tc-cgroup

title: tc-cgroup(8)

text:
# tc-cgroup(8)

## NAME
cgroup - control group based traffic control filter

## SYNOPSIS

tc filter ... cgroup [ match EMATCH_TREE ] [ action ACTION_SPEC ]

## DESCRIPTION
This filter serves as a hint to tc that the assigned class ID of the net_cls control group the process the packet originates from belongs to should be used for classification. Obviously, it is useful for locally generated packets only.

## OPTIONS
action ACTION_SPEC

Apply an action from the generic actions framework on matching packets.

match EMATCH_TREE

Match packets using the extended match infrastructure. See tc-ematch(8) for a detailed description of the allowed syntax in EMATCH_TREE.

## EXAMPLES
In order to use this filter, a net_cls control group has to be created first and class as well as process ID(s) assigned to it. The following creates a net_cls cgroup named "foobar":

```
modprobe cls_cgroup
mkdir /sys/fs/cgroup/net_cls
mount -t cgroup -onet_cls net_cls /sys/fs/cgroup/net_cls
mkdir /sys/fs/cgroup/net_cls/foobar
```

To assign a class ID to the created cgroup, a file named net_cls.classid has to be created which contains the class ID to be assigned as a hexadecimal, 64bit wide number. The upper 32bits are reserved for the major handle, the remaining hold the minor. So a class ID of e.g. ff:be has to be written like so: 0xff00be (leading zeroes may be omitted). To continue the above example, the following assigns class ID 1:2 to foobar cgroup:

```
echo 0x10002 > /sys/fs/cgroup/net_cls/foobar/net_cls.classid
```

Finally some PIDs can be assigned to the given cgroup:

```
echo 1234 > /sys/fs/cgroup/net_cls/foobar/tasks
echo 5678 > /sys/fs/cgroup/net_cls/foobar/tasks
```

Now by simply attaching a cgroup filter to a qdisc makes packets from PIDs 1234 and 5678 be pushed into class 1:2.

## SEE ALSO
tc(8), tc-ematch(8),

the file Documentation/cgroups/net_cls.txt of the Linux kernel tree


tc-choke

title: tc-choke(8)

summary: choose and keep scheduler

text:
# tc-choke(8)

## NAME
choke - choose and keep scheduler

## SYNOPSIS
tc qdisc ... choke limit packets min packets max packets avpkt bytes burst packets [ ecn ] [ bandwidth rate ] probability chance

## DESCRIPTION
CHOKe (CHOose and Keep for responsive flows, CHOose and Kill for unresponsive flows) is a classless qdisc designed to both identify and penalize flows that monopolize the queue. CHOKe is a variation of RED, and the configuration is similar to RED.

## ALGORITHM
Once the queue hits a certain average length, a random packet is drawn from the queue. If both the to-be-queued and the drawn packet belong to the same flow, both packets are dropped. Otherwise, if the queue length is still below the maximum length, the new packet has a configurable chance of being marked (which may mean dropped). If the queue length exceeds max, the new packet will always be marked (or dropped). If the queue length exceeds limit, the new packet is always dropped.

The marking probability computation is the same as used by the RED qdisc.

## PARAMETERS
The parameters are the same as for RED, except that RED uses bytes whereas choke counts packets. See tc-red(8) for a description.

## SOURCE
o

R. Pan, B. Prabhakar, and K. Psounis, "CHOKe, A Stateless Active Queue Management Scheme for Approximating Fair Bandwidth Allocation", IEEE INFOCOM, 2000.

o

A. Tang, J. Wang, S. Low, "Understanding CHOKe: Throughput and Spatial Characteristics", IEEE/ACM Transactions on Networking, 2004

## SEE ALSO
tc(8), tc-red(8)

## AUTHOR
sched_choke was contributed by Stephen Hemminger.

branch: sisyphus


tc-codel

title: tc-codel(8)

text:
# tc-codel(8)

## NAME
CoDel - Controlled-Delay Active Queue Management algorithm

## SYNOPSIS
tc qdisc ... codel [ limit PACKETS ] [ target TIME ] [ interval TIME ] [ ecn | noecn ] [ ce_threshold TIME ]

## DESCRIPTION
CoDel (pronounced "coddle") is an adaptive "no-knobs" active queue management algorithm (AQM) scheme that was developed to address the shortcomings of RED and its variants. It was developed with the following goals in mind:

- It should be parameterless.

- It should keep delays low while permitting bursts of traffic.

- It should control delay.

- It should adapt dynamically to changing link rates with no impact on utilization.

- It should be simple and efficient and should scale from simple to complex routers.

## ALGORITHM
CoDel comes with three major innovations. Instead of using queue size or queue average, it uses the local minimum queue as a measure of the standing/persistent queue. Second, it uses a single state-tracking variable of the minimum delay to see where it is relative to the standing queue delay. Third, instead of measuring queue size in bytes or packets, it is measured in packet-sojourn time in the queue.

CoDel measures the minimum local queue delay (i.e. standing queue delay) and compares it to the value of the given acceptable queue delay target. As long as the minimum queue delay is less than target or the buffer contains fewer than MTU worth of bytes, packets are not dropped. Codel enters a dropping mode when the minimum queue delay has exceeded target for a time greater than interval. In this mode, packets are dropped at different drop times which is set by a control law. The control law ensures that the packet drops cause a linear change in the throughput. Once the minimum delay goes below target, packets are no longer dropped.

Additional details can be found in the paper cited below.

## PARAMETERS

### limit
is the hard limit on the real queue size. When this limit is reached, incoming packets are dropped. If the value is lowered, packets are dropped so that the new limit is met. Default is 1000 packets.

### target
is the acceptable minimum standing/persistent queue delay. This minimum delay is identified by tracking the local minimum queue delay that packets experience. Default and recommended value is 5ms.

### interval
is used to ensure that the measured minimum delay does not become too stale. The minimum delay must be experienced in the last epoch of length interval. It should be set on the order of the worst-case RTT through the bottleneck to give endpoints sufficient time to react. Default value is 100ms.

### ecn | noecn
can be used to mark packets instead of dropping them. If ecn has been enabled, noecn can be used to turn it off and vice-a-versa. By default, ecn is turned off.

### ce_threshold
sets a threshold above which all packets are marked with ECN Congestion Experienced. This is useful for DCTCP-style congestion control algorithms that require marking at very shallow queueing thresholds.

## EXAMPLES

\# tc qdisc add dev eth0 root codel

\# tc -s qdisc show

qdisc codel 801b: dev eth0 root refcnt 2 limit 1000p target 5.0ms interval 100.0ms

Sent 245801662 bytes 275853 pkt (dropped 0, overlimits 0 requeues 24)

backlog 0b 0p requeues 24

count 0 lastcount 0 ldelay 2us drop_next 0us

maxpacket 7306 ecn_mark 0 drop_overlimit 0

\# tc qdisc add dev eth0 root codel limit 100 target 4ms interval 30ms ecn

\# tc -s qdisc show

qdisc codel 801c: dev eth0 root refcnt 2 limit 100p target 4.0ms interval 30.0ms ecn

Sent 237573074 bytes 268561 pkt (dropped 0, overlimits 0 requeues 5)

backlog 0b 0p requeues 5

count 0 lastcount 0 ldelay 76us drop_next 0us

maxpacket 2962 ecn_mark 0 drop_overlimit 0

## SEE ALSO
tc(8), tc-red(8)

## SOURCES
Kathleen Nichols and Van Jacobson, "Controlling Queue Delay", ACM Queue, http://queue.acm.org/detail.cfm?id=2209336

## AUTHORS
CoDel was implemented by Eric Dumazet and David Taht. This manpage was written by Vijay Subramanian. Please reports corrections to the Linux Networking mailing list <netdev@vger.kernel.org>.


tc-connmark

title: tc-connmark(8)

text:
# tc-connmark(8)

## NAME
connmark - netfilter connmark retriever action

## SYNOPSIS

tc ... action connmark [ zone u16_zone_index ] [ CONTROL ] [ index u32_index ]

CONTROL := { reclassify | pipe | drop | continue | ok }

## DESCRIPTION
The connmark action is used to restore the connection's mark value into the packet's fwmark.

## OPTIONS
zone u16_zone_index

Specify the conntrack zone when doing conntrack lookups for packets. u16_zone_index is a 16bit unsigned decimal value.

CONTROL

How to continue after executing this action.

reclassify

Restarts classification by jumping back to the first filter attached to this action's parent.

pipe

Continue with the next action, this is the default.

drop

shot

Packet will be dropped without running further actions.

continue

Continue classification with next filter in line.

pass

Return to calling qdisc for packet processing. This ends the classification process.

index u32_index

Specify an index for this action in order to being able to identify it in later commands. u32_index is a 32bit unsigned decimal value.

## SEE ALSO
tc(8)


tc-csum

title: tc-csum(8)

text:
# tc-csum(8)

## NAME
csum - checksum update action

## SYNOPSIS

tc ... action csum UPDATE

UPDATE := TARGET [ UPDATE ]

TARGET := { ip4h | icmp | igmp | tcp | udp | udplite | sctp | SWEETS }

SWEETS := { and | or | + }

## DESCRIPTION
The csum action triggers checksum recalculation of specified packet headers. It is commonly used to fix incorrect checksums after the pedit action has modified the packet content.

## OPTIONS
TARGET

Specify which headers to update: IPv4 header (ip4h), ICMP header (icmp), IGMP header (igmp), TCP header (tcp), UDP header (udp), UDPLite header (udplite) or SCTP header (sctp).

SWEETS

These are merely syntactic sugar and ignored internally.

## EXAMPLES
The following performs stateless NAT for incoming packets from 192.0.2.100 to new destination 198.51.100.1. Assuming these are UDP packets, both IP and UDP checksums have to be recalculated:

```
# tc qdisc add dev eth0 ingress handle ffff:
# tc filter add dev eth0 prio 1 protocol ip parent ffff: \
	u32 match ip src 192.0.2.100/32 flowid :1 \
	action pedit munge ip dst set 198.51.100.1 pipe \
	csum ip and udp
```

## SEE ALSO
tc(8), tc-pedit(8)


tc-ct

title: tc-ct(8)

summary: tc connection tracking action

text:
# tc-ct(8)

## NAME
ct - tc connection tracking action

## SYNOPSIS

tc ... action ct commit [ force ] [ zone ZONE ] [ mark MASKED_MARK ] [ label MASKED_LABEL ] [ nat NAT_SPEC ]

tc ... action ct [ nat ] [ zone ZONE ]

tc ... action ct clear

## DESCRIPTION
The ct action is a tc action for sending packets and interacting with the netfilter conntrack module.

It can (as shown in the synopsis, in order):

Send the packet to conntrack, and commit the connection, while configuring a 32bit mark, 128bit label, and src/dst nat.

Send the packet to conntrack, which will mark the packet with the connection's state and configured metadata (mark/label), and execute previous configured nat.

Clear the packet's of previous connection tracking state.

## OPTIONS
zone ZONE

Specify a conntrack zone number on which to send the packet to conntrack.

mark MASKED_MARK

Specify a masked 32bit mark to set for the connection (only valid with commit).

label MASKED_LABEL

Specify a masked 128bit label to set for the connection (only valid with commit).

nat NAT_SPEC

Where NAT_SPEC := {src|dst} addr addr1[-addr2] [port port1[-port2]] Specify src/dst and range of nat to configure for the connection (only valid with commit).

src/dst - configure src or dst nat

addr1/addr2 - IPv4/IPv6 addresses

port1/port2 - Port numbers

nat

Restore any previous configured nat.

clear

Remove any conntrack state and metadata (mark/label) from the packet (must only option specified).

force

Forces conntrack direction for a previously committed connections, so that current direction will become the original direction (only valid with commit).

