Linux-Kernel
IFB設備在Linux核心的包流中是如何定位的
我想知道以下設備在入口流量整形的數據包流中的確切位置：
- **IFB：**中間功能塊
我想更好地了解數據包是如何流向此設備的，以及何時發生這種情況，以了解可以使用以下哪些過濾/分類方法：
tc filter ... u32 ...iptables ... -j MARK --set-mark ...iptables ... -j CLASSIFY --set-class ...似乎很難找到關於這個主題的文件，在哪裡可以找到官方文件的任何幫助也將不勝感激。
據我所知的文件：
tc: tldp.org HOWTO , lartc.org HOWTOifb: linuxfoundation.org , tc-mirred 手冊頁, wiki.gentoo.orgnetfilter數據包流：kernel_flow , docum.org kptd從已知文件中，我解釋以下內容：
基本交通管制
figure 1 +-------+ +------+ |ingress| +---------+ |egress| |qdisc +--->netfilter+--->qdisc | |eth0 | +---------+ |eth0 | +-------+ +------+國際足聯？
tc filter add dev eth0 parent ffff: protocol all u32 match u32 0 0 action mirred egress redirect dev ifb0會導致？figure 2 +-------+ +-------+ +------+ +------+ |ingress| |ingress| |egress| +---------+ |egress| |qdisc +--->qdisc +--->qdisc +--->netfilter+--->qdisc | |eth0 | |ifb0 | |ifb0 | +---------+ |eth0 | +-------+ +-------+ +------+ +------+
我想我終於明白重定向
ingress到**IFB**是如何工作的：+-------+ +------+ +------+ |ingress| |egress| +---------+ |egress| |qdisc +--->qdisc +--->netfilter+--->qdisc | |eth1 | |ifb1 | +---------+ |eth1 | +-------+ +------+ +------+我最初的假設是
figure 2，ifb設備插入到和之間ingress eth1，netfilter並且數據包首先進入ingress ifb1然後退出egress ifb1是錯誤的。事實上，將流量從**介面重定向
ingress到egress****ifbegress**是通過重定向（“竊取”）數據包並將其直接放入egressifb 設備中直接完成的。如文件中所述，至少在我的版本中，目前不支持將流量鏡像/重定向到ifb ：
ingressroot@deb8:~# tc -V tc utility, iproute2-ss140804 root@deb8:~# dpkg -l | grep iproute ii iproute2 3.16.0-2 root@deb8:~# uname -a Linux deb8 3.16.0-4-amd64 #1 SMP Debian 3.16.7-ckt25-1 x86_64 GNU/Linux文件
由於以下文件，我能夠獲得此資訊：
- linux-ip.net中間功能塊
- dev.laptop.org ifb-README
- people.netfilter.org Linux 流量控制分類器-動作子系統架構論文
調試
iptables -j LOG還有一些使用and進行的調試tc filter action simple，我用來在數據包流經 netdevssyslog時列印出消息。icmp結果如下：
Jun 14 13:02:12 deb8 kernel: [ 4273.341087] simple: tc[eth1]ingress_1 Jun 14 13:02:12 deb8 kernel: [ 4273.341114] simple: tc[ifb1]egress_1 Jun 14 13:02:12 deb8 kernel: [ 4273.341229] ipt[PREROUTING]raw IN=eth1 OUT= MAC=08:00:27:ee:8f:15:08:00:27:89:16:5b:08:00 SRC=10.1.1.3 DST=10.1.1.2 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=53979 DF PROTO=ICMP TYPE=8 CODE=0 ID=1382 SEQ=1 Jun 14 13:02:12 deb8 kernel: [ 4273.341238] ipt[PREROUTING]mangle IN=eth1 OUT= MAC=08:00:27:ee:8f:15:08:00:27:89:16:5b:08:00 SRC=10.1.1.3 DST=10.1.1.2 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=53979 DF PROTO=ICMP TYPE=8 CODE=0 ID=1382 SEQ=1 Jun 14 13:02:12 deb8 kernel: [ 4273.341242] ipt[PREROUTING]nat IN=eth1 OUT= MAC=08:00:27:ee:8f:15:08:00:27:89:16:5b:08:00 SRC=10.1.1.3 DST=10.1.1.2 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=53979 DF PROTO=ICMP TYPE=8 CODE=0 ID=1382 SEQ=1 Jun 14 13:02:12 deb8 kernel: [ 4273.341249] ipt[INPUT]mangle IN=eth1 OUT= MAC=08:00:27:ee:8f:15:08:00:27:89:16:5b:08:00 SRC=10.1.1.3 DST=10.1.1.2 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=53979 DF PROTO=ICMP TYPE=8 CODE=0 ID=1382 SEQ=1 Jun 14 13:02:12 deb8 kernel: [ 4273.341252] ipt[INPUT]filter IN=eth1 OUT= MAC=08:00:27:ee:8f:15:08:00:27:89:16:5b:08:00 SRC=10.1.1.3 