞僢僋偵擖傞埲慜偺偲偙傠
偱惂尷偡傞偙偲偝偊偱偒傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

14.4.1. 僷儔儊乕僞偲巊偄曽

擖岥 qdisc 帺懱偼丄偳偺傛偆側僷儔儊乕僞傕梫媮偟傑偣傫丅偙偺 qdisc 偼懠
偲偼堎側傝丄僨僶僀僗偺 root 傪愯桳偟傑偣傫丅師偺傛偆偵偟偰傾僞僢僠偟傑
偡丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# tc qdisc add dev eth0 ingress                                     劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
傛偭偰偙偺擖岥 qdisc 偲摨帪偵丄懠偺 (憲怣偱梡偄傞) qdisc 傪偙偺僨僶僀僗
偵揔梡偡傞偙偲傕偱偒傑偡丅

擖岥 qdisc 偺 (傗傗傢偞偲傜偟偄) 棙梡椺偵偮偄偰偼丄僋僢僋僽僢僋傪嶲徠偟
偰偔偩偝偄丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

14.5. 儔儞僟儉弶婜専抦 (Random Early Detection: RED)

偙偺愡偼丄僶儞僪暆偑 100儊僈價僢僩埲忋偵側傞傛偆側丄僶僢僋儃乕儞偺宱楬
偵娭偡傞夝愢傪堄恾偟偰彂偐傟傑偟偨丅帺戭偺 ADSL 儌僨儉側偳偲偼堎側傞傾
僾儘乕僠偑昁梫偵側傝傑偡丅

僀儞僞乕僱僢僩偵偍偗傞儖乕僞偺僉儏乕偺捠忢偺摦嶌偼丄 tail-drop 偲屇偽傟
傑偡丅 tail-drop 偼丄偁傞検傑偱偼僉儏乕傪峴偄丄乽堨傟偨乿僩儔僼傿僢僋傪
偡傋偰攋婞偟傑偡丅偙傟偼旕忢偵晄岞暯偱偁傝丄嵞憲偺徴撍 (retransmit
synchronization) 偺尨場偵傕側傝傑偡丅嵞憲偺徴撍偑婲偙傞偲丄尷奅偵払偟偨
儖乕僞偱撍慠偺攋婞偑僶乕僗僩揑偵惗偠丄偦傟偑傑偨偟偽傜偔屻偵嵞憲偺僶乕
僗僩傪惗偠偝偣丄崿嶨偟偨儖乕僞偼傑偨尷奅偵払偡傞偙偲偵側傝傑偡丅

愙懕偵偍偗傞堦帪揑側崿嶨偵懳張偡傞偨傔丄僶僢僋儃乕儞儖乕僞偱偼戝偒側僉
儏乕偑梡堄偝傟偰偄傞偙偲偑懡偄偱偡丅偟偐偟巆擮側偑傜丄偙偺傛偆側僉儏乕
偼僗儖乕僾僢僩偵偼椙偄偺偱偡偑丄抶墑 (latency) 偑戝偒偔側傝傑偡偟丄 TCP
愙懕偱偼崿嶨帪偺僶乕僗僩偑旕忢偵戝偒偔側偭偰偟傑偄傑偡丅

偙偺 tail-drop 偺摿惈偼丄僀儞僞乕僱僢僩偵偍偄偰偩傫偩傫栵夘側栤戣偵側偭
偰偒偰偄傑偡丅僱僢僩儚乕僋偵桪偟偔側偄傾僾儕働乕僔儑儞偺棙梡偑憹壛偟偰
偒偨偐傜偱偡丅偙偺偨傔 Linux 僇乕僱儖偱偼 RED 偑採嫙偝傟偰偄傑偡 (RED
偼 Random Early Detection 偺棯丅傑偨偦偺摦嶌偐傜丄 Random Early Drop 偲
傕屇偽傟傑偡)丅

RED 偼偙偺栤戣偵偮偄偰偺枩擻栻偱偼偁傝傑偣傫丅巜悢揑側 backoff 傪惓偟偔
幚憰偟偰偄側偄傾僾儕働乕僔儑儞偼丄偄偢傟偵偟偰傕晄岞暯偵僶儞僪暆傪妉摼
偟偰偟傑偆偙偲偵側傝傑偡丅偟偐偟 RED 傪梡偄傟偽丄僗儖乕僾僢僩傗抶墑偵娭
偟偰丄懠偺愙懕偵戝偒側奞傪梌偊傞偙偲偼側偔側傝傑偡丅

RED 偼丄僴乕僪儕儈僢僩偵払偡傞慜偵丄僼儘乕偐傜僷働僢僩傪摑寁揑偵攋婞偟
傑偡丅偙偆偡傞偲崿嶨偟偨僶僢僋儃乕儞偺愙懕傪丄傛傝壐傗偐偵尭懍偱偒丄嵞
憲偺徴撍傪杊偖偙偲偑偱偒傑偡丅偙傟偼僉儏乕偺僒僀僘傪彫偝偔丄抶墑傪堦掕
偵曐偪偮偮丄憗傔偵僷働僢僩傪攋婞偡傞偺偱丄TCP 偑帺暘偺乽岞惓側乿懍搙傪
傛傝憗偔敪尒偡傞偺偵傕栶棫偪傑偡丅偁傞摿掕偺愙懕偵偍偄偰僷働僢僩偑攋婞
偝傟傞妋棪偼丄憲偭偨僷働僢僩偺悢偵偱偼側偔丄僶儞僪暆偺棙梡棪偵斾椺偟傑
偡丅

岞暯側僉儏乕僀儞僌偱昁梫偲偝傟傞丄暋嶨側僙僢僔儑儞偛偲偺忬懺捛愓偑柍棟
偱偁傞傛偆側僶僢僋儃乕儞偵懳偟丄 RED 偼揔偟偨僉儏乕偱偡丅

RED 傪巊偆偵偼丄3 偮偺僷儔儊乕僞 min, max, burst 傪寛傔傞昁梫偑偁傝傑偡
丅 min 偼攋婞傪巒傔傞嵺偺僉儏乕僒僀僘 (偺嵟彫抣)丄 max 偼偙偺傾儖僑儕僘
儉偱棷傔偰偍偒偨偄僜僼僩儕儈僢僩 (嵟戝抣)丄 burst 偼乽僶乕僗僩捠夁乿偑
壜擻側嵟戝僷働僢僩悢偱偡丅

min 傪寁嶼偡傞偵偼丄婎杮僉儏乕僀儞僌抶墑 (base queueing latency) 偺嵟戝
嫋梕抣偵僶儞僪暆傪偐偗傑偡丅椺偊偽 64kbit/s 偺 ISDN 愙懕偵懳偟丄婎杮僉
儏乕僀儞僌抶墑傪 200ms 傑偱擣傔傞応崌丄min 偼 1600 僶僀僩偲側傝傑偡丅
min 傪彫偝偔偟偡偓傞偲僗儖乕僾僢僩偼埆壔偟傑偡偟丄戝偒偔偟偡偓傞偲
latency 偑楎壔偟傑偡丅側偍 min 傪彫偝偔偟偰傕丄抶偄愙懕偱懳榖揑僙僢僔儑
儞偺斀墳傪椙偔偡傞偨傔偵 MTU 傪彫偝偔偡傞偺偲摨偠岠壥偼摼傜傟傑偣傫丅

徴撍傪杊偖偵偼丄max 偼彮側偔偲傕 min 偺 2 攞偵偟側偗傟偽側傝傑偣傫丅抶
偄愙懕偱 min 傕彫偝偄偲偒偼丄偍偦傜偔 max 偼 min 偺 4 攞埲忋偵偡傞傎偆
偑椙偄偱偟傚偆丅

burst 偼 RED 傾儖僑儕僘儉偺僶乕僗僩偵懳偡傞斀墳傪寛傔傑偡丅 burst 偼
min/avpkt 傛傝戝偒偔偟側偗傟偽側傝傑偣傫丅巹偑幚尡偟偨偲偙傠偱偼丄
(min+min+max)/(3*avpkt) 偱偆傑偔摦嶌偡傞傛偆偱偡丅

傑偨丄limit 偲 avpkt 偺愝掕傕昁梫偱偡丅 limit 偼埨慡曎偲側傞抣偱丄僉儏
乕偺拞恎偑 limit 僶僀僩傪墇偊傞偲丄 RED 偼 tail-drop 偵乽曄壔乿偟傑偡丅
巹偼戝懱偺応崌丄limit 傪 max 偺 8 攞偵愝掕偟傑偡丅avpkt 偼僷働僢僩僒僀
僘偺暯嬒抣偱偡丅 MTU 偑 1500 僶僀僩偺崅懍側僀儞僞乕僱僢僩愙懕偱偼丄
1000 偵偟偰偍偗偽傛偄偱偟傚偆丅

媄弍揑側忣曬偼丄 Sally Floyd 偲 Van Jacobson 偵傛傞 RED 僉儏乕僀儞僌偺
榑暥 <http://www.aciri.org/floyd/papers/red/red.html>傪偛棗偔偩偝偄丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

14.6. 斈梡儔儞僟儉弶婜専抦 (Generic Random Early Detection)

GRED 偵偮偄偰偼丄偁傑傝傢偐偭偰偄傞偙偲偼偁傝傑偣傫丅 GRED 偼偄偔偮偐撪
晹僉儏乕傪帩偭偰偄傞傛偆偱丄偦傟傜偼 DiffServ 偺 tcindex 偵婎偯偄偰慖戰
偝傟偰偄傞傛偆偱偡丅偙偪傜 <http://www.davin.ottawa.on.ca/ols/
img22.htm> 偺僗儔僀僪偵傛傟偽丄GRED 偼 Cisco 偺 'Distributed Weighted
RED' 偺婡擻傗丄Dave Clark 偺 RIO 偺傛偆側婡擻傪帩偭偰偄傞傛偆偱偡丅 

奺壖憐僉儏乕偵偼丄偦傟偧傟屌桳偺攋婞僷儔儊乕僞傪巜掕偱偒傑偡丅

FIXME: Jamel 偐 Werner 偵丄傕偆偪傚偭偲嫵偊偰傕傜傢側偄偲丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

14.7. VC/ATM 僄儈儏儗乕僔儑儞

偙傟偼 Werner Almesberger 偵傛傞妱偵桳柤側僾儘僕僃僋僩偱丄壖憐夞楬
(Virtual Circuits) 傪 TCP/IP 僜働僢僩忋偵峔抸偟傛偆偲偄偆傕偺偱偡丅
Virtual Circuit 偼丄ATM 僱僢僩儚乕僋棟榑偺奣擮偱偡丅

傛傝徻偟偔偼丄ATM on Linux 儂乕儉儁乕僕 <http://
linux-atm.sourceforge.net/>傪嶲徠偟偰偔偩偝偄丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

14.8. 廳傒晅偒儔僂儞僪儘價儞 (Weighted Round Robin: WRR)

偙偺 qdisc 偼昗弨偺僇乕僱儖偵偼擖偭偰偄傑偣傫偑丄偙偪傜 <http://
wipl-wrr.dkik.dk/wrr/>偐傜僟僂儞儘乕僪偱偒傑偡丅尰嵼偙偺 qdisc 偼 Linux
2.2 偱偺傒僥僗僩偝傟偰偄傑偡偑丄偍偦傜偔 2.4/2.5 僇乕僱儖偱偺嶌嬈傕側偝
傟傞偱偟傚偆丅

WRR qdisc 偼丄廳傒晅偒儔僂儞僪儘價儞偺巇慻傒傪巊偭偰丄僶儞僪暆傪帺暘偺
帩偮暋悢偺僋儔僗偵暘嶶偝偣傑偡丅偮傑傝 WRR qdisc 偼丄CBQ qdisc 偺傛偆偵
丄帺暘偺攝壓偵僋儔僗傪帩偪丄偦傟偧傟偵偼擟堄偺 qdisc 傪愙懕偱偒傑偡丅梫
媮傪峴偭偨僋儔僗偵偼丄偦傟偧傟偵晅偗傜傟偨廳傒偵斾椺偟偨僶儞僪暆偑偁偰
偑傢傟傑偡丅廳傒偼 tc 僾儘僌儔儉傪梡偄偰庤摦偱愝掕偱偒傑偡丅偟偐偟丄戝
検偺僨乕僞傪揮憲偝偣偨僋儔僗偺廳傒傪帺摦揑偵尭傜偡傛偆偵傕偱偒傑偡丅

偙偺 qdisc 偵偼慻傒崬傒偺僋儔僗慖暿婍偑偁傝丄堎側傞儅僔儞偲偺娫偱憲怣丒
庴怣偟偨僷働僢僩傪丄偦傟偧傟暿乆偺僋儔僗偵妱傝摉偰傑偡丅 MAC 傑偨偼 IP
偲丄敪怣尦傾僪儗僗傑偨偼憲怣愭傾僪儗僗偑棙梡偱偒傑偡丅偨偩偟 MAC 傾僪儗
僗偼 Linux 儅僔儞偑僀乕僒僱僢僩僽儕僢僕偲偟偰摦嶌偟偰偄傞応崌偱偺傒棙梡
偱偒傑偡丅奺僋儔僗偼丄偁傞儅僔儞偐傜偺僷働僢僩偑尰傟傞偲丄帺摦揑偵偦偺
儅僔儞偵懳偟偰妱傝摉偰傜傟傑偡丅

偙偺 qdisc 偼丄椌偺傛偆偵丄偨偔偝傫偺偦傟偧傟撈棫偟偨儅僔儞偑傂偲偮偺僀
儞僞乕僱僢僩愙懕傪嫟桳偟偰偄傞応崌偵偼丄偲偰傕曋棙偱偟傚偆丅偙偺傛偆側
僒僀僩偱丄朷傓摦嶌傪偝偣傞偨傔偺僗僋儕僾僩孮偼丄 WRR 偺攝晍傾乕僇僀僽偵
娷傑傟偰偄傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

Chapter 15. 僋僢僋僽僢僋

偙偺復偼丄栤戣夝寛偺彆偗偲側傞乽僋僢僋僽僢僋乿偑廂傔傜傟偰偄傑偡丅偨偩
偟僋僢僋僽僢僋偼棟夝偺戙傢傝偵側傞傕偺偱偼偁傝傑偣傫丅偱偡偺偱帋偟偨傜
壗偑婲偒偰偄傞偐傪棟夝偡傞傛偆偵怱偑偗偰偔偩偝偄丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

15.1. SLA 偺堎側傞暋悢偺僒僀僩傪摦嶌偝偣傞

偄偔偮偐偺傗傝曽偑偁傝傑偡丅 Apache 偱傕偙偺婡擻傪儌僕儏乕儖偱僒億乕僩
偟偰偄傑偡偑丄偙偙偱偼 Linux 傪巊偭偰偱偒傞偙偲丄懠偺僒乕價僗偱傕摨條偵
揔梡偱偒傞偙偲傪帵偟傑偡丅偙傟傜偺僐儅儞僪偼丄偙偺暥彂偺枛旜偵帵偡
Jamal Hadi 偺敪昞偐傜攓庁偟偰偒偨傕偺偱偡丅

http, ftp, 僗僩儕乕儈儞僌僆乕僨傿僆傪巊偭偰偄傞 2 偮偺屭媞偑偁傝丄偦傟
偧傟偵尷傜傟偨検偺僶儞僪暆傪斕攧偟偨偄偲偟傑偟傚偆丅偙傟偼僒乕僶帺恎偱
峴偄傑偡丅

屭媞 A 偵偼嵟戝 2 儊僈價僢僩傪丄屭媞 B 偵偼 5 儊僈價僢僩傪妱傝摉偰傑偡
丅偙傟傜偺屭媞偼丄僒乕僶偵壖憐 IP 傾僪儗僗傪嶌偭偰暘棧偟傑偡丅

 
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# ip address add 188.177.166.1 dev eth0                             劆
劆# ip address add 188.177.166.2 dev eth0                             劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

偦傟偧傟偺僒乕僶偵揔愗側 IP 傾僪儗僗傪妱傝摉偰傞偺偼撉幰偵偍擟偣偟傑偡
丅桳柤側僨乕儌儞偼丄傎傏娫堘偄側偔偙偺婡擻傪僒億乕僩偟偰偄傑偡丅

傑偢 eth0 偵 CBQ qdisc 傪傾僞僢僠偟傑偡丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# tc qdisc add dev eth0 root handle 1: cbq bandwidth 10Mbit cell 8 avpkt 1000 \ 劆
劆  mpu 64                                                                        劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

懕偄偰奺屭媞偺僋儔僗傪嶌傝傑偡丅

 
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# tc class add dev eth0 parent 1:0 classid 1:1 cbq bandwidth 10Mbit rate \  劆
劆  2MBit avpkt 1000 prio 5 bounded isolated allot 1514 weight 1 maxburst 21  劆
劆# tc class add dev eth0 parent 1:0 classid 1:2 cbq bandwidth 10Mbit rate \  劆
劆  5Mbit avpkt 1000 prio 5 bounded isolated allot 1514 weight 1 maxburst 21  劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

偙偙偱 2 偮偺僋儔僗偦傟偧傟偵僼傿儖僞傪捛壛偟傑偡丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆##FIXME: 偙偺峴偺堄枴偲摦嶌偼? divisor 偲偼?                                    劆
劆##FIXME: divisor 偼僴僢僔儏僥乕僽儖偲僶働僣偺悢偵壗偐娭學偑偁傞傛偆偩 -ahu      劆
劆# tc filter add dev eth0 parent 1:0 protocol ip prio 5 handle 1: u32 divisor 1  劆
劆# tc filter add dev eth0 parent 1:0 prio 5 u32 match ip src 188.177.166.1       劆
劆  flowid 1:1                                                                    劆
劆# tc filter add dev eth0 parent 1:0 prio 5 u32 match ip src 188.177.166.2       劆
劆  flowid 1:2                                                                    劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

偙傟偱廔椆偱偡丅

FIXME: 側偤僩乕僋儞僶働僣僼傿儖僞偑晄梫側偺偐? 偳偙偐偱僨僼僅儖僩偺
pfifo_fast 偵棊偪偰偄傞偺偐?

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

15.2. 儂僗僩傪 SYN 僼儔僢僪偐傜庣傞

Alexey 偺 iproute 暥彂偐傜偲偭偨撪梕傪 netfilter 偵崌傢偣丄僷僗傪挷惍偟
偨傕偺偱偡丅偙傟傪梡偄傞応崌偵偼丄悢抣傪偛帺暘偺僔僗僥儉偵偁傢偣偰廋惓
偟偰偔偩偝偄丅

僱僢僩儚乕僋慡懱傪庣傝偨偄応崌偼丄偙偺僗僋儕僾僩偼撉傒旘偽偟偰偔偩偝偄
丅偙傟偼扨堦偺儂僗僩傪庣傞偨傔偺傕偺偱偡丅

偙傟傪 2.4.0 偱摦嶌偝偣傞偵偼丄嵟怴斉偺 iproute2 偑昁梫側傛偆偱偡丅

 
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆#! /bin/sh -x                                                             劆
劆#                                                                         劆
劆# 擖岥 (ingress) 偺婡擻傪梡偄偨僒儞僾儖僗僋儕僾僩                         劆
劆# 偙偺僗僋儕僾僩偱偼丄摓拝偡傞 SYN 傪惂尷偡傞椺傪帵偟傑偡丅               劆
劆# TCP-SYN 峌寕偵懳偡傞杊屼偲偟偰桳梡偱偡丅SYN 偵懳偟偰傛傝                劆
劆# 嫮椡側婡擻 (椺偊偽僒僽僱僢僩傪捛壛偡傞側偳) 傪捛壛偟偨                  劆
劆# 偗傟偽 IPchains 傪巊偊傑偡丅                                            劆
劆#                                                                         劆
劆# 偄傠偄傠側儐乕僥傿儕僥傿偺僷僗丅                                        劆
劆# 帺暘偺娐嫬偵偁傢偣偰偔偩偝偄丅                                          劆
劆#                                                                         劆
劆TC=/sbin/tc                                                               劆
劆IP=/sbin/ip                                                               劆
劆IPTABLES=/sbin/iptables                                                   劆
劆INDEV=eth2                                                                劆
劆#                                                                         劆
劆# $INDEV 偵摓拝偟偨 SYN 僷働僢僩偵 MARK 偑 1 偺僞僌傪晅偗傑偡丅           劆
劆############################################################              劆
劆$iptables -A PREROUTING -i $INDEV -t mangle -p tcp --syn \                劆
劆  -j MARK --set-mark 1                                                    劆
劆############################################################              劆
劆#                                                                         劆
劆# 擖岥 qdisc 傪丄偙偺擖岥僀儞僞乕僼僃乕僗偵僀儞僗僩乕儖偟傑偡             劆
劆############################################################              劆
劆$TC qdisc add dev $INDEV handle ffff: ingress                             劆
劆############################################################              劆
劆                                                                          劆
劆#                                                                         劆
劆#                                                                         劆
劆# SYN 僷働僢僩偼 40 僶僀僩 (320 價僢僩) 側偺偱丄3 偮偺 SYN                劆
劆# 偼 960 價僢僩 (偍傛偦 1k價僢僩) 偵側傝傑偡丅傛偭偰懷堟惂尷              劆
劆# 偲偟偰丄摓拝 SYN 偼 3/昩 偵偟傑偡 (幚偼偁傑傝曋棙偱偼偁傝               劆
劆# 傑偣傫丅偟偐偟梫揰偼墴偝偊偰偄傑偡 -JHS                                 劆
劆############################################################              劆
劆$TC filter add dev $INDEV parent ffff: protocol ip prio 50 handle 1 fw \  劆
劆police rate 1kbit burst 40 mtu 9k drop flowid :1                          劆
劆############################################################              劆
劆                                                                          劆
劆                                                                          劆
劆#                                                                         劆
劆echo "---- qdisc parameters Ingress  ----------"                          劆
劆$TC qdisc ls dev $INDEV                                                   劆
劆echo "---- Class parameters Ingress  ----------"                          劆
劆$TC class ls dev $INDEV                                                   劆
劆echo "---- filter parameters Ingress ----------"                          劆
劆$TC filter ls dev $INDEV parent ffff:                                     劆
劆                                                                          劆
劆# 擖岥 qdisc 傪嶍彍偟傑偡丅                                               劆
劆#$TC qdisc del $INDEV ingress                                             劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

