\documentclass[letterpaper,english]{article}
\nonstopmode
\akai
\usepackage{linuxdoc-sgml}
\usepackage{qwertz}
\usepackage{url}
\usepackage[latin1]{inputenc}
\usepackage{t1enc}
\usepackage[english]{babel}
\usepackage{epsfig}
\usepackage{null}
\def\addbibtoc{
\addcontentsline{toc}{section}{\numberline{\mbox{}}\relax\bibname}
}%end-preamble
\setcounter{page}{1}
\title{Linux 2.4 Advanced Routing HOWTO}
\author{Netherlabs BV (bert hubert $<$bert.hubert@netherlabs.nl$>$)\\ 
Gregory Maxwell $<$greg@linuxpower.cx$>$ \\ 
Remco van Mook $<$remco@virtu.nl$>$ \\ 
Martijn van Oosterhout $<$kleptog@cupid.suninternet.com$>$ \\ 
Paul B Schroeder  $<$paulsch@us.ibm.com$>$ \\ 
Jasper Spaans $<$jasper@spaans.ds9a.nl$>$ \\ 
howto@ds9a.nl\\ \\ 
Ä¶ªÌ¡Rºô¤¤¤H $<$netmanforever@yahoo.com$>$\\ }
\date{v0.3.0 \$Date: 2001/06/16 12:48:31 \$}
\abstract{°Ê¤â¹ê§@ iproute2 --- ¬y¶qºÞ¨î¤Î³¡¥÷ºô¸ô¹LÂo}


\begin{document}
\maketitle
\tableofcontents

\section{ÄmÃD (Dedication)}

¥»¤åÂÔ§@¬°§Úªº¤@ÂI¤p¦^³ø¡M¥H©^Ämµ¹²³¦hªºªB¤Í¡M®£Ãø¥H¤@¤@­PÁÂ¤F¡M¶È¦C¦p¤U½Ñ¤½¡R

\begin{itemize}
\item Rusty Russell
\item Alexey N. Kuznetsov
\item ¨Ó¦Û Google ªºÀu¨q¦¨­û
\item Casema Internet ªº¦P¤¯
\end{itemize}
        




\section{«e¨¥ (Introduction)}

¦U¦ì¿Ë·RÅªªÌ¡MÅwªï±z¡T

¦ýÄ@¥»¤å¥ó¯à§U±z¤j¤j´£¼W Linux 2.2/2.4 ¤W­±ªº¸ô¥Ñ(routing) ¥\¤O¡C¤h§O¤T¤é¡M¨í¥Ø¬Û¬Ý¡M·í±z¥Î³o¨Ç¤u¨ã°µ¥X«GÄR¦¨ÁZªº®É­Ô¡M©w·|¥O²³¤H²´«e¤@«Gªº¡T¤°»ò 'route' ¤Î 'ifconfig' ³o¨Ç©R¥O¡M¸ò±j¤jªº iproute2 ¾÷¨î¤ñ°_¨Ó¡MÂ²ª½´N¬O¤p§Å¨£¤j§Å°Õ¡C

§Ú§Æ±æ¥» HOWTO ªº¥iÅª©Ê¡M°÷±o¤W Rusty Rusell ¥S¤§ netfilter Åé¨î(¥t¤@»â°ì)ªº¨ä¥L¤å³¹¡C

¦p»Õ¤U¦³¥ô¦óºÃ°Ý©Î«ü±Ð¡MÅwªïÀH®É»P§Ú­ÌÁpµ¸¡R \nameurl{mailto:HOWTO@ds9a.nl}{HOWTO team}.µM¦Ó¡M¦pªG»Õ¤Uªº°ÝÃD¨Ã«D»P¥» HOWTO ª½±µ¬ÛÃö¡M½Ð±H¦Ü§Ú­Ìªº¶l¥ó½×¾Â(°Ñ¦Ò¬ÛÃö³¹¸`)¡C

°²¦p±z³æ¯Âªº¥u·Q­n°µ¬y¶q¤Þ¾É(traffic shaping)¡M¦b±z©ó¥» HOWTO °g¥¢¤§«e¡M¤j¥i²¤¹L¥þ³¡¤º®e¡Mª½±µ¸õ¦Ü '¨ä¥¦¥i¦æ©Ê(Other possibilties)' ³¹¸`¡M¥u¾\Åª CBQ.init §Y¥i¡C




\subsection{³d¥ô»Pª©Åv (Disclaimer \& License)}

¥»¤å¤§´²§G¶È¥H§U¤H¬°¥»¡MµM¨Ã¤£«OÃÒ¥ô¦ó¨Æ±¡¡M¤]¤£¹ï½Ñ¦p¾P°â©Î¯S®íÀ³¥Î¤§ÃþªºÁô±â©Ê©Ó¿Õ°µ¥X«OÃÒ¡C

Â²¦Ó¨¥¤§¡M¦pªG±zªº STM-64 backbone ±¾±¼¤Î¼vÅT¨ì±zªº³Ì¤j¥DÅU¡M©êºp¡M·§»P§Ú­ÌµLÃö¡C

Copyright (c) 2001 by bert hubert, Gregory Maxwell, Martijn van
Oosterhout, Remco van Mook, Paul B. Schroeder and others.