## EXAMPLES
Example showing natted firewall in conntrack zone 2, and conntrack mark usage:

```
#Add ingress qdisc on eth0 and eth1 interfaces

$ tc qdisc add dev eth0 ingress
$ tc qdisc add dev eth1 ingress
#Setup filters on eth0, allowing opening new connections in zone 2, and doing src nat + mark for each new connection
$ tc filter add dev eth0 ingress prio 1 chain 0 proto ip flower ip_proto tcp ct_state -trk \
action ct zone 2 pipe action goto chain 2
$ tc filter add dev eth0 ingress prio 1 chain 2 proto ip flower ct_state +trk+new \
action ct zone 2 commit mark 0xbb nat src addr 5.5.5.7 pipe action mirred egress redirect dev eth1
$ tc filter add dev eth0 ingress prio 1 chain 2 proto ip flower ct_zone 2 ct_mark 0xbb ct_state +trk+est \
action ct nat pipe action mirred egress redirect dev eth1
#Setup filters on eth1, allowing only established connections of zone 2 through, and reverse nat (dst nat in this case)
$ tc filter add dev eth1 ingress prio 1 chain 0 proto ip flower ip_proto tcp ct_state -trk \
action ct zone 2 pipe action goto chain 1
$ tc filter add dev eth1 ingress prio 1 chain 1 proto ip flower ct_zone 2 ct_mark 0xbb ct_state +trk+est \
action ct nat pipe action mirred egress redirect dev eth0
```

## SEE ALSO
tc(8), tc-flower(8) tc-mirred(8)

## AUTHORS
Paul Blakey <paulb@mellanox.com>

Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>

Yossi Kuperman <yossiku@mellanox.com>


tc-ctinfo

title: tc-ctinfo(8)

summary: tc connmark processing action

text:
# tc-ctinfo(8)

## NAME
ctinfo - tc connmark processing action

## SYNOPSIS
tc ... action ctinfo [ dscp MASK [STATEMASK] ] [ cpmark [MASK] ] [ zone ZONE ] [ CONTROL ] [ index <INDEX> ]

## DESCRIPTION
CTINFO (Conntrack Information) is a tc action for retrieving data from conntrack marks into various fields. At present it has two independent processing modes which may be viewed as sub-functions.

DSCP mode copies a DSCP stored in conntrack's connmark into the IPv4/v6 diffserv field. The copying may conditionally occur based on a flag also stored in the connmark. DSCP mode was designed to assist in restoring packet classifications on ingress, classifications which may then be used by qdiscs such as CAKE. It may be used in any circumstance where ingress classification needs to be maintained across links that otherwise bleach or remap according to their own policies.

CPMARK (copymark) mode copies the conntrack connmark into the packet's mark field. Without additional parameters it is functionally completely equivalent to the existing connmark action. An optional mask may be specified to mask which bits of the connmark are restored. This may be useful when DSCP and CPMARK modes are combined.

Simple statistics (tc -s) on DSCP restores and CPMARK copies are maintained where values for set indicate a count of packets altered for that mode. DSCP includes an error count where the destination packet's diffserv field was unwriteable.

## PARAMETERS

### DSCP mode parameters:
mask

A mask of 6 contiguous bits indicating where the DSCP value is located in the 32 bit conntrack mark field. A mask must be provided for this mode. mask is a 32 bit unsigned value.

statemask

A mask of at least 1 bit indicating where a conditional restore flag is located in the 32 bit conntrack mark field. The statemask bit/s must NOT overlap the mask bits. The DSCP will be restored if the conntrack mark logically ANDed with the statemask yields a non-zero result. statemask is an optional unsigned 32 bit value.

### CPMARK mode parameters:
mask

Store the logically ANDed result of conntrack mark and mask into the packet's mark field. Default is 0xffffffff i.e. the whole mark field. mask is an optional unsigned 32 bit value

### Overall action parameters:
zone

Specify the conntrack zone when doing conntrack lookups for packets. zone is a 16bit unsigned decimal value. Default is 0.

CONTROL

The following keywords allow one to control how the tree of qdisc, classes, filters and actions is further traversed after this action.

reclassify

Restart with the first filter in the current list.

pipe

Continue with the next action attached to the same filter.

drop

Drop the packet.

shot

synonym for drop

continue

Continue classification with the next filter in line.

pass

Finish classification process and return to calling qdisc for further packet processing. This is the default.

index

Specify an index for this action in order to being able to identify it in later commands. index is a 32bit unsigned decimal value.

## EXAMPLES
Example showing conditional restoration of DSCP on ingress via an IFB

```
#Set up the IFB interface

tc qdisc add dev ifb4eth0 handle ffff: ingress
#Put CAKE qdisc on it

tc qdisc add dev ifb4eth0 root cake bandwidth 40mbit
#Set interface UP

ip link set dev ifb4eth0 up
#Add 2 actions, ctinfo to restore dscp & mirred to redirect the packets to IFB

tc filter add dev eth0 parent ffff: protocol all prio 10 u32 \

    match u32 0 0 flowid 1:1 action    \

    ctinfo dscp 0xfc000000 0x01000000  \

    mirred egress redirect dev ifb4eth0
tc -s qdisc show dev eth0 ingress

 filter parent ffff: protocol all pref 10 u32 chain 0

 filter parent ffff: protocol all pref 10 u32 chain 0 fh 800: ht divisor 1

 filter parent ffff: protocol all pref 10 u32 chain 0 fh 800::800 order 2048 key ht 800 bkt 0 flowid 1:1 not_in_hw

  match 00000000/00000000 at 0

    action order 1: ctinfo zone 0 pipe

    index 2 ref 1 bind 1 dscp 0xfc000000 0x01000000 installed 72 sec used 0 sec DSCP set 1333 error 0 CPMARK set 0

    Action statistics:

    Sent 658484 bytes 1833 pkt (dropped 0, overlimits 0 requeues 0)

    backlog 0b 0p requeues 0

    action order 2: mirred (Egress Redirect to device ifb4eth0) stolen

    index 1 ref 1 bind 1 installed 72 sec used 0 sec

    Action statistics:

    Sent 658484 bytes 1833 pkt (dropped 0, overlimits 0 requeues 0)

    backlog 0b 0p requeues 0
```

Example showing conditional restoration of DSCP on egress

This may appear nonsensical since iptables marking of egress packets is easy to achieve, however the iptables flow classification rules may be extensive and so some sort of set once and forget may be useful especially on cpu constrained devices.

```
# Send unmarked connections to a marking chain which needs to store a DSCP
and set statemask bit in the connmark

iptables -t mangle -A POSTROUTING -o eth0 -m connmark \

    --mark 0x00000000/0x01000000 -g CLASS_MARKING_CHAIN
# Apply marked DSCP to the packets

tc filter add dev eth0 protocol all prio 10 u32 \

    match u32 0 0 flowid 1:1 action \

    ctinfo dscp 0xfc000000 0x01000000
tc -s filter show dev eth0

 filter parent 800e: protocol all pref 10 u32 chain 0

 filter parent 800e: protocol all pref 10 u32 chain 0 fh 800: ht divisor 1

 filter parent 800e: protocol all pref 10 u32 chain 0 fh 800::800 order 2048 key ht 800 bkt 0 flowid 1:1 not_in_hw

  match 00000000/00000000 at 0

    action order 1: ctinfo zone 0 pipe

    index 1 ref 1 bind 1 dscp 0xfc000000 0x01000000 installed 7414 sec used 0 sec DSCP set 53404 error 0 CPMARK set 0

    Action statistics:

    Sent 32890260 bytes 120441 pkt (dropped 0, overlimits 0 requeues 0)

    backlog 0b 0p requeues 0
```

## SEE ALSO
tc(8), tc-cake(8) tc-connmark(8) tc-mirred(8)

## AUTHORS
ctinfo was written by Kevin Darbyshire-Bryant.


tc-drr

title: tc-drr(8)

summary: deficit round robin scheduler

text:
# tc-drr(8)

## NAME
drr - deficit round robin scheduler

## SYNOPSIS
tc qdisc ... add drr [ quantum bytes ]

## DESCRIPTION
The Deficit Round Robin Scheduler is a classful queuing discipline as a more flexible replacement for Stochastic Fairness Queuing.

Unlike SFQ, there are no built-in queues -- you need to add classes and then set up filters to classify packets accordingly. This can be useful e.g. for using RED qdiscs with different settings for particular traffic. There is no default class -- if a packet cannot be classified, it is dropped.

## ALGORITHM
Each class is assigned a deficit counter, initialized to quantum.

DRR maintains an (internal) ''active'' list of classes whose qdiscs are non-empty. This list is used for dequeuing. A packet is dequeued from the class at the head of the list if the packet size is smaller or equal to the deficit counter. If the counter is too small, it is increased by quantum and the scheduler moves on to the next class in the active list.

## PARAMETERS
quantum

Amount of bytes a flow is allowed to dequeue before the scheduler moves to the next class. Defaults to the MTU of the interface. The minimum value is 1.

## EXAMPLE & USAGE
To attach to device eth0, using the interface MTU as its quantum:

\# tc qdisc add dev eth0 handle 1 root drr

Adding two classes:

\# tc class add dev eth0 parent 1: classid 1:1 drr

\# tc class add dev eth0 parent 1: classid 1:2 drr

You also need to add at least one filter to classify packets.

\# tc filter add dev eth0 protocol .. classid 1:1

Like SFQ, DRR is only useful when it owns the queue -- it is a pure scheduler and does not delay packets. Attaching non-work-conserving qdiscs like tbf to it does not make sense -- other qdiscs in the active list will also become inactive until the dequeue operation succeeds. Embed DRR within another qdisc like HTB or HFSC to ensure it owns the queue.

You can mimic SFQ behavior by assigning packets to the attached classes using the flow filter:

tc qdisc add dev .. drr

for i in .. 1024;do

tc class add dev .. classid $handle:$(print %x $i)

tc qdisc add dev .. fifo limit 16

done

tc filter add .. protocol ip .. $handle flow hash keys src,dst,proto,proto-src,proto-dst divisor 1024 perturb 10

## SOURCE
o

M. Shreedhar and George Varghese "Efficient Fair Queuing using Deficit Round Robin", Proc. SIGCOMM 95.

## NOTES
This implementation does not drop packets from the longest queue on overrun, as limits are handled by the individual child qdiscs.

## SEE ALSO
tc(8), tc-htb(8), tc-sfq(8)

## AUTHOR
sched_drr was written by Patrick McHardy.


title: tc-dualpi2(8)

text:
# tc-dualpi2(8)

## NAME
DUALPI2 - Dual Queue Proportional Integral Controller AQM - Improved with a square

## SYNOPSIS

tc qdisc ... dualpi2

[ limit PACKETS ]

[ memlimit BYTES ]

[ coupling_factor NUMBER ]

[ step_thresh TIME|PACKETS ]

[ min_qlen_step PACKETS ]

[ drop_on_overload | overflow ]

[ drop_enqueue | drop_dequeue ]

[ l4s_ect | any_ect ]

[ classic_protection PERCENTAGE ]

[ max_rtt TIME [ typical_rtt TIME ]]

[ target TIME ]

[ tupdate TIME ]

[ alpha float ]

[ beta float ]

[ split_gso | no_split_gso ]

## DESCRIPTION
DUALPI2 AQM is a combination of the DUALQ Coupled-AQM with a PI2 base-AQM. The PI2 AQM (details can be found in the paper cited below) is in turn both an extension and a simplification of the PIE AQM. PI2 makes quite some PIE heuristics unnecessary, while being able to control scalable congestion controls like TCP-Prague. With PI2, both Reno/Cubic can be used in parallel with Prague, maintaining window fairness. DUALQ provides latency separation between low latency Prague flows and Reno/Cubic flows that need a bigger queue. The main design goals are:

- L4S - Low Loss, Low Latency and Scalable congestion control support

- DualQ option to separate the L4S traffic in a low latency queue (L-queue), without harming remaining traffic that is scheduled in classic queue (C-queue) due to congestion-coupling

- Configurable overload strategies

- Use of sojourn time to reliably estimate queue delay

- Simple implementation

- Guaranteed stability and fast responsiveness

The detailed PI2 parameters (alpha, beta, and tupdate) of DualPI2 are hard to get right and typically give bad results if just tried or guessed. These parameters need to be calculated to a coherent set with a typical objective in mind. DualPI2 has a set of default parameters that can be used for the general Internet, where the maximum RTT is around 100ms and the typical RTT is around 15ms. It is highly recommended to use max_rtt and typical_rtt (or target) helper parameters if your deployment is deviating from the above objectives (e.g., in a data center). These helpers are used to provide the theoretically optimal PI2 parameters (alpha, beta, and tupdate) for those objectives, and that can be used as a basis for further finetuning, experimentation, and testing if desired.

## ALGORITHM
DUALPI2 is designed to provide low loss and low latency to L4S traffic, without harming classic traffic. Every update interval, a new internal base probability is calculated based on queue delay. The base probability is updated with a delta based on the difference between the current queue delay and the target delay, and the queue growth compared with the queuing delay during the previous tupdate interval. The integral gain factor alpha is used to correct slowly enough any persistent standing queue error to the user specified target delay, while the proportional gain factor beta is used to quickly compensate for queue changes (growth or shrink).