15.3. ICMP 傪懷堟惂尷偟偰 dDoS 傪杊偖

嶐崱偺僀儞僞乕僱僢僩偱偼丄暘嶶棙梡晄擻峌寕 (distributed denaial of
service attack: dDoS) 偑摢偺捝偄栤戣偵側偭偰偄傑偡丅僱僢僩儚乕僋偵惓偟
偔僼傿儖僞儕儞僌偲懷堟惂尷傪偐偗傞偲丄偙偺傛偆側峌寕偺懳徾 (偍傛傃尨場)
偲側傞偙偲傪偄偢傟傕杊偘傑偡丅

僱僢僩儚乕僋偵僼傿儖僞傪偐偗丄憲怣尦傾僪儗僗偑儘乕僇儖偱側偄 IP 僷働僢
僩偼丄僱僢僩儚乕僋傪弌偰峴偗側偄傛偆偵偟傑偡丅偙偆偡傞偲丄摻柤偱僑儈傪
僀儞僞乕僱僢僩偵憲傞偙偲偑偱偒側偔側傝傑偡丅

懷堟惂尷偼丄愭偵帵偟偨傕偺偲摨條偱偡丅撉幰偺儊儌儕傪儕僼儗僢僔儏偡傞偨
傔偵丄嵞傃 ASCII 恾傪帵偟傑偟傚偆丅

 
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆[The Internet] ---<E3, T3, whatever>--- [Linux router] --- [Office+ISP] 劆
劆                                      eth1          eth0                劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

傑偢丄偁傜偐偠傔昁梫側晹暘偺愝掕偱偡丅

 
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# tc qdisc add dev eth0 root handle 10: cbq bandwidth 10Mbit avpkt 1000       劆
劆# tc class add dev eth0 parent 10:0 classid 10:1 cbq bandwidth 10Mbit rate \  劆
劆  10Mbit allot 1514 prio 5 maxburst 20 avpkt 1000                             劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

僀儞僞乕僼僃乕僗偑 100M價僢僩 (偁傞偄偼偦傟埲忋) 偩偭偨傜丄 3 偮偺悢抣
傪挷惍偟偰偔偩偝偄丅師偵丄ICMP 僩儔僼傿僢僋傪偳偺掱搙嫋壜偡傞偐傪寛傔傑
偡丅tcpdump 偱應掕傪峴偭偰傒偰丄偟偽傜偔寢壥傪僼傽僀儖偵婰榐偟丄偳偺掱
搙偺 ICMP 偑僱僢僩儚乕僋傪棳捠偟偰偄傞偐尒偰傒傑偟傚偆丅 snapshot 偺挿
偝傪憹傗偡偺傪朰傟側偄傛偆偵丅

應掕偑偱偒側偄応崌偼丄棙梡偱偒傞僶儞僪暆偺 5% 偵偟偰傒傞偲偄偄偱偟傚偆
丅偱偼僋儔僗傪愝掕偟傑偟傚偆丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# tc class add dev eth0 parent 10:1 classid 10:100 cbq bandwidth 10Mbit rate \  劆
劆  100Kbit allot 1514 weight 800Kbit prio 5 maxburst 20 avpkt 250 \              劆
劆  bounded                                                                       劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

偙傟偱 100K價僢僩偵惂尷偟傑偟偨丅偱偼僼傿儖僞傪捛壛偟偰丄 ICMP 僩儔僼傿
僢僋傪偙偺僋儔僗偵妱傝摉偰傞傛偆偵偟傑偟傚偆丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# tc filter add dev eth0 parent 10:0 protocol ip prio 100 u32 match ip  劆
劆  protocol 1 0xFF flowid 10:100                                         劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

15.4. 懳榖揑僩儔僼傿僢僋傪桪愭偡傞

偨偔偝傫偺僨乕僞偑愙懕偐傜弌偰峴偭偨傝擖偭偰偒偨傝偟偰偄傞偲丄 telnet
傗 ssh 偱壗傜偐偺儊儞僥僫儞僗嶌嬈傪峴偆嵺偺斀墳偑埆偔側傝傑偡丅懠偺僷働
僢僩偑僉乕擖椡傪僽儘僢僋偡傞偺偱偡丅偙偺傛偆側懳榖揑側僷働僢僩傪丄偙偭
偦傝僶儖僋揮憲僩儔僼傿僢僋偲偼暿偺宱楬偱捠偡偙偲偑偱偒偨傜偡偛偄偲巚偄
傑偣傫偐? Linux 側傜偱偒傞偺偱偡丅

慜弎偺傛偆偵丄椉曽岦偺僩儔僼傿僢僋傪埖偆昁梫偑偁傝傑偡丅摉慠側偑傜丄愙
懕偺椉抂偑偄偢傟傕 Linux 儅僔儞偱偁傟偽嵟崅偱偡偑丄懠偺 UNIX 偱傕壜擻偱
偡丅偍嬤偔偺 Solaris/BSD 僌儖偵恞偹偰傒傑偟傚偆丅

昗弨偺 pfifo_fast 僗働僕儏乕儔偵偼 3 偮偺乽僶儞僪乿偑偁傝傑偡丅僶儞僪 0
偺僩儔僼傿僢僋偼愭偵憲怣偝傟丄偦偺屻僶儞僪 1 偲 2 偺僩儔僼傿僢僋偑峫椂
偝傟傑偡丅傛偭偰丄巹偨偪偺懳榖揑僩儔僼傿僢僋傪僶儞僪 0 偵妱傝摉偰傞偺偑
儈僜偱偡!

偙傟傜偼 (偦傠偦傠 obsolete 偵側傞) ipchains HOWTO 偐傜僷僋偭偰偒傑偟偨
丅

IP 僿僢僟偵偼丄偁傑傝梡偄傜傟側偄 4 偮偺價僢僩丄 Type of Service (TOS)
價僢僩偲屇偽傟傞椞堟偑偁傝傑偡丅偙傟傜偼僷働僢僩偺埖偄偵塭嬁偟傑偡丅4
偮偺價僢僩偼偦傟偧傟 "Minimum Delay", "Maximum Throughput", "Maximum
Reliability", "Minimum Cost" 傪堄枴偟傑偡丅偙傟傜偺價僢僩偺偆偪丄傂偲偮
偩偗偑愝掕偱偒傑偡丅 ipchains 偺 TOS 廋惓僐乕僪偺挊幰偱偁傞 Rob van
Nieuwkerk 偼丄師偺傛偆偵尵偭偰偄傑偡丅

    巹偵偲偭偰偼 "Minimum Delay" 偑摿偵廳梫偱偡丅巹偼乽懳榖揑側乿僷働僢
    僩偵偼丄忋棳偺儖乕僞 (Linux) 偱偙傟傪桳岠偵偟傑偟偨丅帺暘偼 33.6k
    儌僨儉愙懕偺壓棳偵偄傑偡丅 Linux 偼僷働僢僩傪 3 偮偺僉儏乕偵桪愭晅
    偗偟傑偡丅偙偺傛偆偵偟偰丄巹偼戝偒側僟僂儞儘乕僪傪偟偰偄傞嵟拞偵傕
    丄傑偁傑偁偺懳榖惈擻傪摼傞偙偲偑偱偒偰偄傑偡丅
   
嵟傕傛偔偁傞愝掕偼丄telnet 偲 ftp 偺惂屼愙懕偵 "Minimum Delay" 傪梡偄丄
FTP 僨乕僞偵 "Maximum Throughput" 傪梡偄傞傗傝曽偱偡丅偙傟偵偼忋棳偺儖
乕僞偱丄師偺傛偆偵偟傑偡丅

 
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# iptables -A PREROUTING -t mangle -p tcp --sport telnet \          劆
劆  -j TOS --set-tos Minimize-Delay                                   劆
劆# iptables -A PREROUTING -t mangle -p tcp --sport ftp \             劆
劆  -j TOS --set-tos Minimize-Delay                                   劆
劆# iptables -A PREROUTING -t mangle -p tcp --sport ftp-data \        劆
劆  -j TOS --set-tos Maximize-Throughput                              劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

偙傟偩偲丄telnet 愭偺儂僗僩偐傜儘乕僇儖偺 PC 傊偲岦偐偆僷働僢僩偵偟偐嶌
梡偟傑偣傫丅偟偐偟媡曽岦偼偡偱偵愝掕偝傟偰偄傞偺偱偡丅偮傑傝 telnet 傗
ssh 側偳偱偼丄憲怣僷働僢僩偺 TOS 僼傿乕儖僪傪帺摦揑偵愝掕偟偰偄傞偺偱偡
丅

偙傟傪峴偭偰偄側偄傾僾儕働乕僔儑儞偑偁偭偰傕丄 netfilter 傪梡偄傟偽摨偠
偙偲偑偱偒傑偡丅儘乕僇儖儅僔儞偱師偺傛偆偵偟傑偡丅

 
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# iptables -A OUTPUT -t mangle -p tcp --dport telnet \              劆
劆  -j TOS --set-tos Minimize-Delay                                   劆
劆# iptables -A OUTPUT -t mangle -p tcp --dport ftp \                 劆
劆  -j TOS --set-tos Minimize-Delay                                   劆
劆# iptables -A OUTPUT -t mangle -p tcp --dport ftp-data \            劆
劆  -j TOS --set-tos Maximize-Throughput                              劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

15.5. netfilter, iproute2, ipchains, squid 傪梡偄偨摟夁 Web 僉儍僢僔儏

偙偺愡偼撉幰偺 Ram Narula (Internet for Education, Thailand) 偐傜婑偣傜
傟傑偟偨丅

Linux 偱偙偺栚揑傪枮偨偡偨傔偺捠忢偺僥僋僯僢僋偼丄偍偦傜偔億乕僩 80
(web) 偺乽奜岦偒乿僩儔僼傿僢僋偑 squid 偺摦嶌偟偰偄傞僒乕僶偵儖乕僥傿儞
僌偝傟傞傛偆偵偟偨乽屻偱乿丄ipchains 傪梡偄傞曽朄偱偟傚偆丅

奜岦偒偺億乕僩 80 僩儔僼傿僢僋傪 squid 偺摦嶌偟偰偄傞僒乕僶偵儖乕僥傿儞
僌偡傞偵偼丄3 偮偺曽朄偑抦傜傟偰偄傑偡丅偙偙偱偼 4 斣栚偺曽朄傪徯夘偟傑
偡丅

僎乕僩僂僃僀儖乕僞偵傗傜偣傞
   
    僎乕僩僂僃僀儖乕僞偵丄奜岦偒偱憲怣愭億乕僩偑 80 偺僷働僢僩傪 squid
    僒乕僶偺 IP 傾僪儗僗偵憲傜偣傞偙偲偑壜擻側応崌丅
   
    偟偐偟
   
    偙傟偼儖乕僞偵晧壸傪偐偗傞偙偲偵側傝傑偡偟丄彜梡偺儖乕僞偱偼僒億乕
    僩偟偰偄側偄偙偲傕偁傝傑偡丅
   
儗僀儎 4 僗僀僢僠傪梡偄傞
   
    儗僀儎 4 僗僀僢僠偼丄偙偺嶌嬈傪傑偭偨偔栤戣側偔張棟偱偒傑偡丅
   
    偟偐偟
   
    儗僀儎 4 僗僀僢僠偺壙奿偼旕忢偵崅偔丄偨偄偰偄偺応崌偼丄(堦斒揑側儖
    乕僞 + 椙偄 Linux 僒乕僶) 偺崌寁傛傝傕崅偄偱偡丅
   
僉儍僢僔儏僒乕僶傪僱僢僩儚乕僋偺僎乕僩僂僃僀偵偡傞
   
    偡傋偰偺僩儔僼傿僢僋偵僉儍僢僔儏僒乕僶傪宱桼偝偣傞偙偲傕偱偒傑偡丅
   
    偟偐偟
   
    squid 偼偐側傝偺 CPU 僷儚乕傪徚旓偡傞偨傔丄偙傟偼偐側傝儕僗僋偑崅偄
    偱偡丅偮傑傝僱僢僩儚乕僋慡懱偺惈擻偑抶偔側傞偐傕偟傟傑偣傫偟丄枩堦
    僒乕僶偑僋儔僢僔儏偟偨傜丄扤傕僱僢僩儚乕僋偵傾僋僙僗偱偒側偔側傝傑
    偡丅
   
Linux+NetFilter 儖乕僞
   
    NetFilter 傪梡偄傞偲丄暿偺僥僋僯僢僋偑幚憰偱偒傑偡丅偮傑傝
    NetFilter 偵摓払愭億乕僩偑 80 偺僷働僢僩傪儅乕僉儞僌偝偣丄 iproute2
    傪巊偭偰報偺偮偄偨僷働僢僩傪 squid 僒乕僶偵儖乕僥傿儞僌偝偣傞偺偱偡
    丅
   
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆|----------------|                                                  劆
劆|      幚憰      |                                                  劆
劆|----------------|                                                  劆
劆                                                                    劆
劆 梡偄偨傾僪儗僗                                                     劆
劆 10.0.0.1 naret (NetFilter 僒乕僶)                                  劆
劆 10.0.0.2 silom (Squid 僒乕僶)                                      劆
劆 10.0.0.3 donmuang (僀儞僞乕僱僢僩偵愙懕偟偰偄傞儖乕僞)             劆
劆 10.0.0.4 kaosarn (僱僢僩儚乕僋偺暿偺僒乕僶)                        劆
劆 10.0.0.5 RAS                                                       劆
劆 10.0.0.0/24 儊僀儞僱僢僩儚乕僋                                     劆
劆 10.0.0.0/19 僱僢僩儚乕僋慡懱                                       劆
劆                                                                    劆
劆|---------------|                                                   劆
劆| 僱僢僩儚乕僋恾|                                                   劆
劆|---------------|                                                   劆
劆                                                                    劆
劆Internet                                                            劆
劆|                                                                   劆
劆donmuang                                                            劆
劆|                                                                   劆
劆------------hub/switch----------                                    劆
劆|        |             |       |                                    劆
劆naret   silom        kaosarn  RAS etc.                              劆
劆                                                                    劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
傑偢 naret 傪 silom 埲奜偺儅僔儞偺僨僼僅儖僩僎乕僩僂僃僀偵偟偰丄偡傋偰
偺僩儔僼傿僢僋偑 naret 傪宱桼偡傞傛偆偵偟傑偡丅 silom 偺僨僼僅儖僩僎乕
僩僂僃僀偼 donmuang (10.0.0.3) 偵偟傑偡丅偝傕側偄偲偙偺娐嫬偱偼 web 僩
儔僼傿僢僋偑儖乕僾偟傑偡丅

(埲慜偼偙偺僱僢僩儚乕僋偺偡傋偰偺僒乕僶偱偼 10.0.0.1 偑僨僼僅儖僩僎乕僩
僂僃僀偱丄偙傟偼 donmuang 儖乕僞偺埲慜偺 IP 傾僪儗僗偱偟偨丅傛偭偰偙偙
偱偼 donmuang 偺 IP 傾僪儗僗傪 10.0.0.3 偵曄峏偟丄 naret 偺 IP 傾僪儗僗
傪 10.0.0.1 偵偟偨偺偱偡)

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆Silom                                                               劆
劆-----                                                               劆
劆-squid 偲 ipchains 傪愝掕偡傞                                       劆
劆                                                                    劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

silom 偱 squid 僒乕僶傪愝掕偟丄摟夁僉儍僢僔儏/僾儘僋僔傪僒億乕僩偡傞傛
偆偵偟傑偡丅僨僼僅儖僩偺億乕僩偼捠忢 3128 側偺偱丄億乕僩 80 傊偺僩儔僼
傿僢僋偼儘乕僇儖偺 3128 偵儕僟僀儗僋僩偟側偗傟偽柭傝傑偣傫丅偙傟偼
ipchains 傪梡偄偰師偺傛偆偵彂偗傑偡:

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆silom# ipchains -N allow1                                                   劆
劆silom# ipchains -A allow1 -p TCP -s 10.0.0.0/19 -d 0/0 80 -j REDIRECT 3128  劆
劆silom# ipchains -I input -j allow1                                          劆
劆                                                                            劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

偁傞偄偼 netfilter 偺尵梩偱偼:
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆silom# iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128 劆
劆                                                                                          劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

(拲堄: 懠偺僄儞僩儕傕偁傞偐傕偟傟傑偣傫)

squid 僒乕僶偺愝掕偵娭偡傞徻偟偄忣曬偼丄 Squid FAQ 偺儁乕僕 <http://
squid.nlanr.net> 傪嶲徠偟偰偔偩偝偄丅

偙偺僒乕僶偱偼 ip forwarding 傪桳岠偵偟偰偍偄偰偔偩偝偄丅傑偨偙偺僒乕僶
偺僨僼僅儖僩僎乕僩僂僃僀偼丄 donmuang 儖乕僞偵偟偰偔偩偝偄 (naret 偱偼
偁傝傑偣傫)丅

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆Naret                                                               劆
劆-----                                                               劆
劆-iptables 偲 iproute2 偺愝掕                                        劆
劆- icmp REDIRECT 儊僢僙乕僕傪柍岠偵偡傞 (昁梫側応崌)                 劆
劆                                                                    劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

 1. 憲怣愭億乕僩偑 80 偺僷働僢僩偵丄抣 2 偱儅乕僋偟傑偡丅
    劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
    劆naret# iptables -A PREROUTING -i eth0 -t mangle -p tcp --dport 80 \ 劆
    劆 -j MARK --set-mark 2                                               劆
    劆                                                                    劆
    劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
   
 2. iproute2 傪愝掕偟丄2 偲偄偆儅乕僋偺偮偄偨僷働僢僩傪 silom 偵儖乕僥
    傿儞僌偟傑偡丅
    劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
    劆naret# echo 202 www.out >> /etc/iproute2/rt_tables              劆
    劆naret# ip rule add fwmark 2 table www.out                       劆
    劆naret# ip route add default via 10.0.0.2 dev eth0 table www.out 劆
    劆naret# ip route flush cache                                     劆
    劆                                                                劆
    劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
   
    donmuang 偲 naret 偑摨偠僒僽僱僢僩偵偁傞応崌偼丄 naret 偵 icmp
    REDIRECT 儊僢僙乕僕傪憲怣偝偣偰偼偄偗傑偣傫丅偙偺応崌偼偦偆偩偭偨偺
    偱丄師偺僐儅儞僪偱 icmp REDIRECT 傪柍岠壔偟傑偟偨丅
    劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
    劆naret# echo 0 > /proc/sys/net/ipv4/conf/all/send_redirects      劆
    劆naret# echo 0 > /proc/sys/net/ipv4/conf/default/send_redirects  劆
    劆naret# echo 0 > /proc/sys/net/ipv4/conf/eth0/send_redirects     劆
    劆                                                                劆
    劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
   
偙傟偱愝掕偼姰惉偱偡丅挷傋偰傒傑偟傚偆丅

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆naret 偵偰:                                                                           劆
劆                                                                                      劆
劆naret# iptables -t mangle -L                                                          劆
劆Chain PREROUTING (policy ACCEPT)                                                      劆
劆target     prot opt source               destination                                  劆
劆MARK       tcp  --  anywhere             anywhere           tcp dpt:www MARK set 0x2  劆
劆                                                                                      劆
劆Chain OUTPUT (policy ACCEPT)                                                          劆
劆target     prot opt source               destination                                  劆
劆                                                                                      劆
劆naret# ip rule ls                                                                     劆
劆0:      from all lookup local                                                         劆
劆32765:  from all fwmark        2 lookup www.out                                       劆
劆32766:  from all lookup main                                                          劆
劆32767:  from all lookup default                                                       劆
劆                                                                                      劆
劆naret# ip route list table www.out                                                    劆
劆default via 203.114.224.8 dev eth0                                                    劆
劆                                                                                      劆
劆naret# ip route                                                                       劆
劆10.0.0.1 dev eth0  scope link                                                         劆
劆10.0.0.0/24 dev eth0  proto kernel  scope link  src 10.0.0.1                          劆
劆127.0.0.0/8 dev lo  scope link                                                        劆
劆default via 10.0.0.3 dev eth0                                                         劆
劆                                                                                      劆
劆(silom 偼忋弎偺峴偺偳傟偐偵懏偟偰偄傞偙偲傪妋擣偺偙偲丅                               劆
劆偙偺応崌偼 10.0.0.0/24 偺峴偱偡)                                                      劆
劆                                                                                      劆
劆|------|                                                                              劆
劆|-DONE-|                                                                              劆
劆|------|                                                                              劆
劆                                                                                      劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

15.5.1. 幚憰屻偺僩儔僼傿僢僋僼儘乕恾

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆|-----------------------------------------|                         劆
劆|       幚憰屻偺僩儔僼傿僢僋僼儘乕恾      |                         劆
劆|-----------------------------------------|                         劆
劆                                                                    劆
劆INTERNET                                                            劆
劆/\                                                                  劆
劆||                                                                  劆
劆\/                                                                  劆
劆-----------------donmuang router---------------------               劆
劆/\                                      /\         ||               劆
劆||                                      ||         ||               劆
劆||                                      \/         ||               劆
劆naret                                  silom       ||               劆
劆*destination port 80 traffic=========>(cache)      ||               劆
劆/\                                      ||         ||               劆
劆||                                      \/         \/               劆
劆\\===================================kaosarn, RAS, etc.             劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

