TC Traffic Control for fair share

Hello,

I'm looking for a way to policy my incoming/outgoing traffic on a Linux
router. I would like the policy to be like fair share, where every
workstation behind the router has fair share to the internet
connection.

The router is connect to a 1mb(upstream/downstream) dsl connection. I
have about 30 users on the network. The current problem is, there can
be just 2 users streaming video or something useless and it takes up
the entire pipe.

I would like to limit all workstations to something like 128kb or so
each. So that everyone has a "fair share" limited amount of bandwidth.

For example:
Workstation A has 128kb of the 1mb pipe and Workstation B also has
128kb of the 1mb pipe. In other words, they aren't sharing 128kb, they
each have a limit of 128kb.

The TC documentation I've found so far mostly deals with traffic
controlling outbound services. I would really appreciate it if someone
could give me some advice on how to do this or point me to some good
documentation.

Thanks in advance!

On 14 Dec 2006 14:28:46 -0800, (E-Mail Removed) wrote:

>Hello,

>The TC documentation I've found so far mostly deals with traffic
>controlling outbound services. I would really appreciate it if someone
>could give me some advice on how to do this or point me to some good
>documentation.
>
>Thanks in advance!

The reason TC docs talk about egress is that you can't shape unless
you are the bottleneck and you are NOT the bottleneck for ingress.

Depending on your kernel version you can patch in an ingress device
(IMQ for 2.4 kernels) and shape on that device, but you will lose a
TON of bandwidth in order to achieve desired results - on the order of
50% in my experience.

There is also policing, which is a hard limit rather than shaping,
which queues packets and drops only when necessary.

I've never tried it, but you might try to combine policing and ingress
shaping to see if you can improve that 50% referred to above.
Probably the best you can do is to delay+drop the ACKs going back to
the source for the flows you want to hinder. If you do that, you need
to be sure you don't hinder desired ACKs (happened to me because I
thought ACK was standalone; but ususally that is not the case).

It is "before morning coffee"; I'm not coming up with the correct
terms, but check out layer 7 and ppp2p (file sharing). Look into
netfilter and squid also.
--
buck