Open Source Bandwidth Management: Introduction to Linux Traffic Control

Transcription

1 Open Source Bandwidth Management: Introduction to Linux Traffic Control Christian Benvenuti International Centre for Theoretical Physics (ICTP), Trieste [ AfNOG 2007, 30 April 2007, Abuja, Nigeria

2 Agenda Optimization of the use of the external link/s Factors that can contribute to a better use of the bandwidth (distributed optimizations) Translation of policies into network configurations (Traffic Control + Netfilter) Do you have bandwidth problems in your network? Do you have policies in place in your campus? Do you monitor the traffic? Are you using any kind of Shaping/Firewalling software/hardware?

3 The focus of this presentation is on the external link/s Under the assumption that the campus network is significantly faster than the external link/s (to the ISP or to a peer institution), the bottleneck that requires optimization is/are the external link/s. In this presentation I will therefore touch only briefly the use/implications of QoS inside the campus network (for example to support VoIP, etc).

4 Distributed Optimizations Some applications/servers can can be configured (and optimized) separately. For example: (attachments (size, URLs), delayed/batched TX of digests,...) Proxies Traffic can be filtered by the firewall/s according to the policy Traffic can be rate-limited by a device that implements some form of Traffic Control (i.e., shaper). This can be done by the same device that acts as firewall too.

5 Object 2 Where would you do shaping/policing? Border Router firewall Local Internet exchange switch Core Router? Core Switch Core Router Fiber link to building switch Fiber link to building switch Fiber link to building switch Fiber link to building switch (Centralized Vs Distributed)

6 Ingress vs Egress Queuing/Shaping I n t e r n e t Where do you think it is better to drop/delay packets? TX RX queue queue $ Security Vs Bandwidth Asymmetric RX/TX RX TX queue queue Your campus network here

7 Common applications HTTP/FTP DNS... Terminal (SSH/Telnet) TX (SMTP) RX (POP,IMAP) Audio/Video streaming... P2P... Viruses Spyware ( spam) Easy to cache... Not cachable Not cachable (unless...) Malware The effects of these applications (with the exception of spam) can be significantly reduced with some user cooperation How about polices, priorities and shaping?

8 Open Source Bandwidth Management with Linux QoS iproute2 / Traffic Control Firewall iptables / Netfilter...

9 Object 10 A Linux box can be a firewall and a shaper at the same time Open Source VS Commercial Border Router Single Device VS Multiple Devices Firewall Shaper/Policer Core Switch Local Internet exchange switch Core Router Core Router Fiber link to building switch Fiber link to building switch Fiber link to building switch Fiber link to building switch

10 User The big (scary) picture Application 1 (i.e., SSHD)... Application n (i.e., squid) Kernel M N F M N OUTPUT M F POSTROUTING FORWARD INPUT PREROUTING N F M N M Egress Traffic Control Ingress Traffic Control F Filter table M Mangle table eth0 N NAT table (The Raw table is not shown in the figure) eth1

11 Example of iptables command iptables -t <TAB> <OP> <HOOK> <MATCH>... <MATCH> -j <TARGET> I would like to block ingress ICMP echo request messages User SSHD... Squid Table -t filter Kernel OUTPUT POSTROUTING FORWARD INPUT PREROUTING Operation Hook A INPUT Egress Traffic Control Ingress Traffic Control Match/es -p icmp icmp-type echo-request Target -j DROP eth0 eth1 #iptables -t filter A INPUT -p icmp icmp-type echo-request -j DROP

12 Traffic Control Elements Queueing disciplines Classless: FIFO, RED, GRED, TBF, SFQ, NETEM, TEQL Classful: CBQ, HTB, HFSC, PRIO, DS,... Classifiers FW, ROUTE, RSVP, TCINDEX, U32, BASIC Classifier extensions Policers, Actions Estimators

13 Example of Hierarchical Queuing Discipline Campus 50% 25% 25% Faculty 1 Faculty 2 Faculty 3 50% 50% 70% Prio 1 30% Prio 2 Laboratory 1 Laboratory 2 HTTP Anything else Sharing/Borrowing Priorities Default class... Centralized Vs Distributed

14 Example of simple HTB configuration External network Firewall, Shaper/Policer eth1 eth0 Internal network # QUEUE tc qdisc add dev eth1 handle 1:0 root htb default 1:20 Filter Class 1:10 HTB qdisc 1:0 Class 1:1 Class 1:20 # CLASSES tc class add dev eth1 parent 1:0 classid 1:1 htb rate 10Mbit ceil 10Mbit tc class add dev eth1 parent 1:1 classid 1:10 htb rate 7Mbit ceil 10Mbit tc class add dev eth1 parent 1:1 classid 1:20 htb rate 3Mbit ceil 10Mbit # FILTERS ## 1 st solution tc filter add dev eth1 protocol ip parent 1:0 u32 match ip dport 80 0xffff flowid 1:10 ## 2 nd solution iptables -t mangle -A FORWARD -p tcp --dport 80 -j MARK --set-mark 1 tc filter add dev eth1 protocol ip parent 1:0 handle 1 fw classid 1:10

15 Useful links Book: How To Accelerate Your Internet A Practical Guide to bandwidth Management and Optimization Using Open Source Software (you can download it here) Mailing List: LARTC Linux Advanced Routing and Traffic Control

16 Any Questions?