The updated base probability is used as input to decide to mark and drop packets. DUALPI2 scales the calculated probability for each of the two queues accordingly. For the L-queue, the probability is multiplied by a coupling_factor , while for the C-queue, it is squared to compensate the squareroot rate equation of Reno/Cubic. The ECT identifier ( l4s_ect|any_ect ) is used to classify traffic into respective queues.

If DUALPI2 AQM has detected overload (when excessive non-responsive traffic is sent), it can signal congestion solely using drop , irrespective of the ECN field, or alternatively limit the drop probability and let the queue grow and eventually overflow (like tail-drop).

Additional details can be found in the RFC cited below.

## PARAMETERS
limit PACKETS

Limit the number of packets that can be enqueued. Incoming packets will be dropped once this limit is reached. This limit is common for the L-queue and C-queue. Defaults to 10000 packets. This is about 125ms delay on a 1Gbps link.

memlimit BYTES

Limit the total amount of memory that can be used. Incoming packets will be dropped once this memlimit is reached. This memlimit is common for the L-queue and C-queue. Defaults to 10000 * interface MTU bytes.

coupling_factor NUMBER

Set the coupling rate factor between Classic and L4S. Defaults to 2

l4s_ect|any_ect

Configures the ECT classifier. Packets whose ECT codepoint matches this are sent to the L-queue, where they receive a scalable marking. Defaults to l4s_ect , i.e., the L4S identifier ECT(1). Setting this to any_ect causes all packets whose ECN field is not zero to be sent to the L-queue. This enables it to be backward compatible with, e.g., DCTCP. Note DCTCP should only be used for intra-DC traffic with very low RTTs and AQM delay targets bigger than those RTTs, separated from Internet traffic (also if Prague compliant CC), as it does not support all Prague requirements that make sure that a congestion control can work well with the range of RTTs on the Internet.

step_thresh TIME | PACKETS

Set the step threshold for the L-queue. This will cause packets with a sojourn time exceeding the threshold to always be marked. This value can either be specified using time units (i.e., us, ms, s), or in packets (p, pkt, packet(s)). A value without units is assumed to be in time (us). If defining the step in packets, be sure to disable GRO on the ingress interfaces. Defaults to 1ms

min_qlen_step PACKETS

Incoming packets enqueued to the L-queue may apply the step threshold when the queue length of the L-queue exceeds this value. Default to 0 packets. This means that every enqueued packets to the L-queue with a sojourn time exceeds the step threshold will be marked.

drop_on_overload | overflow

Control the overload strategy. drop_on_overload preserves the delay in the L-queue by dropping in both queues on overload. overflow sacrifices delay to avoid losses, eventually resulting in a taildrop behavior once the limit is reached. Defaults to drop_on_overload

drop_enqueue | drop_dequeue

Decide when packets are PI-based dropped or marked. The step_thresh based L4S marking is always at dequeue. Defaults to drop_dequeue

classic_protection PERCENTAGE

Protects the C-queue from unresponsive traffic in the L-queue. This bounds the maximal scheduling delay in the C-queue to be (100 - PERCENTAGE) times greater than the one in the L-queue. Defaults to 10

typical_rtt TIME

max_rtt TIME

Specify the maximum round trip time (RTT) and/or the typical RTT of the traffic that will be controlled by DUALPI2. These values are specified using time units (i.e., us, ms, s). A value without units is assumed to be in us. If either max_rtt or typical_rtt is not specified, the missing value will be computed from the following relationship: max_rtt = typical_rtt * 6. If any of these parameters is given, it will be used to automatically compute suitable values for alpha, beta, target, and tupdate, according to the relationship from the appendix A.1 in the IETF RFC cited below, to achieve a stable control. Consequently, those derived values will override their eventual user-provided ones. The default range of operation for the qdisc uses max_rtt = 100ms and typical_rtt = 15ms , which is suited to controlling Internet traffic.

target TIME

Set the expected queue delay. Defaults to 15 ms. A value without units is assumed to be in us.

tupdate TIME

Set the frequency at which the system drop probability is calculated. Defaults to 16 ms. A value without units is assumed to be in microseconds. This should be less than one-third of the maximum RTT supported.

alpha float

beta float

Set alpha and beta, the integral and proportional gain factors in Hz for the PI controller. These can be calculated based on control theory. Defaults are 0.16 and 3.2 Hz, which provide stable control for RTT's up to 100ms with tupdate of 16ms. Be aware, unlike with PIE, these are the real unscaled gain factors. If not provided, they will be automatically derived from typical_rtt and max_rtt , if one of them or both are provided.

split_gso | no_split_gso

Decide how to handle aggregated packets. Either treat the aggregate as a single packet (thus all share fate with respect to marks and drops) with no_split_gso , trading some tail latency for CPU usage, or treat each packet individually (i.e., split them) with split_gso to enable fine-grained marking/dropping of packets to control queueing latencies. Defaults to split_gso

## EXAMPLES
Setting DUALPI2 for the Internet with default parameters:

\# sudo tc qdisc add dev eth0 root dualpi2

Setting DUALPI2 for datacenter with legacy DCTCP using ECT(0):

\# sudo tc qdisc add dev eth0 root dualpi2 any_ect

## FILTERS
This qdisc can be used in conjunction with tc-filters. More precisely, it will honor filters "stealing packets", as well as accept other classification schemes.

Packets whose priority/classid are set to

1 will be enqueued in the L-queue, alongside L4S traffic, and thus subject to the increased marking probability (or drops if they are marked not-ECT).

Packets whose priority/classid are set to

2 will also be enqueued in the L-queue, but will never be dropped if they are not-ECT (unless the qdisc is full and thus resorts to taildrop).

Finally, all the other classid/priority map to the C-queue.

## SEE ALSO
tc(8), tc-pie(8)

## SOURCES

- IETF RFC9332 : https://datatracker.ietf.org/doc/html/rfc9332

- CoNEXT '16 Proceedings of the 12th International on Conference on emerging Networking Experiments and Technologies : "PI2: A Linearized AQM for both Classic and Scalable TCP"

## AUTHORS
DUALPI2 was implemented by Koen De Schepper, Olga Albisser, Henrik Steen, Olivier Tilmans, and Chia-Yu Chang, also the authors of this man page. Please report bugs and corrections to the Linux networking development mailing list at <netdev@vger.kernel.org>.


tc-ematch

title: tc-ematch(8)

summary: extended matches for use with basic, cgroup  or flow filters

text:
# tc-ematch(8)

## NAME
ematch - extended matches for use with "basic", "cgroup" or "flow" filters

## SYNOPSIS
tc filter add .. basic match EXPR .. flowid ..

EXPR := TERM [ { and | or } EXPR ]

TERM := [ not ] { MATCH | '(' EXPR ')' }

MATCH := module '(' ARGS ')'

ARGS := ARG1 ARG2 ..

## MATCHES

### cmp
Simple comparison ematch: arithmetic compare of packet data to a given value.

cmp( ALIGN at OFFSET [ ATTRS ] { eq | lt | gt } VALUE )

ALIGN := { u8 | u16 | u32 }

ATTRS := [ layer LAYER ] [ mask MASK ] [ trans ]

LAYER := { link | network | transport | 0..2 }

### meta
Metadata ematch

meta( OBJECT { eq | lt |gt } OBJECT )

OBJECT := { META_ID | VALUE }

META_ID := id [ shift SHIFT ] [ mask MASK ]

meta attributes:

random 32 bit random value

loadavg_1 Load average in last 5 minutes

nf_mark Netfilter mark

vlan Vlan tag

sk_rcvbuf Receive buffer size

sk_snd_queue Send queue length

A full list of meta attributes can be obtained via

\# tc filter add dev eth1 basic match 'meta(list)'

### nbyte
match packet data byte sequence

nbyte( NEEDLE at OFFSET [ layer LAYER ] )

NEEDLE := { string | c-escape-sequence }

OFFSET := int

LAYER := { link | network | transport | 0..2 }

### u32
u32 ematch

u32( ALIGN VALUE MASK at [ nexthdr+ ] OFFSET )

ALIGN := { u8 | u16 | u32 }

### ipset
test packet against ipset membership

ipset( SETNAME FLAGS )

SETNAME := string

FLAGS := { FLAG [, FLAGS] }

The flag options are the same as those used by the iptables "set" match.

When using the ipset ematch with the "ip_set_hash:net,iface" set type, the interface can be queried using "src,dst (source ip address, outgoing interface) or "src,src" (source ip address, incoming interface) syntax.

### ipt
test packet against xtables matches

ipt( [-6] -m MATCH_NAME FLAGS )

MATCH_NAME := string

FLAGS := { FLAG [, FLAGS] }

The flag options are the same as those used by the xtable match used.

### canid
ematch rule to match CAN frames

canid( IDLIST )

IDLIST := IDSPEC[IDLIST]

IDSPEC := { ’sff’ CANID | ’eff’ CANID }

CANID := ID[:MASK]

ID, MASK := hexadecimal number (i.e. 0x123)

## CAVEATS
The ematch syntax uses '(' and ')' to group expressions. All braces need to be escaped properly to prevent shell commandline from interpreting these directly.

When using the ipset ematch with the "ifb" device, the outgoing device will be the ifb device itself, e.g. "ifb0". The original interface (i.e. the device the packet arrived on) is treated as the incoming interface.

## EXAMPLE & USAGE
\# tc filter add .. basic match ...

\# 'cmp(u16 at 3 layer 2 mask 0xff00 gt 20)'

\# 'meta(nfmark gt 24)' and 'meta(tcindex mask 0xf0 eq 0xf0)'

\# 'nbyte("ababa" at 12 layer 1)'

\# 'u32(u16 0x1122 0xffff at nexthdr+4)'

Check if packet source ip address is member of set named bulk:

\# 'ipset(bulk src)'

Check if packet source ip and the interface the packet arrived on is member of "hash:net,iface" set named interactive:

\# 'ipset(interactive src,src)'

Check if packet matches an IPSec state with reqid 1:

\# 'ipt(-m policy --dir in --pol ipsec --reqid 1)'

## AUTHOR
The extended match infrastructure was added by Thomas Graf.


tc-etf

title: tc-etf(8)

summary: Earliest TxTime First (ETF) Qdisc

text:
# tc-etf(8)

## NAME
ETF - Earliest TxTime First (ETF) Qdisc

## SYNOPSIS
tc qdisc ... dev dev parent classid [ handle major: ] etf clockid clockid [ delta delta_nsecs ] [ deadline_mode ] [ offload ]

## DESCRIPTION
The ETF (Earliest TxTime First) qdisc allows applications to control the instant when a packet should be dequeued from the traffic control layer into the netdevice. If offload is configured and supported by the network interface card, the it will also control when packets leave the network controller.

ETF achieves that by buffering packets until a configurable time before their transmission time (i.e. txtime, or deadline), which can be configured through the delta option.

The qdisc uses a rb-tree internally so packets are always 'ordered' by their txtime and will be dequeued following the (next) earliest txtime first.

It relies on the SO_TXTIME socket option and the SCM_TXTIME CMSG in each packet field to configure the behavior of time dependent sockets: the clockid to be used as a reference, if the expected mode of txtime for that socket is deadline or strict mode, and if packet drops should be reported on the socket's error queue. See socket(7) for more information.

The etf qdisc will drop any packets with a txtime in the past, or if a packet expires while waiting for being dequeued.

This queueing discipline is intended to be used by TSN (Time Sensitive Networking) applications, and it exposes a traffic shaping functionality that is commonly documented as "Launch Time" or "Time-Based Scheduling" by vendors and the documentation of network interface controllers.

ETF is meant to be installed under another qdisc that maps packet flows to traffic classes, one example is mqprio(8).

