Re: Ipfw accept rule

From: Jon Simola (jon_at_abccom.bc.ca)
Date: 09/24/04

  • Next message: jromero_at_save-ferris.com: "freeBSD 5.X SMP --> QUAD XEON SCALABILITY QUESTION"
    Date: Fri, 24 Sep 2004 08:37:38 -0700 (PDT)
    To: Bikrant Neupane <bikrant_ml@wlink.com.np>
    
    

    On Fri, 24 Sep 2004, Bikrant Neupane wrote:

    > > > Well, I have no problem with the MAC filtering rules.
    > > > Only problem that I am having is that the pkts hit the matching rule
    > > > twice as a result I get only half of the b/w than that specified in ipfw
    > > > pipe command.

    Yes, the packets will hit the pipe twice. Once at layer2 and once at
    layer3. You're not stopping the packets from passing through a pipe simply
    by leaving out a "layer2" from the rule.

    ether_input -> ipfw -> ip_input -> ipfw -> network stack

    > > > Isn't there a way to construct rules such that matching pkts hit the rule
    > > > only once?

    Write your ruleset appropriately, or stick "not layer2" on your pipe
    rules.

    ---
    Jon Simola <jon@abccom.bc.ca> | "In the near future - corporate networks
        Systems Administrator     |  reach out to the stars, electrons and light
         ABC  Communications      |  flow throughout the universe." -- GITS
    _______________________________________________
    freebsd-isp@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-isp
    To unsubscribe, send any mail to "freebsd-isp-unsubscribe@freebsd.org"
    

  • Next message: jromero_at_save-ferris.com: "freeBSD 5.X SMP --> QUAD XEON SCALABILITY QUESTION"

    Relevant Pages

    • Re: Ipfw accept rule
      ... the packets will hit the pipe twice. ... layer3. ... by leaving out a "layer2" from the rule. ...
      (freebsd-questions)
    • Re[3]: IPFW DUMMYNET: Several pipes after each other
      ... put two flows to pipe 512Kbit, ... ipfw add 2 queue 1 all from any to any ... First of all packets will be piped to 320Kbit/s then they will be ... Because of flow of 320 is less then 512kbit packets ...
      (freebsd-questions)
    • Re: dummynet dropping too many packets
      ... both "netgraph/ngtee" and "pipe" decide the fate of the packet unless one_pass=0. ... Or do you mean sprinkling smart skiptos here and there? ... IP packets are for- ... Is it a drop in replacement given my ipfw rules? ...
      (freebsd-net)
    • Re: IPFW DUMMYNET: Several pipes after each other
      ... 10 slots ie packets is likely too small a queue size at these rates. ... You want to check the dropped packet stats from 'ipfw pipe show' re ... I had a look at the ipfw howto on the freebsd site, ...
      (freebsd-questions)
    • IPFW traffic shaping questions
      ... I have few questions for ipfw gurus.. ... I'm using "ipfw pipe show" for example but there is always only one host so if I'm testing some rules I can't tell if they work or not (maybe there is some ... I have tried to add rule for ACK packets - no effect. ...
      (freebsd-questions)