捠忢偺奜岦偒偺宱楬偵偼梋寁偵 1 hop 偑嫴傑傞偺偱丄僱僢僩儚乕僋偼旕懳徧偵
側偭偰偄傑偡丅

偙偙偵偼 kaosarn 偲僀儞僞乕僱僢僩偺娫偱憲庴怣偝傟傞僷働僢僩傪捛愓偟偰傒
傑偟傚偆丅

web/http 僩儔僼傿僢僋
   
    劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
    劆     kaosarn 偺 http 儕僋僄僗僩仺naret仺silom仺donumuang仺僀儞僞乕僱僢僩  劆
    劆     僀儞僞乕僱僢僩偐傜摓拝偟偨僨乕僞仺donmuang仺kaosarn                  劆
    劆                                                                          劆
    劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
   
web/http 埲奜偺僩儔僼傿僢僋 (telnet 側偳)
   
    劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
    劆     kaosarn 偺奜岦偒僨乕僞仺naret仺donumuang仺僀儞僞乕僱僢僩 劆
    劆     僀儞僞乕僱僢僩偐傜摓拝偟偨僨乕僞仺donmuang仺kaosarn      劆
    劆                                                              劆
    劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
   
劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

15.6. 宱楬偛偲偵 MTU 傪愝掕偟 Path MTU Discovery 栤戣傪夞旔偡傞

僀儞僞乕僱僢僩偱戝検偺僨乕僞傪憲怣偡傞偲偒丄堦斒揑偵戝偒側僷働僢僩傪棙
梡偡傞傎偆偑岠棪傛偔摦嶌偟傑偡丅奺僷働僢僩偼宱楬偺寛掕傪斀塮偟傑偡偑丄
1 儊僈僶僀僩偺僼傽僀儖傪憲怣偡傞応崌丄偱偒傞偩偗戝偒側僷働僢僩傪巊偊偽
栺 700 僷働僢僩偵側傝傑偡偟丄僨僼僅儖僩偺嵟彫僒僀僘傪巊偆偲栺 4000 偵側
傝傑偡丅

1 僷働僢僩偁偨傝偺儁僀儘乕僪偺嵟戝抣偼 1460 僶僀僩偱偡偑丄偙偺抣偼僀儞
僞乕僱僢僩偺偁傜備傞晹暘偱僒億乕僩偝傟偰偄傞傢偗偱偼偁傝傑偣傫丅傛偭偰
愙懕傪嵟揔壔偡傞偵偼丄揔梡偱偒傞嵟戝偺僷働僢僩僒僀僘傪帋峴傪捠偟偰尒偮
偗傞昁梫偑偁傝傑偡丅

偙偺僾儘僙僗偼 'Path MTU Discovery' 偲屇偽傟偰偄傑偡丅 MTU 偼 'Maximum
Transfer Unit' 偺堄枴偱偡丅

儖乕僞偑傂偲傑偲傔偱憲傞偵偼戝偒偡偓傞僷働僢僩傪庴怣偟丄偐偮偦偺僷働僢
僩偱乽僼儔僌儊儞僩晄壜乿價僢僩偑棫偭偰偄傞偲丄儖乕僞偼 ICMP 儊僢僙乕僕
傪憲傝丄偙偺棟桼偱僷働僢僩傪攋婞偣偞傞傪摼側偐偭偨偙偲傪揱偊傑偡丅憲怣
尦偺儂僗僩偼偙偺僸儞僩偵懳墳偟丄傛傝彫偝偄僷働僢僩傪憲傝傑偡丅偙傟傪孞
傝曉偡偙偲偱丄偁傞宱楬傪宱桼偡傞愙懕偵偍偗傞丄嵟揔側僷働僢僩僒僀僘傪敪
尒偱偒傞偺偱偡丅

偙傟偼偆傑偔摦嶌偟偰偄偨偺偱偡偑丄捠怣傪崿棎偝偣傞偙偲偵怱寣傪拲偖僼乕
儕僈儞払偑僀儞僞乕僱僢僩傪敪尒偡傞偲丄忬嫷偑曄傢傝傑偟偨丅娗棟幰払偼丄
僀儞僞乕僱僢僩僒乕價僗偺埨慡惈丒寴楽惈偺岦忋傪峴偆偨傔丄 ICMP 僩儔僼傿
僢僋傪 (娫堘偭偨傗傝曽偱) 僽儘僢僋偟偨傝峣偭偨傝偡傞傛偆偵側偭偰偟傑偭
偨偺偱偡丅

偙傟偵傛偭偰尰嵼偱偼丄Path MTU Discovery 偑惓偟偔摦嶌偡傞忬嫷偼偳傫偳傫
彮側偔側傝丄摿掕偺宱楬偱偼幐攕偡傞傛偆偵側偭偰偟傑偄傑偟偨丅偙偺応崌
TCP/IP 僙僢僔儑儞偑偟偽傜偔偡傞偲棊偪傞側偳丄柇側摦嶌傪偟傑偡丅

徹嫆偼側偄偺偱偡偑丄巹偺宱尡偱偼丄偙偺栤戣偑惗偠偨 2 偮偺僒僀僩偱偼丄偄
偢傟傕偦偺僔僗僥儉偺庤慜偱 Alteon Acedirectors 傪巊偭偰偄傑偟偨丅偙偺尨
場偵偮偄偰偼丄傛傝徻偟偄偳側偨偐偑庤偑偐傝傪梌偊偰偔傟傞偲婜懸偟偰偄傑
偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

15.6.1. 夝寛朄

偙偺傛偆側栤戣偺偁傞僒僀僩偵峴偒摉偨偭偨傜丄庤摦愝掕偱 Path MTU
discovery 傪柍岠偵偟側偗傟偽側傝傑偣傫丅埲壓偼 Koo van den Hout 偺彂偄
偨傕偺偱偡 (彮乆曇廤偟偰偄傑偡):

    栤戣偼偙偺傛偆側傕偺偱偡: 巹偼庁傝偰偄傞 ppp 愙懕偺 mtu/mru 傪 296
    偵偟傑偟偨丅偙偺愙懕偼 33.6k 偟偐側偔丄愙懕愭偺僉儏乕僀儞僌偼憖嶌偱
    偒側偐偭偨偐傜偱偡丅 296 偵偡傞偲丄僉乕傪墴偟偨偲偒偺斀墳偑懨摉側帪
    娫偵廂傑傞傛偆偵側傝傑偟偨丅
   
    傑偨巹偺懁偱偼丄(摉慠) Linux 偺丄儅僗僇儗乕僪儖乕僞偑摦嶌偟偰偄傑偡
    丅
   
    嵟嬤巹偼乽僒乕僶乿偲乽儖乕僞乿傪暿偵偟傑偟偨丅傛偭偰傎偲傫偳偺傾僾
    儕働乕僔儑儞偼丄儖乕僥傿儞僌傪峴偭偰偄傞偺偲偼暿偺儅僔儞偱摦嶌偡傞
    傛偆偵側傝傑偟偨丅
   
    偡傞偲 irc 傊偺儘僌僀儞偵栤戣偑弌傞傛偆偵側傝傑偟偨丅偨偄傊傫偱偡!
    偁傟偙傟挷傋偨偲偙傠丄irc 傊偺愙懕偼偱偒偰偍傝丄'connected' 傕昞帵
    偝傟偰偄傞偲傢偐偭偨偺偱偡偑丄 irc 偐傜偺 motd 傪庴怣偱偒側偄偺偱偡
    丅壗偑偍偐偟偄偐傪僠僃僢僋偟偨偲偙傠丄埲慜偐傜摿掕偺 web 僒僀僩傊偺
    愙懕偵丄 MTU 娭楢偱栤戣偑偁偭偨偙偲傪巚偄弌偟傑偟偨丅偙傟偼 MTU 傪
    296 偵愝掕偟偨偲偒偵弌尰偟偨傕偺偱偟偨丅 irc 僒乕僶偼丄捈愙偺摦嶌偵
    娭學偺側偄僩儔僼傿僢僋偼偡傋偰僽儘僢僋偟偰偄傑偟偨丅 icmp 傕僽儘僢
    僋偺懳徾偱偟偨丅
   
    巹偼 web 僒乕僶偺僆儁儗乕僞偵懳偟偰偼丄偙傟偑栤戣偺尨場偵側傞偺偩偲
    擺摼偝偣傞偙偲偑偱偒傑偟偨偑丄 irc 僒乕僶偺僆儁儗乕僞偼偙偺栤戣傪廋
    惓偟傛偆偲偼偟傑偣傫偱偟偨丅
   
    偦偙偱丄巹偼奜偵弌偰峴偔儅僗僇儗乕僪僩儔僼傿僢僋偵懳偟偰丄傛傝彫偝
    側 mtu 傪梌偊傞傛偆偵偟側偗傟偽側傝傑偣傫偱偟偨丅偨偩偟儘乕僇儖偺僀
    乕僒僱僢僩僩儔僼傿僢僋偱偼丄捠忢偺 mtu 傪巊偄偨偐偭偨偺偱偡 (椺偊偽
    nfs 偺僩儔僼傿僢僋側偳)丅
   
    夝寛朄:
   
    劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
    劆ip route add default via 10.0.0.1 mtu 296                       劆
    劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
   
    (10.0.0.1 偼僨僼僅儖僩僎乕僩僂僃僀偱丄儅僗僇儗乕僪儖乕僞偺撪懁偺傾
    僪儗僗)
   
堦斒偵丄PMTU Discovery 偺愝掕傪摿掕偺宱楬偵懳偟偰曄峏偡傞偙偲偼壜擻偱偡
丅椺偊偽丄偁傞僒僽僱僢僩偱偺傒栤戣偑偁傞偺側傜丄師偺傛偆偵偡傞偲傛偄偱
偡丅

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆ip route add 195.96.96.0/24 via 10.0.0.1 mtu 1000                   劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

15.7. MSS 僋儔儞僾偵傛偭偰 Path MTU Discovery 栤戣傪夞旔偡傞 (ADSL, 働
乕僽儖, PPPoE, PPtP 儐乕僓岦偗)

愭偵愢柧偑偁偭偨傛偆偵丄Path MTU Discovery 偼丄傕偆埲慜偺傛偆偵偼偆傑偔
摦嶌偟傑偣傫丅僱僢僩儚乕僋偺宱楬偺偳偙偐偵丄MTU 偺惂尷 (<1500) 偑偁傞偲
傢偐偭偰偄傞傛偆側応崌偵丄 PMTU Discovery 偑偙傟傪敪尒偟偰偔傟傞偲婜懸
偡傞偙偲偼偱偒傑偣傫丅

MTU 埲奜偵傕丄僷働僢僩偺嵟戝僒僀僘傪愝掕偡傞曽朄偼偁傝傑偡丅偙傟偼
Maximum Segment Size 偲屇偽傟偰偄傑偡丅偙傟偼 SYN 僷働僢僩偺堦晹丄TCP
僆僾僔儑儞偺僼傿乕儖僪偱偡丅

嵟嬤偺 Linux 僇乕僱儖偲丄偄偔偮偐偺 PPPoE 僪儔僀僶 (摿偵 Roaring
Penguin 偺偑慺惏傜偟偄) 偼丄偙偺 MSS 傪乽僋儔儞僾偡傞乿婡擻傪帩偭偰偄傑
偡丅

偙偺曽朄偺挿強偼丄MSS 偺抣傪愝掕偡傞偲丄儕儌乕僩懁偵傕乽偙偺抣傛傝戝偒
側僷働僢僩傪憲傞側乿偲偄偆偙偲傪偼偭偒傝揱偊傜傟傞偙偲偱偡丅偙偺婡峔偺
摦嶌偵偼 ICMP 僩儔僼傿僢僋偼昁梫偁傝傑偣傫丅

堦曽寚揰偼丄偙傟偼柧傜偐偵偦偺応偟偺偓偩偲偄偆偙偲偱偡丅偙偺曽朄偼僷働
僢僩傪廋惓偟偰偍傝丄end-to-end 偺娭學傪曐懚偟傑偣傫丅偙偺揰傪彍偗偽丄偙
偺彫媄偼懡偔偺応崌偱巊偊傑偡偟丄杺朄偺傛偆偵岠偒傑偡丅

偙傟傪峴偆偵偼丄iptables-1.2.1a 埲崀偲 Linux 2.4.3 埲崀偑昁梫偱偡丅婎杮
揑側僐儅儞僪儔僀儞偼師偺捠傝:
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS  --clamp-mss-to-pmtu 劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

偙傟偼愙懕偵懳偡傞揔愗側 MSS 傪寁嶼偟傑偡丅傕偆偪傚偭偲桬婥偑偁傞曽丄偁
傞偄偼帺暘偺抦幆偵妋怣偑偁傞曽偼丄師偺傛偆偵偡傞偙偲傕偱偒傑偡丅

 
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 128劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

偙傟偼愭曽偵搉偡 SYN 僷働僢僩偺 MSS 傪 128 偵偟傑偡丅僷働僢僩偺彫偝側
VoIP 傪巊偭偰偄偰丄 http 偺嫄戝側僷働僢僩偑棃傞偲壒惡捠榖偑搑愗傟偰偟傑
偆傛偆側応崌偵偼丄偙傟傪梡偄傞偲椙偄偱偟傚偆丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

15.8. 媶嬌偺僩儔僼傿僢僋挷惍婍: 掅抶墑, 崅懍傾僢僾儘乕僪/僟僂儞儘乕僪

拲堄: 偙偺僗僋儕僾僩偼嵟嬤傾僢僾僌儗乕僪偝傟傑偟偨丅埲慜偱偼丄僱僢僩儚
乕僋偺 Linux 僋儔僀傾儞僩偵懳偟偰偟偐婡擻偟偰偄傑偣傫偱偟偨! 偱偡偐傜僱
僢僩儚乕僋偵 Windows 儅僔儞傗 Mac 偑偁傝丄偦傟傜偱偺僟僂儞儘乕僪偑懠偺
儅僔儞偺傾僢僾儘乕僪帪偵懍偔側偄偙偲偵偍婥偯偒偱偟偨傜丄峏怴偝傟偨傎偆
偑傛偄偱偟傚偆丅

巹偼惞攖傪嶌傠偆偲帋傒偨偺偱偡:

偁傜備傞応崌偵丄懳榖揑僩儔僼傿僢僋偺抶墑偼彫偝偔曐偮
   
    偮傑傝丄僼傽僀儖偺僟僂儞儘乕僪傗傾僢僾儘乕僪偑丄SSH (偁傞偄偼
    telnet) 偵偼塭嬁偟側偄丄偲偄偆偙偲偱偡丅偙傟偼嵟傕廳梫側揰偱丄偨偲
    偊 200ms 偺抶墑偱傕丄嶌嬈偵偼懴偊偑偨偄傎偳偺抶偝偲側傝傑偡丅
   
傾僢僾儘乕僪丒僟僂儞儘乕僪帪偵傕丄偦傟側傝偺懍搙偱僱僢僩僒乕僼傿儞偟偨
    偄
   
    http 偼乽僶儖僋乿僩儔僼傿僢僋偱偡偑丄懠偺僩儔僼傿僢僋偵傛傞尭懍傪偁
    傑傝崜偔偼偝偣偨偔偁傝傑偣傫丅
   
傾僢僾儘乕僪偑僟僂儞儘乕僪傪楎壔偝偣傞偙偲 (偍傛傃偦偺媡) 偑側偄傛偆偵
    偡傞
   
    忋傝偺僩儔僼傿僢僋偑僟僂儞儘乕僪偺懍搙傪棊偲偟偰偟傑偆偲偄偆偺偼丄
    傛偔傒傜傟傞尰徾偱偡丅
   
幚偼偙傟傜偺偡傋偰偼丄傎傫偺彮乆僶儞僪暆傪媇惖偵偡傟偽壜擻偱偡丅傾僢僾
儘乕僪丒僟僂儞儘乕僪丒ssh 偑偍屳偄傪朩奞偟崌偆偺偼丄働乕僽儖儌僨儉傗
DSL 儌僨儉偺傛偆側庤尦偺傾僋僙僗僨僶僀僗偵丄戝偒側僉儏乕偑偁傞偨傔側偺
偱偡丅

師偺愡偱偼丄壗偑抶墑偺尨場側偺偐丄偳偆偡傟偽偦傟傪廋惓偱偒傞偐傪丄傛傝
徻偟偔愢柧偟傑偡丅傕偟偙偺杺朄偺摦嶌尨棟偵娭怱偑側偗傟偽丄師偼旘偽偟偰
捈愙僗僋儕僾僩偵岦偐偭偰傕栤戣偁傝傑偣傫丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

15.8.1. 側偤僨僼僅儖僩偱偼摦嶌偟側偄偺偐

ISP 偼丄帺暘払偺儀儞僠儅乕僋偑僟僂儞儘乕僪偺懍搙偺傒偵傛偭偰側偝傟傞偙
偲傪抦偭偰偄傑偡丅僶儞僪暆埲奜偵丄僟僂儞儘乕僪偺懍搙偼僷働僢僩儘僗偵傛
偭偰傕戝偒偔塭嬁偝傟傑偡丅僷働僢僩儘僗偼 TCP/IP 偺惈擻傪戝偒偔掅壓偝偣
傞偐傜偱偡丅僉儏乕傪戝偒偔偡傞偲僷働僢僩儘僗傪杊偖偺偵栶棫偪丄僟僂儞儘
乕僪偺懍搙傪戝偒偔偱偒傑偡丅傛偭偰 ISP 偼戝偒側僉儏乕傪巊偆傛偆偵愝掕偟
偰偄傑偡丅

偟偐偟偙偺傛偆側戝偒側僉儏乕偼懳榖惈偵偼奞偲側傝傑偡丅僉乕僗僩儘乕僋偼
傑偢忋傝偺僉儏乕傪捠夁偟側偗傟偽側傜偢丄偙傟偼儕儌乕僩儂僗僩偵撏偔慜偵
悢昩 (!) 傕棷傑傞偙偲偑偁傞偺偱偡丅偦偺屻丄曉怣僷働僢僩偑栠傝丄僗僋儕乕
儞偵昞帵偝傟傞慜偵偼丄偦偺僷働僢僩傕 (ISP 偵偁傞) 壓傝偺僉儏乕傪捠夁偟
側偗傟偽側傜側偄偺偱偡丅

偙偺 HOWTO 偼丄偄傠偄傠側揰偱僉儏乕傪廋惓丒張棟偟側偗傟偽側傜側偄偙偲傪
嫵偊偰偄傑偡丅偟偐偟斶偟偄偙偲偵丄偡傋偰偺僉儏乕偵傾僋僙僗偱偒傞偲偼尷
傝傑偣傫丅 ISP 偵偁傞僉儏乕偼偍偦傜偔傑偭偨偔怗傟傑偣傫丅堦曽丄忋傝偺僉
儏乕偼偍偦傜偔庤尦偺働乕僽儖儌僨儉偐 DSL 僨僶僀僗偺撪晹偵偁傞偱偟傚偆丅
愝掕偱偒傞応崌傕偱偒側偄応崌傕偁傞偱偟傚偆偑丄偨偄偰偄偼僟儊偩偲巚偄傑
偡丅

偱偼偳偆偟傑偟傚偆? 偙傟傜偺僉儏乕偼惂屼偱偒側偄偺偱偡偐傜丄嶦偟偰偟傑
傢側偗傟偽側傝傑偣傫丅僉儏乕偼 Linux 儖乕僞偵堏摦偡傞偺偱偡丅偁傝偑偨偄
偙偲偵丄偙傟偼壜擻偱偡丅

傾僢僾儘乕僪偺懍搙傪惂尷偡傞
   
    傾僢僾儘乕僪偺懍搙傪丄幚嵺偵棙梡偱偒傞抣傛傝傢偢偐偵峣傞偙偲偵傛偭
    偰丄儌僨儉偺僉儏乕偵偼僨乕僞偑棴傑傝傑偣傫丅偙傟偵傛偭偰僉儏乕偼
    Linux 偵堏摦偟傑偡丅
   
僟僂儞儘乕僪偺懍搙傪惂尷偡傞
   
    僀儞僞乕僱僢僩偺僨乕僞揮憲懍搙傪惂屼偡傞偙偲偼晄壜擻側偺偱丄偙偪傜
    偼傗傗媄岻揑偵側傝傑偡丅旕忢偵昿斏偵偔傞僷働僢僩傪攋婞偡傟偽丄 TCP/
    IP 偼尭懍偟偰朷傓懍搙偵側偭偰偔傟傑偡丅晄昁梫偵僩儔僼傿僢僋傪攋婞偡
    傞偙偲偼偟偨偔偁傝傑偣傫偐傜丄乽僶乕僗僩 (burst)乿偺嫋壜僒僀僘偺愝
    掕偼丄戝偒偔偟偰偍偔偲偄偄偱偟傚偆丅
   
偝偰丄偙傟傜傪峴偆偲丄壓傝偺僉儏乕傪姰慡偵 (抁偄僶乕僗僩傪彍偄偰) 柍岠
偵偱偒丄壓傝偺僉儏乕偺娗棟偵傕丄Linux 偺帩偮擻椡傪偡傋偰棙梡偱偒傞傛偆
偵側傝傑偡丅

偁偲峴傢側偗傟偽側傜側偄偙偲偼丄懳榖揑側僩儔僼傿僢僋傪妋幚偵忋傝僉儏乕
偺愭摢偵墴偟弌偡偙偲偱偡丅傑偨傾僢僾儘乕僪偑僟僂儞儘乕僪偺奞偵側傜側偄
傛偆偵丄 ACK 僷働僢僩傕僉儏乕偺愭摢偵弌偟傑偡丅偙傟偼丄椉曽岦偱僶儖僋僩
儔僼傿僢僋傪敪惗偝偣偨偲偒偵捠忢尒傜傟傞丄寖偟偄僗儘乕僟僂儞偺尨場側偺
偱偡丅壓傝僩儔僼傿僢僋偺 ACK (墳摎) 偼捠忢偺忋傝僩儔僼傿僢僋傛傝桪愭偝
偣傞昁梫偑偁傝丄偝傕側偄偲偙偺張棟偼抶墑偝偣傜傟偰偟傑偄傑偡丅

偙傟傜傪偡傋偰愝掕偡傟偽丄僆儔儞僟偺 xs4all 偵偍偗傞 excellent ADSL 愙
懕偱偼丄師偺傛偆側應掕寢壥偑摼傜傟傑偡丅

 
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆婎杮揑側抶墑:                                                       劆
劆round-trip min/avg/max = 14.4/17.1/21.7 ms                          劆
劆                                                                    劆
劆僩儔僼傿僢僋挷惍婍側偟丄僟僂儞儘乕僪拞:                             劆
劆round-trip min/avg/max = 560.9/573.6/586.4 ms                       劆
劆                                                                    劆
劆僩儔僼傿僢僋挷惍婍側偟丄傾僢僾儘乕僪拞:                             劆
劆round-trip min/avg/max = 2041.4/2332.1/2427.6 ms                    劆
劆                                                                    劆
劆僩儔僼傿僢僋挷惍婍偁傝丄220kbit/s 偺傾僢僾儘乕僪拞:                 劆
劆round-trip min/avg/max = 15.7/51.8/79.9 ms                          劆
劆                                                                    劆
劆僩儔僼傿僢僋挷惍婍偁傝丄850kbit/s 偺僟僂儞儘乕僪拞:                 劆
劆round-trip min/avg/max = 20.4/46.9/74.0 ms                          劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
傾僢僾儘乕僪帪偺僟僂儞儘乕僪偼丄嵟崅懍搙偺栺 80% 偵側傝傑偡丅傾僢僾儘乕
僪偼栺 90% 偵側傝傑偡丅偨偩偟抶墑偼 850 ms 偵挼偹忋偑傝丄偙偺尨場偼傑偩
挷嵏拞偱偡丅

偙偺僗僋儕僾僩偐傜摼傜傟傞岠壥偼丄幚嵺偺愙懕懍搙偵戝偒偔埶懚偟傑偡丅嵟
崅懍搙偱傾僢僾儘乕僪偟偰偄傞偲丄僉乕僗僩儘乕僋偺僷働僢僩偺慜偵偼昁偢 1
僷働僢僩偑懚嵼偟傑偡丅偙傟偑払惉偱偒傞抶墑偺壓尷抣偱偡丅MTU 傪忋傝懍搙
偱妱傟偽寁嶼偱偒傑偡丅捠忢偼偙偺抣傛傝偼彮乆戝偒偔側傝傑偡丅傛傝岠壥傪
忋偘偨偗傟偽 MTU 傪彫偝偔偟偰偔偩偝偄!