## PARAMETERS
clockid

Specifies the clock to be used by qdisc's internal timer for measuring time and scheduling events. The qdisc expects that packets passing through it to be using this same clockid as the reference of their txtime timestamps. It will drop packets coming from sockets that do not comply with that. For more information about time and clocks on Linux, please refer to time(7) and clock_gettime(3).

delta

After enqueueing or dequeueing a packet, the qdisc will schedule its next wake-up time for the next txtime minus this delta value. This means delta can be used as a fudge factor for the scheduler latency of a system. This value must be specified in nanoseconds. The default value is 0 nanoseconds.

deadline_mode

When deadline_mode is set, the qdisc will handle txtime with a different semantics, changed from a 'strict' transmission time to a deadline. In practice, this means during the dequeue flow etf(8) will set the txtime of the packet being dequeued to 'now'. The default is for this option to be disabled.

offload

When offload is set, etf(8) will try to configure the network interface so time-based transmission arbitration is enabled in the controller. This feature is commonly referred to as "Launch Time" or "Time-Based Scheduling" by the documentation of network interface controllers. The default is for this option to be disabled.

skip_sock_check

etf(8) currently drops any packet which does not have a socket associated with it or if the socket does not have SO_TXTIME socket option set. But, this will not work if the launchtime is set by another entity inside the kernel (e.g. some other Qdisc). Setting the skip_sock_check will skip checking for a socket associated with the packet.

## EXAMPLES
ETF is used to enforce a Quality of Service. It controls when each packets should be dequeued and transmitted, and can be used for limiting the data rate of a traffic class. To separate packets into traffic classes the user may choose mqprio(8), and configure it like this:

```
# tc qdisc add dev eth0 handle 100: parent root mqprio num_tc 3 \
	map 2 2 1 0 2 2 2 2 2 2 2 2 2 2 2 2 \
	queues 1@0 1@1 2@2 \
	hw 0
```

To replace the current queueing discipline by ETF in traffic class number 0, issue:

```
# tc qdisc replace dev eth0 parent 100:1 etf \
	clockid CLOCK_TAI delta 300000 offload
```

With the options above, etf will be configured to use CLOCK_TAI as its clockid_t, will schedule packets for 300 us before their txtime, and will enable the functionality on that in the network interface card. Deadline mode will not be configured for this mode.

## AUTHORS
Jesus Sanchez-Palencia <jesus.sanchez-palencia@intel.com>

Vinicius Costa Gomes <vinicius.gomes@intel.com>


tc-ets

title: tc-ets(8)

text:
# tc-ets(8)

## NAME
ETS - Enhanced Transmission Selection scheduler

## SYNOPSIS
tc qdisc ... ets [ bands number ] [ strict number ] [ quanta bytes bytes bytes... ] [ priomap band band band... ]

tc class ... ets [ quantum bytes ]

## DESCRIPTION
The Enhanced Transmission Selection scheduler is a classful queuing discipline that merges functionality of PRIO and DRR qdiscs in one scheduler. ETS makes it easy to configure a set of strict and bandwidth-sharing bands to implement the transmission selection described in 802.1Qaz.

On creation with 'tc qdisc add', a fixed number of bands is created. Each band is a class, although it is not possible to directly add and remove bands with 'tc class' commands. The number of bands to be created must instead be specified on the command line as the qdisc is added.

The minor number of classid to use when referring to a band is the band number increased by one. Thus band 0 will have classid of major:1, band 1 that of major:2, etc.

ETS bands are of two types: some number may be in strict mode, the remaining ones are in bandwidth-sharing mode.

## ALGORITHM
When dequeuing, strict bands are tried first, if there are any. Band 0 is tried first. If it did not deliver a packet, band 1 is tried next, and so on until one of the bands delivers a packet, or the strict bands are exhausted.

If no packet has been dequeued from any of the strict bands, if there are any bandwidth-sharing bands, the dequeuing proceeds according to the DRR algorithm. Each bandwidth-sharing band is assigned a deficit counter, initialized to quantum assigned by a quanta element. ETS maintains an (internal) ''active'' list of bandwidth-sharing bands whose qdiscs are non-empty. This list is used for dequeuing. A packet is dequeued from the band at the head of the list if the packet size is smaller or equal to the deficit counter. If the counter is too small, it is increased by quantum and the scheduler moves on to the next band in the active list.

Only qdiscs that own their queue should be added below the bandwidth-sharing bands. Attaching to them non-work-conserving qdiscs like TBF does not make sense -- other qdiscs in the active list will be skipped until the dequeue operation succeeds. This limitation does not exist with the strict bands.

## CLASSIFICATION
The ETS qdisc allows three ways to decide which band to enqueue a packet to:

- Packet priority can be directly set to a class handle, in which case that

is the queue where the packet will be put. For example, band number 2 of

a qdisc with handle of 11: will have classid 11:3. To mark a packet for

queuing to this band, the packet priority should be set to 0x110003.

- A tc filter attached to the qdisc can put the packet to a band by using

the flowid keyword.

- As a last resort, the ETS qdisc consults its priomap (see below), which

maps packets to bands based on packet priority.

## PARAMETERS
strict

The number of bands that should be created in strict mode. If not given, this value is 0.

quanta

Each bandwidth-sharing band needs to know its quantum, which is the amount of bytes a band is allowed to dequeue before the scheduler moves to the next bandwidth-sharing band. The quanta argument lists quanta for the individual bandwidth-sharing bands. The minimum value of each quantum is 1. If quanta is not given, the default is no bandwidth-sharing bands, but note that when specifying a large number of bands, the extra ones are in bandwidth-sharing mode by default.

bands

Number of bands given explicitly. This value has to be at least large enough to cover the strict bands specified through the strict keyword and bandwidth-sharing bands specified in quanta. If a larger value is given, any extra bands are in bandwidth-sharing mode, and their quanta are deduced from the interface MTU. If no value is given, as many bands are created as necessary to cover all bands implied by the strict and quanta keywords.

priomap

The priomap maps the priority of a packet to a band. The argument is a list of numbers. The first number indicates which band the packets with priority 0 should be put to, the second is for priority 1, and so on. There can be up to 16 numbers in the list. If there are fewer, the default band that traffic with one of the unmentioned priorities goes to is the last one.

## EXAMPLE & USAGE
Add a qdisc with 8 bandwidth-sharing bands, using the interface MTU as their quanta. Since all quanta are the same, this will lead to equal distribution of bandwidth between the bands, each will get about 12.5% of the link. The low 8 priorities go to individual bands in a reverse 1:1 fashion (such that the highest priority goes to the first band).

\# tc qdisc add dev eth0 root handle 1: ets bands 8 priomap 7 6 5 4 3 2 1 0

\# tc qdisc show dev eth0

qdisc ets 1: root refcnt 2 bands 8 quanta 1514 1514 1514 1514 1514 1514 1514 1514 priomap 7 6 5 4 3 2 1 0 7 7 7 7 7 7 7 7

Tweak the first band of the above qdisc to give it a quantum of 2650, which will give it about 20% of the link (and about 11.5% to the remaining bands):

\# tc class change dev eth0 classid 1:1 ets quantum 2650

\# tc qdisc show dev eth0

qdisc ets 1: root refcnt 2 bands 8 quanta 2650 1514 1514 1514 1514 1514 1514 1514 priomap 7 6 5 4 3 2 1 0 7 7 7 7 7 7 7 7

Create a purely strict Qdisc with reverse 1:1 mapping between priorities and bands:

\# tc qdisc add dev eth0 root handle 1: ets strict 8 priomap 7 6 5 4 3 2 1 0

\# tc qdisc sh dev eth0

qdisc ets 1: root refcnt 2 bands 8 strict 8 priomap 7 6 5 4 3 2 1 0 7 7 7 7 7 7 7 7

Add a Qdisc with 6 bands, 3 strict and 3 ETS with 35%-30%-25% weights:

\# tc qdisc add dev eth0 root handle 1: ets strict 3 quanta 3500 3000 2500 priomap 0 1 1 1 2 3 4 5

\# tc qdisc sh dev eth0

qdisc ets 1: root refcnt 2 bands 6 strict 3 quanta 3500 3000 2500 priomap 0 1 1 1 2 3 4 5 5 5 5 5 5 5 5 5

Create a Qdisc such that traffic with priorities 2, 3 and 4 are strictly prioritized over other traffic, and the rest goes into bandwidth-sharing classes with equal weights:

\# tc qdisc add dev eth0 root handle 1: ets bands 8 strict 3 priomap 3 4 0 1 2 5 6 7

\# tc qdisc sh dev eth0

qdisc ets 1: root refcnt 2 bands 8 strict 3 quanta 1514 1514 1514 1514 1514 priomap 3 4 0 1 2 5 6 7 7 7 7 7 7 7 7 7

## SEE ALSO
tc(8), tc-prio(8), tc-drr(8)

## AUTHOR
Parts of both this manual page and the code itself are taken from PRIO and DRR qdiscs.

ETS qdisc itself was written by Petr Machata.


tc-flow

title: tc-flow(8)

summary: flow based traffic control filter

text:
# tc-flow(8)

## NAME
flow - flow based traffic control filter

## SYNOPSIS
Mapping mode:

tc filter ... flow map key KEY [ OPS ] [ OPTIONS ]

Hashing mode:

tc filter ... flow hash keys KEY_LIST [ perturb secs ] [ OPTIONS ]

OPS := [ OPS ] OP

OPTIONS := [ divisor NUM ] [ baseclass ID ] [ match EMATCH_TREE ] [ action ACTION_SPEC ]

KEY_LIST := [ KEY_LIST ] KEY

OP := { or | and | xor | rshift | addend } NUM

ID := X:Y

KEY := { src | dst | proto | proto-src | proto-dst | iif | priority | mark | nfct | nfct-src | nfct-dst | nfct-proto-src | nfct-proto-dst | rt-classid | sk-uid | sk-gid | vlan-tag | rxhash }

## DESCRIPTION
The flow classifier is meant to extend the SFQ hashing capabilities without hard-coding new hash functions. It also allows deterministic mappings of keys to classes.

## OPTIONS
action ACTION_SPEC

Apply an action from the generic actions framework on matching packets.

baseclass ID

An offset for the resulting class ID. ID may be root, none or a hexadecimal class ID in the form [X:]Y. X must match qdisc's/class's major handle (if omitted, the correct value is chosen automatically). If the whole baseclass is omitted, Y defaults to 1.

divisor NUM

Number of buckets to use for sorting into. Keys are calculated modulo NUM.

hash keys KEY-LIST

Perform a jhash2 operation over the keys in KEY-LIST, the result (modulo the divisor if given) is taken as class ID, optionally offset by the value of baseclass. It is possible to specify an interval (in seconds) after which jhash2's entropy source is recreated using the perturb parameter.

map key KEY

Packet data identified by KEY is translated into class IDs to push the packet into. The value may be mangled by OPS before using it for the mapping. They are applied in the order listed here:

and NUM

Perform bitwise AND operation with numeric value NUM.

or NUM

Perform bitwise OR operation with numeric value NUM.

xor NUM

Perform bitwise XOR operation with numeric value NUM.

rshift NUM

Shift the value of KEY to the right by NUM bits.

addend NUM

Add NUM to the value of KEY.

For the or, and, xor and rshift operations, NUM is assumed to be an unsigned, 32bit integer value. For the addend operation, NUM may be much more complex: It may be prefixed by a minus ('-') sign to cause subtraction instead of addition and for keys of src, dst, nfct-src and nfct-dst it may be given in IP address notation. See below for an illustrating example.

match EMATCH_TREE

Match packets using the extended match infrastructure. See tc-ematch(8) for a detailed description of the allowed syntax in EMATCH_TREE.

## KEYS
In mapping mode, a single key is used (after optional permutation) to build a class ID. The resulting ID is deducible in most cases. In hashing more, a number of keys may be specified which are then hashed and the output used as class ID. This ID is not deducible in beforehand, and may even change over time for a given flow if a perturb interval has been given.

The range of class IDs can be limited by the divisor option, which is used for a modulus.

src, dst

Use source or destination address as key. In case of IPv4 and TIPC, this is the actual address value. For IPv6, the 128bit address is folded into a 32bit value by XOR'ing the four 32bit words. In all other cases, the kernel-internal socket address is used (after folding into 32bits on 64bit systems).

proto

Use the layer four protocol number as key.

proto-src

Use the layer four source port as key. If not available, the kernel-internal socket address is used instead.

proto-dst

Use the layer four destination port as key. If not available, the associated kernel-internal dst_entry address is used after XOR'ing with the packet's layer three protocol number.

iif

Use the incoming interface index as key.

priority

Use the packet's priority as key. Usually this is the IP header's DSCP/ECN value.

mark

Use the netfilter fwmark as key.

nfct

Use the associated conntrack entry address as key.

nfct-src, nfct-dst, nfct-proto-src, nfct-proto-dst

These are conntrack-aware variants of src, dst, proto-src and proto-dst. In case of NAT, these are basically the packet header's values before NAT was applied.

rt-classid

Use the packet's destination routing table entry's realm as key.

sk-uid

sk-gid

For locally generated packets, use the user or group ID the originating socket belongs to as key.

vlan-tag

Use the packet's vlan ID as key.

rxhash

Use the flow hash as key.

