verifying set-mark

DISCUSSION Casey Scott 3 participants 8 messages Feb 22, 2008 – Feb 23, 2008

Share & tools

Casey Scott

author

2008-02-22 20:14 UTC #0 lore raw

How can I detemine whether or not a iptables set-mark operation is working? iptables -t mangle -nvL shows packets matching the rules with the set-mark. However, with a tcpdump -vvv -i <interface> I can not see the mark. I am looking at the tos field, and I don't see a tos field matching the marks I am trying to set.

Thanks,
Casey

Rob Sterenborg

2008-02-22 20:44 UTC #1 lore raw

Quoted 6 lines

How can I detemine whether or not a iptables set-mark operation is working? iptables -t mangle -nvL shows packets matching the rules with the set-mark. However, with a tcpdump -vvv -i <interface>
I can not see the mark. I am looking at the tos field, and I don't see a tos field matching the marks I am trying to set.

Did you try to match the mark in a subsequent rule and LOG the packet when the rule hits? See also man iptables:

mark
This module matches the netfilter mark field associated with a packet (which can be set using the MARK target below).
--mark value[/mask] Matches packets with the given unsigned mark value (if a mask is specified, this is logically ANDed with the mask before the comparison).

Grts,
Rob

Casey Scott

author

2008-02-22 20:53 UTC #2 lore raw

Good suggestion. Tried just tried that. Traffic gets logged, but the mark is not set. E.g. (from dump)

Feb 22 12:50:52 tomcat kernel: IN= OUT=eth0 SRC=66.93.87.2

DST=192.168.1.7 LEN=1500 TOS=0x00 PREC=0x20 TTL=54 ID=4397 DF PROTO=TCP SPT=80 DPT=4322 WINDOW=17520 RES=0x00 ACK URGP=0

Feb 22 12:50:52 tomcat kernel: IN=eth0 OUT=eth1 SRC=192.168.1.7

DST=66.93.87.2 LEN=40 TOS=0x00 PREC=0x00 TTL=127 ID=18031 DF PROTO=TCP SPT=4322 DPT=80 WINDOW=64240 RES=0x00 ACK URGP=0

Feb 22 12:50:52 tomcat kernel: IN= OUT=eth0 SRC=66.93.87.2

DST=192.168.1.7 LEN=1500 TOS=0x00 PREC=0x20 TTL=54 ID=4398 DF PROTO=TCP SPT=80 DPT=4322 WINDOW=17520 RES=0x00 ACK URGP=0

Notice all the TOS is still 0x00. I am setting marks to 3 or 4 depending on traffic type.

Casey

Quoted 28 lines · ----- "Rob Sterenborg

Quoted 6 lines
How can I detemine whether or not a iptables set-mark operation is working? iptables -t mangle -nvL shows packets matching the rules with the set-mark. However, with a tcpdump -vvv -i <interface>
I can not see the mark. I am looking at the tos field, and I don't see a tos field matching the marks I am trying to set.
Did you try to match the mark in a subsequent rule and LOG the packet when the rule hits?
See also man iptables:
mark
This module matches the netfilter mark field associated with a packet (which can be set using the MARK target below).
--mark value[/mask] Matches packets with the given unsigned mark value (if a mask is specified, this is logically ANDed with the mask before the comparison).
Grts,
Rob
-
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

Matt Zagrabelny

2008-02-22 21:44 UTC #3 lore raw

Quoted 11 lines · Casey Scott

Good suggestion. Tried just tried that. Traffic gets logged, but the mark is not set. E.g. (from dump)
Feb 22 12:50:52 tomcat kernel: IN= OUT=eth0 SRC=66.93.87.2 
DST=192.168.1.7 LEN=1500 TOS=0x00 PREC=0x20 TTL=54 ID=4397 DF PROTO=TCP SPT=80 DPT=4322 WINDOW=17520 RES=0x00 ACK URGP=0
Feb 22 12:50:52 tomcat kernel: IN=eth0 OUT=eth1 SRC=192.168.1.7 
DST=66.93.87.2 LEN=40 TOS=0x00 PREC=0x00 TTL=127 ID=18031 DF PROTO=TCP SPT=4322 DPT=80 WINDOW=64240 RES=0x00 ACK URGP=0

Quoted 7 lines

Feb 22 12:50:52 tomcat kernel: IN= OUT=eth0 SRC=66.93.87.2 
DST=192.168.1.7 LEN=1500 TOS=0x00 PREC=0x20 TTL=54 ID=4398 DF PROTO=TCP SPT=80 DPT=4322 WINDOW=17520 RES=0x00 ACK URGP=0
Notice all the TOS is still 0x00. I am setting marks to 3 or 4 depending on traffic type.

AFAIK, setting TOS is not the same as marking. [goes to check] The man page confirms that.