師偵丄偙偺僗僋儕僾僩偺 2 偮偺斉傪帵偟傑偡丅傂偲偮偼 Devik 偺桪傟偨 HTB
傪巊偭偨傕偺偱丄傕偆傂偲偮偼 Linux 僇乕僱儖偵 (HTB 偲偼堘偄) 嵟弶偐傜擖
偭偰偄傞 CBQ 傪巊偭偨傕偺偱偡丅椉曽偲傕僥僗僩嵪傒偱丄偆傑偔摦嶌偟傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

15.8.2. 幚嵺偺僗僋儕僾僩 (CBQ)

偡傋偰偺僇乕僱儖偱摦嶌偟傑偡丅 CBQ qdisc 偺撪晹偵 2 偮偺妋棪揑晄曃僉儏
乕傪抲偒丄暋悢偺僶儖僋僗僩儕乕儉偑偍屳偄傪姰慡偵嶦偟偰偟傑傢側偄傛偆偵
偟偰偄傑偡丅

壓傝僩儔僼傿僢僋偼僩乕僋儞僶働僣僼傿儖僞傪梡偄偨 tc 僼傿儖僞偱惂尷偟偰
偄傑偡丅

'tc class add .. classid 1:20' 偱巒傑傞峴偵 'bounded' 傪捛壛偡傞偲丄偙
偺僗僋儕僾僩傪夵慞偱偒傞偐傕抦傟傑偣傫丅 MTU 傪彫偝偔偡傞応崌偼丄allot
偲 avpkt 偺悢傕尭傜偡偙偲!

 
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆#!/bin/bash                                                                   劆
劆                                                                              劆
劆# 帺戭偺僀儞僞乕僱僢僩愙懕梡偺媶嬌愝掕                                        劆
劆#                                                                             劆
劆#                                                                             劆
劆# 師偺僷儔儊乕僞傪丄幚嵺偺僟僂儞儘乕僪丒傾僢僾儘乕僪懍搙傛傝                  劆
劆# 彮乆彫偝偔偟偰偔偩偝偄 (僉儘僶僀僩扨埵)                                     劆
劆DOWNLINK=800                                                                  劆
劆UPLINK=220                                                                    劆
劆DEV=ppp0                                                                      劆
劆                                                                              劆
劆# 婛懚偺壓傝丒忋傝偺 qdisc 傪嶍彍丅僄儔乕偼塀偡丅                             劆
劆tc qdisc del dev $DEV root    2> /dev/null > /dev/null                        劆
劆tc qdisc del dev $DEV ingress 2> /dev/null > /dev/null                        劆
劆                                                                              劆
劆###### 忋傝                                                                   劆
劆                                                                              劆
劆# root CBQ 傪僀儞僗僩乕儖                                                     劆
劆                                                                              劆
劆tc qdisc add dev $DEV root handle 1: cbq avpkt 1000 bandwidth 10mbit          劆
劆                                                                              劆
劆# 偁傜備傞暔傪 $UPLINK 懍搙偺撪晹偵廂傔傞 - 偙傟偼 DSL 儌僨儉偺               劆
劆# 嫄戝側僉儏乕傪柍岠偵偟丄抶墑偑弌側偄傛偆偵偟傑偡:                           劆
劆# 儊僀儞僋儔僗                                                                劆
劆                                                                              劆
劆tc class add dev $DEV parent 1: classid 1:1 cbq rate ${UPLINK}kbit \          劆
劆allot 1500 prio 5 bounded isolated                                            劆
劆                                                                              劆
劆# 崅桪愭搙僋儔僗 1:10                                                         劆
劆                                                                              劆
劆tc class add dev $DEV parent 1:1 classid 1:10 cbq rate ${UPLINK}kbit \        劆
劆   allot 1600 prio 1 avpkt 1000                                               劆
劆                                                                              劆
劆# 僶儖僋偍傛傃僨僼僅儖僩偺僋儔僗 1:20丅傗傗僩儔僼傿僢僋偑彮側偔丄             劆
劆# 桪愭搙偑掅偔側傝傑偡                                                        劆
劆                                                                              劆
劆tc class add dev $DEV parent 1:1 classid 1:20 cbq rate $[9*$UPLINK/10]kbit \  劆
劆   allot 1600 prio 2 avpkt 1000                                               劆
劆                                                                              劆
劆# 椉幰偵妋棪揑晄曃僉儏乕傪偁偰偑偄傑偡                                        劆
劆tc qdisc add dev $DEV parent 1:10 handle 10: sfq perturb 10                   劆
劆tc qdisc add dev $DEV parent 1:20 handle 20: sfq perturb 10                   劆
劆                                                                              劆
劆# 偙偙偐傜僼傿儖僞                                                            劆
劆# TOS 偑 Minimum Delay (scp 埲奜偺 ssh) 偺傕偺傪 1:10 傊:                     劆
劆tc filter add dev $DEV parent 1:0 protocol ip prio 10 u32 \                   劆
劆      match ip tos 0x10 0xff  flowid 1:10                                     劆
劆                                                                              劆
劆# ICMP (ip 僾儘僩僐儖 1) 傪懳榖揑僋儔僗 1:10 傊丅                             劆
劆# 應掕偲憡庤傊偺捠抦偑偱偒傞傛偆偵側傝傑偡:                                   劆
劆tc filter add dev $DEV parent 1:0 protocol ip prio 11 u32 \                   劆
劆        match ip protocol 1 0xff flowid 1:10                                  劆
劆                                                                              劆
劆# 傾僢僾儘乕僪帪偺僟僂儞儘乕僪傪崅懍壔偡傞偨傔偵丄ACK 僷働僢僩傪              劆
劆# 懳榖揑僋儔僗傊:                                                             劆
劆                                                                              劆
劆tc filter add dev $DEV parent 1: protocol ip prio 12 u32 \                    劆
劆   match ip protocol 6 0xff \                                                 劆
劆   match u8 0x05 0x0f at 0 \                                                  劆
劆   match u16 0x0000 0xffc0 at 2 \                                             劆
劆   match u8 0x10 0xff at 33 \                                                 劆
劆   flowid 1:10                                                                劆
劆                                                                              劆
劆# 巆傝偼乽旕懳榖揑乿偮傑傝乽僶儖僋乿側偺偱 1:20 傊                            劆
劆                                                                              劆
劆tc filter add dev $DEV parent 1: protocol ip prio 13 u32 \                    劆
劆   match ip dst 0.0.0.0/0 flowid 1:20                                         劆
劆                                                                              劆
劆###### 壓傝                                                                   劆
劆# 僟僂儞儘乕僪傪幚嵺偺懍搙傛傝傕彮乆抶偔偟偰丄ISP 偱偺僉儏乕傪                劆
劆# 柍岠偵偡傞丅挷惍偟偰偱偒傞偩偗戝偒偔偟偰偔偩偝偄丅                          劆
劆# ISP 偼戝偒側僒僀僘偺僟僂儞儘乕僪傪崅懍壔偡傞偨傔偵乽嫄戝乿側                劆
劆# 僉儏乕傪帩偮偙偲偑懡偄                                                      劆
劆#                                                                             劆
劆# 擖岥娔帇惂尷傪捛壛:                                                         劆
劆                                                                              劆
劆tc qdisc add dev $DEV handle ffff: ingress                                    劆
劆                                                                              劆
劆# 乽偡傋偰乿(0.0.0.0/0) 傪偙偪傜傊僼傿儖僞偟丄懍偡偓傞傕偺偼                  劆
劆# 攋婞偡傞:                                                                   劆
劆                                                                              劆
劆tc filter add dev $DEV parent ffff: protocol ip prio 50 u32 match ip src \    劆
劆   0.0.0.0/0 police rate ${DOWNLINK}kbit burst 10k drop flowid :1             劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
偙偺僗僋儕僾僩傪 ppp 偺愙懕帪偵幚峴偟偨偗傟偽丄 /etc/ppp/ip-up.d 偵僐僺
乕偟偰偔偩偝偄丅

嵟屻偺 2 峴偱僄儔乕偵側傞応崌偼丄 tc 僣乕儖傪怴偟偄僶乕僕儑儞偵傾僢僾僨
乕僩偟偰偔偩偝偄!

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

15.8.3. 幚嵺偺僗僋儕僾僩 (HTB)

偙偺僗僋儕僾僩偼慺惏傜偟偄 HTB 僉儏乕傪梡偄丄偡傋偰偺栚揑傪払惉偟偰偄傑
偡丅 HTB 偺復傪尒偰偔偩偝偄丅僇乕僱儖傊偺僷僢僠摉偰嶌嬈偵廫暘尒崌偄傑
偡!
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆#!/bin/bash                                                                   劆
劆                                                                              劆
劆# 帺戭偺僀儞僞乕僱僢僩愙懕梡偺媶嬌愝掕                                        劆
劆#                                                                             劆
劆#                                                                             劆
劆# 師偺僷儔儊乕僞傪丄幚嵺偺僟僂儞儘乕僪丒傾僢僾儘乕僪懍搙傛傝                  劆
劆# 彮乆彫偝偔偟偰偔偩偝偄 (僉儘僶僀僩扨埵)                                     劆
劆DOWNLINK=800                                                                  劆
劆UPLINK=220                                                                    劆
劆DEV=ppp0                                                                      劆
劆                                                                              劆
劆# 婛懚偺壓傝丒忋傝偺 qdisc 傪嶍彍丅僄儔乕偼塀偡丅                             劆
劆tc qdisc del dev $DEV root    2> /dev/null > /dev/null                        劆
劆tc qdisc del dev $DEV ingress 2> /dev/null > /dev/null                        劆
劆                                                                              劆
劆###### 忋傝                                                                   劆
劆                                                                              劆
劆# root HTB 傪僀儞僗僩乕儖偟丄僨僼僅儖僩偺僩儔僼傿僢僋傪 1:20 傊:              劆
劆                                                                              劆
劆tc qdisc add dev $DEV root handle 1: htb default 20                           劆
劆                                                                              劆
劆# 偁傜備傞暔傪 $UPLINK 懍搙偺撪晹偵廂傔傞 - 偙傟偼 DSL 儌僨儉偺               劆
劆# 嫄戝側僉儏乕傪柍岠偵偟丄抶墑偑弌側偄傛偆偵偟傑偡:                           劆
劆                                                                              劆
劆tc class add dev $DEV parent 1: classid 1:1 htb rate ${UPLINK}kbit burst 6k   劆
劆                                                                              劆
劆# 崅桪愭搙僋儔僗 1:10                                                         劆
劆                                                                              劆
劆tc class add dev $DEV parent 1:1 classid 1:10 htb rate ${UPLINK}kbit \        劆
劆   burst 6k prio 1                                                            劆
劆                                                                              劆
劆# 僶儖僋偍傛傃僨僼僅儖僩偺僋儔僗 1:20丅傗傗僩儔僼傿僢僋偑彮側偔丄             劆
劆# 桪愭搙偑掅偔側傝傑偡                                                        劆
劆                                                                              劆
劆tc class add dev $DEV parent 1:1 classid 1:20 htb rate $[9*$UPLINK/10]kbit \  劆
劆   burst 6k prio 2                                                            劆
劆                                                                              劆
劆# 椉幰偵妋棪揑晄曃僉儏乕傪偁偰偑偄傑偡                                        劆
劆tc qdisc add dev $DEV parent 1:10 handle 10: sfq perturb 10                   劆
劆tc qdisc add dev $DEV parent 1:20 handle 20: sfq perturb 10                   劆
劆                                                                              劆
劆# TOS 偑 Minimum Delay (scp 埲奜偺 ssh) 偺傕偺傪 1:10 傊:                     劆
劆tc filter add dev $DEV parent 1:0 protocol ip prio 10 u32 \                   劆
劆      match ip tos 0x10 0xff  flowid 1:10                                     劆
劆                                                                              劆
劆# ICMP (ip 僾儘僩僐儖 1) 傪懳榖揑僋儔僗 1:10 傊丅                             劆
劆# 應掕偲憡庤傊偺捠抦偑偱偒傞傛偆偵側傝傑偡:                                   劆
劆tc filter add dev $DEV parent 1:0 protocol ip prio 10 u32 \                   劆
劆        match ip protocol 1 0xff flowid 1:10                                  劆
劆                                                                              劆
劆# 傾僢僾儘乕僪帪偺僟僂儞儘乕僪傪崅懍壔偡傞偨傔偵丄ACK 僷働僢僩傪              劆
劆# 懳榖揑僋儔僗傊:                                                             劆
劆                                                                              劆
劆tc filter add dev $DEV parent 1: protocol ip prio 10 u32 \                    劆
劆   match ip protocol 6 0xff \                                                 劆
劆   match u8 0x05 0x0f at 0 \                                                  劆
劆   match u16 0x0000 0xffc0 at 2 \                                             劆
劆   match u8 0x10 0xff at 33 \                                                 劆
劆   flowid 1:10                                                                劆
劆                                                                              劆
劆# 巆傝偼乽旕懳榖揑乿偮傑傝乽僶儖僋乿側偺偱 1:20 傊                            劆
劆                                                                              劆
劆                                                                              劆
劆###### 壓傝                                                                   劆
劆# 僟僂儞儘乕僪傪幚嵺偺懍搙傛傝傕彮乆抶偔偟偰丄ISP 偱偺僉儏乕傪                劆
劆# 柍岠偵偡傞丅挷惍偟偰偱偒傞偩偗戝偒偔偟偰偔偩偝偄丅                          劆
劆# ISP 偼戝偒側僒僀僘偺僟僂儞儘乕僪傪崅懍壔偡傞偨傔偵乽嫄戝乿側                劆
劆# 僉儏乕傪帩偮偙偲偑懡偄                                                      劆
劆#                                                                             劆
劆# 擖岥娔帇惂尷傪捛壛:                                                         劆
劆                                                                              劆
劆tc qdisc add dev $DEV handle ffff: ingress                                    劆
劆                                                                              劆
劆# 乽偡傋偰乿(0.0.0.0/0) 傪偙偪傜傊僼傿儖僞偟丄懍偡偓傞傕偺偼                  劆
劆# 攋婞偡傞:                                                                   劆
劆                                                                              劆
劆tc filter add dev $DEV parent ffff: protocol ip prio 50 u32 match ip src \    劆
劆   0.0.0.0/0 police rate ${DOWNLINK}kbit burst 10k drop flowid :1             劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
 

偙偺僗僋儕僾僩傪 ppp 偺愙懕帪偵幚峴偟偨偗傟偽丄 /etc/ppp/ip-up.d 偵僐僺
乕偟偰偔偩偝偄丅

嵟屻偺 2 峴偱僄儔乕偵側傞応崌偼丄 tc 僣乕儖傪怴偟偄僶乕僕儑儞偵傾僢僾僨
乕僩偟偰偔偩偝偄!

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

15.9. 扨堦偺儂僗僩傑偨偼僱僢僩儚乕僋偺懍搙惂尷

偙偺栤戣偼懠偺応強傗巹偨偪偺 man 儁乕僕偱旕忢偵徻嵶偵夝愢偟偰偁傞偺偱偡
偑丄幙栤偑偨偔偝傫婑偣傜傟傑偡偟丄岾偄側偙偲偵僩儔僼傿僢僋惂屼偺姰慡側
棟夝傪昁梫偲偟側偄娙扨側摎偊偑懚嵼偟傑偡丅

偙偺 3 峴偺僗僋儕僾僩偑巇帠傪偟偰偔傟傑偡:

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆# tc qdisc add dev $DEV root handle 1: cbq avpkt 1000 bandwidth 10mbit  劆
劆                                                                        劆
劆# tc class add dev $DEV parent 1: classid 1:1 cbq rate 512kbit \        劆
劆allot 1500 prio 5 bounded isolated                                      劆
劆                                                                        劆
劆# tc filter add dev $DEV parent 1: protocol ip prio 16 u32 \            劆
劆match ip dst 195.96.96.97 flowid 1:1                                    劆
劆                                                                        劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

嵟弶偺峴偼僋儔僗儀乕僗偺僉儏乕傪僀儞僞乕僼僃乕僗偵僀儞僗僩乕儖偟丄偙傟
偑 10mbit 偺僀儞僞乕僼僃乕僗偱偁傞偙偲傪 (寁嶼偺偨傔) 僇乕僱儖偵揱偊偰
偄傑偡丅偙偙傪娫堘偊偰傕幚奞偼偁傝傑偣傫丅偟偐偟惓偟偔愝掕偡傞偲丄慡懱
偑傛傝惓妋偵側傝傑偡丅

擇斣栚偺峴偼 512kbit 偺僋儔僗傪嶌傝丄懨摉側僨僼僅儖僩抣傪梌偊偰偄傑偡丅
徻嵶偼 cbq 偺 man 儁乕僕偲 Chapter 9 傪偛棗偔偩偝偄丅

嵟屻偺峴偼丄偙偺懷堟惂尷僋儔僗偵岦偗傞傋偒僩儔僼傿僢僋傪巜掕偟偰偄傑偡
丅偙偺儖乕儖偵儅僢僠偟側偄僩儔僼傿僢僋偼惂尷偝傟傑偣傫丅傛傝暋嶨側儅僢
僠 (僒僽僱僢僩丄敪怣尦億乕僩丄憲怣愭億乕僩) 傪偝偣偨偄応崌偼丄 Section
9.6.2 傪偛棗偔偩偝偄丅

壗偐傪曄峏偟偰僗僋儕僾僩傪儕儘乕僪偡傞嵺偵偼丄 'tc qdisc del dev $DEV
root' 傪幚峴偟偰尰嵼偺愝掕傪嶍彍偟偰偔偩偝偄丅

偙偺僗僋儕僾僩偺嵟屻偵 'tc qdisc add dev $DEV parent 1:1 sfq perturb
10' 偲偄偆峴傪捛壛偡傞偲丄偝傜偵岠壥揑偱偡丅偙偺峴偑壗傪峴偆偺偐偵偮偄
偰偼丄 Section 9.2.3 傪偛棗偔偩偝偄丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

15.10. QoS 晅偒 nat 偺姰慡側椺

巹偼 Pedro Larroy <piotr%member.fsf.org> 偱偡丅偙偙偱偼偨偔偝傫偺儐乕僓
偑偄傞僾儔僀儀乕僩僱僢僩儚乕僋傪丄僷僽儕僢僋側 ip 傾僪儗僗傪帩偮 Linux
儖乕僞傪捠偟偰僀儞僞乕僱僢僩偵偮側偓丄偙偺 Linux 儖乕僞偵僱僢僩儚乕僋傾
僪儗僗曄姺 (NAT) 傪傗傜偣傞曽朄偵偮偄偰丄傛偔偁傞愝掕椺傪愢柧偟偨偄偲巚
偄傑偡丅偙偙偱偼 QoS 愝掕傪梡偄偰丄戝妛椌偺 198 儐乕僓 (巹傕偦偺堦恖丅
偨偩偟娗棟幰偱偡) 偵僀儞僞乕僱僢僩傾僋僙僗傪採嫙偟傑偡丅儐乕僓偼傒側僺
傾僣乕僺傾僾儘僌儔儉偺僿價乕儐乕僓偱偡偺偱丄揔愗側僩儔僼傿僢僋惂屼偑晄
壜寚偱偡丅偙傟偑嫽枴傪帩偨傟偨 lartc 撉幰偵懳偡傞丄幚梡揑側椺偵側偭偰偄
傞偙偲傪婜懸偟傑偡丅