## EXAMPLES
Classic SFQ hash:

```
tc filter add ... flow hash \
	keys src,dst,proto,proto-src,proto-dst divisor 1024

```

Classic SFQ hash, but using information from conntrack to work properly in combination with NAT:

```
tc filter add ... flow hash \
	keys nfct-src,nfct-dst,proto,nfct-proto-src,nfct-proto-dst \
	divisor 1024

```

Map destination IPs of 192.168.0.0/24 to classids 1-256:

```
tc filter add ... flow map \
	key dst addend -192.168.0.0 divisor 256

```

Alternative to the above:

```
tc filter add ... flow map \
	key dst and 0xff

```

The same, but in reverse order:

```
tc filter add ... flow map \
	key dst and 0xff xor 0xff

```

## SEE ALSO
tc(8), tc-ematch(8), tc-sfq(8)


tc-flower

title: tc-flower(8)

summary: flow based traffic control filter

text:
# tc-flower(8)

## NAME
flower - flow based traffic control filter

## SYNOPSIS

tc filter ... flower [ MATCH_LIST ] [ action ACTION_SPEC ] [ classid CLASSID ] [ hw_tc TCID ]

MATCH_LIST := [ MATCH_LIST ] MATCH

MATCH := { indev ifname | verbose | skip_sw | skip_hw | { dst_mac | src_mac } MASKED_LLADDR | vlan_id VID | vlan_prio PRIORITY | vlan_ethtype { ipv4 | ipv6 | ETH_TYPE } | cvlan_id VID | cvlan_prio PRIORITY | cvlan_ethtype { ipv4 | ipv6 | ETH_TYPE } | pppoe_sid PSID | ppp_proto { ip | ipv6 | mpls_uc | mpls_mc | PPP_PROTO } | mpls LSE_LIST | mpls_label LABEL | mpls_tc TC | mpls_bos BOS | mpls_ttl TTL | l2tpv3_sid LSID | ip_proto { tcp | udp | sctp | icmp | icmpv6 | l2tp | IP_PROTO } | ip_tos MASKED_IP_TOS | ip_ttl MASKED_IP_TTL | { dst_ip | src_ip } PREFIX | { dst_port | src_port } { MASKED_NUMBER | min_port_number-max_port_number } | tcp_flags MASKED_TCP_FLAGS | type MASKED_TYPE | code MASKED_CODE | { arp_tip | arp_sip } IPV4_PREFIX | arp_op { request | reply | OP } | { arp_tha | arp_sha } MASKED_LLADDR | enc_key_id KEY-ID | { enc_dst_ip | enc_src_ip } { ipv4_address | ipv6_address } | enc_dst_port port_number | enc_tos TOS | enc_ttl TTL | { geneve_opts | vxlan_opts | erspan_opts | gtp_opts | pfcp_opts } OPTIONS | ip_flags IP_FLAGS | l2_miss L2_MISS | cfm CFM_OPTIONS | enc_flags ENCFLAG-LIST }

LSE_LIST := [ LSE_LIST ] LSE

LSE := lse depth DEPTH { label LABEL | tc TC | bos BOS | ttl TTL }

CFM := cfm mdl LEVEL | op OPCODE

ENCFLAG-LIST := [ ENCFLAG-LIST/ ] ENCFLAG

ENCFLAG := { [no]tuncsum | [no]tundf | [no]tunoam | [no]tuncrit }

## DESCRIPTION
The flower filter matches flows to the set of keys specified and assigns an arbitrarily chosen class ID to packets belonging to them. Additionally (or alternatively) an action from the generic action framework may be called.

## OPTIONS
action ACTION_SPEC

Apply an action from the generic actions framework on matching packets.

classid CLASSID

Specify a class to pass matching packets on to. CLASSID is in the form X:Y, while X and Y are interpreted as numbers in hexadecimal format.

hw_tc TCID

Specify a hardware traffic class to pass matching packets on to. TCID is in the range 0 through 15.

indev ifname

Match on incoming interface name. Obviously this makes sense only for forwarded flows. ifname is the name of an interface which must exist at the time of tc invocation.

verbose

Enable verbose logging, including offloading errors when not using skip_sw flag.

skip_sw

Do not process filter by software. If hardware has no offload support for this filter, or TC offload is not enabled for the interface, operation will fail.

skip_hw

Do not process filter by hardware.

dst_mac MASKED_LLADDR

src_mac MASKED_LLADDR

Match on source or destination MAC address. A mask may be optionally provided to limit the bits of the address which are matched. A mask is provided by following the address with a slash and then the mask. It may be provided in LLADDR format, in which case it is a bitwise mask, or as a number of high bits to match. If the mask is missing then a match on all bits is assumed.

num_of_vlans NUM

Match on the number of vlan tags in the packet. NUM can be 0 or small positive integer. Typically in 0-4 range.

vlan_id VID

Match on vlan tag id. VID is an unsigned 12bit value in decimal format.

vlan_prio PRIORITY

Match on vlan tag priority. PRIORITY is an unsigned 3bit value in decimal format.

vlan_ethtype VLAN_ETH_TYPE

Match on layer three protocol. VLAN_ETH_TYPE may be either ipv4, ipv6 or an unsigned 16bit value in hexadecimal format. To match on QinQ packet, it must be 802.1Q or 802.1AD.

cvlan_id VID

Match on QinQ inner vlan tag id. VID is an unsigned 12bit value in decimal format.

cvlan_prio PRIORITY

Match on QinQ inner vlan tag priority. PRIORITY is an unsigned 3bit value in decimal format.

cvlan_ethtype VLAN_ETH_TYPE

Match on QinQ layer three protocol. VLAN_ETH_TYPE may be either ipv4, ipv6 or an unsigned 16bit value in hexadecimal format.

pppoe_sid PSID

Match on PPPoE session id. PSID is an unsigned 16bit value in decimal format.

ppp_proto PPP_PROTO

Match on PPP layer three protocol. PPP_PROTO may be either ip, ipv6, mpls_uc, mpls_mc or an unsigned 16bit value in hexadecimal format.

mpls LSE_LIST

Match on the MPLS label stack. LSE_LIST is a list of Label Stack Entries, each introduced by the lse keyword. This option can't be used together with the standalone mpls_label, mpls_tc, mpls_bos and mpls_ttl options.

lse LSE_OPTIONS

Match on an MPLS Label Stack Entry. LSE_OPTIONS is a list of options that describe the properties of the LSE to match.

depth DEPTH

The depth of the Label Stack Entry to consider. Depth starts at 1 (the outermost Label Stack Entry). The maximum usable depth may be limited by the kernel. This option is mandatory. DEPTH is an unsigned 8 bit value in decimal format.

label LABEL

Match on the MPLS Label field at the specified depth. LABEL is an unsigned 20 bit value in decimal format.

tc TC

Match on the MPLS Traffic Class field at the specified depth. TC is an unsigned 3 bit value in decimal format.

bos BOS

Match on the MPLS Bottom Of Stack field at the specified depth. BOS is a 1 bit value in decimal format.

ttl TTL

Match on the MPLS Time To Live field at the specified depth. TTL is an unsigned 8 bit value in decimal format.

mpls_label LABEL

Match the label id in the outermost MPLS label stack entry. LABEL is an unsigned 20 bit value in decimal format.

mpls_tc TC

Match on the MPLS TC field, which is typically used for packet priority, in the outermost MPLS label stack entry. TC is an unsigned 3 bit value in decimal format.

mpls_bos BOS

Match on the MPLS Bottom Of Stack field in the outermost MPLS label stack entry. BOS is a 1 bit value in decimal format.

mpls_ttl TTL

Match on the MPLS Time To Live field in the outermost MPLS label stack entry. TTL is an unsigned 8 bit value in decimal format.

l2tpv3_sid LSID

Match on L2TPv3 session id field transported over IPv4 or IPv6. LSID is an unsigned 32 bit value in decimal format.

ip_proto IP_PROTO

Match on layer four protocol. IP_PROTO may be tcp, udp, sctp, icmp, icmpv6, l2tp or an unsigned 8bit value in hexadecimal format.

ip_tos MASKED_IP_TOS

Match on ipv4 TOS or ipv6 traffic-class - eight bits in hexadecimal format. A mask may be optionally provided to limit the bits which are matched. A mask is provided by following the value with a slash and then the mask. If the mask is missing then a match on all bits is assumed.

ip_ttl MASKED_IP_TTL

Match on ipv4 TTL or ipv6 hop-limit - eight bits value in decimal or hexadecimal format. A mask may be optionally provided to limit the bits which are matched. Same logic is used for the mask as with matching on ip_tos.

dst_ip PREFIX

src_ip PREFIX

Match on source or destination IP address. PREFIX must be a valid IPv4 or IPv6 address, depending on the protocol option to tc filter, optionally followed by a slash and the prefix length. If the prefix is missing, tc assumes a full-length host match.

dst_port { MASKED_NUMBER | MIN_VALUE-MAX_VALUE }

src_port { MASKED_NUMBER | MIN_VALUE-MAX_VALUE }

Match on layer 4 protocol source or destination port number, with an optional mask. Alternatively, the minimum and maximum values can be specified to match on a range of layer 4 protocol source or destination port numbers. Only available for ip_proto values udp, tcp and sctp which have to be specified in beforehand.

tcp_flags MASKED_TCP_FLAGS

Match on TCP flags represented as 12bit bitfield in in hexadecimal format. A mask may be optionally provided to limit the bits which are matched. A mask is provided by following the value with a slash and then the mask. If the mask is missing then a match on all bits is assumed.

type MASKED_TYPE

code MASKED_CODE

Match on ICMP type or code. A mask may be optionally provided to limit the bits of the address which are matched. A mask is provided by following the address with a slash and then the mask. The mask must be as a number which represents a bitwise mask If the mask is missing then a match on all bits is assumed. Only available for ip_proto values icmp and icmpv6 which have to be specified in beforehand.

arp_tip IPV4_PREFIX

arp_sip IPV4_PREFIX

Match on ARP or RARP sender or target IP address. IPV4_PREFIX must be a valid IPv4 address optionally followed by a slash and the prefix length. If the prefix is missing, tc assumes a full-length host match.

arp_op ARP_OP

Match on ARP or RARP operation. ARP_OP may be request, reply or an integer value 0, 1 or 2. A mask may be optionally provided to limit the bits of the operation which are matched. A mask is provided by following the address with a slash and then the mask. It may be provided as an unsigned 8 bit value representing a bitwise mask. If the mask is missing then a match on all bits is assumed.

arp_sha MASKED_LLADDR

arp_tha MASKED_LLADDR

Match on ARP or RARP sender or target MAC address. A mask may be optionally provided to limit the bits of the address which are matched. A mask is provided by following the address with a slash and then the mask. It may be provided in LLADDR format, in which case it is a bitwise mask, or as a number of high bits to match. If the mask is missing then a match on all bits is assumed.

enc_key_id NUMBER

enc_dst_ip PREFIX

enc_src_ip PREFIX

enc_dst_port NUMBER

enc_tos NUMBER

enc_ttl NUMBER

ct_state CT_STATE

ct_zone CT_MASKED_ZONE

ct_mark CT_MASKED_MARK

ct_label CT_MASKED_LABEL

Matches on connection tracking info

CT_STATE

Match the connection state, and can be combination of [{+|-}flag] flags, where flag can be one of

trk - Tracked connection.

new - New connection.

est - Established connection.

rpl - The packet is in the reply direction, meaning that it is in the opposite direction from the packet that initiated the connection.

inv - The state is invalid. The packet couldn't be associated to a connection.

rel - The packet is related to an existing connection.

Example: +trk+est

CT_MASKED_ZONE

Match the connection zone, and can be masked.

CT_MASKED_MARK

32bit match on the connection mark, and can be masked.