DST=10.1.1.2 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=53979 DF PROTO=ICMP TYPE=8 CODE=0 ID=1382 SEQ=1 Jun 14 13:02:12 deb8 kernel: [ 4273.341255] ipt[INPUT]nat IN=eth1 OUT= MAC=08:00:27:ee:8f:15:08:00:27:89:16:5b:08:00 SRC=10.1.1.3 DST=10.1.1.2 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=53979 DF PROTO=ICMP TYPE=8 CODE=0 ID=1382 SEQ=1 Jun 14 13:02:12 deb8 kernel: [ 4273.341267] ipt[OUTPUT]raw IN= OUT=eth1 SRC=10.1.1.2 DST=10.1.1.3 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=37735 PROTO=ICMP TYPE=0 CODE=0 ID=1382 SEQ=1 Jun 14 13:02:12 deb8 kernel: [ 4273.341270] ipt[OUTPUT]mangle IN= OUT=eth1 SRC=10.1.1.2 DST=10.1.1.3 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=37735 PROTO=ICMP TYPE=0 CODE=0 ID=1382 SEQ=1 Jun 14 13:02:12 deb8 kernel: [ 4273.341272] ipt[OUTPUT]filter IN= OUT=eth1 SRC=10.1.1.2 DST=10.1.1.3 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=37735 PROTO=ICMP TYPE=0 CODE=0 ID=1382 SEQ=1 Jun 14 13:02:12 deb8 kernel: [ 4273.341274] ipt[POSTROUTING]mangle IN= OUT=eth1 SRC=10.1.1.2 DST=10.1.1.3 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=37735 PROTO=ICMP TYPE=0 CODE=0 ID=1382 SEQ=1 Jun 14 13:02:12 deb8 kernel: [ 4273.341278] simple: tc[eth1]egress_1 Jun 14 13:02:12 deb8 kernel: [ 4273.341280] simple: tc[ifb0]egress_1使用以下設置完成調試：
iptables -F -t filter iptables -F -t nat iptables -F -t mangle iptables -F -t raw iptables -A PREROUTING -t raw -p icmp --icmp-type 8 -j LOG --log-level 7 --log-prefix 'ipt[PREROUTING]raw ' iptables -A PREROUTING -t mangle -p icmp --icmp-type 8 -j LOG --log-level 7 --log-prefix 'ipt[PREROUTING]mangle ' iptables -A PREROUTING -t nat -p icmp --icmp-type 8 -j LOG --log-level 7 --log-prefix 'ipt[PREROUTING]nat ' iptables -A INPUT -t mangle -p icmp --icmp-type 8 -j LOG --log-level 7 --log-prefix 'ipt[INPUT]mangle ' iptables -A INPUT -t filter -p icmp --icmp-type 8 -j LOG --log-level 7 --log-prefix 'ipt[INPUT]filter ' iptables -A INPUT -t nat -p icmp --icmp-type 8 -j LOG --log-level 7 --log-prefix 'ipt[INPUT]nat ' iptables -A FORWARD -t mangle -p icmp --icmp-type 8 -j LOG --log-level 7 --log-prefix 'ipt[FORWARD]mangle ' iptables -A FORWARD -t filter -p icmp --icmp-type 8 -j LOG --log-level 7 --log-prefix 'ipt[FORWARD]filter ' iptables -A OUTPUT -t raw -p icmp --icmp-type 8 -j LOG --log-level 7 --log-prefix 'ipt[OUTPUT]raw ' iptables -A OUTPUT -t mangle -p icmp --icmp-type 8 -j LOG --log-level 7 --log-prefix 'ipt[OUTPUT]mangle ' iptables -A OUTPUT -t nat -p icmp --icmp-type 8 -j LOG --log-level 7 --log-prefix 'ipt[OUTPUT]nat ' iptables -A OUTPUT -t filter -p icmp --icmp-type 8 -j LOG --log-level 7 --log-prefix 'ipt[OUTPUT]filter ' iptables -A POSTROUTING -t mangle -p icmp --icmp-type 8 -j LOG --log-level 7 --log-prefix 'ipt[POSTROUTING]mangle ' iptables -A POSTROUTING -t nat -p icmp --icmp-type 8 -j LOG --log-level 7 --log-prefix 'ipt[POSTROUTING]nat ' iptables -A PREROUTING -t raw -p icmp --icmp-type 0 -j LOG --log-level 7 --log-prefix 'ipt[PREROUTING]raw ' iptables -A PREROUTING -t mangle -p icmp --icmp-type 0 -j