not a support question
new_u
offlineMember
I'm trying to limit the bandwidth used by an application (firefox) using this
http://unix.stackexchange.com/questions/34116/how-can-i-limit-the-bandwidth-used-by-a-process
but it turns out that iptables doesn't recognize these options
iptables v1.4.10: unknown option `--pid-owner'
iptables v1.4.10: unknown option `--cmd-owner'
I'm wondering why is that so?
new_u
offlineMember
I took a look at iptables source and seems that those options are handled by
/usr/lib/iptables/xtables/libxt_owner.so
which is installed in my system. Also in /proc/config.gz I found
CONFIG_NETFILTER_XT_MATCH_OWNER=m
so I'm guessing that some module needs to be loaded for those filtering options to work?
kultex
offlineKey Master
http://doc.slitaz.org/en:handbook:networkconf#manage-the-firewall-firewall-using-iptables
you can also try as root in ther terminal: "hwsetup firewall"
hwsetup should install iptables change IPTABLES=no to IPTABLES=yes in /etc/firewall.conf and start the firewall with /etc/init.d/firewall start
new_u
offlineMember
Thannks kultex. I've done a bit more of research and apparently the functionality I want isn't available on the kernel anymore. Looks like at some point the pid matching ability was dropped.
So, in order to mamage the bandwidth used by an app, a workaround is to create a new user, have that user run the app and apply filtering/traffic control rules to the user.
kultex
offlineKey Master
I have no idea, what are you looking for - so jsut a question - what are you using to get the pid?
I had also troubles with my audioscripts changing from 4.0 to 5.0...
"pidof" works fine in 5.0
new_u
offlineMember
Yes, getting the pid is not a problem. Once I have the pid (xxxx) for a process I do
iptables -A OUTPUT -p TCP -m owner --pid-owner xxxx -j ACCEPT
and I get
iptables v1.4.10: unknown option `--pid-owner'
I was told that happens because pid matching was removed from the kernel (and iptables is just an interface to the kernel). "Pid matching" here refers to netfilter being able to tell which process owns which packets.
kultex
offlineKey Master
I am not aspecialist on this, but somthing in my memory says syntax in iptables is is --uid-owner and --gid-owner not --pid-owner
new_u
offlineMember
--pid-owner used to be a valid option (I checked the source for iptables and the code is there)
But right now matching on user and group (--uid-owner and --gid-owner) are the only(?) available options...
from iptables-1.4.10/extensions/libxt_owner.c
printf(
"owner match options:\n"
"[!] --uid-owner userid Match local UID\n"
"[!] --gid-owner groupid Match local GID\n"
"[!] --pid-owner processid Match local PID\n"
"[!] --sid-owner sessionid Match local SID\n"
"[!] --cmd-owner name Match local command name\n"
"NOTE: PID, SID and command matching are broken on SMP\n");
kultex
offlineKey Master
I just can reccomand this...
http://wiki.openwrt.org/doc/howto/packet.scheduler/packet.scheduler
new_u
offlineMember
Thanks! Yes, I've been taking a look at some docs on traffic shaping.
One of the techniques is to first mark packets using iptables and then use tc to operate on the marked packets.
In my case, I'll need to mark packets based on user with --uid-owner
I'll post the whole procedure if/when I get it to work...
kultex
offlineKey Master
I think, we dont have tc in the repos - in debian it together with iproute, but pkgs.slitaz.org is so slow, that I dont get info if I search for files....
kultex
offlineKey Master
who is/was the star in traffic shaping is the old tomato router firmware...
http://www.polarcloud.com/tomato
I still use Buffalo WHR-HP-G54 routers to get ipad/android video to isadoro with kinoni - its far off the shortest delay.....
if you have the possibilty, have a look inside...
new_u
offlineMember
I should get a decent router. But I don't think in this case it would do much good since I need to restrict the bandwidth of a particular user/application that runs on SliTaz? Hm I guess the router can shape packets marked by SliTaz, but so can do SliTaz itself?...
Well, I just tried tc and it seems to be broken...I'll start a new topic on that :
http://forum.slitaz.org/topic/iproute2-tc?replies=1#post-36454
bodhi.zazen
offlineMember
I know this thread is a few years old, but the answer is that support for --cmd-owner was broken and removed from the kernel in 2005
See http://www.spinics.net/lists/netfilter/msg49716.html
commit 34b4a4a624bafe089107966a6c56d2a1aca026d4
Author: Christoph Hellwig <hch@xxxxxx>
Date: Sun Aug 14 17:33:59 2005 -0700
[NETFILTER]: Remove tasklist_lock abuse in ipt{,6}owner
Rip out cmd/sid/pid matching since its unfixable broken and stands in the
way of locking changes to tasklist_lock.
Signed-off-by: Christoph Hellwig <hch@xxxxxx>
Signed-off-by: Patrick McHardy <kaber@xxxxxxxxx>
Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
You must log in to post.