CT_MASKED_LABEL

128bit match on the connection label, and can be masked.

geneve_opts OPTIONS

vxlan_opts OPTIONS

erspan_opts OPTIONS

gtp_opts OPTIONS

pfcp_opts OPTIONS

Match on IP tunnel metadata. Key id NUMBER is a 32 bit tunnel key id (e.g. VNI for VXLAN tunnel). PREFIX must be a valid IPv4 or IPv6 address optionally followed by a slash and the prefix length. If the prefix is missing, tc assumes a full-length host match. Dst port NUMBER is a 16 bit UDP dst port. Tos NUMBER is an 8 bit tos (dscp+ecn) value, ttl NUMBER is an 8 bit time-to-live value. geneve_opts OPTIONS must be a valid list of comma-separated geneve options where each option consists of a key optionally followed by a slash and corresponding mask. If the masks is missing, tc assumes a full-length match. The options can be described in the form CLASS:TYPE:DATA/CLASS_MASK:TYPE_MASK:DATA_MASK, where CLASS is represented as a 16bit hexadecimal value, TYPE as an 8bit hexadecimal value and DATA as a variable length hexadecimal value. vxlan_opts OPTIONS doesn't support multiple options, and it consists of a key followed by a slash and corresponding mask. If the mask is missing, tc assumes a full-length match. The option can be described in the form GBP/GBP_MASK, where GBP is represented as a 32bit number. erspan_opts OPTIONS doesn't support multiple options, and it consists of a key followed by a slash and corresponding mask. If the mask is missing, tc assumes a full-length match. The option can be described in the form VERSION:INDEX:DIR:HWID/VERSION:INDEX_MASK:DIR_MASK:HWID_MASK, where VERSION is represented as a 8bit number, INDEX as an 32bit number, DIR and HWID as a 8bit number. Multiple options is not supported. Note INDEX/INDEX_MASK is used when VERSION is 1, and DIR/DIR_MASK and HWID/HWID_MASK are used when VERSION is 2. gtp_opts OPTIONS doesn't support multiple options, and it consists of a key followed by a slash and corresponding mask. If the mask is missing, tc assumes a full-length match. The option can be described in the form PDU_TYPE:QFI/PDU_TYPE_MASK:QFI_MASK where both PDU_TYPE and QFI are represented as a 8bit hexadecimal values. pfcp_opts OPTIONS does not support multiple options. It consists of a key followed by a slash and corresponding mask. If the mask is missing, tc assumes a full-length match. The option can be described in the form TYPE:SEID/TYPE_MASK:SEID_MASK where TYPE is represented as a 8bit number, SEID is represented by 64bit. Both TYPE and SEID are provided in hex.

ip_flags IP_FLAGS

IP_FLAGS may be either frag, nofrag, firstfrag or nofirstfrag where frag and nofrag could be used to match on fragmented packets or not, respectively. firstfrag and nofirstfrag can be used to further distinguish fragmented packet. firstfrag can be used to indicate the first fragmented packet. nofirstfrag can be used to indicates subsequent fragmented packets or non-fragmented packets.

l2_miss L2_MISS

Match on layer 2 miss in the bridge driver's FDB / MDB. L2_MISS may be 0 or 1. When 1, match on packets that encountered a layer 2 miss. When 0, match on packets that were forwarded using an FDB / MDB entry. Note that broadcast packets do not encounter a miss since a lookup is not performed for them.

cfm CFM_OPTIONS

Match on Connectivity Fault Management (CFM) fields. CFM_OPTIONS is a list of options that describe the properties of the CFM information fields to match.

mdl LEVEL

Match on the Maintenance Domain (MD) level field. LEVEL is an unsigned 3 bit value in decimal format.

op OPCODE

Match on the CFM opcode field. OPCODE is an unsigned 8 bit value in decimal format.

enc_flags ENCFLAG-LIST

Match on tunnel control flags. ENCFLAG-LIST is a list of the following tunnel control flags: [no]tuncsum, [no]tundf, [no]tunoam, [no]tuncrit, each separated by '/'.

## NOTES
As stated above where applicable, matches of a certain layer implicitly depend on the matches of the next lower layer. Precisely, layer one and two matches (indev, dst_mac, src_mac and enc_flags) have no dependency, MPLS and layer three matches (mpls, mpls_label, mpls_tc, mpls_bos, mpls_ttl, ip_proto, dst_ip, src_ip, arp_tip, arp_sip, arp_op, arp_tha, arp_sha and ip_flags) depend on the protocol option of tc filter, layer four port matches (dst_port and src_port) depend on ip_proto being set to tcp, udp or sctp, and finally ICMP matches (code and type) depend on ip_proto being set to icmp or icmpv6.

There can be only used one mask per one prio. If user needs to specify different mask, he has to use different prio.

## SEE ALSO
tc(8), tc-flow(8)


tc-fq

title: tc-fq(8)

summary: Fair Queue traffic policing

text:
# tc-fq(8)

## NAME
FQ - Fair Queue traffic policing

## SYNOPSIS
tc qdisc ... fq [ limit PACKETS ] [ flow_limit PACKETS ] [ quantum BYTES ] [ initial_quantum BYTES ] [ maxrate RATE ] [ buckets NUMBER ] [ orphan_mask NUMBER ] [ pacing | nopacing ] [ ce_threshold TIME ]

## DESCRIPTION
FQ (Fair Queue) is a classless packet scheduler meant to be mostly used for locally generated traffic. It is designed to achieve per flow pacing. FQ does flow separation, and is able to respect pacing requirements set by TCP stack. All packets belonging to a socket are considered as a 'flow'. For non local packets (router workload), packet hash is used as fallback.

An application can specify a maximum pacing rate using the SO_MAX_PACING_RATE setsockopt call. This packet scheduler adds delay between packets to respect rate limitation set on each socket. Note that after linux-4.20, linux adopted EDT (Earliest Departure Time) and TCP directly sets the appropriate Departure Time for each skb.

Dequeueing happens in a round-robin fashion. A special FIFO queue is reserved for high priority packets ( TC_PRIO_CONTROL priority), such packets are always dequeued first.

FQ is non-work-conserving.

TCP pacing is good for flows having idle times, as the congestion window permits TCP stack to queue a possibly large number of packets. This removes the 'slow start after idle' choice, badly hitting large BDP flows and applications delivering chunks of data such as video streams.

## PARAMETERS

### limit
Hard limit on the real queue size. When this limit is reached, new packets are dropped. If the value is lowered, packets are dropped so that the new limit is met. Default is 10000 packets.

### flow_limit
Hard limit on the maximum number of packets queued per flow. Default value is 100.

### quantum
The credit per dequeue RR round, i.e. the amount of bytes a flow is allowed to dequeue at once. A larger value means a longer time period before the next flow will be served. Default is 2 * interface MTU bytes.

### initial_quantum
The initial sending rate credit, i.e. the amount of bytes a new flow is allowed to dequeue initially. This is specifically meant to allow using IW10 without added delay. Default is 10 * interface MTU, i.e. 15140 for 'standard' ethernet.

### maxrate
Maximum sending rate of a flow. Default is unlimited. Application specific setting via SO_MAX_PACING_RATE is ignored only if it is larger than this value.

### buckets
The size of the hash table used for flow lookups. Each bucket is assigned a red-black tree for efficient collision sorting. Default: 1024.

### orphan_mask
For packets not owned by a socket, fq is able to mask a part of skb->hash and reduce number of buckets associated with the traffic. This is a DDOS prevention mechanism, and the default is 1023 (meaning no more than 1024 flows are allocated for these packets)

### [no]pacing
Enable or disable flow pacing. Default is enabled.

### ce_threshold
sets a threshold above which all packets are marked with ECN Congestion Experienced. This is useful for DCTCP-style congestion control algorithms that require marking at very shallow queueing thresholds.

## EXAMPLES
\#tc qdisc add dev eth0 root fq ce_threshold 4ms

\#tc -s -d qdisc show dev eth0

qdisc fq 8001: dev eth0 root refcnt 2 limit 10000p flow_limit 100p buckets 1024 orphan_mask 1023 quantum 3028b initial_quantum 15140b low_rate_threshold 550Kbit refill_delay 40.0ms ce_threshold 4.0ms

Sent 72149092 bytes 48062 pkt (dropped 2176, overlimits 0 requeues 0)

backlog 1937920b 1280p requeues 0

flows 34 (inactive 17 throttled 0)

gc 0 highprio 0 throttled 0 ce_mark 47622 flows_plimit 2176

## SEE ALSO
tc(8), socket(7)

## AUTHORS
FQ was written by Eric Dumazet.


title: tc-fq_codel(8)

text:
# tc-fq_codel(8)

## NAME
CoDel - Fair Queuing (FQ) with Controlled Delay (CoDel)

## SYNOPSIS
tc qdisc ... fq_codel [ limit PACKETS ] [ flows NUMBER ] [ target TIME ] [ interval TIME ] [ quantum BYTES ] [ ecn | noecn ] [ ce_threshold TIME ] [ ce_threshold_selector VALUE/MASK ] [ memory_limit BYTES ]

## DESCRIPTION
FQ_Codel (Fair Queuing Controlled Delay) is queuing discipline that combines Fair Queuing with the CoDel AQM scheme. FQ_Codel uses a stochastic model to classify incoming packets into different flows and is used to provide a fair share of the bandwidth to all the flows using the queue. Each such flow is managed by the CoDel queuing discipline. Reordering within a flow is avoided since Codel internally uses a FIFO queue.

## PARAMETERS

### limit
has the same semantics as codel and is the hard limit on the real queue size. When this limit is reached, incoming packets are dropped. Default is 10240 packets.

### memory_limit
sets a limit on the total number of bytes that can be queued in this FQ-CoDel instance. The lower of the packet limit of the limit parameter and the memory limit will be enforced. Default is 32 MB.

### flows
is the number of flows into which the incoming packets are classified. Due to the stochastic nature of hashing, multiple flows may end up being hashed into the same slot. Newer flows have priority over older ones. This parameter can be set only at load time since memory has to be allocated for the hash table. Default value is 1024.

### target
has the same semantics as codel and is the acceptable minimum standing/persistent queue delay. This minimum delay is identified by tracking the local minimum queue delay that packets experience. Default value is 5ms.

### interval
has the same semantics as codel and is used to ensure that the measured minimum delay does not become too stale. The minimum delay must be experienced in the last epoch of length interval. It should be set on the order of the worst-case RTT through the bottleneck to give endpoints sufficient time to react. Default value is 100ms.

### quantum
is the number of bytes used as 'deficit' in the fair queuing algorithm. Default is set to 1514 bytes which corresponds to the Ethernet MTU plus the hardware header length of 14 bytes.

### ecn | noecn
has the same semantics as codel and can be used to mark packets instead of dropping them. If ecn has been enabled, noecn can be used to turn it off and vice-a-versa. Unlike codel, ecn is turned on by default.

### ce_threshold
sets a threshold above which all packets are marked with ECN Congestion Experienced. This is useful for DCTCP-style congestion control algorithms that require marking at very shallow queueing thresholds.

### ce_threshold_selector
sets a filter so that the ce_threshold feature is applied to only a subset of the traffic seen by the qdisc. If set, the MASK value will be applied as a bitwise AND to the diffserv/ECN byte of the IP header, and only if the result of this masking equals VALUE, will the ce_threshold logic be applied to the packet.

### drop_batch
sets the maximum number of packets to drop when limit or memory_limit is exceeded. Default value is 64.

## EXAMPLES
\#tc qdisc add dev eth0 root fq_codel

\#tc -s qdisc show

qdisc fq_codel 8002: dev eth0 root refcnt 2 limit 10240p flows 1024 quantum 1514

target 5.0ms interval 100.0ms ecn

Sent 428514 bytes 2269 pkt (dropped 0, overlimits 0 requeues 0)

backlog 0b 0p requeues 0

maxpacket 256 drop_overlimit 0 new_flow_count 0 ecn_mark 0

new_flows_len 0 old_flows_len 0

\#tc qdisc add dev eth0 root fq_codel limit 2000 target 3ms interval 40ms noecn

\#tc -s qdisc show

qdisc fq_codel 8003: dev eth0 root refcnt 2 limit 2000p flows 1024 quantum 1514 target 3.0ms interval 40.0ms

Sent 2588985006 bytes 1783629 pkt (dropped 0, overlimits 0 requeues 34869)

backlog 0b 0p requeues 34869

maxpacket 65226 drop_overlimit 0 new_flow_count 73 ecn_mark 0

new_flows_len 1 old_flows_len 3

## SEE ALSO
tc(8), tc-codel(8), tc-red(8)

## AUTHORS
FQ_CoDel was implemented by Eric Dumazet. This manpage was written by Vijay Subramanian. Please report corrections to the Linux Networking mailing list <netdev@vger.kernel.org>.


title: tc-fq_pie(8)

text:
# tc-fq_pie(8)

## NAME
FQ-PIE - Flow Queue Proportional Integral controller Enhanced

## SYNOPSIS
tc qdisc ... fq_pie [ limit PACKETS ] [ flows NUMBER ]

[ target TIME ] [ tupdate TIME ]

[ alpha NUMBER ] [ beta NUMBER ]

[ quantum BYTES ] [ memory_limit BYTES ]

[ ecn_prob PERENTAGE ] [ [no]ecn ]

[ [no]bytemode ] [ [no_]dq_rate_estimator ]

## DESCRIPTION
FQ-PIE (Flow Queuing with Proportional Integral controller Enhanced) is a queuing discipline that combines Flow Queuing with the PIE AQM scheme. FQ-PIE uses a Jenkins hash function to classify incoming packets into different flows and is used to provide a fair share of the bandwidth to all the flows using the qdisc. Each such flow is managed by the PIE algorithm.

