Re: libpcap and tc filters

[Aaron Turner <synfinatic () gmail com>]

On Sun, Jun 5, 2011 at 12:29 AM, Adam Katz <adamkatz0 () gmail com> wrote:
> First of all, thanks for the quick reply.
>
> Well, I am using Linux, sorry for not mentioning that explicitly. tc is the
> built in linux utility for (among other things) traffic shaping... it's a
> pretty useful piece of software. I use it to create three output queues on
> eth0 with a scheduler that selects which of them to dequeue. I immediately
> though of the explanation you gave me and imagined pcap might bypass some of
> the stack but it doesn't seem that way as packets sent with pcap do show up
> in those queues I created, they're only not classified correctly and end up
> in the default queue.
>
> If pcap was completely bypassing the stack, I imagine i would not have seen
> the packets in the queue at all.

Correct.  If they are getting classified, but not correctly, then I'd
have to guess that the classification rules you're using don't match
the traffic.   No idea if it matters, but make sure your IP checksums
are correct.  When you captured the traffic, outbound traffic may have
the wrong checksums.

Other then that, may want to ask the traffic shaping guys.


-- 
Aaron Turner
http://synfin.net/         Twitter: @synfinatic
http://tcpreplay.synfin.net/ - Pcap editing and replay tools for Unix & Windows
Those who would give up essential Liberty, to purchase a little temporary
Safety, deserve neither Liberty nor Safety.
    -- Benjamin Franklin
"carpe diem quam minimum credula postero"
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.