1

I'm trying to achieve the following scenario:

Using the iptables command, mark UDP traffic with destination port 1234 that passes through a Linux router with the recommended DSCP value for Expedited Forwarding PHB (46), in case the input rate of this type of traffic exceeds 2Mbps. (I don't want to drop the traffic below 2mbps, just to not be marked with DSCP value 46).

I'm struggling to find a way to mark only the traffic that exceeds 2Mbps. There is no direct way to limit traffic based on the rate using iptables, but I've found that you can use limit or hashlimit in order to obtain something similar. Limit and hashlimit allow you to specify the rate of packets/s, therefore assuming that a packet has 1500 bytes => 2mbps = 2.000.000/1500/8 = aprox 167 packets/s.

That's what I've tried so far, but still all my traffic (including the one below 2mbps) is marked with DSCP value 46:

using limit:

sudo iptables -A OUTPUT -p udp --dport 1234 -m limit --limit 167/s -j ACCEPT
sudo iptables -t mangle -A OUTPUT -p udp --dport 1234 -m recent --name above_limit --set -j DSCP --set-dscp 46

using hashlimit:

sudo iptables -A OUTPUT -m udp -p udp --dport 1234 -m hashlimit --hashlimit-upto 167/sec --hashlimit-mode srcip --hashlimit-name above_2mbps -j ACCEPT
sudo iptables -t mangle -A OUTPUT -p udp --dport 1234 -m recent --name above_limit --set -j DSCP --set-dscp 46

If you have any other suggestions, feel free to share with me.

Thank you!

1
  • 1
    Have removed the other question from stackexchange. May 25, 2023 at 7:37

0

You must log in to answer this question.

Browse other questions tagged .