傑偢愭偵丄弴斣偵抜奒傪捛偭偨幚慔揑側傾僾儘乕僠傪庢傝丄嵟屻偵偦偺張棟傪
僽乕僩帪偵帺摦揑偵峴偆傗傝曽傪愢柧偟傑偡丅偙偺椺偑揔梡偝傟傞僱僢僩儚乕
僋偼丄僷僽儕僢僋 ip 傾僪儗僗傪傂偲偮偩偗帩偮 Linux 儖乕僞傪夘偟偰丄僀儞
僞乕僱僢僩偵偮側偑偭偰偄傞僾儔僀儀乕僩 LAN 偱偡丅偙傟傪暋悢偺僷僽儕僢僋
傾僪儗僗偵奼挘偡傞偙偲偼旕忢偵娙扨偱丄 iptables 偺儖乕儖傪偄偔偮偐捛壛
偡傞偩偗偱偡丅摦嶌娐嫬傪嶌傞偵偼丄埲崀偺傕偺偑昁梫偲側傝傑偡丅

Linux 2.4.18 埲崀偺僇乕僱儖偑僀儞僗僩乕儖偝傟偰偄傞偙偲
   
    2.4.18 傪巊偭偰偄傞応崌偼丄HTB 僷僢僠偑昁梫偱偡丅
   
iproute
   
    tc 偺僶僀僫儕偑 HTB 偵懳墳偟偰偄傞偙偲丅僐儞僷僀儖嵪傒偺僶僀僫儕偑
    HTB 偲堦弿偵攝晍偝傟偰偄傑偡丅
   
iptables
   
劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

15.10.1. 傑偢朢偟偄僶儞僪暆傪嵟揔壔偟傑偟傚偆

傑偢偄偔偮偐 qdisc 傪愝掕偟偰丄僩儔僼傿僢僋傪僋儔僗慖暿偟傑偡丅 htb
qdisc 傪嶌傝丄徃弴偺桪愭搙傪帩偮 6 偮偺僋儔僗傪晅懏偝偣傑偡丅師偵丄昁偢
妱傝摉偰傜傟偨懍搙傪巊偊丄懠偺僋儔僗偑晄梫偲偟偰偄傞僶儞僪暆傕巊偊傞僋
儔僗傪嶌傝傑偡丅桪愭搙傪崅偔 (偮傑傝 prio 斣崋傪彫偝偔) 偟偨僋儔僗偼丄
梋偭偨僶儞僪暆傪愭偵棙梡偱偒傑偡丅巹偨偪偺愙懕偼壓傝 2Mb 忋傝 300kbit/s
偺 ADSL 偱偡丅巹偼 240kbit/s 傪忋尷懍搙偲偟傑偟偨丅偙傟埲忋偵偡傞偲丄偍
偦傜偔愙懕偺偳偙偐偺僶僢僼傽偑岠偔偨傔偱偟傚偆偑丄抶墑偑戝偒偔側傝巒傔
傞偐傜偱偡丅偙偺僷儔儊乕僞偼幚尡揑偵應掕偟偰丄嬤偔偺儂僗僩偵懳偡傞抶墑
傪尒側偑傜憹尭偟偰偔偩偝偄丅

CEIL 傪忋傝僶儞僪暆忋尷抣偺 75% 偵挷惍偟偰偔偩偝偄丅 eth0 偵側偭偰偄傞
偲偙傠偼丄僀儞僞乕僱僢僩偺傾僋僙僗偵巊偭偰偄傞僷僽儕僢僋側僀儞僞乕僼僃
乕僗偵曄峏偟偰偔偩偝偄丅傑偢庤巒傔偵丄埲崀傪 root 偺僔僃儖偱幚峴偟傑偡
丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆CEIL=240                                                                              劆
劆tc qdisc add dev eth0 root handle 1: htb default 15                                   劆
劆tc class add dev eth0 parent 1: classid 1:1 htb rate ${CEIL}kbit ceil ${CEIL}kbit     劆
劆tc class add dev eth0 parent 1:1 classid 1:10 htb rate 80kbit ceil 80kbit prio 0      劆
劆tc class add dev eth0 parent 1:1 classid 1:11 htb rate 80kbit ceil ${CEIL}kbit prio 1 劆
劆tc class add dev eth0 parent 1:1 classid 1:12 htb rate 20kbit ceil ${CEIL}kbit prio 2 劆
劆tc class add dev eth0 parent 1:1 classid 1:13 htb rate 20kbit ceil ${CEIL}kbit prio 2 劆
劆tc class add dev eth0 parent 1:1 classid 1:14 htb rate 10kbit ceil ${CEIL}kbit prio 3 劆
劆tc class add dev eth0 parent 1:1 classid 1:15 htb rate 30kbit ceil ${CEIL}kbit prio 3 劆
劆tc qdisc add dev eth0 parent 1:12 handle 120: sfq perturb 10                          劆
劆tc qdisc add dev eth0 parent 1:13 handle 130: sfq perturb 10                          劆
劆tc qdisc add dev eth0 parent 1:14 handle 140: sfq perturb 10                          劆
劆tc qdisc add dev eth0 parent 1:15 handle 150: sfq perturb 10                          劆
劆                                                                                      劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
偙偙偱偼傑偢丄怺偝偑 1 儗儀儖偺 htb 僣儕乕傪嶌傝傑偟偨丅師偺傛偆側姶偠
偱偡丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆+---------+                                                         劆
劆| root 1: |                                                         劆
劆+---------+                                                         劆
劆     |                                                              劆
劆+---------------------------------------+                           劆
劆| class 1:1                             |                           劆
劆+---------------------------------------+                           劆
劆  |      |      |      |      |      |                              劆
劆+----+ +----+ +----+ +----+ +----+ +----+                           劆
劆|1:10| |1:11| |1:12| |1:13| |1:14| |1:15|                           劆
劆+----+ +----+ +----+ +----+ +----+ +----+                           劆
劆                                                                    劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

classid 1:10 htb rate 80kbit ceil 80kbit prio 0
   
    偙傟偑桪愭搙偑嵟崅偺僋儔僗偱偡丅偙偺僋儔僗偺僷働僢僩偼丄抶墑偑嵟傕
    彫偝偔丄梋偭偨僶儞僪暆傪嵟弶偵妱傝摉偰傜傟傑偡丅傛偭偰偙偺僋儔僗偺
    ceil 偼梷偊栚偵愝掕偟偰偍偔偺偑椙偄偱偟傚偆丅懳榖揑僩儔僼傿僢僋偺傛
    偆偵丄抶墑偑彫偝偄偙偲偵傛傞棙塿偑戝偒偄僷働僢僩偼丄偙偺僋儔僗傪巊
    偭偰憲傝傑偡丅嬶懱揑偵偼 ssh, telnet, dns, quake3, irc, SYN 僼儔僌
    偺棫偭偨僷働僢僩偱偡丅
   
classid 1:11 htb rate 80kbit ceil ${CEIL}kbit prio 1
   
    偙傟偑僶儖僋僩儔僼傿僢僋傪偁偰偑偆嵟弶偺僋儔僗偱偡丅偙偺椺偱偼丄儘
    乕僇儖偺 web 僒乕僶偐傜敪偡傞僩儔僼傿僢僋 (敪怣尦億乕僩偑 80) 偲丄
    web 儁乕僕偺儕僋僄僗僩 (憲怣愭億乕僩偑 80) 偱偡丅
   
classid 1:12 htb rate 20kbit ceil ${CEIL}kbit prio 2
   
    偙偺僋儔僗偵偼丄TOS 僼傿乕儖僪偱 Maximize-Throughput 價僢僩偑棫偭偰
    偄傞僩儔僼傿僢僋偲丄儖乕僞偺乽儘乕僇儖僾儘僙僗乿偐傜僀儞僞乕僱僢僩
    偵岦偗偰敪偡傞僩儔僼傿僢僋傪偍偒傑偡丅傛偭偰埲崀偺僋儔僗偼丄偙偺儅
    僔儞傪乽宱桼偡傞乿僩儔僼傿僢僋偩偗偵側傝傑偡丅
   
classid 1:13 htb rate 20kbit ceil ${CEIL}kbit prio 2
   
    偙偺僋儔僗偼丄懠偺 NAT 偝傟傞儅僔儞偱丄崅偄桪愭搙傪昁梫偲偡傞僶儖僋
    僩儔僼傿僢僋偺偨傔偺傕偺偱偡丅
   
classid 1:14 htb rate 10kbit ceil ${CEIL}kbit prio 3
   
    偙偙偵偼儊乕儖娭楢偺僩儔僼傿僢僋 (SMTP, pop3 側偳) 偲丄 TOS 僼傿乕
    儖僪偺 Minimize-Cost 價僢僩偑棫偭偨僷働僢僩傪擖傟傑偡丅
   
classid 1:15 htb rate 30kbit ceil ${CEIL}kbit prio 3
   
    嵟屻偵丄偙偙偵偼儖乕僞偺攚屻偵抲偐傟偨丄NAT 偝傟偨儅僔儞偐傜偺僩儔
    僼傿僢僋傪擖傟傑偡丅 kazaa, edonkey 側偳偼偙偙偵擖傟丄懠偺僒乕價僗
    偲姳徛偟側偄傛偆偵偟傑偡丅
   
劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

15.10.2. 僷働僢僩偺僋儔僗慖暿

qdisc 愝掕偼峴偄傑偟偨偑丄僷働僢僩偺僋儔僗慖暿偼傑偩偱偡丅偱偡偺偱尰嵼
偼丄憲怣偝傟傞僷働僢僩偼偡傋偰 1:15 偵擖傝傑偡 (側偤側傜 tc qdisc add
dev eth0 root handle 1: htb default 15 傪梡偄偨偐傜)丅偙偙偱丄偳偺僷働
僢僩偑偳偙偵峴偔偺偐傪揱偊傞昁梫偑偁傝傑偡丅偙偙偑嵟傕廳梫側晹暘偱偡丅

偱偼僼傿儖僞傪愝掕偟丄僷働僢僩傪 iptables 偱僋儔僗慖暿偱偒傞傛偆偵偟傑
偡丅巹偼偙偺嶌嬈偵偼丄傑偢傎偲傫偳偺応崌 iptables 傪梡偄傑偡丅 iptables
偼廮擃偱偡偟丄奺儖乕儖偱偺僷働僢僩偺寁悢傕偱偒傞偐傜偱偡丅傑偨 RETURN
僞乕僎僢僩傪梡偄傟偽丄僷働僢僩偵偡傋偰偺儖乕儖傪揔梡偟側偔偰嵪傒傑偡丅
師偺僐儅儞僪傪幚峴偟傑偡丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆tc filter add dev eth0 parent 1:0 protocol ip prio 1 handle 1 fw classid 1:10 劆
劆tc filter add dev eth0 parent 1:0 protocol ip prio 2 handle 2 fw classid 1:11 劆
劆tc filter add dev eth0 parent 1:0 protocol ip prio 3 handle 3 fw classid 1:12 劆
劆tc filter add dev eth0 parent 1:0 protocol ip prio 4 handle 4 fw classid 1:13 劆
劆tc filter add dev eth0 parent 1:0 protocol ip prio 5 handle 5 fw classid 1:14 劆
劆tc filter add dev eth0 parent 1:0 protocol ip prio 6 handle 6 fw classid 1:15 劆
劆                                                                              劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
偙偙偱偼扨偵丄摿掕偺 FWMARK 抣 (handle x fw) 傪帩偭偨奺僷働僢僩傪懳墳偡
傞僋儔僗 (classid x:x) 偵憲傞傛偆僇乕僱儖偵揱偊偨偩偗偱偡丅師偼丄僷働僢
僩傊偺儅乕僋晅偗傪 iptables 傪巊偭偰峴偆曽朄偱偡丅

傑偢丄僷働僢僩偑 iptables 偺僼傿儖僞傪偳偺傛偆偵捠傞偺偐傪棟夝偟側偗傟
偽側傝傑偣傫丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆        +------------+                +---------+               +-------------+           劆
劆Packet -| PREROUTING |--- routing-----| FORWARD |-------+-------| POSTROUTING |- Packets  劆
劆input   +------------+    decision    +---------+       |       +-------------+    out    劆
劆                             |                          |                                 劆
劆                        +-------+                    +--------+                           劆
劆                        | INPUT |---- Local process -| OUTPUT |                           劆
劆                        +-------+                    +--------+                           劆
劆                                                                                          劆
劆                                                                                          劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
偡傋偰偺僥乕僽儖偑懚嵼偟丄僨僼僅儖僩偺億儕僔乕偑 ACCEPT (-P ACCEPT) 偵
側偭偰偄傞偲偟傑偡丅傑偩 iptables 偵怗偭偨偙偲偑側偗傟偽丄僨僼僅儖僩偱
ok 偺偼偢偱偡丅巹偨偪偺僾儔僀儀乕僩僱僢僩儚乕僋偼僋儔僗 B 偺傾僪儗僗
172.17.0.0/16 傪帩偪丄僷僽儕僢僋 ip 偼 212.170.21.172 偱偡丅

師偵僇乕僱儖偵幚嵺偵 NAT 傪峴偆傛偆巜帵偟丄僾儔僀儀乕僩僱僢僩儚乕僋偺僋
儔僀傾儞僩偑奜晹偲捠怣傪奐巒偱偒傞傛偆偵偟傑偡丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆echo 1 > /proc/sys/net/ipv4/ip_forward                                                              劆
劆iptables -t nat -A POSTROUTING -s 172.17.0.0/255.255.0.0 -o eth0 -j SNAT --to-source 212.170.21.172 劆
劆                                                                                                    劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
偙偙偱僷働僢僩偑 1:15 宱桼偱棳傟偰偄傞偙偲傪妋擣偟傑偟傚偆:
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆tc -s class show dev eth0                                           劆
劆                                                                    劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

僷働僢僩傊偺報晅偗傪奐巒偡傞偵偼丄mangle 僥乕僽儖偺 PREROUTING 僠僃僀儞
偵儖乕儖傪捛壛偟傑偡丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆iptables -t mangle -A PREROUTING -p icmp -j MARK --set-mark 0x1     劆
劆iptables -t mangle -A PREROUTING -p icmp -j RETURN                  劆
劆                                                                    劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
偙傟偱僾儔僀儀乕僩僱僢僩儚乕僋偐傜僀儞僞乕僱僢僩偺偳偙偐偵 ping 傪峴偆
偲丄 1:10 偺僷働僢僩悢偑憹壛偡傞偺偑傢偐傞偼偢偱偡丅尒偰傒傑偟傚偆:
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆tc -s class show dev eth0                                           劆
劆                                                                    劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
偙偙偱偼 -j RETURN 傪峴偭偰丄僷働僢僩偑懠偺儖乕儖偵偼峴偐側偄傛偆偵偟傑
偟偨丅 icmp 僷働僢僩偼 RETURN 埲崀偺儖乕儖偺儅僢僠摦嶌偺懳徾偵偼側傝傑
偣傫丅妎偊偰偍偄偰偔偩偝偄丅偱偼揔愗偵 TOS 傪張棟偡傞傛偆丄懠偵傕儖乕儖
傪捛壛偟傑偟傚偆丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆iptables -t mangle -A PREROUTING -m tos --tos Minimize-Delay -j MARK --set-mark 0x1       劆
劆iptables -t mangle -A PREROUTING -m tos --tos Minimize-Delay -j RETURN                    劆
劆iptables -t mangle -A PREROUTING -m tos --tos Minimize-Cost -j MARK --set-mark 0x5        劆
劆iptables -t mangle -A PREROUTING -m tos --tos Minimize-Cost -j RETURN                     劆
劆iptables -t mangle -A PREROUTING -m tos --tos Maximize-Throughput -j MARK --set-mark 0x6  劆
劆iptables -t mangle -A PREROUTING -m tos --tos Maximize-Throughput -j RETURN               劆
劆                                                                                          劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
偱偼 ssh 僷働僢僩傪桪愭晅偗偟傑偡:
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆iptables -t mangle -A PREROUTING -p tcp -m tcp --sport 22 -j MARK --set-mark 0x1  劆
劆iptables -t mangle -A PREROUTING -p tcp -m tcp --sport 22 -j RETURN               劆
劆                                                                                  劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
tcp 愙懕傪奐巒偡傞僷働僢僩丄偮傑傝 SYN 僼儔僌偺棫偭偨僷働僢僩偼丄桪愭偟
傑偟傚偆丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆iptables -t mangle -I PREROUTING -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j MARK --set-mark 0x1 劆
劆iptables -t mangle -I PREROUTING -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j RETURN              劆
劆                                                                                                  劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
側偳側偳丅mangle 偺 PREROUTING 傊偺儖乕儖捛壛偑廔傢偭偨傜丄師偺僐儅儞僪
偱 PREROUTING 僥乕僽儖傪掲傔偔偔傝傑偟傚偆丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆iptables -t mangle -A PREROUTING -j MARK --set-mark 0x6             劆
劆                                                                    劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
偙傟偱丄偙偙傑偱報晅偗偝傟側偐偭偨僩儔僼傿僢僋偼 1:15 偵岦偐偄傑偡丅幚
偼僨僼僅儖僩偺僋儔僗偼 1:15 側偺偱丄偙偺嵟廔僗僥僢僾偼晄昁梫偱偡丅偱偡
偑愝掕慡懱偺惍崌惈傪曐偮偨傔丄傑偨偙偺儖乕儖偺僇僂儞僞傪尒傞偨傔偵丄偙
偙偱偼報晅偗傪峴偭偰偄傑偡丅

摨條偺嶌嬈傪 OUTPUT 儖乕儖偵懳偟偰傕峴偆偲偄偄偱偟傚偆丅傛偭偰偙傟傜偺
僐儅儞僪傪丄-A PREROUTING 偺戙傢傝偵 -A OUTPUT 偲偍偄偰孞傝曉偟傑偡 (s/
PREROUTING/OUTPUT/)丅偙偆偡傞偲儘乕僇儖 (偙偺 Linux 儖乕僞) 偱惗惉偝傟
偨僩儔僼傿僢僋傕僋儔僗慖暿偱偒傑偡丅 OUTPUT 僠僃僀儞偺嵟屻偼丄-j MARK
--set-mark 0x3 偱掲傔偔偔傝丄儘乕僇儖偺僩儔僼傿僢僋偵偼崅傔偺桪愭搙傪梌
偊傞傛偆偵偟傑偟偨丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

15.10.3. 偙偺愝掕傪夵慞偡傞

偙傟偱偙偺愝掕偼偡傋偰摦嶌偡傞傛偆偵側傝傑偟偨丅僌儔僼傪尒偰丄僶儞僪暆
偑偳偺傛偆偵巊傢傟偰偄傞偐丄偦傟傪偳偺傛偆偵偟偨偄偐峫偊傑偟傚偆丅偙傟
偵偼挿偄帪娫傪偐偗傑偟傚偆丅巹偺応崌偼嵟廔揑偵丄偙偺僀儞僞乕僱僢僩愙懕
傪旕忢偵偆傑偔摦嶌偝偣傜傟傞傛偆偵側傝傑偟偨丅偙傟傪峴傢側偗傟偽丄忢偵
僞僀儉傾僂僩偵擸傑偝傟偨傝丄怴偟偔惗惉偝傟傞 tcp 愙懕偵傑偭偨偔僶儞僪暆
偺攝暘偑側偝傟側偐偭偨傝丄偲偄偆忬懺偩偭偨偱偟傚偆丅

摿掕偺僋儔僗偑丄傎偲傫偳偺娫堦攖偵側偭偰偄傞傛偆側忬嫷偱偟偨傜丄懠偺僉
儏乕僀儞僌婯懃傪偦偙偵偁偰偑偭偰丄僶儞僪暆偺嫟桳傪傛傝岞暯偵偟偰偁偘傞
偲偄偄偱偟傚偆丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆tc qdisc add dev eth0 parent 1:13 handle 130: sfq perturb 10        劆
劆tc qdisc add dev eth0 parent 1:14 handle 140: sfq perturb 10        劆
劆tc qdisc add dev eth0 parent 1:15 handle 150: sfq perturb 10        劆
劆                                                                    劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

15.10.4. 偙偺偡傋偰傪僽乕僩帪偵婲摦偡傞

摉慠偱偡偑丄偄傠偄傠側曽朄偑偁傝傑偡丅巹偺応崌偼 [start | stop |
stop-tables | start-tables | reload-tables] 偲偄偭偨僆僾僔儑儞傪庴偗晅
偗傞 /etc/init.d/packetfilter 偲偄偆僗僋儕僾僩傪彂偒丄qdisc 傪愝掕偟丄
昁梫側僇乕僱儖儌僕儏乕儖傪儘乕僪偟丄僨乕儌儞偺傛偆偵摦嶌偡傞傛偆偵偟傑
偟偨丅偙偺僗僋儕僾僩偼摨帪偵丄/etc/network/iptables-rules 偐傜 iptables
偺儖乕儖傕儘乕僪偟傑偡丅偙偺僼傽僀儖偺撪梕偼 iptables-save 偱曐懚丄
iptables-restore 偱暅尦偱偒傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

Chapter 16. 僽儕僢僕偲丄戙棟 ARP 傪梡偄偨媅帡僽儕僢僕偺峔抸

僽儕僢僕偼愝掕傪曄峏偣偢偵僱僢僩儚乕僋傊憓擖偱偒傞僨僶僀僗偱偡丅僱僢僩
儚乕僋僗僀僢僠偼丄婎杮揑偵偼懡億乕僩偺僽儕僢僕偱偡丅僽儕僢僕偼偦偆偄偆
堄枴偱偼 2 億乕僩偺僗僀僢僠偱偡丅偟偐偟 Linux 偱偼暋悢偺僀儞僞乕僼僃乕
僗傪梡偄偨僽儕僢僕傪僒億乕僩偟偰偍傝丄傎傫偲偆偺堄枴偱偺僗僀僢僠偵偱偒
傑偡丅

僽儕僢僕偼丄夡傟偨僱僢僩儚乕僋傪丄懠偵偼堦愗曄峏傪梌偊偢偵捈偟偨偄傛偆
側忬嫷偱丄傛偔梡偄傜傟傑偡丅僽儕僢僕偼儗僀儎 2 偺僨僶僀僗偱偡偐傜 IP 傛
傝堦憌壓偱丄儖乕僞傗僒乕價僗偼偦偺懚嵼偵婥偯偒傑偣傫丅偮傑傝摟夁揑偵摿
掕偺僷働僢僩傪僽儘僢僋丒廋惓偟偨傝丄峣偭偨傝偱偒傞偺偱偡丅