## ALGORITHM
The FQ-PIE algorithm consists of two logical parts: the scheduler which selects which queue to dequeue a packet from, and the PIE AQM which works on each of the queues. The major work of FQ-PIE is mostly in the scheduling part. The interaction between the scheduler and the PIE algorithm is straight forward.

During the enqueue stage, a hashing-based scheme is used, where flows are hashed into a number of buckets with each bucket having its own queue. The number of buckets is configurable, and presently defaults to 1024 in the implementation. The flow hashing is performed on the 5-tuple of source and destination IP addresses, port numbers and IP protocol number. Once the packet has been successfully classified into a queue, it is handed over to the PIE algorithm for enqueuing. It is then added to the tail of the selected queue, and the queue's byte count is updated by the packet size. If the queue is not currently active (i.e., if it is not in either the list of new or the list of old queues) , it is added to the end of the list of new queues, and its number of credits is initiated to the configured quantum. Otherwise, the queue is left in its current queue list.

During the dequeue stage, the scheduler first looks at the list of new queues; for the queue at the head of that list, if that queue has a negative number of credits (i.e., it has already dequeued at least a quantum of bytes), it is given an additional quantum of credits, the queue is put onto the end of the list of old queues, and the routine selects the next queue and starts again. Otherwise, that queue is selected for dequeue again. If the list of new queues is empty, the scheduler proceeds down the list of old queues in the same fashion (checking the credits, and either selecting the queue for dequeuing, or adding credits and putting the queue back at the end of the list). After having selected a queue from which to dequeue a packet, the PIE algorithm is invoked on that queue.

Finally, if the PIE algorithm does not return a packet, then the queue must be empty and the scheduler does one of two things:

If the queue selected for dequeue came from the list of new queues, it is moved to the end of the list of old queues. If instead it came from the list of old queues, that queue is removed from the list, to be added back (as a new queue) the next time a packet arrives that hashes to that queue. Then (since no packet was available for dequeue), the whole dequeue process is restarted from the beginning.

If, instead, the scheduler did get a packet back from the PIE algorithm, it subtracts the size of the packet from the byte credits for the selected queue and returns the packet as the result of the dequeue operation.

## PARAMETERS

### limit
It is the limit on the queue size in packets. Incoming packets are dropped when the limit is reached. The default value is 10240 packets.

### flows
It is the number of flows into which the incoming packets are classified. Due to the stochastic nature of hashing, multiple flows may end up being hashed into the same slot. Newer flows have priority over older ones. This parameter can be set only at load time since memory has to be allocated for the hash table. The default value is 1024.

### target
It is the queue delay which the PIE algorithm tries to maintain. The default target delay is 15ms.

### tupdate
It is the time interval at which the system drop probability is calculated. The default is 15ms.

### beta
alpha and beta are parameters chosen to control the drop probability. These should be in the range between 0 and 32.

### quantum
quantum signifies the number of bytes that may be dequeued from a queue before switching to the next queue in the deficit round robin scheme.

### memory_limit
It is the maximum total memory allowed for packets of all flows. The default is 32Mb.

### ecn_prob
It is the drop probability threshold below which packets will be ECN marked instead of getting dropped. The default is 10%. Setting this parameter requires ecn to be enabled.

### [no]ecn
It has the same semantics as pie and can be used to mark packets instead of dropping them. If ecn has been enabled, noecn can be used to turn it off and vice-a-versa.

### [no]bytemode
It is used to scale drop probability proportional to packet size bytemode to turn on bytemode, nobytemode to turn off bytemode. By default, bytemode is turned off.

### [no_]dq_rate_estimator
dq_rate_estimator can be used to calculate queue delay using Little's Law, no_dq_rate_estimator can be used to calculate queue delay using timestamp. By default, dq_rate_estimator is turned off.

## EXAMPLES
\# tc qdisc add dev eth0 root fq_pie

\# tc -s qdisc show dev eth0

qdisc fq_pie 8001: root refcnt 2 limit 10240p flows 1024 target 15.0ms tupdate 16.0ms alpha 2 beta 20 quantum 1514b memory_limit 32Mb ecn_prob 10

Sent 159173586 bytes 105261 pkt (dropped 24, overlimits 0 requeues 0)

backlog 75700b 50p requeues 0

pkts_in 105311 overlimit 0 overmemory 0 dropped 24 ecn_mark 0

new_flow_count 7332 new_flows_len 0 old_flows_len 4 memory_used 108800

\# tc qdisc add dev eth0 root fq_pie dq_rate_estimator

\# tc -s qdisc show dev eth0

qdisc fq_pie 8001: root refcnt 2 limit 10240p flows 1024 target 15.0ms tupdate 16.0ms alpha 2 beta 20 quantum 1514b memory_limit 32Mb ecn_prob 10 dq_rate_estimator

Sent 8263620 bytes 5550 pkt (dropped 4, overlimits 0 requeues 0)

backlog 805448b 532p requeues 0

pkts_in 6082 overlimit 0 overmemory 0 dropped 4 ecn_mark 0

new_flow_count 94 new_flows_len 0 old_flows_len 8 memory_used 1157632

## SEE ALSO
tc(8), tc-pie(8), tc-fq_codel(8)

## SOURCES
RFC 8033: https://tools.ietf.org/html/rfc8033

## AUTHORS
FQ-PIE was implemented by Mohit P. Tahiliani. Please report corrections to the Linux Networking mailing list <netdev@vger.kernel.org>.


tc-fw

title: tc-fw(8)

summary: fwmark traffic control filter

text:
# tc-fw(8)

## NAME
fw - fwmark traffic control filter

## SYNOPSIS

tc filter ... fw [ classid CLASSID ] [ action ACTION_SPEC ]

## DESCRIPTION
the fw filter allows one to classify packets based on a previously set fwmark by iptables. If the masked value of the fwmark matches the filter's masked handle, the filter matches. By default, all 32 bits of the handle and the fwmark are masked. iptables allows one to mark single packets with the MARK target, or whole connections using CONNMARK. The benefit of using this filter instead of doing the heavy-lifting with tc itself is that on one hand it might be convenient to keep packet filtering and classification in one place, possibly having to match a packet just once, and on the other users familiar with iptables but not tc will have a less hard time adding QoS to their setups.

## OPTIONS
classid CLASSID

Push matching packets to the class identified by CLASSID.

action ACTION_SPEC

Apply an action from the generic actions framework on matching packets.

## EXAMPLES
Take e.g. the following tc filter statement:

```
tc filter add ... handle 6 fw classid 1:1
```

will match if the packet's fwmark value is 6. This is a sample iptables statement marking packets coming in on eth0:

```
iptables -t mangle -A PREROUTING -i eth0 -j MARK --set-mark 6
```

Specific bits of the packet's fwmark can be set using the skbedit action. For example, to only set one bit of the fwmark without changing any other bit:

```
tc filter add ... action skbedit mark 0x8/0x8
```

The fw filter can then be used to match on this bit by masking the handle:

```
tc filter add ... handle 0x8/0x8 fw action drop
```

This is useful when different bits of the fwmark are assigned different meanings.

## SEE ALSO
tc(8), iptables(8), iptables-extensions(8), tc-skbedit(8)


tc-gact

title: tc-gact(8)

text:
# tc-gact(8)

## NAME
gact - generic action

## SYNOPSIS

tc ... action gact CONTROL [ RAND ] [ INDEX ] CONTROL := { reclassify | drop | continue | pass | pipe |

goto chain CHAIN_INDEX |

jump JUMP_COUNT }

RAND := random RANDTYPE CONTROL VAL RANDTYPE := { netrand | determ } VAL := number not exceeding 10000 JUMP_COUNT := absolute jump from start of action list INDEX := index value used

## DESCRIPTION
The gact action allows reclassify, dropping, passing, or accepting packets. At the moment there are only two algorithms. One is deterministic and the other uses internal kernel netrand.

## OPTIONS
random RANDTYPE CONTROL VAL

The probability of taking the action expressed in terms of 1 out of VAL packets.

CONTROL

Indicate how tc should proceed if the packet matches. For a description of the possible CONTROL values, see tc-actions(8).

## EXAMPLES
Apply a rule on ingress to drop packets from a given source address.

```
# tc filter add dev eth0 parent ffff: protocol ip prio 6 u32 match ip src 10.0.0.9/32 flowid 1:16 action drop
```

Allow 1 out 10 packets from source randomly using the netrand generator

```
# tc filter add dev eth0 parent ffff: protocol ip prio 6 u32 match ip src 10.0.0.9/32 flowid 1:16 action drop random netrand ok 10
```

Deterministically accept every second packet

```
# tc filter add dev eth0 parent ffff: protocol ip prio 6 u32 match ip src 10.0.0.9/32 flowid 1:16 action drop random determ ok 2
```

## SEE ALSO
tc(8), tc-actions(8), tc-u32(8)


tc-gate

title: tc-gate(8)

summary: Stream Gate Action

text:
# tc-gate(8)

## NAME
gate - Stream Gate Action

## SYNOPSIS
tc ... action gate [ base-time BASETIME ] [ clockid CLOCKID ] sched-entry <gate state> <interval 1> [ <internal priority> <max octets> ] sched-entry <gate state> <interval 2> [ <internal priority> <max octets> ] sched-entry <gate state> <interval 3> [ <internal priority> <max octets> ] ...... sched-entry <gate state> <interval N> [ <internal priority> <max octets> ]

## DESCRIPTION
GATE action allows specified ingress frames can be passed at specific time slot, or be dropped at specific time slot. Tc filter filters the ingress frames, then tc gate action would specify which time slot and how many bytes these frames can be passed to device and which time slot frames would be dropped. Gate action also assign a base-time to tell when the entry list start. Then gate action would start to repeat the gate entry list cyclically at the start base-time. For the software simulation, gate action requires the user assign reference time clock type.

## PARAMETERS
base-time

Specifies the instant in nanoseconds, defining the time when the schedule starts. If 'base-time' is a time in the past, the schedule will start at base-time + (N * cycle-time)

where N is the smallest integer so the resulting time is greater than "now", and "cycle-time" is the sum of all the intervals of the entries in the schedule. Without base-time specified, will default to be 0.

clockid

Specifies the clock to be used by qdisc's internal timer for measuring time and scheduling events. Not valid if gate action is used for offloading filter. For example, tc filter command with skip_sw parameter.

sched-entry

There may multiple sched-entry parameters in a single schedule. Each one has the format: sched-entry <gate state> <interval> [ <internal priority> <max octets> ]

<gate state> means gate states. 'open' keep gate open, 'close' keep gate close.

<interval> means how much nano seconds for this time slot.

<internal priority> means internal priority value. Present of the internal receiving queue for this stream. "-1" means wildcard. <internal priority> and <max octets> can be omit default to be "-1" which both

value to be "-1" for this <sched-entry>.

<max octets> means how many octets size could pass in this time slot. Dropped if overlimited. "-1" means wildcard. <max octets> can be omit default to be "-1" which value to be "-1" for this <sched-entry>.

Note that <internal priority> and <max octets> are nothing meaning for gate state is "close" in a "sched-entry". All frames are dropped when "sched-entry" with "close" state.

