SliTaz Forum
You are not logged in.
Pages: 1
I'm trying to limit the bandwidth used by an application (firefox) using this
http://unix.stackexchange.com/questions/34116/how-can-i-limit-the-bandwidth-used-by-a-process
but it turns out that iptables doesn't recognize these options
iptables v1.4.10: unknown option `--pid-owner'
iptables v1.4.10: unknown option `--cmd-owner'
I'm wondering why is that so?
Offline
I took a look at iptables source and seems that those options are handled by
/usr/lib/iptables/xtables/libxt_owner.so
which is installed in my system. Also in /proc/config.gz I found
CONFIG_NETFILTER_XT_MATCH_OWNER=m
so I'm guessing that some module needs to be loaded for those filtering options to work?
Offline
http://doc.slitaz.org/en:handbook:networkconf#manage-the-firewall-firewall-using-iptables
you can also try as root in ther terminal: "hwsetup firewall"
hwsetup should install iptables change IPTABLES=no to IPTABLES=yes in /etc/firewall.conf and start the firewall with /etc/init.d/firewall start
Offline
Thannks kultex. I've done a bit more of research and apparently the functionality I want isn't available on the kernel anymore. Looks like at some point the pid matching ability was dropped.
So, in order to mamage the bandwidth used by an app, a workaround is to create a new user, have that user run the app and apply filtering/traffic control rules to the user.
Offline
I have no idea, what are you looking for - so jsut a question - what are you using to get the pid?
I had also troubles with my audioscripts changing from 4.0 to 5.0...
"pidof" works fine in 5.0
Offline
Yes, getting the pid is not a problem. Once I have the pid (xxxx) for a process I do
iptables -A OUTPUT -p TCP -m owner --pid-owner xxxx -j ACCEPT
and I get
iptables v1.4.10: unknown option `--pid-owner'
I was told that happens because pid matching was removed from the kernel (and iptables is just an interface to the kernel). "Pid matching" here refers to netfilter being able to tell which process owns which packets.
Offline
I am not aspecialist on this, but somthing in my memory says syntax in iptables is is --uid-owner and --gid-owner not --pid-owner
Offline
--pid-owner used to be a valid option (I checked the source for iptables and the code is there)
But right now matching on user and group (--uid-owner and --gid-owner) are the only(?) available options...
from iptables-1.4.10/extensions/libxt_owner.c
printf(
"owner match options:\n"
"[!] --uid-owner userid Match local UID\n"
"[!] --gid-owner groupid Match local GID\n"
"[!] --pid-owner processid Match local PID\n"
"[!] --sid-owner sessionid Match local SID\n"
"[!] --cmd-owner name Match local command name\n"
"NOTE: PID, SID and command matching are broken on SMP\n");
Offline
I just can reccomand this...
http://wiki.openwrt.org/doc/howto/packet.scheduler/packet.scheduler
Offline
Thanks! Yes, I've been taking a look at some docs on traffic shaping.
One of the techniques is to first mark packets using iptables and then use tc to operate on the marked packets.
In my case, I'll need to mark packets based on user with --uid-owner
I'll post the whole procedure if/when I get it to work...
Offline
I think, we dont have tc in the repos - in debian it together with iproute, but pkgs.slitaz.org is so slow, that I dont get info if I search for files....
Offline
Ah, at some point I installed tc but now I don't even recall where I got it from =/
Offline
who is/was the star in traffic shaping is the old tomato router firmware...
http://www.polarcloud.com/tomato
I still use Buffalo WHR-HP-G54 routers to get ipad/android video to isadoro with kinoni - its far off the shortest delay.....
if you have the possibilty, have a look inside...
Offline
I should get a decent router. But I don't think in this case it would do much good since I need to restrict the bandwidth of a particular user/application that runs on SliTaz? Hm I guess the router can shape packets marked by SliTaz, but so can do SliTaz itself?...
Well, I just tried tc and it seems to be broken...I'll start a new topic on that :
http://forum.slitaz.org/topic/iproute2-tc?replies=1#post-36454
Offline
I know this thread is a few years old, but the answer is that support for --cmd-owner was broken and removed from the kernel in 2005
See http://www.spinics.net/lists/netfilter/msg49716.html
[c]commit 34b4a4a624bafe089107966a6c56d2a1aca026d4
Author: Christoph Hellwig <hch@xxxxxx>
Date: Sun Aug 14 17:33:59 2005 -0700
[NETFILTER]: Remove tasklist_lock abuse in ipt{,6}owner
Rip out cmd/sid/pid matching since its unfixable broken and stands in the
way of locking changes to tasklist_lock.
Signed-off-by: Christoph Hellwig <hch@xxxxxx>
Signed-off-by: Patrick McHardy <kaber@xxxxxxxxx>
Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>[/c]
Offline
Pages: 1
[ Generated in 0.021 seconds, 7 queries executed - Memory usage: 1.56 MiB (Peak: 1.77 MiB) ]