傕偆傂偲偮偺棙揰丄僽儕僢僕偼 (傕偟夡傟偨応崌偵偼) 僋儘僗働乕僽儖傗僴僽
偵抲偒姺偊壜擻偱偡丅

埆偄抦傜偣偱偡偑丄僽儕僢僕偼旕忢偵椙偔暥彂壔偝傟偰偄傞偵傕娭傢傜偢丄戝
偒側崿棎傪堷偒婲偙偡偙偲偑偁傝傑偡丅僽儕僢僕偼 traceroute 偵尰傟傑偣傫
偑丄側偤偐僷働僢僩偑 A 抧揰偐傜 B 抧揰傑偱偺娫偱徚偊偨傝曄壔偟偨傝偡傞
偺偱偡 (乽偙偺僱僢僩儚乕僋偼庺傢傟偰偄傞!乿)丅傑偨丄乽壗傕曄偊偨偔側偄
乿偲偄偆慻怐偑惓偟偄偙偲傪偟偰偄傞偐偳偆偐偵傕丄媍榑偺梋抧偑偁傞偐傕偟
傟傑偣傫丅

Linux 2.4/2.5 偺僽儕僢僕偼丄偙偺儁乕僕 < http://bridge.sourceforge.net
/> 偱愢柧偝傟偰偄傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

16.1. 僽儕僢僕偲 iptables 偺忬嫷

Linux 2.4.20 偱偼丄僽儕僢僕偲 iptables 偼壗傕偟側偄偲偍屳偄傪乽尒傞乿偙
偲偑偱偒傑偣傫丅僽儕僢僕偺僷働僢僩偑 eth0 偐傜 eth1 偵岦偐偆偲偒丄偦偺
僷働僢僩偼 iptables 傪宱桼偟側偄偺偱偡丅偮傑傝僼傿儖僞儕儞僌丄NAT丄廋惓
(mangling) 側偳偼峴偊傑偣傫丅 Linux 2.5.45 埲崀偱偼丄偙偺揰偼廋惓偝傟偰
偄傑偡丅

偁傞偄偼傑偨暿偺僾儘僕僃僋僩偱偁傞 'ebtables' 偑徯夘偝傟偰偄傞偺傪尒偐
偗偨恖傕偄傞偐傕偟傟傑偣傫丅偙傟偼 MACNAT 偲偐乽僽儖乕僥傿儞僌乿側偳偺
峳嬈偑偱偒傑偡丅旕忢偵偍偦傠偟偄傕偺偱偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

16.2. 僽儕僢僕偲懷堟惂尷

偙傟偼愰揱偳偍傝偵摦嶌偟傑偡丅奺僀儞僞乕僼僃乕僗偑偦傟偧傟偳偪傜懁偵偮
偄偰偄傞偐傪妋擣偟偰偍偄偰偔偩偝偄丅偝傕側偄偲奜岦偒偺僩儔僼傿僢僋傪撪
懁偺僀儞僞乕僼僃乕僗偱峣傝偐偹傑偣傫丅偙傟偼摦嶌偟傑偣傫丅昁梫偵墳偠偰
tcpdump 傪巊偄傑偟傚偆丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

16.3. 戙棟 ARP 傪梡偄偨媅帡僽儕僢僕

扨偵媅帡僽儕僢僕傪幚憰偟偨偄偩偗偱偟偨傜丄悢愡旘偽偟偰乽幚憰偡傞乿傑偱
恑傫偱偔偩偝偄丅偟偐偟幚嵺偺摦嶌偵娭偟偰彮乆撉傫偱偍偔偺偼丄尗偄偙偲偩
偲巚偄傑偡丅

媅帡僽儕僢僕偼彮乆堘偭偨摦嶌傪偟傑偡丅僽儕僢僕偱偼丄僨僼僅儖僩偩偲僷働
僢僩偼曄峏偝傟偢偵丄偁傞僀儞僞乕僼僃乕僗偐傜暿偺僀儞僞乕僼僃乕僗傊偲搉
傝傑偡丅僽儕僢僕偑尒傞偺偼僷働僢僩偺僴乕僪僂僃傾傾僪儗僗偩偗偱丄偦傟偱
峴偒愭傪寛傔傑偡丅偙傟偼偮傑傝丄Linux 偑棟夝偱偒側偄僩儔僼傿僢僋偱偁偭
偰傕丄僴乕僪僂僃傾傾僪儗僗傪帩偭偰偄偝偊偡傟偽僽儕僢僕偱偒傞傢偗偱偡丅

乽媅帡僽儕僢僕乿偼堎側傞摦嶌傪偟丄僽儕僢僕偲偄偆傛傝偼尒偊側偄儖乕僞偵
嬤偄偺偱偡偑丄偟偐偟僽儕僢僕偲摨條丄僱僢僩儚乕僋偺愝寁偵偼傎偲傫偳塭嬁
傪梌偊傑偣傫丅

幚嵺偵偼僽儕僢僕偱偼側偄丄偲偄偆偙偲偺棙揰偼丄僷働僢僩偑幚嵺偵僇乕僱儖
傪捠傝丄偟偨偑偭偰僼傿儖僞丒廋惓丒儕僟僀儗僋僩丒宱楬曄峏側偳偑偱偒傞丄
偲偄偆偲偙傠偵偁傝傑偡丅

幚嵺偺僽儕僢僕偵傕偙傟傜偺婡擻傪帩偨偣傞偙偲偼偱偒傑偡偑丄僀乕僒僱僢僩
僼儗乕儉僟僀僶乕僞偺傛偆側摿庩側僐乕僪偑昁梫偩偭偨傝丄偁傞偄偼慜弎偟偨
傛偆側僷僢僠偑昁梫偱偡丅

媅帡僽儕僢僕偺傕偆傂偲偮偺棙揰偼丄棟夝偟側偄僷働僢僩偼捠偝側偄偙偲偱偡
丅傛偭偰墭暔傑傒傟偺僱僢僩儚乕僋傪憒彍偱偒傞偺偱偡丅偙偺傛偆側墭暔 (SAP
僷働僢僩偲偐 Netbeui 偲偐) 偑昁梫側応崌偼丄杮暔偺僽儕僢僕傪巊偭偰偔偩偝
偄丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

16.3.1. ARP 偲戙棟 ARP

偁傞儂僗僩偑丄摨偠暔棟僱僢僩儚乕僋僙僌儊儞僩偵懚嵼偡傞暿偺儂僗僩偲捠怣
偟偨偔側傞偲丄偦偺儂僗僩偼傾僪儗僗夝寛僾儘僩僐儖偺僷働僢僩傪憲傝傑偡丅
偙傟偼娙扨偵偄偆偲丄乽扤偑 10.0.0.1 傪帩偭偰傞偐 10.0.0.7 偵嫵偊偰偔傟
乿偲偄偆傛偆側傕偺偱偡丅偙傟偵懳偡傞斀墳偲偟偰丄10.0.0.1 偼乽偙偙偩傛乿
偲偄偆抁偄僷働僢僩傪曉偟傑偡丅

偡傞偲 10.0.0.7 偼丄乽偙偙偩傛乿僷働僢僩偑帵偡僴乕僪僂僃傾傾僪儗僗傊偲
僷働僢僩傪憲傝傑偡丅傑偨偙偺僴乕僪僂僃傾傾僪儗僗偼斾妑揑挿偄娫僉儍僢僔
儏偝傟丄僉儍僢僔儏偺婜尷偑愗傟傞偲丄嵞傃幙栤偑敪偣傜傟傑偡丅

媅帡僽儕僢僕傪嶌傞偲偒偼丄僽儕僢僕偵懳偟偰偙偺傛偆側 ARP 僷働僢僩偵曉怣
偡傞傛偆柦偠傞偺偱偡丅傛偭偰僱僢僩儚乕僋偺儂僗僩偼丄偦偺屻偺僷働僢僩傪
偙偺僽儕僢僕偵懳偟偰憲怣偟傑偡丅偡傞偲僽儕僢僕偼偙傟傜偺僷働僢僩傪張棟
偟丄揔愗側僀儞僞乕僼僃乕僗傊偲憲傞偺偱偡丅

偮傑傝丄娙扨偵偄偊偽丄僽儕僢僕偺堦曽偵偁傞儂僗僩偑丄媡懁偵偁傞儂僗僩偺
僴乕僪僂僃傾傾僪儗僗傪恞偹傞偲丄僽儕僢僕偑乽壌偵搉偣乿偲偄偆僷働僢僩偱
摎偊傞偺偱偡丅

偙偺傛偆偵偟偰丄偡傋偰偺僨乕僞僩儔僼傿僢僋偼惓偟偄応強偵攝払偝傟丄忢偵
僽儕僢僕傪宱桼偡傞偺偱偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

16.3.2. 幚憰偡傞

埲慜偁傑傝忬嫷偺椙偔側偐偭偨崰偼丄Linux 僇乕僱儖偵乽戙棟 ARP乿偺摦嶌傪
偡傞傛偆柦椷偱偒傞偺偼丄偁傞僒僽僱僢僩偵懳偟偰偩偗偱偟偨丅傛偭偰媅帡僽
儕僢僕傪愝掕偡傞偵偼丄僽儕僢僕偺椉懁偵椉曽傊偺惓偟偄宱楬傪巜掕偟偰丄戙
棟 ARP 偺儅僢僠儞僌儖乕儖傪嶌傞昁梫偑偁傝傑偟偨丅偙傟偵偼戝検偺擖椡偑昁
梫偱丄傑偨娫堘偄傕婲偙傝傗偡偔丄僽儕僢僕偑宱楬傪抦傜側偄僱僢僩儚乕僋傊
偺 ARP 梫媮偵墳摎偡傞偙偲傕婲偙傝偑偪偱偟偨丅

Linux 2.4/2.5 (偍偦傜偔偼 2.2 傕) 偱偼丄偙偺婡擻偼側偔側傝丄 /proc 僨傿
儗僋僩儕偺 'proxy_arp' 偲偄偆僼儔僌偑庢偭偰戙傢傝傑偟偨丅傛偭偰媅帡僽儕
僢僕傪峔抸偡傞庤懕偒偼師偺傛偆偵側傝傑偡:

 

 1. 椉懁偺僀儞僞乕僼僃乕僗 (偙偙偱偼 'left' 偲 'right' 偲偟傑偡) 偵 IP
    傾僪儗僗傪妱傝摉偰傞
   
 2. 宱楬傪嶌傝丄left 懁偵偳偺儂僗僩偑偁傝丄 right 懁偵偳偺儂僗僩偑偁傞
    偺偐丄傢偐傞傛偆偵偡傞丅
   
 3. echo 1 > /proc/sys/net/ipv4/conf/ethL/proxy_arp, echo 1 > /proc/sys
    /net/ipv4/conf/ethR/proxy_arp, 偵傛偭偰椉僀儞僞乕僼僃乕僗偺戙棟 ARP
    傪桳岠偵偡傞丅偨偩偟 L 偲 R 偼 left 懁丄right 懁奺僀儞僞乕僼僃乕僗
    偺斣崋
   
 

傑偨丄ip_forwarding 僼儔僌傪 ON 偵偡傞偺傕朰傟側偄傛偆偵! 杮暔偺僽儕僢
僕偵偼偙偺僼儔僌偼昁梫側偄偨傔丄堏峴偟偰偒偨偲偒偵偼偙偺僼儔僌偼 OFF 偵
側偭偰偄傞偐傕偟傟傑偣傫丅

傕偆傂偲偮堏峴偺嵺偵拲堄偟側偗傟偽側傜側偄偺偼丄僱僢僩儚乕僋偺奺僐儞僺
儏乕僞偺 ARP 僉儍僢僔儏傪僋儕傾偟側偗傟偽側傜側偄丄偲偄偆偙偲偱偡丅ARP
僉儍僢僔儏偵偼丄慜偺屆偄僽儕僢僕偺僴乕僪僂僃傾傾僪儗僗偑巆偭偰偄傞 (偦
偟偰偦傟偼傕偆惓偟偔側偄) 偱偟傚偆偐傜丅

Cisco 偱偼丄偙傟偼 'clear arp-cache' 僐儅儞僪偱幚峴偱偒傑偡丅 Linux 偱
偼 'arp -d ip.address' 偱偡丅僉儍僢僔儏偑婜尷愗傟偵側傞偺傪懸偭偰偄偰傕
椙偄偱偡偑丄偙傟偼斾妑揑帪娫偑偐偐傝傑偡丅

偙傟傪崅懍壔偡傞偵偼丄慺惏傜偟偄僣乕儖 'arping' 偑巊偊傑偡丅偙傟偼懡偔
偺僨傿僗僩儕價儏乕僔儑儞偱 'iputils' 僷僢働乕僕偵擖偭偰偄傑偡丅 arping
傪梡偄傞偲丄梫媮偺側偐偭偨 (unsolicited 側) ARP 儊僢僙乕僕傪憲傝偮偗傞
偙偲偑偱偒丄儕儌乕僩偺 ARP 僉儍僢僔儏傪峏怴偱偒傑偡丅

偙傟偼旕忢偵嫮椡側僥僋僯僢僋偱丄埆幰偑儖乕僥傿儞僌傪曵夡偝偣傞偺偵傕巊
偊傑偡!

    Note: Linux 2.4 偱偼丄偙偺乽梫媮偺側偐偭偨 ARP 儊僢僙乕僕乿傪憲怣偡
    傞慜偵偼丄 'echo 1 > /proc/sys/net/ipv4/ip_nonlocal_bind' 傪幚峴偡
    傞昁梫偑偁傞偐傕偟傟傑偣傫丅
   
傑偨丄僱僢僩儅僗僋傪徣棯偟偰宱楬傪巜掕偡傞僋僙偺偁傞 (偁偭偨) 恖偼丄嶌
嬈偺寢壥僱僢僩儚乕僋愝掕偑夡傟偰偟傑偆偐傕偟傟傑偣傫丅摿掕偺僶乕僕儑儞
偺 route 偼僱僢僩儅僗僋傪惓偟偔悇検偟偰偄偨偐傕偟傟傑偣傫偟丄壗傕昞帵偡
傞偙偲側偔娫堘偭偰偄偨偐傕偟傟傑偣傫丅慜弎偟偨傛偆側奜壢庤弍揑側儖乕僥
傿儞僌傪偡傞偲偒偵偼丄僱僢僩儅僗僋傪僠僃僢僋偡傞偺偼乽惗巰乿偵娭傢傝傑
偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

Chapter 17. 摦揑儖乕僥傿儞僌 - OSPF 偲 BGP

僱僢僩儚乕僋偑杮摉偵戝偒偔側傝巒傔偨傝丄傑偨偙傟傪乽僀儞僞乕僱僢僩乿偲
峫偊傞昁梫偑惗偠偰偒偨傜丄僨乕僞傪摦揑偵儖乕僥傿儞僌偡傞僣乕儖偑昁梫偱
偡丅僒僀僩摨巑偼偨偄偰偄暋悢偺宱楬偱偮側偑偭偰偍傝丄傑偨偨偔偝傫偺宱楬
偑忢偵惗傑傟偰偄傑偡丅

僀儞僞乕僱僢僩偼傎傏 OSPF (RFC 2328) 偲 BGP4 (RFC 1771) 偱昗弨壔偝傟偰
偄傑偡丅Linux 偼偙偺椉幰傪丄 gated 偲 zebra 偵傛偭偰僒億乕僩偟偰偄傑偡
丅

尰嵼偺偲偙傠偼偙偺暥彂偺庣旛斖埻偱偼偁傝傑偣傫偑丄嵟傕怣棅偱偒傞挊嶌傪
帵偟偰偍偒傑偡丅

奣榑:

Cisco Systems Designing large-scale IP Internetworks <http://
www.cisco.com/univercd/cc/td/doc/cisintwk/idg4/nd2003.htm>

OFPF 偵偮偄偰:

Moy, John T. "OSPF. The anatomy of an Internet routing protocol"
Addison Wesley. Reading, MA. 1998.

Halabi 巵傕 OSPF 偺儖乕僥傿儞僌愝寁偵娭偡傞椙偄僈僀僪傪彂偄偰偄傑偡丅偟
偐偟偙傟偼 Cisco 偺 web 僒僀僩偐傜徚偝傟偰偟傑偭偨傛偆偱偡丅

BGP 偵偮偄偰:

Halabi, Bassam "Internet routing architectures" Cisco Press (New Riders
Publishing). Indianapolis, IN. 1997.

傑偨

Cisco Systems Using the Border Gateway Protocol for interdomain routing
<http://www.cisco.com/univercd/cc/td/doc/cisintwk/ics/icsbgp4.htm>

椺偼 Cisco 巜岦偱偡偑丄偙傟傜偼 Zebra 偱偺愝掕尵岅偲戝曄椙偔帡偰偄傑偡
:-)

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

17.1. Zebra 偵傛傞 OSPF 偺愝掕

傕偟埲崀偺忣曬偵晄惓妋側晹暘偑偁偭偨傝丄懠偵傕採埬偑偁偭偨傜丄偳偆偐巹
<mailto:piotr%member.fsf.org>偵抦傜偣偰偔偩偝偄丅 Zebra <http://
www.zebra.org> 偼愇崟朚岹丄Toshiaki Takada, Yasuhiro Ohara 偵傛偭偰彂偐
傟偨執戝側摦揑儖乕僥傿儞僌僜僼僩僂僃傾偱偡丅 Zebra 傪巊偆偲丄OSPF 偺愝
掕偼懍傗偐偱僔儞僾儖偵側傝傑偡偑丄偟偐偟偦偺棤偵偼丄摿庩側梡搑偵岦偗偨
懡偔偺僷儔儊乕僞偑偁傞偺偱偡丅 OSPF 偼 Open Shortest Path First (嵟抁宱
楬傪愭偵奐偔) 傪昞偟偰偄傑偡丅偦偺婎杮揑側婡擻偲偟偰偼:

奒憌揑
   
    僱僢僩儚乕僋偼 area 偵傛偭偰僌儖乕僾壔偝傟丄偦傟偧傟偼 area 0 偲柤
    晅偗傜傟偨僶僢僋儃乕儞 area 偵傛偭偰愙懕偝傟傑偡丅偡傋偰偺僩儔僼傿
    僢僋偼 area 0 傪捠傝丄 area 0 偺偡傋偰偺儖乕僞偼丄偦偺懠偺 area 偡
    傋偰偵懳偡傞宱楬忣曬傪帩偭偰偄傑偡丅
   
憗偄廂懇
   
    宱楬忣曬偼丄椺偊偽 RIP 偵斾傋偰丄旕忢偵懍偔揱攄偟傑偡丅
   
僶儞僪暆傪岠棪揑偵巊偆
   
    僽儘乕僪僉儍僗僩偱偼側偔儅儖僠僉儍僗僩傪巊偆偺偱丄宱楬忣曬偵偼嫽枴
    偑側偄偱偁傠偆懠偺儂僗僩傪偙偺忣曬偱堨傟偝偣傞偙偲偼側偔丄僱僢僩儚
    乕僋偺僆乕僶乕僿僢僪偑尭彮偟傑偡丅傑偨撪晹儖乕僞 (傂偲偮偺 area 偵
    懏偡傞僀儞僞乕僼僃乕僗偟偐帩偭偰偄側偄儖乕僞) 偼懠偺 area 偺宱楬忣
    曬傪帩偮偙偲偑偁傝傑偣傫丅暋悢偺暿乆偺 area 偵懏偡傞僀儞僞乕僼僃乕
    僗傪帩偭偰偄傞儖乕僞偼 area 嫬奅儖乕僞偲屇偽傟丄愙懕偟偰偄傞 area
    偵娭偡傞僩億儘僕乕忣曬傪曐帩偟傑偡丅
   
CPU 晧壸偑崅偄
   
    OSPF 偼 Dijkstra 偺 Shortest Path First algorithm <http://
    www.soi.wide.ad.jp/class/99007/slides/13/07.html> 傪婎偵偟偰偍傝丄
    偙傟偼懠偺儖乕僥傿儞僌傾儖僑儕僘儉偵斾傋崅壙偱偡丅偟偐偟幚嵺偵偼丄
    嵟抁宱楬偼奺 area 偺撪晹偱偺傒寁嶼偝傟傑偡偺偱丄偦傟傎偳偼埆偔偁傝
    傑偣傫丅傑偨拞彫僒僀僘偺僱僢僩儚乕僋偱偼偙傟偼栤戣偵側傜側偄偱偟傚
    偆丅婥偯偔偙偲傕側偄偐傕偟傟傑偣傫丅
   
愙懕忬懺
   
    OSPF 偼僱僢僩儚乕僋偲僀儞僞乕僼僃乕僗偺摿庩側摿惈 (僶儞僪暆丄抐慄忬
    懺丄壙奿側偳) 傕峫椂偟傑偡丅
   
僆乕僾儞側僾儘僩僐儖偲 GPL 偺僜僼僩僂僃傾
   
    OSPF 偼僆乕僾儞側僾儘僩僐儖偱丄Zebra 偼 GPL 僜僼僩僂僃傾偱偡丅偙傟
    偼撈愯揑側僜僼僩僂僃傾傗僾儘僩僐儖偵懳偟偰丄柧傜偐側桪埵揰偱偡丅
   
劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

17.1.1. 昁梫忦審

 