Quoted 36 lines

Casey
Quoted 23 lines · ----- "Rob Sterenborg
Quoted 6 lines
How can I detemine whether or not a iptables set-mark operation is working? iptables -t mangle -nvL shows packets matching the rules with the set-mark. However, with a tcpdump -vvv -i <interface>
I can not see the mark. I am looking at the tos field, and I don't see a tos field matching the marks I am trying to set.
Did you try to match the mark in a subsequent rule and LOG the packet when the rule hits?
See also man iptables:
mark
This module matches the netfilter mark field associated with a packet (which can be set using the MARK target below).
--mark value[/mask] Matches packets with the given unsigned mark value (if a mask is specified, this is logically ANDed with the mask before the comparison).
Grts,
Rob
Quoted 5 lines
-
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
-
To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

Signature · 9 lines

Matt Zagrabelny - [email protected] - (218) 726 8844
University of Minnesota Duluth
Information Technology Systems & Services
PGP key 1024D/84E22DA2 2005-11-07
Fingerprint: 78F9 18B3 EF58 56F5 FC85  C5CA 53E7 887F 84E2 2DA2

He is not a fool who gives up what he cannot keep to gain what he cannot
lose.
-Jim Elliot

Casey Scott

author

2008-02-22 22:40 UTC #4 lore raw

Ultimately, I am trying to mark packets for a tc filter. Should I not be using the iptables set-mark to do that?

Casey

Quoted 77 lines · ----- "Matt Zagrabelny

Quoted 11 lines · Casey Scott
Good suggestion. Tried just tried that. Traffic gets logged, but the mark is not set. E.g. (from dump)
Feb 22 12:50:52 tomcat kernel: IN= OUT=eth0 SRC=66.93.87.2 
DST=192.168.1.7 LEN=1500 TOS=0x00 PREC=0x20 TTL=54 ID=4397 DF PROTO=TCP SPT=80 DPT=4322 WINDOW=17520 RES=0x00 ACK URGP=0
Feb 22 12:50:52 tomcat kernel: IN=eth0 OUT=eth1 SRC=192.168.1.7 
DST=66.93.87.2 LEN=40 TOS=0x00 PREC=0x00 TTL=127 ID=18031 DF PROTO=TCP SPT=4322 DPT=80 WINDOW=64240 RES=0x00 ACK URGP=0
Quoted 7 lines
Feb 22 12:50:52 tomcat kernel: IN= OUT=eth0 SRC=66.93.87.2 
DST=192.168.1.7 LEN=1500 TOS=0x00 PREC=0x20 TTL=54 ID=4398 DF PROTO=TCP SPT=80 DPT=4322 WINDOW=17520 RES=0x00 ACK URGP=0
Notice all the TOS is still 0x00. I am setting marks to 3 or 4 depending on traffic type.
AFAIK, setting TOS is not the same as marking. [goes to check] The man page confirms that.
Quoted 12 lines
Casey
Quoted 8 lines · ----- "Rob Sterenborg
Quoted 6 lines
How can I detemine whether or not a iptables set-mark operation is working? iptables -t mangle -nvL shows packets matching the rules with the set-mark. However, with a tcpdump -vvv -i <interface>
I can not see the mark. I am looking at the tos field, and I don't see a tos field matching the marks I am trying to set.
Did you try to match the mark in a subsequent rule and LOG the
packet
Quoted 5 lines
Quoted 5 lines
when the rule hits?
See also man iptables:
mark
This module matches the netfilter mark field associated with a
packet
Quoted 2 lines
Quoted 2 lines
(which can be set using the MARK target below). --mark value[/mask] Matches packets with the given unsigned mark
value
Quoted 1 line
Quoted 1 line
(if a mask is specified, this is logically ANDed with the mask
before
Quoted 9 lines
Quoted 9 lines
the comparison).
Grts,
Rob
-
To unsubscribe from this list: send the line "unsubscribe
netfilter"
Quoted 3 lines
Quoted 3 lines
in
the body of a message to [email protected] More majordomo info at
http://vger.kernel.org/majordomo-info.html
Quoted 2 lines
-
To unsubscribe from this list: send the line "unsubscribe netfilter"
in
Quoted 2 lines
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Signature · 10 lines
Matt Zagrabelny - [email protected] - (218) 726 8844
University of Minnesota Duluth
Information Technology Systems & Services
PGP key 1024D/84E22DA2 2005-11-07
Fingerprint: 78F9 18B3 EF58 56F5 FC85  C5CA 53E7 887F 84E2 2DA2

He is not a fool who gives up what he cannot keep to gain what he
cannot
lose.
-Jim Elliot

Matt Zagrabelny

2008-02-22 22:49 UTC #5 lore raw

Quoted 2 lines · Casey Scott

Ultimately, I am trying to mark packets for a tc filter. Should I not be using the iptables set-mark to do that?

I think set-mark is fine for that.