½Ð¥H¥ô¦ó§Î¦¡¦Û¥Ñ´²§G(³c½æ©ÎÃØ°e)¥»¤å¥ó¤§°Æ¥»¡CµM¦Ó©Ò¦³­×¥¿¤Î/©Î«ØÄ³¡M¬Ò¶·ª¾·|¤å¥óªººûÅ@ªÌ¡C¥u­n±z²Å¦X¦p¤U±ø¥ó¡M¤]¥i¥H³Ð«Ø¦Û¤vªº¬£¥Íª©¥»(derivative work )¡R

\begin{enumerate}
\item ±N±zªº¬£¥Íª©¥»(¥H sgml ®æ¦¡) ±Hµ¹ LDP (Linux Documentation Project) ¡M©Î Internet ¤Wªº¬ÛÃþ¥Zµn¾÷ºc¡C¦pªG¤£¥æ¥Ñ LDP ªº¸Ü¡M¥²¶·ª¾·| LDP ¸g¥Ñ­þ¸Ì¥i¥HÀò±o¡C\\ 
Send your derivative work (in the most suitable format such as sgml) to
the LDP (Linux Documentation Project) or the like for posting on the Internet. 
If not the LDP, then let the LDP know where it is available. 

\item ¬£¥Íª©¥»¥²¶·¥H¬Û¦Pª©Åv©Î GPL µo¦æ¡M¥B¨ã³Æª©ÅvÁn©ú¡M¥H¤Î¦Ü¤Ö­n¦³¤@­Ó©Ò¥Îª©Åvªº«ü¤Þ¡C\\ 
License the derivative work with this same license or use GPL. Include a
copyright notice and at least a pointer to the license used. 
\item ­ì§@ªÌ¤Î¥D­n´²§GªÌ§¡¨É¦³¹w´ÁªºÅv¯q¡C\\ 
Give due credit to previous authors and major contributors. 
\end{enumerate}

°²¦p±z¦³·N»s§@¬£¥Íª©¥»¦Ó«D¶i¦æÂ½Ä¶¡M¥²¶·»P·í«eºûÅ@ªÌ¨ó°Ó¡C

¦p±z­n¥H¦L¨ê¥ó(hardcopy) µo¦æ¥» HOWTO¡M±z¥²¶·±H´X¥÷²M¼Ëµ¹§@ªÌ­Ì¡M¶È¨Ñ®ÕÅç¦Ó¤w :-) 




\subsection{¥²³Æª¾ÃÑ (Prior knowledge)}

¥¿¦p¤å³¹ÃD¥Ø©Ò¥Ü¡M¦¹¤å¬° '¶i¶¥ (Advanced)' HOWTO¡C·íµM¡M¤£¬O»¡±z­n¾å±o§Ë¤õ½b¡M¦ý¤@¨Ç¥²¨ãªºª¾ÃÑÁÙ¬O­n¦³ªº¡C 

·íµMÅo¡M¦pªG±zÁÙ·Q¦h¾Ç¤@ÂI¡M³o¸ÌÁÙ¦³¤@¨Ç¤åÄm©Î³\·|¦³©ÒÀ°§Uªº¡R
\begin{description}
\item[\nameurl{http://netfilter.kernelnotes.org/unreliable-guides/networking-concepts-HOWTO.html}{Rusty Russell's networking-concepts-HOWTO}] \mbox{}

«D±`¦nªº¤¶²Ð©Ê¤å¥ó¡MÁ¿¸Ñ¦ó¿×ºô¸ô¡M¥H¤Îºô¸ô¤§¶¡¬O¦p¦ó³s±µ¤@°_ªº¡C



\item[Linux Networking-HOWTO (Previously the Net-3 HOWTO)] \mbox{}

«D±`´ÎªºªF¦è¡M¥u¬O²¤¬°ªø¤FÂI¡C°²¦p±z¤w¸g³s¤W internet ªº¸Ü¡M±z·|¾Ç¨ì³\¦h¤w¸g³]©w¦nªºªF¦è¡C±z¥i¦b¥»¾÷ªº \url{/usr/doc/HOWTO/NET3-4-HOWTO.txt} ³o­Ó¦ì¸m§ä¨ì¥¦¡M¦ý¤]¥i¥H¨ì \nameurl{http://www.linuxports.com/howto/networking}{³o¸Ì}  §ä§ä¡C

\end{description}





\subsection{Linux ¥i¥H¬°±z°µ¨Ç¤°»ò (What Linux can do for you)}

¤U­±©Ò¦C¥u¬O¤@¤p³¡¥÷¦Ó¤w¡R

\begin{itemize}
\item ¬°¯S©wªº¹q¸£½Õ¸`ÀW¼e
\item Åý±z¤À¨ÉÀW¼e
\item «OÅ@±zªººô¸ô¨¾½d DoS §ðÀ»
\item «OÅ@ internet §K¨üÅU«È¤zÂZ
\item ¦X¦h¥x¦øªA¾¹¬°¤@¡M½Ñ¦p¥­¿Å­t¸ü©Î¬O´£ª@¨Ï¥Î®Ä¯à
\item ¨î¬ù¶i¤J¶Q¹q¸£ªº³s½u
\item ­­¨î¥Î¤á³s½u¦Ü¨ä¥L¥D¾÷
\item ®Ú¾Ú user id(¨S¿ù¡T)¡NMAC ¦ì§}¡N¨Ó·½ IP ¦ì§}¡Nport¡NªA°ÈÃþ«¬(type of service)¡N¥H¤Î¨C¤Ñ©T©w®É¶¡©Î³s½u®É¶¡¡Mµ¥¦]¯À¶i¦æ¸ô¥Ñ¡C
\end{itemize}


¥Ø«eÁÙ¤£¬O«Ü¦h¤H¨Ï¥Î³o¨Ç¶i¶¥¥\¯à¡M©Î³\¬O¦³¨ä­ì¦]ªº¡C¨Ò¦p¡MÁöµM´£¨Ñªº¤å¥ó³£«Ü¸ÔºÉ¡MµM«o¬y©ó«D¹ê¾Ô(hands on)°òÂ¦¡Q¬y¶qºÞ¨î¤]¦ü¥GÁÙ¥¼³Q­z¤§©ó¤å¦r¡C


