Re: [IT-SecNots] Traffic shaping on debian

[Raúl Alexis Betancor Santana <rabs AT dimension-virtual.com>]

> So, yes, I have 10G uplinks. The main goal is to be able to shape
> traffic from certain hosts to the destinations that are reachable
> through local internet exchange and to all other destinations (world).
> Local IX is connected to one interface of my debian box and worldwide
> traffic flows through the another. The simpliest way to achieve this,
> for my opinion, was to apply egress qdiscs on there interfaces and apply
> filters and classes there also, so it would effectively shape as I need.
> The problem with shaping closer to the source is that I wouldn't be able
> to classify the traffic on switches - it's not only one or a couple of
> destinations, it's something like 30k destinations available through
> local IX.
> 
> Probably you could point me to a better option.
> 
> P.S. to lxP - increasing rate on the default htb class didn't help -
> probably, CPU usage could drop a couple percents lower (not sure,
> really) but is is definitely not significant.
> 
> --
> With kind regards,
> Aleksey

If you are trying to shape 10G links with an Debian box, apart from routing 
... you will have to do lot tunning on the system.

Look for 'High performance Linux routing' on google, you will find lot of
articles explain the caveats you will face.

When going over 1G links ... it's better to use dedicated hardware for 
rouiting
and shaping, IMHO.

Best regards
(null)