mirror of
https://git.kernel.org/pub/scm/network/iproute2/iproute2.git
synced 2024-11-17 15:03:29 +08:00
50 lines
1.6 KiB
Bash
50 lines
1.6 KiB
Bash
#! /bin/sh -x
|
|
#
|
|
# sample script on using the ingress capabilities
|
|
# this script shows how one can rate limit incoming SYNs
|
|
# Useful for TCP-SYN attack protection. You can use
|
|
# IPchains to have more powerful additions to the SYN (eg
|
|
# in addition the subnet)
|
|
#
|
|
#path to various utilities;
|
|
#change to reflect yours.
|
|
#
|
|
IPROUTE=/root/DS-6-beta/iproute2-990530-dsing
|
|
TC=$IPROUTE/tc/tc
|
|
IP=$IPROUTE/ip/ip
|
|
IPCHAINS=/root/DS-6-beta/ipchains-1.3.9/ipchains
|
|
INDEV=eth2
|
|
#
|
|
# tag all incoming SYN packets through $INDEV as mark value 1
|
|
############################################################
|
|
$IPCHAINS -A input -i $INDEV -y -m 1
|
|
############################################################
|
|
#
|
|
# install the ingress qdisc on the ingress interface
|
|
############################################################
|
|
$TC qdisc add dev $INDEV handle ffff: ingress
|
|
############################################################
|
|
|
|
#
|
|
#
|
|
# SYN packets are 40 bytes (320 bits) so three SYNs equals
|
|
# 960 bits (approximately 1kbit); so we rate limit below
|
|
# the incoming SYNs to 3/sec (not very sueful really; but
|
|
#serves to show the point - JHS
|
|
############################################################
|
|
$TC filter add dev $INDEV parent ffff: protocol ip prio 50 handle 1 fw \
|
|
police rate 1kbit burst 40 mtu 9k drop flowid :1
|
|
############################################################
|
|
|
|
|
|
#
|
|
echo "---- qdisc parameters Ingress ----------"
|
|
$TC qdisc ls dev $INDEV
|
|
echo "---- Class parameters Ingress ----------"
|
|
$TC class ls dev $INDEV
|
|
echo "---- filter parameters Ingress ----------"
|
|
$TC filter ls dev $INDEV parent ffff:
|
|
|
|
#deleting the ingress qdisc
|
|
#$TC qdisc del $INDEV ingress
|