\subsection{¾ã²z¶·ª¾ (Housekeeping notes)}

Ãö©ó¥»¤å¡M©|¦³¬Y¨Ç¦a¤è¬O»Ý­n¯d·Nªº¡CÁö»¡§Ú¤w¸g¼g§¹¤F¡M»¡¹ê¦b¡MÁÙÁ`¬OÄ±±o¦³ÂI®t±j¤H·N¡C§Ú¬O¤@­Ó·¥ºÝ Open Source «H®{¡M©Ò¥H«D±`´Á«Ý±z¯à´£¨Ñ¦^õX¡N§ó·s¡N­×¸É¡N½Ñ¦p¦¹Ãþªº·N¨£¡C¦p¦³»~µ§©Î¥ÕÄê¤§³B¡M¤@©w­n¤Î®É«ü¥¿®@¡C°²¦pµo²{§Úªº­^¤åµü¤£¹F·N¡M½Ð­ì½Ì§Ú³o¤£¬O¥À»y¤§¬G¡C¥ô¦ó«ØÄ³¡M³£¬OµL¥ôÅwªïªº¡C

°²¦p»Õ¤U¦æ¦³¾l¤O¡MÀ°¦£ºûÅ@¬Y¤@³¹¸`¡M©Î¬OÄ±±o¥i¥H¼¶¼g¨ÃºûÅ@·sªº³¹¸`¡M¨º§ó¬O¨D¤§¤£±o¡C¥» HOWTO ªº SGML ª©¥»¥i¥H³z¹L CVS Àò±o¡M­Y¯à¼sÁÜ¸t½å¦@Á¸³ÓÁ|¡M§Ì«D±`¼Ö¨£¨ä¦¨¡C

¬°¦¹¡M±z·|µo²{³\¦h FIXME ´£¥Ü¡MÀH®É®¥­Ô­×¸É¡C·í±z¸I¨ì¤@­Ó FIXME ¤§®É¡M±z´Nª¾¹D¨º¬O¤@¤ù¥¼¾Á¤§³¥¡C¨S¤H´±¥]»¡¨ä¥L¦a¤è´N¨S¦³¿ù»~¦s¦b¡M¥u¬O¤p¤ß¬°¤W°Õ¡C¦pªG±zÅçÃÒ¹L¬Y¨ÇªF¦è¡M¨º´N¤£­n«È®ð§iª¾§Ú­Ì¡MµM«á´N¥i¥H®³±¼¸Ó FIXME ´£¥Ü¤F¡C

Ãö©ó¥» HOWTO¡M¦³®É§Ú·|¤ñ¸û¤Ñ°¨¦æªÅªº¡C¤ñ¤è»¡¡M§Ú·|°²³]¤@±ø 10M bit ªº internet ³s½u¡M¾¨ºÞ§Ú«D±`²M·¡³o¹ï´M±`¦Ê©m¤H®a¦Ó¨¥¡M¤´¬O¤ý©²°ó«e¿P¡C




\subsection{³s½u¡NCVS¡M¤Î´£¥æ³Ì·s«H®§ (Access, CVS \& submitting updates)}

¥» HOWTO ªº©x¤èºô¯¸¦ì©ó \nameurl{http://www.ds9a.nl/2.4Routing}{³o¸Ì}¡C

§Ú­Ì¤w¦³¹ï¥þ²y¶}©ñªº°Î¦W CVS ³s½u¡M±q¤£¦P¨¤«×¦Ò¶q§¡¬Ò¤jÅw³ß¡C±z¥i¥H»´»´ÃPÃPªº¤U¸ü³Ì·sª©¥»¡M´£¥æ­×¸É¤]ÅÜ±o¤£¶O§j¦Ç¤§¤O¡C

¦Ó¥B¡M¤]¯àÅý¦U¦ì§@ªÌ¿W¥ß³B²z·½½X(source)¡M¦ó¼Ö¤£¬°¡C

\begin{tscreen}
\begin{verbatim}
$ export CVSROOT=:pserver:anon@outpost.ds9a.nl:/var/cvsroot
$ cvs login
CVS password: [enter 'cvs' (without 's)]
$ cvs co 2.4routing
cvs server: Updating 2.4routing
U 2.4routing/2.4routing.sgml
\end{verbatim}
\end{tscreen}


¦pªG±zµo²{¦³¿ù»~¤§³B¡M©Î¬O·Q¼W¥[¬Y¨Ç¤º®e¡M¥i¥H¥ý¦b¥»¾÷¤W§¹¦¨¡MµM«á°õ¦æ cvs diff -u¡M¦A±Nµ²ªG±Hµ¹§Ú­Ì§Y¥i¡C

±z¤]¥i¥H­É§U§Ú­Ì©Ò´£¨Ñªº Makefile ¨Ó³Ð«Ø postscript¡Ndvi¡Npdf¡Nhtml¡NÁÙ¦³¯Â¤å¦rµ¥¦UºØ®æ¦¡¡C¤£¹L¡M±z©Î³\»Ý­n¦w¸Ë sgml-tools¡Nghostscript¡NÁÙ¦³ tetex µ¥¤u¨ã¡M¤~¯àÀò±o©Ò¦³®æ¦¡¡C