Linux 僇乕僱儖
   
    CONFIG_NETLINK_DEV 偲 CONFIG_IP_MULTICAST 傪慻傒崬傓昁梫偑偁傝傑偡
    (懠偵昁梫偲偝傟傞傕偺偼丄挊幰偼偪傖傫偲棟夝偟偰偄傑偣傫)丅
   
iproute
   
Zebra
   
    偍岲傒偺僷僢働乕僕儅僱乕僕儍偐丄 zebra.org <http://www.zebra.org>
    偐傜擖庤偟傑偟傚偆丅
   
劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

17.1.2. Zebra 偺愝掕

偙偺傛偆側僱僢僩儚乕僋傪椺偵庢傝傑偟傚偆:
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆----------------------------------------------------                                      劆
劆| 192.168.0.0/24                                   |                                      劆
劆|                                                  |                                      劆
劆|      Area 0    100BaseTX Switched                |                                      劆
劆|     Backbone     Ethernet                        |                                      劆
劆----------------------------------------------------                                      劆
劆  |           |                |              |                                           劆
劆  |           |                |              |                                           劆
劆  |eth1       |eth1            |eth0          |                                           劆
劆  |100BaseTX  |100BaseTX       |100BaseTX     |100BaseTX                                  劆
劆  |.1         |.2              |.253          |                                           劆
劆 ---------   ------------   -----------      ----------------                             劆
劆 |R Omega|   |R Atlantis|   |R Legolas|      |R Frodo       |                             劆
劆 ---------   ------------   -----------      ----------------                             劆
劆  |eth0         |eth0             |             |          |                              劆
劆  |             |                 |             |          |                              劆
劆  |2MbDSL/ATM   |100BaseTX        |10BaseT      |10BaseT   |10BaseT                       劆
劆------------   ------------------------------------       ------------------------------- 劆
劆| Internet |   | 172.17.0.0/16        Area 1      |       |  192.168.1.0/24 wlan  Area 2| 劆
劆------------   |         Student network (dorm)   |       |       barcelonawireless     | 劆
劆               ------------------------------------       ------------------------------- 劆
劆                                                                                          劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
偙偺恾偵嬃偐側偄偱偔偩偝偄丅 zebra 偼傎偲傫偳傪帺摦揑偵張棟偟偰偔傟傑偡
偺偱丄偙傟傜偺宱楬偡傋偰傪愝掕偡傞偺傕娙扨偱偡丅偙傟傜偺宱楬傪枅擔堐帩
偡傞偺偼嬯捝傪敽偆嶌嬈偱偡丅攃埇偟偰偍偔傋偒嵟傕廳梫側揰偼丄僱僢僩儚乕
僋偺僩億儘僕乕偱偡丅傑偨 area 0 偼嵟傕廳梫側 area 側偺偱丄嵶怱偺拲堄傪
暐偭偰偔偩偝偄丅傑偢 zebra.conf 傪梫媮偵偁傢偣偰曇廤偟丄zebra 傪愝掕偟
傑偡丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆hostname omega                                                      劆
劆password xxx                                                        劆
劆enable password xxx                                                 劆
劆!                                                                   劆
劆! Interface's description.                                          劆
劆!                                                                   劆
劆!interface lo                                                       劆
劆! description test of desc.                                         劆
劆!                                                                   劆
劆interface eth1                                                      劆
劆multicast                                                           劆
劆!                                                                   劆
劆! Static default route                                              劆
劆!                                                                   劆
劆ip route 0.0.0.0/0 212.170.21.129                                   劆
劆!                                                                   劆
劆log file /var/log/zebra/zebra.log                                   劆
劆                                                                    劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
Debian 偱偼丄/etc/zebra/daemons 傕曇廤偟偰丄僽乕僩帪偵婲摦偡傞傛偆偵愝
掕偡傞昁梫傕偁傝傑偟偨丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆zebra=yes                                                           劆
劆ospfd=yes                                                           劆
劆                                                                    劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
師偵丄傑偩 IPv4 傪巊偭偰偄傞側傜 ospfd.conf 傪丄 IPv6 側傜 ospf6d.conf
傪曇廤偟傑偡丅巹偺 ospfd.conf 偼師偺傛偆側姶偠偱偡:
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆hostname omega                                                      劆
劆password xxx                                                        劆
劆enable password xxx                                                 劆
劆!                                                                   劆
劆router ospf                                                         劆
劆  network 192.168.0.0/24 area 0                                     劆
劆  network 172.17.0.0/16 area 1                                      劆
劆!                                                                   劆
劆! log stdout                                                        劆
劆log file /var/log/zebra/ospfd.log                                   劆
劆                                                                    劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
偙偙偱偼変乆偺僱僢僩儚乕僋僩億儘僕乕傪 ospf 偵嫵偊偰偄傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

17.1.3. Zebra 傪幚峴偡傞

偱偼 Zebra 傪幚峴偟傑偡丅庤摦偱 "zebra -d" 偲僞僀僾偡傞偐丄"/etc/init.d
/zebra start" 偺傛偆側僗僋儕僾僩傪巊偄傑偡丅婲摦偟偨傜 ospfd 偺儘僌傪拲
堄怺偔娔帇偟傑偟傚偆丅師偺傛偆側撪梕偑尰傟傞偼偢偱偡丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆2002/12/13 22:46:24 OSPF: interface 192.168.0.1 join AllSPFRouters Multicast group.   劆
劆2002/12/13 22:46:34 OSPF: SMUX_CLOSE with reason: 5                                   劆
劆2002/12/13 22:46:44 OSPF: SMUX_CLOSE with reason: 5                                   劆
劆2002/12/13 22:46:54 OSPF: SMUX_CLOSE with reason: 5                                   劆
劆2002/12/13 22:47:04 OSPF: SMUX_CLOSE with reason: 5                                   劆
劆2002/12/13 22:47:04 OSPF: DR-Election[1st]: Backup 192.168.0.1                        劆
劆2002/12/13 22:47:04 OSPF: DR-Election[1st]: DR     192.168.0.1                        劆
劆2002/12/13 22:47:04 OSPF: DR-Election[2nd]: Backup 0.0.0.0                            劆
劆2002/12/13 22:47:04 OSPF: DR-Election[2nd]: DR     192.168.0.1                        劆
劆2002/12/13 22:47:04 OSPF: interface 192.168.0.1 join AllDRouters Multicast group.     劆
劆2002/12/13 22:47:06 OSPF: DR-Election[1st]: Backup 192.168.0.2                        劆
劆2002/12/13 22:47:06 OSPF: DR-Election[1st]: DR     192.168.0.1                        劆
劆2002/12/13 22:47:06 OSPF: Packet[DD]: Negotiation done (Slave).                       劆
劆2002/12/13 22:47:06 OSPF: nsm_change_status(): scheduling new router-LSA origination  劆
劆2002/12/13 22:47:11 OSPF: ospf_intra_add_router: Start                                劆
劆                                                                                      劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
SMUX_CLOSE 儊僢僙乕僕偼 SNMP 娭楢偺傕偺側偺偱丄偄傑偼柍帇偟傑偟傚偆丅
192.168.0.1 偑 Designated 儖乕僞偱丄 192.168.0.2 偑僶僢僋傾僢僾
Designated 儖乕僞偲側偭偰偄傞偙偲偑傢偐傝傑偡丅

zebra 傗 ospfd 僀儞僞乕僼僃乕僗偲偼丄師偺傛偆側僐儅儞僪偱懳榖偱偒傑偡丅
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆$ telnet localhost zebra                                            劆
劆$ telnet localhost ospfd                                            劆
劆                                                                    劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
宱楬偑偳偺傛偆偵揱攄偟偰偄傞偐尒偰傒傑偟傚偆丅 zebra 偵儘僌僀儞偟偰師傪
擖椡偟傑偡:
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆root@atlantis:~# telnet localhost zebra                                 劆
劆Trying 127.0.0.1...                                                     劆
劆Connected to atlantis.                                                  劆
劆Escape character is '^]'.                                               劆
劆                                                                        劆
劆Hello, this is zebra (version 0.92a).                                   劆
劆Copyright 1996-2001 Kunihiro Ishiguro.                                  劆
劆                                                                        劆
劆User Access Verification                                                劆
劆                                                                        劆
劆Password:                                                               劆
劆atlantis> show ip route                                                 劆
劆Codes: K - kernel route, C - connected, S - static, R - RIP, O - OSPF,  劆
劆       B - BGP, > - selected route, * - FIB route                       劆
劆                                                                        劆
劆K>* 0.0.0.0/0 via 192.168.0.1, eth1                                     劆
劆C>* 127.0.0.0/8 is directly connected, lo                               劆
劆O   172.17.0.0/16 [110/10] is directly connected, eth0, 06:21:53        劆
劆C>* 172.17.0.0/16 is directly connected, eth0                           劆
劆O   192.168.0.0/24 [110/10] is directly connected, eth1, 06:21:53       劆
劆C>* 192.168.0.0/24 is directly connected, eth1                          劆
劆atlantis> show ip ospf border-routers                                   劆
劆============ OSPF router routing table =============                    劆
劆R    192.168.0.253         [10] area: (0.0.0.0), ABR                    劆
劆                           via 192.168.0.253, eth1                      劆
劆                                 [10] area: (0.0.0.1), ABR              劆
劆                           via 172.17.0.2, eth0                         劆
劆                                                                        劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
偁傞偄偼捈愙 iproute 傪巊偭偰:
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆root@omega:~# ip route                                                    劆
劆212.170.21.128/26 dev eth0  proto kernel  scope link  src 212.170.21.172  劆
劆192.168.0.0/24 dev eth1  proto kernel  scope link  src 192.168.0.1        劆
劆172.17.0.0/16 via 192.168.0.2 dev eth1  proto zebra  metric 20            劆
劆default via 212.170.21.129 dev eth0  proto zebra                          劆
劆root@omega:~#                                                             劆
劆                                                                          劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
偙偺傛偆偵 zebra 偺宱楬傪傒傞偙偲偑偱偒傑偡丅埲慜偵偼懚嵼偟偰偄側偐偭偨
傕偺偱偡丅 zebra 偲 ospfd 傪婲摦偟偰悢昩屻偵偼宱楬偑尰傟偰偄傞偺傪尒傞
偺偼丄偲偰傕婥暘偺偄偄傕偺偱偡丅懠偺儂僗僩傊偺愙懕忬懺偼 ping 偱妋擣偱
偒傑偡丅 zebra 偼帺摦揑偵儖乕僥傿儞僌傪峴偄傑偡偐傜丄扨偵懠偺儖乕僞傪僱
僢僩儚乕僋偵壛偊丄zebra 傪愝掕偡傟偽丅偳偆偱偡!

僸儞僩: OSPF 僷働僢僩傪僉儍僾僠儍偟偰夝愅偡傞偵偼師偑巊偊傑偡:
劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆tcpdump -i eth1 ip[9] == 89                                         劆
劆                                                                    劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
OSPF 偺 ip 僾儘僩僐儖斣崋偼 89 偱丄僾儘僩僐儖僼傿乕儖僪偼 ip 僿僢僟偺戞
9 僆僋僥僢僩偱偡丅

OSPF 偵偼丄摿偵戝偒側僱僢僩儚乕僋岦偗偵丄挷惍偱偒傞僷儔儊乕僞偑偨偔偝傫
偁傝傑偡丅偙偺 howto 傪偝傜偵奼廩偱偒傟偽丄 OSPF 偺僼傽僀儞僠儏乕僯儞僌
偺曽朄榑傪帵偣傞偲巚偄傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

17.2. Zebra 偵傛傞 BGP4 偺愝掕

Border Gateway Protocol Version 4 (BGP4) 偼丄 RFC 1771 偱婰弎偝傟偰偄傞
摦揑儖乕僥傿儞僌僾儘僩僐儖偱偡丅 BGP4 傪巊偆偲丄摓払惈忣曬偡側傢偪宱楬
僥乕僽儖傪丄懠偺 BGP4 僲乕僪偵攝晍偱偒傑偡丅EGP 偐 IGP 偑巊偊丄 IGP 儌
乕僪偱偼奺僲乕僪偵屌桳偺 Autonomous System (AS) 斣崋偑偮偒傑偡丅 BGP4
偼丄僋儔僗儗僗僀儞僞乕僱僢僩僪儊僀儞儖乕僥傿儞僌 (CIDR) 偲丄宱楬廤崌
(暋悢偺宱楬傪傂偲偮偵傑偲傔傞) 偲傪僒億乕僩偟傑偡丅

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

17.2.1. 僱僢僩儚乕僋恾 (椺)

師偺僱僢僩儚乕僋恾傪埲崀偱偺椺偲偟偰梡偄傑偡丅 AS 1 偲 50 偵偼懠偵傕嬤
椬僲乕僪偑偁傝傑偡偑丄偙偙偱偼 1 偲 50 偩偗傪巹偨偪偺嬤椬偲偟偰愝掕偡傟
偽椙偄偩偗偱偡丅偙偺椺偱偼丄奺僲乕僪偼僩儞僱儖傪宱桼偟偰捠怣偟傑偡偑丄
偙傟偼昁偢偟傕昁梫偱偼偁傝傑偣傫丅

拲堄: 偙偺椺偱偺 AS 斣崋偼梊栺嵪傒偱偡偺偱丄岞幃側愙懕傪愝掕偡傞応崌偼
丄RIPE 偐傜 AS 傪庢摼偟偰偔偩偝偄丅

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆          --------------------                                      劆
劆          | 192.168.23.12/24 |                                      劆
劆          |    AS: 23        |                                      劆
劆          --------------------                                      劆
劆            /             \                                         劆
劆           /               \                                        劆
劆          /                 \                                       劆
劆------------------       ------------------                         劆
劆| 192.168.1.1/24 |-------| 10.10.1.1/16   |                         劆
劆|    AS: 1       |       |    AS: 50      |                         劆
劆------------------       ------------------                         劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

17.2.2. 愝掕 (椺)

師偺愝掕偼 192.168.23.12/24 偺傕偺偱偡丅懠偺僲乕僪偵偁傢偣傞偺傕娙扨偱
偟傚偆丅

傑偢儂僗僩柤丄僷僗儚乕僪丄僨僶僢僌僗僀僢僠側偳偺堦斒忣曬偐傜巒傑傝傑偡
丅

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆! hostname                                                          劆
劆hostname anakin                                                     劆
劆                                                                    劆
劆! login password                                                    劆
劆password xxx                                                        劆
劆                                                                    劆
劆! enable password (super user mode)                                 劆
劆enable password xxx                                                 劆
劆                                                                    劆
劆! path to logfile                                                   劆
劆log file /var/log/zebra/bgpd.log                                    劆
劆                                                                    劆
劆! debugging: be verbose (can be removed afterwards)                 劆
劆debug bgp events                                                    劆
劆debug bgp filters                                                   劆
劆debug bgp fsm                                                       劆
劆debug bgp keepalives                                                劆
劆debug bgp updates                                                   劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

僾儔僀儀乕僩僱僢僩儚乕僋 (RFC 1918) 偺嵞攝晍傪惂尷偡傞偨傔偺傾僋僙僗儕
僗僩偱偡丅

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆! RFC 1918 networks                                                 劆
劆access-list local_nets permit 192.168.0.0/16                        劆
劆access-list local_nets permit 172.16.0.0/12                         劆
劆access-list local_nets permit 10.0.0.0/8                            劆
劆access-list local_nets deny any                                     劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

師偺僗僥僢僾偼 AS 偛偲偺愝掕偱偡丅

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆! Own AS number                                                       劆
劆router bgp 23                                                         劆
劆                                                                      劆
劆    ! IP address of the router                                        劆
劆    bgp router-id 192.168.23.12                                       劆
劆                                                                      劆
劆    ! announce our own network to other neighbors                     劆
劆    network 192.168.23.0/24                                           劆
劆                                                                      劆
劆    ! advertise all connected routes (= directly attached interfaces) 劆
劆    redistribute connected                                            劆
劆                                                                      劆
劆    ! advertise kernel routes (= manually inserted routes)            劆
劆    redistribute kernel                                               劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

'router bgp' 僽儘僢僋偵偼丄昁偢儖乕僞偑愙懕偡傞嬤椬偺儕僗僩偑娷傑傟傑偡
丅

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆    neighbor 192.168.1.1 remote-as 1                                劆
劆    neighbor 192.168.1.1 distribute-list local_nets in              劆
劆    neighbor 10.10.1.1   remote-as 50                               劆
劆    neighbor 10.10.1.1   distribute-list local_nets in              劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

17.2.3. 愝掕偺妋擣

拲堄: vtysh 偼儅儖僠僾儗僋僒偱丄 Zebra 僀儞僞乕僼僃乕僗傪偡傋偰傂偲傑偲
傔偵愙懕偟傑偡丅

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆anakin# sh ip bgp summary                                                         劆
劆BGP router identifier 192.168.23.12, local AS number 23                           劆
劆2 BGP AS-PATH entries                                                             劆
劆0 BGP community entries                                                           劆
劆                                                                                  劆
劆Neighbor        V    AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd  劆
劆10.10.0.1       4    50      35      40        0    0    0 00:28:40        1      劆
劆192.168.1.1     4     1   27574   27644        0    0    0 03:26:04       14      劆
劆                                                                                  劆
劆Total number of neighbors 2                                                       劆
劆anakin#                                                                           劆
劆anakin# sh ip bgp neighbors 10.10.0.1                                             劆
劆BGP neighbor is 10.10.0.1, remote AS 50, local AS 23, external link               劆
劆  BGP version 4, remote router ID 10.10.0.1                                       劆
劆  BGP state = Established, up for 00:29:01                                        劆
劆  ....                                                                            劆
劆anakin#                                                                           劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊

嬤椬偐傜庴偗偲偭偨宱楬傪尒偰傒傑偟傚偆丅

劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
劆anakin# sh ip ro bgp                                                    劆
劆Codes: K - kernel route, C - connected, S - static, R - RIP, O - OSPF,  劆
劆       B - BGP, > - selected route, * - FIB route                       劆
劆                                                                        劆
劆B>* 172.16.0.0/14 [20/0] via 192.168.1.1, tun0, 2d10h19m                劆
劆B>* 172.30.0.0/16 [20/0] via 192.168.1.1, tun0, 10:09:24                劆
劆B>* 192.168.5.10/32 [20/0] via 192.168.1.1, tun0, 2d10h27m              劆
劆B>* 192.168.5.26/32 [20/0] via 192.168.1.1, tun0, 10:09:24              劆
劆B>* 192.168.5.36/32 [20/0] via 192.168.1.1, tun0, 2d10h19m              劆
劆B>* 192.168.17.0/24 [20/0] via 192.168.1.1, tun0, 3d05h07m              劆
劆B>* 192.168.17.1/32 [20/0] via 192.168.1.1, tun0, 3d05h07m              劆
劆B>* 192.168.32.0/24 [20/0] via 192.168.1.1, tun0, 2d10h27m              劆
劆anakin#                                                                 劆
劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

Chapter 18. 偦偺懠偺岓曗

偙偺復偱偼丄崅搙側 Linux 儖乕僥傿儞僌偲僩儔僼傿僢僋偺懷堟惂尷偵娭楢偺偁
傞僾儘僕僃僋僩傪徯夘偟傑偡丅偙偺偆偪偺偄偔偮偐偼丄偙傟傑偱偺復偱婛偵徯
夘偟偰偄偨偐傕偟傟傑偣傫丅偁傞偄偼懠偵 HOWTO 傪昁梫偲偟側偄偔傜偄丄帺慜
偱旕忢偵椙偔暥彂壔偝傟偰偄傞傕偺傕偁傝傑偡丅

Linux 梡偺 802.1Q VLAN 幚憰 <http://scry.wanfear.com/~greear/vlan.html>
   
    VLAN 偼僱僢僩儚乕僋傪暔棟揑偱偼側偔壖憐揑偵廤崌偝偣傞丄旕忢偵尗偄傗
    傝曽偱偡丅VLAN 偵娭偡傞桪傟偨忣曬偼偙偪傜 <ftp://
    ftp.netlab.ohio-state.edu/pub/jain/courses/cis788-97/virtual_lans/
    index.htm> 偵偁傝傑偡丅偙偺幚憰傪巊偆偲丄Linux 偵 VLAN 傪偟傖傋傜偣
    丄 Cisco Catalyst, 3Com: {Corebuilder, Netbuilder II, SuperStack II
    switch 630}, Extreme Ntwks Summit 48, Foundry: {ServerIronXL,
    FastIron} 側偳偲夛榖偝偣傞偙偲偑偱偒傑偡丅
   
    VLAN 偵娭偡傞慺惏傜偟偄 HOWTO 偑偙偪傜 <http://scry.wanfear.com/
    ~greear/vlan/cisco_howto.html> 偵偁傝傑偡丅
   
    峏怴: 2.4.14 (懡暘 13) 偱偼僇乕僱儖偵娷傑傟偰偄傑偡丅
   
Linux 梡 802.1Q VLAN 偺暿偺幚憰 <http://vlan.sourceforge.net >
   
    Linux 梡 VLAN 偺暿偺幚憰偱偡丅偙偺僾儘僕僃僋僩偼乽尃埿偁傞乿VLAN 僾
    儘僕僃僋僩偺傾乕僉僥僋僠儍傗僐乕僨傿儞僌僗僞僀儖偵懳偡傞堄尒偺憡堘
    偐傜僗僞乕僩偟丄傛傝慡懱偺愝寁傪尒捠偟椙偔偡傞偙偲傪慱偭偨傕偺偱偡
    丅
   
Linux Virtual Server <http://www.LinuxVirtualServer.org/>
   
    偙偺恖偨偪偼嵟崅偱偡丅Linux Virtual Server 偼丄杮暔偺僒乕僶偺僋儔僗
    僞忋偵丄 Linux OS 偱摦嶌偡傞儘乕僪僶儔儞僒傪巊偭偰峔抸偡傞丄旕忢偵
    僗働乕儔僽儖偐偮崅昳埵側僒乕僶偱偡丅僋儔僗僞偺傾乕僉僥僋僠儍偼僄儞
    僪儐乕僓偵懳偟偰摟夁揑偱丄僄儞僪儐乕僓偼扨偵堦戜偺壖憐僒乕僶傪尒傞
    偙偲偵側傝傑偡丅
   