I suggest marking some packets in the prerouting chain and then logging them in input chain. Something like the following:

$iptables --table mangle --append PREROUTING --in-interface $in_interface
--destination $host --jump MARK --set-mark $mark_integer

$iptables --table filter --append INPUT
--in-interface $in_interface
--match mark --mark $mark_integer --jump LOG

Quoted 84 lines

Quoted 60 lines · ----- "Matt Zagrabelny
Quoted 11 lines · Casey Scott
Good suggestion. Tried just tried that. Traffic gets logged, but the mark is not set. E.g. (from dump)
Feb 22 12:50:52 tomcat kernel: IN= OUT=eth0 SRC=66.93.87.2 
DST=192.168.1.7 LEN=1500 TOS=0x00 PREC=0x20 TTL=54 ID=4397 DF PROTO=TCP SPT=80 DPT=4322 WINDOW=17520 RES=0x00 ACK URGP=0
Feb 22 12:50:52 tomcat kernel: IN=eth0 OUT=eth1 SRC=192.168.1.7 
DST=66.93.87.2 LEN=40 TOS=0x00 PREC=0x00 TTL=127 ID=18031 DF PROTO=TCP SPT=4322 DPT=80 WINDOW=64240 RES=0x00 ACK URGP=0
Quoted 7 lines
Feb 22 12:50:52 tomcat kernel: IN= OUT=eth0 SRC=66.93.87.2 
DST=192.168.1.7 LEN=1500 TOS=0x00 PREC=0x20 TTL=54 ID=4398 DF PROTO=TCP SPT=80 DPT=4322 WINDOW=17520 RES=0x00 ACK URGP=0
Notice all the TOS is still 0x00. I am setting marks to 3 or 4 depending on traffic type.
AFAIK, setting TOS is not the same as marking. [goes to check] The man page confirms that.
Quoted 12 lines
Casey
Quoted 8 lines · ----- "Rob Sterenborg
Quoted 6 lines
How can I detemine whether or not a iptables set-mark operation is working? iptables -t mangle -nvL shows packets matching the rules with the set-mark. However, with a tcpdump -vvv -i <interface>
I can not see the mark. I am looking at the tos field, and I don't see a tos field matching the marks I am trying to set.
Did you try to match the mark in a subsequent rule and LOG the
packet
Quoted 5 lines
Quoted 5 lines
when the rule hits?
See also man iptables:
mark
This module matches the netfilter mark field associated with a
packet
Quoted 2 lines
Quoted 2 lines
(which can be set using the MARK target below). --mark value[/mask] Matches packets with the given unsigned mark
value
Quoted 1 line
Quoted 1 line
(if a mask is specified, this is logically ANDed with the mask
before
Quoted 9 lines
Quoted 9 lines
the comparison).
Grts,
Rob
-
To unsubscribe from this list: send the line "unsubscribe
netfilter"
Quoted 3 lines
Quoted 3 lines
in
the body of a message to [email protected] More majordomo info at
Quoted 17 lines
http://vger.kernel.org/majordomo-info.html
Quoted 2 lines
-
To unsubscribe from this list: send the line "unsubscribe netfilter"
in
Quoted 2 lines
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Signature · 10 lines
Matt Zagrabelny - [email protected] - (218) 726 8844
University of Minnesota Duluth
Information Technology Systems & Services
PGP key 1024D/84E22DA2 2005-11-07
Fingerprint: 78F9 18B3 EF58 56F5 FC85  C5CA 53E7 887F 84E2 2DA2

He is not a fool who gives up what he cannot keep to gain what he
cannot
lose.
-Jim Elliot
-
To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

Signature · 9 lines

Matt Zagrabelny - [email protected] - (218) 726 8844
University of Minnesota Duluth
Information Technology Systems & Services
PGP key 1024D/84E22DA2 2005-11-07
Fingerprint: 78F9 18B3 EF58 56F5 FC85  C5CA 53E7 887F 84E2 2DA2

He is not a fool who gives up what he cannot keep to gain what he cannot
lose.
-Jim Elliot

Casey Scott

author

2008-02-23 18:14 UTC #6 lore raw

Is there a way with tcpdump to verify that the marks are actually getting set though?

Casey

Quoted 19 lines · ----- "Matt Zagrabelny

Quoted 2 lines · Casey Scott
Ultimately, I am trying to mark packets for a tc filter. Should I not be using the iptables set-mark to do that?
I think set-mark is fine for that.
I suggest marking some packets in the prerouting chain and then logging
them in input chain. Something like the following:
$iptables --table mangle --append PREROUTING --in-interface $in_interface
--destination $host --jump MARK --set-mark $mark_integer
$iptables --table filter --append INPUT
--in-interface $in_interface
--match mark --mark $mark_integer --jump LOG
Quoted 1 line

Rob Sterenborg

2008-02-23 19:23 UTC #7 lore raw

Quoted 2 lines

Is there a way with tcpdump to verify that the marks are actually getting set though?

However, I was under the impression that tc is able to use the flags set by iptables.

Man tc:

tc filters
If tc filters are attached to a class, they are consulted first for relevant instructions. Filters can match on all fields of a packet header, as well as on the firewall mark applied by ipchains or iptables. See tc-filters(8).

Now, I don't seem to have a man page for tc-filters, I can't find it on the internet, nor can I find it in the source (I looked in iproute2-2.6.19-061214), so I'm afraid nobody's got it which makes this a dead end.

There surely must be examples around that show how to work with tc and iptables' mark. Perhaps this will get you going: http://www.szabilinux.hu/bandwidth/index.html

Grts,
Rob