\subsection{¶l¥ó½×¾Â (Mailing list)}

\label{MLIST}
§Ú­Ìªº§@ªÌ­Ì§¡¦¬¨ì¤£Â_¼W¥[¤¤ªº¥» HOWTO ¬ÛÃöªº¶l¥ó¡C¦³¨£©óªÀ¸sªº¿@«p¿³½ì¡M§Ú­Ì¤w¨M©w¦¨¥ß¤@­Ó¶l¥ó½×¾Â¡MÅý¤j®a©¼¦¹¥æ¬y¶i¶¥¸ô¥Ñ¤Î¬y¶q±±ºÞªº¤ß±o¡CÅwªï±z¨Ó \nameurl{http://mailman.ds9a.nl/mailman/listinfo/lartc}{³o¸Ì} ­q¾\¥»½×¾Â¡C

³o¼Ë»¡¦n¤F¡M§@ªÌ­Ì¨Ã¤£¼ö°J©ó¦^µª«D½×¾Â©Ò´£¥Xªº°ÝÃD¡C§Ú­Ì§Æ±æ¯à±N½×¾Âªº¤å³¹·J¾ã°_¨Ó¡M¦¨¬°¬Y¤@§Î¦¡ªºª¾ÃÑ®w¡C°²¦p±z¦³¥ô¦ó°ÝÃD¡M½Ð¥ý·j¯Á¤@¤U¥ý«e¤å³¹¡M¤~¦n¥á¨ì½×¾Â¤W¨Ó¡C




\subsection{¥»¤å§G§½ (Layout of this document)}

§Ú­Ì°¨¤W´N­n¶i¦æ¤@¨Ç¦³½ìªº¨Æ±¡¡M¤£¹L¡M¦P®É¤]±N±µÄ²¨ì¬Y¨Ç¸ÑÄÀ¤£¸Ô©Î¥¼¿²§¹¬üªº³¡¥÷¡C½Ð¼È®É¤£­n¤ÓÆp¤û¨¤¦y¦Óµø¤§±N·|§¹µ½¡C

¸ô¥Ñ(routing)¸ò¹LÂo(filtering)¬O¨â½X¤l¨Æ±¡¡C¦b Rustry ªº HOWTO ¸Ì­±¤w¸g¹ï¹LÂo¦³§¹¾ãªºÄÄ­z¤F¡M½Ð°Ñ¦Ò¡R

\begin{itemize}
\item \nameurl{http://netfilter.kernelnotes.org/unreliable-guides/}{Rusty's Remarkably Unreliable Guides}
\end{itemize}


§Ú­Ì³o¸Ì¾¨¶q¶°¤¤¦b netfilter ©M iproute2 ªº¾ã¦X¤W­±¡C


\section{¤¶²Ð iproute2 (Introduction to iproute2)}


\subsection{¬°¦ó­n iproute2? (Why iproute2?)}

¤j³¡¥÷ªº Linux µo¦æ¼t°Ó ¡M¥H¤Î¦h¼Æ UNIX ¨t²Î¡M¥Ø«e§¡ªu¥Î¾ú¥v±y¤[ªº 'arp'¡N'ifconfig'¡N©M 'route' µ¥©R¥O¡CÁö»¡³o¨Ç¤u¨ã³£¤´¯à¨Ï¥Î¡MµM¦Ó¦b Linux 2.2 ¤Î¥H«áªºª©¥»¤¤¡M¥L­Ì«o·|¾É­P¤@¨Ç«D¹w´Áªº®ÄªG¡C¨Ò¦p¡M¥Ø«e GRE tunnel ¤w¦¨¸ô¥Ñ¤¤ªº±K¤£¥i¤Àªº¤@³¡¥÷¡M¦ý«o»Ý­n§¹¥þ¤£¤@¼Ëªº¤u¨ã¤~°µ±o¨ì¡C

¥Î iproute2 ªº¸Ü¡M¨ä¦Û¨­ªº¤u¨ã²Õ¸Ì­±´N¥]§t¤F tunnels ¤F¡C

Linux 2.2 ¤Î¥H«áªº®Ö¤ß¤º§t¤@­Ó§¹¥þ­«·s³]­pªººô¸ô¤l¨t²Î¡C¦¹¤@¥þ·sªººô¸ôµ{¦¡½X(networking code) Åý Linux ¦b®Ä¯à©M¥\¯à¤W¡M¸û¨ä¥¦ OS ²¤³Ó¤@Äw¡C¨Æ¹ê¤W¡M·sªº¸ô¥Ñ¹LÂoÁÙ¦³¤ÀÃþ(classifying) µ{¦¡ ¡M¤ñ°_¤@¨Ç±M¥Î¸ô¥Ñ¾¹¥H¤Î¨¾¤õÀð©M¬y¶qºÞ¨î²£«~¡M¦b¥\¯à¤W¬Æ¦Ü¦³¹L¤§¦ÓµL¤£¤Î¡C

ÀHµÛ·sºô¸ô·§©Àªº¤£Â_¯F²{¡M¤H­ÌµL¤£¦UÅã¯«³q±N¤§¦w´¡©ó²{¦³ OS ªº¬[ºc¤§¤W¡CµM¦Ó¡M³o¨Ç«ùÄòªº°ï¿n¡M«o¾É­Pºô¸ôµ{¦¡½XÅÜªºµL©_¤£¦³¡M¦³¦p§Ú­Ì¤HÃþªº¦U¦¡»y¨¥¡C¦b¹L¥h¡MLinux ¼Ò¥é SunOS ¨Ó³B²z³o¨Ç¨Æ±¡¡M¦ý²×«D¨}µ¦¡C

