![尽管我仅使用 tc 命令来定位传入数据包,但传入和传出的数据包都会延迟](https://linux22.com/image/791993/%E5%B0%BD%E7%AE%A1%E6%88%91%E4%BB%85%E4%BD%BF%E7%94%A8%20tc%20%E5%91%BD%E4%BB%A4%E6%9D%A5%E5%AE%9A%E4%BD%8D%E4%BC%A0%E5%85%A5%E6%95%B0%E6%8D%AE%E5%8C%85%EF%BC%8C%E4%BD%86%E4%BC%A0%E5%85%A5%E5%92%8C%E4%BC%A0%E5%87%BA%E7%9A%84%E6%95%B0%E6%8D%AE%E5%8C%85%E9%83%BD%E4%BC%9A%E5%BB%B6%E8%BF%9F.png)
我想使用 tc 命令延迟来自特定 IP 的传入数据包。我试过
sudo tc qdisc add dev eth0 root handle 1: prio
sudo tc qdisc add dev eth0 parent 1:3 handle 10: netem delay 500ms
sudo tc filter add dev eth0 protocol ip parent 1:0 prio 1 u32 match ip dst 10.20.30.400 flowid 1:3
这奇怪地增加了传入和传出请求的延迟,尽管从技术上讲它应该增加传出请求的延迟(在 tc 过滤器中,我提到了 dst 地址而不是 src)。然后,为了只为传入数据包添加延迟,我尝试将 dst 更改为 src,如下所示
sudo tc qdisc add dev wlp0s20f3 root handle 1: prio
sudo tc qdisc add dev wlp0s20f3 parent 1:3 handle 10: netem delay 500ms
sudo tc filter add dev wlp0s20f3 protocol ip parent 1:0 prio 1 u32 match ip src 10.20.30.400 flowid 1:3
但在此之后没有发生任何变化,并且所有数据包都正常进出。我在这里做错了什么?
参考链接 -参考
为了检查延迟,我使用了 ping 命令。
答案1
使用 TC,您只需处理传出的数据包。要匹配正在进行的数据包,您需要设置伊夫堡。
此外,您的连接正在聊天,例如,如果您通过 TCP 发送消息,响应者必须确认已收到该消息。因此,增加一种方式的延迟将增加两种方式的延迟。
对于 ping 来说,它也进行两种方式的测量。
答案2
您需要将 tc 与 ingress 和 ifb 一起使用 https://gist.githubusercontent.com/dogbunny/fda68f21784025876c57a4dfc3fb6bcc/raw/bfb19da28152364340f2d3f7ef179ee5371fd447/TC_ingress_port_filtering.txt
# This a solution for inducing latency on ingress traffic to a specific port
# note: ianae, but many hours of sleuthing and experimenting got me to this answer
# Adapted from https://wiki.gentoo.org/wiki/Traffic_shaping
# Note technically TC can only induce latency on egress traffic so we add an intermediate device which allows
# us to first identify the traffic we want to affect and then send it to a queue to do <stuff>
# eth0 is the external interface receiving the traffic we want to filter, 4222 is the port we want to add latency to.
# Those are the only values that you should need to change, if necessary.
# Add a TC ingress queue to your external interface, by default you shouldn't have one
sudo tc qdisc add dev eth0 handle ffff: ingress
# make sure ifb module is loaded and bring up the interface (IFB = Intermediate Functional Block device)
sudo modprobe ifb
sudo ifconfig ifb0 up
# redirect all traffic to the ifb so that we can later filter on the traffic that leaves that interface
sudo tc filter add dev eth0 parent ffff: protocol all u32 match u32 0 0 action mirred egress redirect dev ifb0
# build up our egress queues and filters
# we need a root, this one uses priority queues which defaults to not modifying any traffic
sudo tc qdisc add dev ifb0 root handle 1: prio
# add a special queue that induces latency
sudo tc qdisc add dev ifb0 parent 1:1 handle 2: netem delay 100ms 50ms distribution normal
# if we find a packet that matches our destination port, send it to the above queue
sudo tc filter add dev ifb0 protocol ip parent 1:0 prio 1 u32 match ip dport 4222 0xffff flowid 2:1