## EXAMPLES
The following example shows tc filter frames source ip match to the 192.168.0.20 will keep the gate open for 200ms and limit the traffic to 8MB in this sched-entry. Then keep the traffic gate to be close for 100ms. Frames arrived at gate close state would be dropped. Then the cycle would run the gate entries periodically. The schedule will start at instant 200.0s using the reference CLOCK_TAI. The schedule is composed of two entries each of 300ms duration.

```
# tc qdisc add dev eth0 ingress
# tc filter add dev eth0 parent ffff: protocol ip \

           flower skip_hw src_ip 192.168.0.20 \

           action gate index 2 clockid CLOCK_TAI \

           base-time 200000000000ns \

           sched-entry open 200000000ns -1 8000000b \

           sched-entry close 100000000ns
```

Following commands is an example to filter a stream source mac match to the 10:00:80:00:00:00 icmp frames will be dropped at any time with cycle 200ms. With a default basetime 0 and clockid is CLOCK_TAI as default.

```
# tc qdisc add dev eth0 ingress
# tc filter add dev eth0 parent ffff:  protocol ip \
	flower ip_proto icmp dst_mac 10:00:80:00:00:00 \
	action gate index 12 sched-entry close 200000000ns
```

## AUTHORS
Po Liu <Po.Liu@nxp.com>


tc-hfsc

title: tc-hfsc(8)

text:
# tc-hfsc(8)

## NAME
HFSC - Hierarchical Fair Service Curve's control under linux

## SYNOPSIS

```
tc qdisc add ... hfsc [ default CLASSID ]
tc class add ... hfsc [ [ rt SC ] [ ls SC ] | [ sc SC ] ] [ ul SC ]
rt : realtime service curve
ls : linkshare service curve
sc : rt+ls service curve
ul : upperlimit service curve
• at least one of rt, ls or sc must be specified
• ul can only be specified with ls or sc
```

SC := [ [ m1 BPS ] d SEC ] m2 BPS

```
m1 : slope of the first segment
d  : x-coordinate of intersection
m2 : slope of the second segment
```

SC := [ [ umax BYTE ] dmax SEC ] rate BPS

```
umax : maximum unit of work
dmax : maximum delay
rate : rate
```

```

```

For description of BYTE, BPS and SEC - please see UNITS section of tc(8).

## DESCRIPTION (qdisc)
HFSC qdisc has only one optional parameter - default. CLASSID specifies the minor part of the default classid, where packets not classified by other means (e.g. u32 filter, CLASSIFY target of iptables) will be enqueued. If default is not specified, unclassified packets will be dropped.

## DESCRIPTION (class)
HFSC class is used to create a class hierarchy for HFSC scheduler. For explanation of the algorithm, and the meaning behind rt, ls, sc and ul service curves - please refer to tc-hfsc(7).

As you can see in SYNOPSIS, service curve (SC) can be specified in two ways. Either as maximum delay for certain amount of work, or as a bandwidth assigned for certain amount of time. Obviously, m1 is simply umax/dmax.

Both m2 and rate are mandatory. If you omit other parameters, you will specify linear service curve.

## SEE ALSO
tc(8), tc-hfsc(7), tc-stab(8)

Please direct bugreports and patches to: <netdev@vger.kernel.org>

## AUTHOR
Manpage created by Michal Soltys (soltys@ziu.info)


tc-htb

title: tc-htb(8)

summary: Hierarchy Token Bucket

text:
# tc-htb(8)

## NAME
HTB - Hierarchy Token Bucket

## SYNOPSIS
tc qdisc ... dev dev ( parent classid | root) [ handle major: ] htb [ default minor-id ] [ r2q divisor ] [ offload ]

tc class ... dev dev parent major:[minor] [ classid major:minor ] htb rate rate [ ceil rate ] burst bytes [ cburst bytes ] [ prio priority ] [ quantum bytes ]

## DESCRIPTION
HTB allows control of the outbound bandwidth on a given link. It allows simulating several slower links and to send different kinds of traffic on different simulated links. In both cases, you have to specify how to divide the physical link into simulated links and how to decide which simulated link to use for a given packet to be sent.

HTB shapes traffic based on the Token Bucket Filter algorithm which does not depend on interface characteristics and so does not need to know the underlying bandwidth of the outgoing interface.

## SHAPING ALGORITHM
Shaping works as documented in tc-tbf (8).

## CLASSIFICATION
Within the one HTB instance many classes may exist. Each of these classes contains another qdisc, by default tc-pfifo(8).

When enqueueing a packet, HTB starts at the root and uses various methods to determine which class should receive the data.

In the absence of uncommon configuration options, the process is rather easy. At each node we look for an instruction, and then go to the class the instruction refers us to. If the class found is a barren leaf-node (without children), we enqueue the packet there. If it is not yet a leaf node, we do the whole thing over again starting from that node.

The following actions are performed, in order at each node we visit, until one sends us to another node, or terminates the process.

(i)

Consult filters attached to the class. If sent to a leafnode, we are done. Otherwise, restart.

(ii)

If none of the above returned with an instruction, enqueue at this node.

This algorithm makes sure that a packet always ends up somewhere, even while you are busy building your configuration.

## LINK SHARING ALGORITHM
FIXME

## QDISC
The root of a HTB qdisc class tree has the following parameters:

parent major:minor | root

This mandatory parameter determines the place of the HTB instance, either at the root of an interface or within an existing class.

handle major:

Like all other qdiscs, the HTB can be assigned a handle. Should consist only of a major number, followed by a colon. Optional, but very useful if classes will be generated within this qdisc.

default minor-id

Unclassified traffic gets sent to the class with this minor-id.

r2q divisor

Divisor used to calculate quantum values for classes. Classes divide rate by this number. Default value is 10.

offload

Offload the HTB algorithm to hardware (requires driver and device support).

## CLASSES
Classes have a host of parameters to configure their operation.

parent major:minor

Place of this class within the hierarchy. If attached directly to a qdisc and not to another class, minor can be omitted. Mandatory.

classid major:minor

Like qdiscs, classes can be named. The major number must be equal to the major number of the qdisc to which it belongs. Optional, but needed if this class is going to have children.

prio priority

In the round-robin process, classes with the lowest priority field are tried for packets first.

rate rate

Maximum rate this class and all its children are guaranteed. Mandatory.

ceil rate

Maximum rate at which a class can send, if its parent has bandwidth to spare. Defaults to the configured rate, which implies no borrowing

burst bytes

Amount of bytes that can be burst at ceil speed, in excess of the configured rate. Should be at least as high as the highest burst of all children.

cburst bytes

Amount of bytes that can be burst at 'infinite' speed, in other words, as fast as the interface can transmit them. For perfect evening out, should be equal to at most one average packet. Should be at least as high as the highest cburst of all children.

quantum bytes

Number of bytes to serve from this class before the scheduler moves to the next class. Default value is rate divided by the qdisc r2q parameter. If specified, r2q is ignored.

## NOTES
Due to Unix timing constraints, the maximum ceil rate is not infinite and may in fact be quite low. On Intel, there are 100 timer events per second, the maximum rate is that rate at which 'burst' bytes are sent each timer tick. From this, the minimum burst size for a specified rate can be calculated. For i386, a 10mbit rate requires a 12 kilobyte burst as 100*12kb*8 equals 10mbit.

## SEE ALSO
tc(8)

HTB website: http://luxik.cdi.cz/~devik/qos/htb/

## AUTHOR
Martin Devera <devik@cdi.cz>. This manpage maintained by bert hubert <ahu@ds9a.nl>


tc-ife

title: tc-ife(8)

text:
# tc-ife(8)

## NAME
IFE - encapsulate/decapsulate metadata

## SYNOPSIS

tc ... action ife DIRECTION [ ACTION ] [ dst DMAC ] [ src SMAC ] [ type TYPE ] [ CONTROL ] [ index INDEX ]

DIRECTION := { decode | encode }

ACTION := { allow ATTR | use ATTR value }

ATTR := { mark | prio | tcindex }

CONTROL := { reclassify | use | pipe | drop | continue | ok | goto chain CHAIN_INDEX }

## DESCRIPTION
The ife action allows for a sending side to encapsulate arbitrary metadata, which is then decapsulated by the receiving end. The sender runs in encoding mode and the receiver in decode mode. Both sender and receiver must specify the same ethertype. In the future, a registered ethertype may be available as a default.

## OPTIONS
decode

For the receiving side; decode the metadata if the packet matches.

encode

For the sending side. Encode the specified metadata if the packet matches.

allow

Encode direction only. Allows encoding specified metadata.

use

Encode direction only. Enforce static encoding of specified metadata.

mark [

u32_value ] The value to set for the skb mark. The u32 value is required only when use is specified. If mark value is zero, it will not be encoded, instead "overlimits" statistics increment and CONTROL action is taken.

prio [

u32_value ] The value to set for priority in the skb structure. The u32 value is required only when use is specified.

tcindex [

u16_value ] Value to set for the traffic control index in the skb structure. The u16 value is required only when use is specified.

dmac DMAC

smac SMAC

Optional six byte destination or source MAC address to encode.

type TYPE

Optional 16-bit ethertype to encode. If not specified value of 0xED3E will be used.

CONTROL

Action to take following an encode/decode.

index INDEX

Assign a unique ID to this action instead of letting the kernel choose one automatically. INDEX is a 32bit unsigned integer greater than zero.

## EXAMPLES
On the receiving side, match packets with ethertype 0xdead and restart classification so that it will match ICMP on the next rule, at prio 3:

```
# tc qdisc add dev eth0 handle ffff: ingress
# tc filter add dev eth0 parent ffff: prio 2 protocol 0xdead \
	u32 match u32 0 0 flowid 1:1 \
	action ife decode reclassify
# tc filter add dev eth0 parent ffff: prio 3 protocol ip \
	u32 match ip protocol 0xff flowid 1:1 \
	action continue
```

Match with skb mark of 17:

```
# tc filter add dev eth0 parent ffff: prio 4 protocol ip \
	handle 0x11 fw flowid 1:1 \
	action ok
```

Configure the sending side to encode for the filters above. Use a destination IP address of 192.168.122.237/24, then tag with skb mark of decimal 17. Encode the packet with ethertype 0xdead, add skb->mark to allowed list of meta datum to send, and rewrite the destination MAC address to 02:15:15:15:15:15.

```
# tc qdisc add dev eth0 root handle 1: prio
# tc filter add dev eth0 parent 1: protocol ip prio 10 u32 \
	match ip dst 192.168.122.237/24 \
	match ip protocol 1 0xff \
	flowid 1:2 \
	action skbedit mark 17 \
	action ife encode \
	type 0xDEAD \
	allow mark \
	dst 02:15:15:15:15:15
```

## SEE ALSO
tc(8), tc-u32(8)


tc-matchall

title: tc-matchall(8)

text:
# tc-matchall(8)

## NAME
matchall - traffic control filter that matches every packet

## SYNOPSIS

tc filter ... matchall [ skip_sw | skip_hw ] [ action ACTION_SPEC ] [ classid CLASSID ]

## DESCRIPTION
The matchall filter allows one to classify every packet that flows on the port and run a action on it.

## OPTIONS
action ACTION_SPEC

Apply an action from the generic actions framework on matching packets.

classid CLASSID

Push matching packets into the class identified by CLASSID.

skip_sw

Do not process filter by software. If hardware has no offload support for this filter, or TC offload is not enabled for the interface, operation will fail.

skip_hw

Do not process filter by hardware.

## EXAMPLES
To create ingress mirroring from port eth1 to port eth2:

```
tc qdisc  add dev eth1 handle ffff: clsact
tc filter add dev eth1 ingress                \

        matchall skip_sw                      \

        action mirred egress mirror           \

        dev eth2
```

The first command creates a clsact qdisc with handle ffff: on device eth1 where the second command attaches a matchall filters on it that mirrors the packets to device eth2 for ingress.

To create egress mirroring from port eth1 to port eth2:

```
tc qdisc add dev eth1 handle ffff: clsact
tc filter add dev eth1 egress                  \

        matchall skip_sw                       \

        action mirred egress mirror            \

        dev eth2
```

The first command creates a clsact qdisc with handle ffff: on device eth1 where the second command attaches a matchall filters on it that mirrors the packets to device eth2 for egress.

To sample one of every 100 packets flowing into interface eth0 to psample group 12:

```
tc qdisc add dev eth0 handle ffff: ingress
tc filter add dev eth0 parent ffff: matchall \

     action sample rate 100 group 12
```

## SEE ALSO
tc(8),