¦¹¤@·s¬[ºc±N¥i¸ÔºÉÄÄÄÀ»·«D Linux ©Ò¯à¤Îªº¥\¯à¦æ¬°¡C




\subsection{iproute2 ¾ÉÄý (iproute2 tour)}

Linux ¥»¨­¦³¤@­Ó½ÆÂø²§±`ªº¨t²Î¥Î©óÀW¼e¬É©w¡M¥s°µ Traffic Control¡C¦¹¨t²Î¤ä´©¦hºØ¤èªk¡M¥HÀ³¥I¶Ç¤J¤Î¶Ç¥X¥æ³qªº¤ÀÃþ(classfying)¡NÀu¥ý±Æ§Ç(prioritizing)¡N¤À¨É(sharing)¡N¥H¤Î­­¨î(limiting)¡Mµ¥³B²z¡C



¤U­±¡M§Ú­Ì´NÅý§Ú­Ì²Ê²¤·Èø°¤@¤U iproute2 ªº¯à­@§a¡C


\subsection{«e´£ (Prerequisites)}

­º¥ý¡M½Ð½T©w¥²¶·ªº¨Ï¥ÎªÌ¤u¨ã¤w¸g¦w¥þ§´·í¡C¦b RedHat ©M Debian ¤W¡M¦¹®M¥ó³£¥s°µ 'iproute'¡M©Î¬Oª½±µ§ì {\ttfamily ftp://ftp.inr.ac.ru/ip-routing/iproute2-2.2.4-now-ss??????.tar.gz"} ¤]¥i¥H¡C

±z¤]¥i¥H¹Á¸Õ¨ì \nameurl{ftp://ftp.inr.ac.ru/ip-routing/iproute2-current.tar.gz}{³o¸Ì} Àò±o³Ì·sªºª©¥»¡C

iproute ¤¤ªº¬Y¨Ç³¡¥÷ÁÙ»Ý­n±N¯S©wªº®Ö¤ß¿ï¶µ¥´¶}¡C¥t¥~¡M±zÁÙ­nª¾¹D¡MRedHat 6.2 ¤§«eªº©Ò¦³µo¦æª©¥»¡M¨ä®Ö¤ß¸Ì­±¡M¤j³¡¥÷ªº¬y¶q±±ºÞ¥\¯à³£¥I½ÑÂö¦p¡C

FIXME: ¦³½Ö¥i¥HÀ°¦£½T»{¤@¤U 7.0 ¤w¸g±N©Ò»Ý®Ö¤ß½sÄ¶¶i¨Ó¤F¶Ü¡S

¦P®É¡M±zÁÙ­n½T»{±z¦³¤ä´© netlink ¡M±z©Î³\»Ý­n¥´³y¦Û¤vªº®Ö¤ß¡M¦]¬° iproute2 »Ý­n³o­Ó¥\¯à¡C




\subsection{±´¬d·í«e³]©w (Exploring your current configuration)}

µ¹±z¤@­ÓÅå³ß¡M¨ä¹ê iproute2 ¤w¸g³]©w¦n¤F¡T·í«e©R¥O¦p {\ttfamily ifconfig} ©M {\ttfamily route} ¡M³£¤w¸g¨Ï¥Î¶i¶¥ªº syscall¡M¦ý³q±`³£¨Ï¥Î¹w³]­È¡C

¨ä¤¤ {\ttfamily ip} ³o¤u¨ã³Ì¬°­«­n¡M¤U­±¥Î¥¦±N§Ú­Ìªº¬É­±¦C¥Ü¥X¨Ó¡C


\subsubsection{¥Î {\ttfamily ip} Åã¥Ü³s½u ({\ttfamily ip} shows us our links)}

\begin{tscreen}
\begin{verbatim}
[ahu@home ahu]$ ip link list
1: lo: <LOOPBACK,UP> mtu 3924 qdisc noqueue 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: dummy: <BROADCAST,NOARP> mtu 1500 qdisc noop 
    link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff
3: eth0: <BROADCAST,MULTICAST,PROMISC,UP> mtu 1400 qdisc pfifo_fast qlen 100
    link/ether 48:54:e8:2a:47:16 brd ff:ff:ff:ff:ff:ff
4: eth1: <BROADCAST,MULTICAST,PROMISC,UP> mtu 1500 qdisc pfifo_fast qlen 100
    link/ether 00:e0:4c:39:24:78 brd ff:ff:ff:ff:ff:ff
3764: ppp0: <POINTOPOINT,MULTICAST,NOARP,UP> mtu 1492 qdisc pfifo_fast qlen 10
    link/ppp 
\end{verbatim}
\end{tscreen}


±z©ÒÅª¨ìªº¸ê®Æ©Î³\¦³©Ò¤£¦P¡M³o¸Ì©ÒÅã¥Üªº¬O¦b§Ú®a¸Ìªº NAT router ¤Wªº¸ê®Æ¡C§Ú¤U­±¥u·|¸ÑÄÀ¿é¥Xµ²ªGªº¤@³¡¥÷¦Ó¤w¡M¦]¬°¨Ã«D¥þ³¡¸ê®Æ³£¬O¬ÛÃöªº¡C

Åý§Ú­Ì¥ý¬Ý¬Ý loopback ¬É­±¡C¦³¥i¯à±zªº¹q¸£¨Ã¨S¸Ë¥ô¦ó¬É­±¡M¦ý§Ú«ØÄ³±z°_½X±N¥¦³]©w°_¨Ó¡C¨ä¤¤ªº MTU (Maximum Transfer Unit) Åé¿n¬O 3924 octet¡M¦P®É¨Ã¨S³Q¦î¦C(queued) °_¨Ó¡C³o¬O¦X²zªº¡M¦]¬° loopback ¬É­±¬O¥Ñ®Ö¤ßµêºc¥X¨Óªº¡C