LOG --log-level 7 --log-prefix 'ipt[PREROUTING]mangle ' iptables -A PREROUTING -t nat -p icmp --icmp-type 0 -j LOG --log-level 7 --log-prefix 'ipt[PREROUTING]nat ' iptables -A INPUT -t mangle -p icmp --icmp-type 0 -j LOG --log-level 7 --log-prefix 'ipt[INPUT]mangle ' iptables -A INPUT -t filter -p icmp --icmp-type 0 -j LOG --log-level 7 --log-prefix 'ipt[INPUT]filter ' iptables -A INPUT -t nat -p icmp --icmp-type 0 -j LOG --log-level 7 --log-prefix 'ipt[INPUT]nat ' iptables -A FORWARD -t mangle -p icmp --icmp-type 0 -j LOG --log-level 7 --log-prefix 'ipt[FORWARD]mangle ' iptables -A FORWARD -t filter -p icmp --icmp-type 0 -j LOG --log-level 7 --log-prefix 'ipt[FORWARD]filter ' iptables -A OUTPUT -t raw -p icmp --icmp-type 0 -j LOG --log-level 7 --log-prefix 'ipt[OUTPUT]raw ' iptables -A OUTPUT -t mangle -p icmp --icmp-type 0 -j LOG --log-level 7 --log-prefix 'ipt[OUTPUT]mangle ' iptables -A OUTPUT -t nat -p icmp --icmp-type 0 -j LOG --log-level 7 --log-prefix 'ipt[OUTPUT]nat ' iptables -A OUTPUT -t filter -p icmp --icmp-type 0 -j LOG --log-level 7 --log-prefix 'ipt[OUTPUT]filter ' iptables -A POSTROUTING -t mangle -p icmp --icmp-type 0 -j LOG --log-level 7 --log-prefix 'ipt[POSTROUTING]mangle ' iptables -A POSTROUTING -t nat -p icmp --icmp-type 0 -j LOG --log-level 7 --log-prefix 'ipt[POSTROUTING]nat ' export TC="/sbin/tc" $TC qdisc del dev eth1 root $TC qdisc del dev eth1 ingress ip link set dev ifb0 down ip link set dev ifb1 down $TC qdisc del dev ifb0 root $TC qdisc del dev ifb1 root rmmod ifb modprobe ifb numifbs=2 $TC qdisc add dev ifb0 root handle 1: htb default 2 $TC class add dev ifb0 parent 1: classid 1:1 htb rate 2Mbit $TC class add dev ifb0 parent 1: classid 1:2 htb rate 10Mbit $TC filter add dev ifb0 parent 1: protocol ip prio 1 u32 \ match ip protocol 1 0xff flowid 1:1 \ action simple "tc[ifb0]egress" $TC qdisc add dev ifb0 ingress $TC filter add dev ifb0 parent ffff: protocol ip prio 1 u32 \ match ip protocol 1 0xff \ action simple "tc[ifb0]ingress" $TC qdisc add dev ifb1 root handle 1: htb default 2 $TC class add dev ifb1 parent 1: classid 1:1 htb rate 2Mbit $TC class add dev ifb1 parent 1: classid 1:2 htb rate 10Mbit $TC filter add dev ifb1 parent 1: protocol ip prio 1 u32 \ match ip protocol 1 0xff flowid 1:1 \ action simple "tc[ifb1]egress" $TC qdisc add dev ifb1 ingress $TC filter add dev ifb1 parent ffff: protocol ip prio 1 u32 \ match ip protocol 1 0xff \ action simple "tc[ifb1]ingress" ip link set dev ifb0 up ip link set dev ifb1 up $TC qdisc add dev eth1 root handle 1: htb default 2 $TC class add dev eth1 parent 1: classid 1:1 htb rate 2Mbit $TC class add dev eth1 parent 1: classid 1:2 htb rate 10Mbit $TC filter add dev eth1 parent 1: protocol ip prio 1 u32 \ match ip protocol 1 0xff flowid 1:1 \ action simple "tc[eth1]egress" pipe \ action mirred egress redirect dev ifb0 $TC qdisc add dev eth1 ingress $TC filter add dev eth1 parent ffff: protocol ip prio 1 u32 \ match ip protocol 1 0xff \ action simple "tc[eth1]ingress" pipe \ action mirred egress redirect dev ifb1