    梫偡傞偵丄壗偐晧壸暘嶶偟偨偄傕偺偑偁偭偨傜丄偦傟偑偳傫側儗儀儖偺僩
    儔僼傿僢僋偱傕丄LVS 偵偼偦傟傪峴偆擻椡偑偁傞偺偱偡丅斵傜偺僥僋僯僢
    僋偼椙偄堄枴偱幾埆偱偡! 椺偊偽丄暋悢偺儅僔儞偵偁傞僙僌儊儞僩撪偱摨
    偠 IP 傾僪儗僗傪帩偨偣丄偦傟傜偵懳偡傞 ARP 傪柍岠偵偡傞偺偱偡丅LVS
    儅僔儞偩偗偑 ARP 傪峴偄 - 偦偟偰摓拝僷働僢僩偺張棟傪偳偺僶僢僋僄儞
    僪儂僗僩偑峴偆偐傪寛傔丄捈愙偦偺僶僢僋僄儞僪僒乕僶偺 MAC 傾僪儗僗傊
    偲僷働僢僩傪憲傞偺偱偡丅奜岦偒偺僩儔僼傿僢僋偼捈愙儖乕僞傊棳傟丄LVS
    儅僔儞偼宱桼偟傑偣傫丅傛偭偰 LVS 儅僔儞偼悽奅傊岦偗偨 5Gbit/s 偺僐
    儞僥儞僣偺僼儘乕傪尒傞昁梫偼側偔丄傛偭偰儃僩儖僱僢僋偵傕側傝傑偣傫
    丅
   
    LVS 偼 Linux 2.0, 2.2 偱偼僇乕僱儖僷僢僠偲偟偰幚憰偝傟偰偄傑偡偑丄
    2.4/2.5 偱偼 netfilter 偺儌僕儏乕儖偵側偭偰偄傑偡偺偱丄僇乕僱儖僷僢
    僠昁梫偼偁傝傑偣傫丅 2.4 僒億乕僩偼傑偩奐敪偺弶婜抜奒偱偡偺偱丄惀旕
    偄偠偔傝夞偟偰丄僼傿乕僪僶僢僋傗僷僢僠傪憲偭偰偔偩偝偄丅
   
CBQ.init <ftp://ftp.equinox.gu.net/pub/linux/cbq/>
   
    CBQ 偺愝掕偼丄偪傚偭偲傗傞婥傪偔偠偐傟傞偲偙傠偑偁傝傑偡丅摿偵丄傗
    傝偨偄偙偲偑扨偵儖乕僞偺攚屻偺僐儞僺儏乕僞傪偄偔偮偐峣傝偨偄偩偗丄
    偲偄偆傛偆側応崌偵偼側偍偝傜偱偡丅 CBQ.init 偼丄Linux 偺愝掕傪傛傝
    扨弮側暥朄偱壜擻偵偟偰偔傟傑偡丅
   
    椺偊偽丄(10mbit eth1 偵偮側偑偭偨) 192.168.1.0/24 僒僽僱僢僩偺偡傋
    偰偺僐儞僺儏乕僞偵懳偟丄僟僂儞儘乕僪偺懍搙傪 28kbit/s 偵惂尷偟偨偗
    傟偽丄師偺撪梕傪 CBQ.init 偺愝掕僼傽僀儖偵彂偔偩偗偱偡:
   
     
    劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
    劆DEVICE=eth1,10Mbit,1Mbit                                劆
    劆RATE=28Kbit                                             劆
    劆WEIGHT=2Kbit                                            劆
    劆PRIO=5                                                  劆
    劆RULE=192.168.1.0/24                                     劆
    劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
     
   
    乽側偤丄偳偺傛偆偵乿偲偄偆撪梕偵嫽枴偑側偗傟偽丄愨懳偵偙偺僾儘僌儔
    儉傪巊偆傋偒偱偡丅巹偨偪偼惢昳偱 CBQ.init 傪巊偭偰偄傑偡偑丄旕忢偵
    偆傑偔摦嶌偟偰偄傑偡丅帪崗偵埶懚偟偨懷堟惂尷偲偄偭偨傛偆側丄傛傝崅
    搙側愝掕傕壜擻偱偡丅暥彂偼僗僋儕僾僩偵杽傔崬傑傟偰偍傝丄偙傟偑
    README 偑尒偮偐傜側偄棟桼偱偡丅
   
Chronox 庤寉側懷堟惂尷僗僋儕僾僩 <http://www.chronox.de>
   
    Stephan Mueller (smueller@chronox.de) 偼 2 偮偺曋棙側僗僋儕僾僩傪彂
    偒傑偟偨丅 'limit.conn' 偲 'shaper' 偱偡丅'limit.conn' 傪巊偆偲丄偁
    傞傂偲偮偺僟僂儞儘乕僪僙僢僔儑儞傪庤寉偵峣傟傑偡丅偙傫側姶偠偱偡:
   
     
    劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
    劆# limit.conn -s SERVERIP -p SERVERPORT -l LIMIT         劆
    劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
     
   
    Linux 2.2 偲 2.4/2.5 偱摦嶌偟傑偡丅
   
    'shaper' 偺曽偼傛傝暋嶨偱丄偨偔偝傫偺堎側傞僉儏乕傪丄iptables 偺儖
    乕儖傪傕偲偵偟偰嶌傟傑偡丅 iptables 偼峣傝偨偄僷働僢僩偵報傪晅偗傞
    偺偵巊偄傑偡丅
   
Virtual Router Redundancy 僾儘僩僐儖偺幚憰 (僒僀僩 1 <http://
    w3.arobas.net/~jetienne/vrrpd/index.html>, 僒僀僩 2 <http://
    www.imagestream.com/VRRP.html>)
   
    偙傟偼弮悎偵忕挿惈 (redundancy) 偺偨傔偺傕偺偱偡丅 IP 傾僪儗僗偲
    MAC 傾僪儗僗偑摨偠 2 戜偺儅僔儞傪梡偄偰丄偝傜偵暿偺 IP 傾僪儗僗偲
    MAC 傾僪儗僗傪帩偭偨丄壖憐揑側儅僔儞傪嶌傝傑偡丅傕偲傕偲偼 (忢偵摨
    偠 MAC 傾僪儗僗傪昁梫偲偡傞) 儖乕僞岦偗偺傕偺偩偭偨偺偱偡偑丄懠偺僒
    乕僶偱傕巊偊傑偡丅
   
    偙偺傾僾儘乕僠偺旤揰偼丄怣偠傜傟側偄偔傜偄愝掕偑娙扨側偙偲偱偡丅僇
    乕僱儖偺僐儞僷僀儖傕僷僢僠摉偰傕昁梫側偔丄偡傋偰偼儐乕僓嬻娫偱偡丅
   
    師偺僐儅儞僪傪丄僒乕價僗偵嶲壛偡傞偡傋偰偺儅僔儞偱幚峴偡傞偩偗偱偡:
    劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
    劆# vrrpd -i eth0 -v 50 10.0.0.22                         劆
    劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
     
   
    偙傟偱弌棃忋偑傝! 偙偺帪揰偱 10.0.0.22 偼偳傟偐傂偲偮偺僒乕僶 (懡暘
    嵟弶偵 vrrp 僨乕儌儞傪幚峴偟偨傗偮) 偑曐桳偟傑偡丅偙偙偱偦偺僐儞僺
    儏乕僞傪僱僢僩儚乕僋偐傜愗傝棧偡偲丄旕忢偵偡偽傗偔懠偺僐儞僺儏乕僞
    偑 10.0.0.22 偲偦偺 MAC 傾僪儗僗偲傪堷偒宲偓傑偡丅
   
    巹偼庤尦偱帋偟偰傒偰丄1 暘偱摦嶌偝偣傞偙偲偑偱偒傑偟偨丅壗偐偍偐偟
    側棟桼偱丄僨僼僅儖僩僎乕僩僂僃僀偺忣曬偑徚偊偰偟傑偭偨偺偱偡偑丄 -n
    僼儔僌傪晅偗傟偽偙傟偼夞旔偱偒傑偟偨丅
   
    偙傟偼僼僃僀儖僆乕僶乕偺乽儔僀僽夋憸乿偱偡:
   
     
    劇劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劉
    劆64 bytes from 10.0.0.22: icmp_seq=3 ttl=255 time=0.2 ms   劆
    劆64 bytes from 10.0.0.22: icmp_seq=4 ttl=255 time=0.2 ms   劆
    劆64 bytes from 10.0.0.22: icmp_seq=5 ttl=255 time=16.8 ms  劆
    劆64 bytes from 10.0.0.22: icmp_seq=6 ttl=255 time=1.8 ms   劆
    劆64 bytes from 10.0.0.22: icmp_seq=7 ttl=255 time=1.7 ms   劆
    劋劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劅劊
     
   
    ping 僷働僢僩偼傂偲偮傕幐傢傟偰偄傑偣傫! 4 斣栚偺僷働僢僩偺屻丄巹偼
    P200 傪僱僢僩儚乕僋偐傜愗傝棧偟偨偺偱偡偑丄 486 偑堷偒宲偓傑偟偨丅
    傛偭偰抶墑偑戝偒偔側偭偰偄傞偙偲偑傢偐傝傑偡丅
   
tc-config (僒僀僩) <http://slava.local.nsys.by/projects/tc_config/>
   
    tc_config 偼 linux 2.4 埲崀偱偺僩儔僼傿僢僋惂屼傪 RedHat 僔僗僥儉偲
    (偍偦傜偔) 偦偺攈惗僔僗僥儉偱峴偆偨傔偺僗僋儕僾僩廤偱偡 (linux
    2.2.X 偲 ipchains 偲偱偺傕偺偼屆偔側偭偰偄傑偡)丅儖乕僩偵偼 cbq
    qdisc 傪丄梩偵偼 sfq qdisc 傪巊偭偰偄傑偡丅
   
    snmp 偱僩儔僼傿僢僋惂屼偺摑寁傪庢傞偨傔丄 snmp_pass 儐乕僥傿儕僥傿
    偑娷傑傟偰偄傑偡丅
   
劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

Chapter 19. 偝傜偵愭偵恑傓偨傔偵

http://snafu.freedom.org/linux2.2/iproute-notes.html
   
    僇乕僱儖偐傜偺偨偔偝傫偺忣曬偲僐儊儞僩
   
http://www.davin.ottawa.on.ca/ols/
   
    Linux 僩儔僼傿僢僋惂屼偺挊幰偺堦恖偱偁傞 Jamal Hadi Salim 偺僗儔僀
    僪
   
http://defiant.coinet.com/iproute2/ip-cref/
   
    Alexey 偺 LaTeX 暥彂偺 HTML 斉 - iproute2 偺堦晹傪旕忢偵徻嵶偵愢柧
    偟偰偄傑偡
   
http://www.aciri.org/floyd/cbq.html
   
    Sally Floyd 偺 CBQ 偵娭偡傞桪傟偨儁乕僕丅斵彈偺僆儕僕僫儖偺榑暥傕偁
    傝傑偡丅Linux 屌桳偱偼偁傝傑偣傫偑丄 CBQ 偺棟榑偲棙梡偵偮偄偰丄椙偄
    媍榑傪偟偰偄傑偡丅旕忢偵媄弍揑側撪梕偱偡偑丄愲偭偨恖偨偪偵偼椙偄撉
    傒暔偱偟傚偆丅
   
Differentiated Services on Linux
   
    Werner Almesberger, Jamal Hadi Salim, Alexey Kuzunetsov 偵傛傞偙偺
    暥彂 <ftp://icaftp.epfl.ch/pub/linux/diffserv/misc/dsid-01.txt.gz>
    偼丄Linux 僇乕僱儖偵偍偗傞 DiffServe 偺婡擻丄側偐偱傕 TBF, GRED,
    DSMARK qdisc 偲 tcindex 僋儔僗慖暿婍偵偮偄偰愢柧偟偰偄傑偡丅
   
http://ceti.pl/~kravietz/cbq/NET4_tc.html
   
    傑偨暿偺 HOWTO 偱偡偑丄偙偪傜偼億乕儔儞僪岅偱偡! 偱傕僐儅儞僪儔僀儞
    傪僐僺乕/儁乕僗僩偡傟偽丄偳偺尵岅偱傕摨偠傛偆偵摦嶌偟傑偡丅挊幰偼変
    乆偲傕嫟摨嶌嬈傪偟偰偄傞偺偱丄嬤偄偆偪偵偙偺 HOWTO 偵傕彂偄偰偔傟傞
    偱偟傚偆丅
   
IOS Committed Access Rate <http://www.cisco.com/univercd/cc/td/doc/
    product/software/ios111/cc111/car.htm>
   
    徿巀偡傋偒婥幙傪帩偭偨丄Cisco 偺嫤椡揑側恖偨偪偑丄斵傜偺暥彂傪僆儞
    儔僀儞偵嵹偣偰偔傟傑偟偨丅 Cisco 偱偼暥朄偼堎側傝傑偡偑丄奣擮偼摨偠
    偱偡丅偨偩偟変乆偺傎偆偑偱偒傞偙偲偼懡偔丄傑偨幵偵摍偟偄壙奿偺儖乕
    僞偼晄梫偱偡偑 :-)
   
Docum experimental site(site) <http://www.docum.org>
   
    Stef Coene 偼丄Linux 僒億乕僩傪斕攧偡傞傛偆斵偺忋巌傪擺摼偝偣傞偺偵
    朲偟偔丄傛偭偰丄摿偵僶儞僪暆偺娗棟偵娭偟偰丄偨偔偝傫偺幚尡傪峴偭偰
    偄傑偡丅斵偺僒僀僩偵偼幚梡揑側忣曬丒椺丒僥僗僩偑枮嵹偝傟偰偍傝丄傑
    偨 CBQ/tc 偺偄偔偮偐偺僶僌偵偮偄偰傕巜揈偑偁傝傑偡丅
   
TCP/IP Illustrated, volume 1, W. Richard Stevens, ISBN 0-201-63346-9
   
    TCP/IP 傪杮摉偵棟夝偟偨偗傟偽丄撉傑側偗傟偽側傜側偄杮偱偡丅柺敀偄杮
    偱傕偁傝傑偡丅
   
Policy Routing Using Linux, Matthew G. Marsh, ISBN 0-672-32052-5
   
    億儕僔乕儖乕僥傿儞僌偺擖栧彂偱丄偨偔偝傫椺偑偁傝傑偡丅
   
劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

Chapter 20. 幱帿

嵟廔揑側栚揑偼丄偙偺 HOWTO 偵峷專偟偰偔傟偨恖丄傑偨暔帠偺摦嶌尨棟偵懳偡
傞変乆偺棟夝傪彆偗偰偔傟偨恖丄偺偡傋偰傪儕僗僩偡傞偙偲偱偡丅偄傑偺偲偙
傠 Netfilter 偺傛偆側僗僐傾儃乕僪傪抲偔寁夋偼偁傝傑偣傫偑丄嫤椡偟偰偔偩
偝偭偨恖偨偪偼惀旕妎偊偰偍偒偨偄偲巚偭偰偄傑偡丅

 

 丒 Junk Alins
   
    <juanjo@mat.upc.es>
   
 丒 Joe Van Andel
   
 丒 Michael T. Babcock
   
    <mbabcock@fibrespeed.net>
   
 丒 Christopher Barton
   
    <cpbarton%uiuc.edu>
   
 丒 Ard van Breemen
   
    <ard%kwaak.net>
   
 丒 Ron Brinker
   
    <service%emcis.com>
   
 丒 ?ukasz Bromirski
   
    <l.bromirski@mr0vka.eu.org>
   
 丒 Lennert Buytenhek
   
    <buytenh@gnu.org>
   
 丒 Esteve Camps
   
    <esteve@hades.udg.es>
   
 丒 Ricardo Javier Cardenes
   
    <ricardo%conysis.com>
   
 丒 Stef Coene
   
    <stef.coene@docum.org>
   
 丒 Don Cohen
   
    <don-lartc%isis.cs3-inc.com>
   
 丒 Jonathan Corbet
   
    <lwn%lwn.net>
   
 丒 Gerry N5JXS Creager
   
    <gerry%cs.tamu.edu>
   
 丒 Marco Davids
   
    <marco@sara.nl>
   
 丒 Jonathan Day
   
    <jd9812@my-deja.com>
   
 丒 Martin aka devik Devera
   
    <devik@cdi.cz>
   
 丒 Hannes Ebner
   
    <he%fli4l.de>
   
 丒 Derek Fawcus
   
    <dfawcus%cisco.com>
   
 丒 David Fries
   
    <dfries%mail.win.org>
   
 丒 Stephan "Kobold" Gehring
   
    <Stephan.Gehring@bechtle.de>
   
 丒 Jacek Glinkowski
   
    <jglinkow%hns.com>
   
 丒 Andrea Glorioso
   
    <sama%perchetopi.org>
   
 丒 Thomas Graf
   
    <tgraf%suug.ch>
   
 丒 Sandy Harris
   
    <sandy%storm.ca>
   
 丒 Nadeem Hasan
   
    <nhasan@usa.net>
   
 丒 Erik Hensema
   
    <erik%hensema.xs4all.nl>
   
 丒 Vik Heyndrickx
   
    <vik.heyndrickx@edchq.com>
   
 丒 Spauldo Da Hippie
   
    <spauldo%usa.net>
   
 丒 Koos van den Hout
   
    <koos@kzdoos.xs4all.nl>
   
 丒 Stefan Huelbrock <shuelbrock%datasystems.de>
   
 丒 Alexander W. Janssen <yalla%ynfonatic.de>
   
 丒 Andreas Jellinghaus <aj%dungeon.inka.de>
   
 丒 Gareth John <gdjohn%zepler.org>
   
 丒 Dave Johnson
   
    <dj@www.uk.linux.org>
   
 丒 Martin Josefsson <gandalf%wlug.westbo.se>
   
 丒 Andi Kleen <ak%suse.de>
   
 丒 Andreas J. Koenig <andreas.koenig%anima.de>
   
 丒 Pawel Krawczyk <kravietz%alfa.ceti.pl>
   
 丒 Amit Kucheria <amitk@ittc.ku.edu>
   
 丒 Pedro Larroy
   
    <piotr%member.fsf.org>
   
     仩 Chapter 15, section 10: Example of a full nat solution with QoS
       
     仩 Chapter 17, section 1: Setting up OSPF with Zebra
       
 丒 Edmund Lau <edlau%ucf.ics.uci.edu>
   
 丒 Philippe Latu <philippe.latu%linux-france.org>
   
 丒 Arthur van Leeuwen <arthurvl%sci.kun.nl>
   
 丒 Jose Luis Domingo Lopez
   
    <jdomingo@24x7linux.com>
   
 丒 Robert Lowe
   
    <robert.h.lowe@lawrence.edu>
   
 丒 Jason Lunz <j@cc.gatech.edu>
   
 丒 Stuart Lynne <sl@fireplug.net>
   
 丒 Alexey Mahotkin <alexm@formulabez.ru>
   
 丒 Predrag Malicevic <pmalic@ieee.org>
   
 丒 Patrick McHardy <kaber@trash.net>
   
 丒 Andreas Mohr <andi%lisas.de>
   
 丒 James Morris <jmorris@intercode.com.au>
   
 丒 Andrew Morton <akpm%zip.com.au>
   
 丒 Wim van der Most
   
 丒 Stephan Mueller <smueller@chronox.de>
   
 丒 Togan Muftuoglu <toganm%yahoo.com>
   
 丒 Chris Murray <cmurray@stargate.ca>
   
 丒 Patrick Nagelschmidt <dto%gmx.net>
   
 丒 Ram Narula <ram@princess1.net>
   
 丒 Jorge Novo <jnovo@educanet.net>
   
 丒 Patrik <ph@kurd.nu>
   
 丒 P?l Osgy?ny <oplab%westel900.net>
   
 丒 Lutz Preler <Lutz.Pressler%SerNet.DE>
   
 丒 Jason Pyeron <jason%pyeron.com>
   
 丒 Rod Roark <rod%sunsetsystems.com>
   
 丒 Pavel Roskin <proski@gnu.org>
   
 丒 Rusty Russell <rusty%rustcorp.com.au>
   
 丒 Mihai RUSU <dizzy%roedu.net>
   
 丒 Rob Pitman <rob%pitman.co.za>
   
 丒 Jamal Hadi Salim <hadi%cyberus.ca>
   
 丒 Ren? Serral <rserral%ac.upc.es>
   
 丒 David Sauer <davids%penguin.cz>
   
 丒 Sheharyar Suleman Shaikh <sss23@drexel.edu>
   
 丒 Stewart Shields <MourningBlade%bigfoot.com>
   
 丒 Nick Silberstein <nhsilber%yahoo.com>
   
 丒 Konrads Smelkov <konrads@interbaltika.com>
   
 丒 William Stearns
   
    <wstearns@pobox.com>
   
 丒 Andreas Steinmetz <ast%domdv.de>
   
 丒 Matthew Strait <straitm%mathcs.carleton.edu>
   
 丒 Jason Tackaberry <tack@linux.com>
   
 丒 Charles Tassell <ctassell%isn.net>
   
 丒 Glen Turner <glen.turner%aarnet.edu.au>
   
 丒 Tea Sponsor: Eric Veldhuyzen <eric%terra.nu>
   
 丒 Thomas Walpuski <thomas%bender.thinknerd.de>
   
 丒 Song Wang <wsong@ece.uci.edu>
   
 丒 Frank v Waveren <fvw@var.cx>
   
 丒 Chris Wilson
   
    <chris@netservers.co.uk>
   
 丒 Lazar Yanackiev
   
    <Lyanackiev%gmx.net>
   
 

劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒劒 

Chapter 21. 擔杮岅栿偵偮偄偰

杮暥彂偼拞栰晲梇偑東栿偟傑偟偨丅儔僀僙儞僗偼尨暥偲摨偠偔 Open
Publication License 偺 v1.0 偍傛傃偦傟埲崀偵廬偄傑偡丅

杮暥彂偺東栿偵偁偨偭偰偼丄JF Project 偺儊乕儕儞僌儕僗僩傪棙梡偝偣偰偄偨
偩偒傑偟偨丅悪嶳桭復偝傫偵偼丄慡暥偵傢偨傞僠僃僢僋傪偟偰偄偨偩偒傑偟偨
丅愇捤恑偝傫偵偼丄懡偔偺媄弍揑側僐儊儞僩傪偄偨偩偒傑偟偨丅偙偙偵婰偟偰
姶幱偟傑偡丅