²{¦b¦Ó¨¥¡M§Ú¼È®É²¤¹L dummy ¬É­±¤£½Í¡M¦Ó¥B¥¦¤]¥¼¥²¥X²{¦b±zªº¹q¸£¤W­±¡C±µ¤U¨Ó¬O§Úªº¨â±i¹êÅéºô¸ô¬É­±¡M¤@­Ó³s±µ§Úªº cable modem¡M¥t¤@­Ó±µ¨ì§Úªº®a¤¤ºô¸ô¥h¡C³Ì«á¡M§Ú­Ì¤]¬Ý¨ì¤@­Ó ppp0 ªº¬É­±¡C

ª`·N¡M³o¸Ì¨Ã¨S¦³ IP ¦ì§}¡Ciproute ¨Ã¨S¦³±N 'links' ©M 'IP addresses' ³o¨â·§©À³s¦b¤@°_¡C¦pªG¥Î IP aliasing ªº¸Ü¡M¨º»ò IP ¦ì§}ªº·§©À´N¦ü¥GÅÜ±o¤£«ç»ò¶K¤Á¤F¡C

¤£¹L¡M¥¦·|±N MAC ¦ì§}Åã¥Ü¥X¨Ó¡M¤]´N¬O§Ú­Ìªº ethernet ¬É­±ªº¹êÅé¿ë§O¦ì§}°Õ¡C


\subsubsection{¥Î {\ttfamily ip} Åã¥Ü IP ¦ì§} ({\ttfamily ip} shows us our IP addresses)}

\begin{tscreen}
\begin{verbatim}
[ahu@home ahu]$ ip address show        
1: lo: <LOOPBACK,UP> mtu 3924 qdisc noqueue 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 brd 127.255.255.255 scope host lo
2: dummy: <BROADCAST,NOARP> mtu 1500 qdisc noop 
    link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff
3: eth0: <BROADCAST,MULTICAST,PROMISC,UP> mtu 1400 qdisc pfifo_fast qlen 100
    link/ether 48:54:e8:2a:47:16 brd ff:ff:ff:ff:ff:ff
    inet 10.0.0.1/8 brd 10.255.255.255 scope global eth0
4: eth1: <BROADCAST,MULTICAST,PROMISC,UP> mtu 1500 qdisc pfifo_fast qlen 100
    link/ether 00:e0:4c:39:24:78 brd ff:ff:ff:ff:ff:ff
3764: ppp0: <POINTOPOINT,MULTICAST,NOARP,UP> mtu 1492 qdisc pfifo_fast qlen 10
    link/ppp 
    inet 212.64.94.251 peer 212.64.94.1/32 scope global ppp0
\end{verbatim}
\end{tscreen}


³o¦¸¥]§tªº¸ê°T´N¤ñ¸û¦h¤F¡C¥¦±N©Ò¦³ªº¦ì§}¡M¥H¤Î©ÒÄÝªººô¥d³£Åã¥Ü¥X¨Ó¡C'inet' ¥Nªí Internet (IPv4)¡C·íµM¡MÁÙ¦³³\¦h¨ä¥¦ªº¦ì§}±Ú¸s¡M¤£¹L¥Ø«e¨Ó»¡¡M¼È®É»P§Ú­ÌµLÃö¡C

Åý§Ú­Ì¥J²Óªº¬Ý¬Ý eth0 §a¡C¥¦¥Ø«e³Q¤À°tªº inet ¦ì§}¬O '10.0.0.1/8'¡C³o¬O¤°»ò·N«ä©O¡S¥ý¬Ý /8 ¦n¤F¡M¥¦©Ò¥Nªíªº¬Oºô¸ô¦ì§} bit ¼Æ¥Ø¡C¦]¬°¤@­Ó IP ¦ì§}¦³ 32 bit¡M©Ò¥H§Ú­Ì´N³Ñ¤U 24 bit µ¹§Úªººô¸ô(¥D¾÷)¨Ï¥Î¤F¡C10.0.0.1 ªº«e­± 8 ­Ó bit ©Ò¹ïÀ³ªº¬O 10.0.0.0¡M¤]´N¬O§Ú­Ìªººô¸ô¦ì§}(Network Address)¡M³o¼Ë§Ú­Ìªº netmask ¬O 255.0.0.0¡C

¨º³Ñ¤Uªº bits (©Ò¹ïÀ³ªº¦ì§})´Nª½±µ³s½u¨ì³o­Ó¬É­±¡M®³¨Ò¤l¨Ó»¡©ú¡R¥i¥Hª½±µ¦b³o­Ó¬É­±³s¤W 10.250.3.13 ¡M©M 10.0.0.1 ¤@¼Ë¡C

¦Ü©ó ppp0 ©O¡M¤]¬O¦P¼Ëªº­ì²z°Õ¡M¥u¬O¸¹½X¤§§O¦Ó¤w¡C¥¦ªº¦ì§}¬O 212.64.94.251¡M¨Ã¨S¦³ subnet mask¡C³oªí¥Ü§Ú­Ì¦³¤@­Ó point-to-point ªº³s½u¡M¨Ã¥B©Ò¦³¦ì§}¡M°£¤F³o­Ó 212.64.94.251 ¤§¥~¡M³£¦b»·ºÝ¨ºÃä¡C°£¦¹¤§¥~¡MÁÙ¦³§ó¦hªº¸ê°T¡M§i¶D§Ú­Ì¦b³s½uªº¥t¤@ºÝ¤]¦P¼Ë¥u¦³¤@­Ó¦ì§}¡R212.64.94.1¡C¨º­Ó /32 ¡M¬O§i¶D§Ú­Ì¨S¦³ 'network bits' ªº·N«ä¡C

¨c¾aªº´x´¤«e­z·§©À¬O¦ÜÃö­«­nªº¡C°²¦p±z¦b²z¸Ñ¤W¦³§xÃø¡M½Ð°Ñ¦Ò¥» HOWTO «e­±©Ò¤¶²Ðªº¸ê®Æ¡C

(Ä¶ªÌ«ö¡RÃö©ó IP ©M netmask ªºÃö«Y¡M¥D­n¬O¥Î¨Ó§PÂ_¥X¡¥ºô¸ô¦ì§}¡¦©M¡¥¥D¾÷¦ì§}¡¦¤§¥Îªº¡C¸Ô²Óªº§PÂ_³W«h¡M¥i¥H°Ñ¦ÒÄ¶ªÌªººô¯¸¡R \nameurl{http://www.study-area.org/network/network_ipadd.htm}{http://www.study-area.org/network/network\_ipadd.htm}¡C)

¦P®É¡MÁÙ½Ð¯d·N 'qdisc' ³o­ÓªFªF¡M¥¦¬O Queueing Discipline (¦î¦C§Ù«ß¡S) ªº·N«ä¡C³o­Ó·§©À¤]¦Ü¬°­«­n¡C




\subsubsection{¥Î {\ttfamily ip} Åã¥Ü¸ô¥Ñ ({\ttfamily ip} shows us our routes)}

¦n¤F¡M§Ú­Ì¤w¸g¾å±o¦p¦ó¬d§ä 10.x.y.z ³o¼Ëªº¦ì§}¤F¡M¦Ó¥B¤]¯à°÷³s¤W 212.64.94.1¡C¥u¬O¡M¥ú¬O³o´X¸ô´²¤â¬O¤£¯à¥X®vªº¡M©Ò¥H§Ú­ÌÁÙ­n±Ð±z¦p¦ó±þ¥X¤ì¤H«Ñ¡C§Ú­Ì¥i¥H³z¹L ppp ³s½u±µ¤W internet¡M¦P®É«Ê¥]·|¥H 212.64.94.1 ³o­Ó¦ì§}¥á¨ì¥~­±¥h¡MµM«á§O¤H¤]¬O¥H³o­Ó¦ì§}±Nµ²ªG°e¦^¨Ó¡C

\begin{tscreen}
\begin{verbatim}
[ahu@home ahu]$ ip route show
212.64.94.1 dev ppp0  proto kernel  scope link  src 212.64.94.251 
10.0.0.0/8 dev eth0  proto kernel  scope link  src 10.0.0.1 
127.0.0.0/8 dev lo  scope link 
default via 212.64.94.1 dev ppp0 
\end{verbatim}
\end{tscreen}


¿é¥Xµ²ªG¥»¨­´N»¡±o«Ü²M·¡¤F¡C«e­± 4 ¦æºë½Tªº´y­z¥X§Ú­Ì±q {\ttfamily ip address show} ©Ò´¦¥Üªº·N¸q¡M¦Ó³Ì«á¤@¦æ«h§i¶D§Ú­Ì§Ú­Ì¥i¥H³z¹L 212.64.94.1¡M¤]´N¬O§Ú­Ìªº¹w³]ºôÃö(default gateway)¡M©M¥~­±ªº¥@¬É°µ³s½u¡C§Ú­Ì¤§©Ò¥H±N¤§µø¬°ºôÃö¡M¬O¦]¬°§Ú­Ì±N«Ê¥]°eµ¹ 212.64.94.1¡MµM«á¥¦´N·|À°§Ú­Ìµ½«á¤F¡C

¬°¤è«K¤ñ¸û¡M¦p¤U¬OÂÂªº 'route' ©R¥O©ÒÅã¥Üªº¤º®e¡R
\begin{tscreen}
\begin{verbatim}
[ahu@home ahu]$ route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use
Iface
212.64.94.1     0.0.0.0         255.255.255.255 UH    0      0        0 ppp0
10.0.0.0        0.0.0.0         255.0.0.0       U     0      0        0 eth0
127.0.0.0       0.0.0.0         255.0.0.0       U     0      0        0 lo
0.0.0.0         212.64.94.1     0.0.0.0         UG    0      0        0 ppp0
\end{verbatim}
\end{tscreen}





\subsection{ARP}

ARP ´N¬O Address Resolution Protocol¡M¨ä©w¸q¥i¥H°Ñ¦Ò \nameurl{http://www.faqs.org/rfcs/rfc826.html}{RFC 826}¡CARP ¬O¥Î¨Ó¬d§ä¦P¤@¥»¦aºô¸ô¤W¡M¨ä¥¦¥D¾÷¤§¹êÅé¦ì§}/¦ì¸m¥Îªº¡C¦Ó¦b Internet ¤Wªº¾÷¾¹¡M«h³q±`¥Î¥¦ªº¦WºÙ¨Ó§P§O¡M¨Ã¥Î¥¦¬d¸ß¥X IP ¦ì§}¡C³o´N¬O foo.com ºô¸ôªº¾÷¾¹¡M¬°¦ó¯à»P bar.net ºô¸ôªº¾÷¾¹¶i¦æ·¾³qªº­ì²z¡C¤£¹L¡M¥ú±o¨ì¤@­Ó IP ¦ì§}¡M¬O¨S¿ìªk§i¶D±z¸Ó¾÷¾¹ªº¹êÅé¦ì¸m¦b­þ¸Ì¡C³o®É¡MARP ´N¬£±o¤W¥Î³õ¤F¡C

©Î³\¡M§Ú­Ì§ä­Ó¨Ò¤l¨Ó»¡»¡·|¤ñ¸û¦n²z¸Ñ¡C°²³]§Ú¥Î´X¥x¾÷¾¹²Õ¦¨¤@­Óºô¸ô¡C¨ä¤¤¨â¥x¥Ø«e¦b§Úªººô¸ô¤W¡M¤@¥x¥s foo¡M¨ä IP ¦ì§}¬O 10.0.0.1¡Q¥t¤@¥x¥s bar¡M¨ä IP ¦ì§}¬O 10.0.0.2¡C²{¦b¡Mfoo ·Q­n ping ¤@¤U bar¡M¬Ý¬Ý¥L¬O§_¦b½u¤W¡MµM¦ÓÀYµhªº¬O¡Mfoo ¨Ã¤£ª¾¹D bar ¦b­þ¸Ì¡C³o¼Ë¡M·í foo ¨M©w­n¹ï bar °µ ping ªº®É­Ô¡M¥¦»Ý­n¥ý¥á¥X¤@­Ó ARP ½Ð¨D(request)¡C
³o­Ó ARP ½Ð¨D´N¦n¹³ foo ¦b¤jÁn³Û¡R¡§Bar(10.0.0.2)¡T±z¦b­þ¸Ì°Ú¡S¡¨¨äµ²ªG¬O¡M¦bºô¸ô¤Wªº©Ò¦³¾÷¾¹³£Å¥¨ì³o­Ó©I¥s¡M¦ý«o¥u¦³ bar (10.0.0.2) ·|§@¥X¦^À³¡CµM«á bar ·|¥á¥X¤@­Ó ARP ¦^À³(reply) ª½±µ°e¦^µ¹ foo ¡R¡§Foo(10.0.0.1)¡M§Ú¦b 00:60:94:E9:08:12 ³o¸Ì°Õ¡C¡¨¥Î³o­ÓÂ²³æªº¥æ¬y¨Ó§ä¥Xºô¸ô¤Wªº¦P¦ñ¤§«á¡Mfoo ´N¥i¥H©M bar ·¾³q¤F¡Mª½¨ì¥¦(¨ä arp cache)§Ñ°O bar ¦b¦ó¤è¬°¤î¡C

²{¦b´NÅý§Ú­Ì¬Ý¬Ý³o¬O¦p¦ó¤u§@ªº¡C±z¥i¥H¥ýÀË¬d¾÷¾¹¥Ø«eªº arp table ¡MÀ³¸Ó·|¦³ÂI¹³³o¼Ë¡R
\begin{tscreen}
\begin{verbatim}
[root@espa041 /home/src/iputils]# ip neigh show
9.3.76.42 dev eth0 lladdr 00:60:08:3f:e9:f9 nud reachable
9.3.76.1 dev eth0 lladdr 00:06:29:21:73:c8 nud reachable
\end{verbatim}
\end{tscreen}


¥¿¦p±z©Ò¨£¨ìªº¡M§Úªº¾÷¾¹ espa041(9.3.76.41) ¤wª¾¹D¦p¦ó§ä¥X espa042(9.3.76.42)¡MÁÙ¦³ espagate(9.3.76.1)¡CµM«áÅý§Ú­Ì±N¥t¤@¥x¾÷¾¹¥[¤J arp cache ¤¤¡C

\begin{tscreen}
\begin{verbatim}
[root@espa041 /home/paulsch/.gnome-desktop]# ping -c 1 espa043
PING espa043.austin.ibm.com (9.3.76.43) from 9.3.76.41 : 56(84) bytes of data.
64 bytes from 9.3.76.43: icmp_seq=0 ttl=255 time=0.9 ms

--- espa043.austin.ibm.com ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 0.9/0.9/0.9 ms

[root@espa041 /home/src/iputils]# ip neigh show
9.3.76.43 dev eth0 lladdr 00:06:29:21:80:20 nud reachable
9.3.76.42 dev eth0 lladdr 00:60:08:3f:e9:f9 nud reachable
9.3.76.1 dev eth0 lladdr 00:06:29:21:73:c8 nud reachable
\end{verbatim}
\end{tscreen}


µ²ªG¦p¤W¡Mespa041 ¥ý¹Á¸Õ³s±µ espa043¡MµM«á espa043 ªº¹êÅé¦ì§}¤]¤w³Q¥[¶i arp cache ¤¤¡C³o¼Ë¡M°£«D espa043 ªº°O¿ý¹O®É(¨Ò¦p¥L­Ì¤§¶¡¦AµL·¾³q)¡Mespa041 ´Nª¾¹D¨ì­þ¸Ì§ä espa043¡M¦ÓµL»Ý¦A°e ARP ½Ð¨D¤F¡C¡M

²{¦b¡MÅý§Ú­Ì±N espa043 ±q arp cache ¤¤§R°£¬Ý¬Ý¡R

\begin{tscreen}
\begin{verbatim}
[root@espa041 /home/src/iputils]# ip neigh delete 9.3.76.43 dev eth0
[root@espa041 /home/src/iputils]# ip neigh show
9.3.76.43 dev eth0  nud failed
9.3.76.42 dev eth0 lladdr 00:60:08:3f:e9:f9 nud reachable
9.3.76.1 dev eth0 lladdr 00:06:29:21:73:c8 nud stale
\end{verbatim}
\end{tscreen}


¦n¤F¡M²{¦b espa041 ¦A¦¸§Ñ°O¨ì­þ¸Ì§ä espa043¡M¦Ó¦b¤U¦¸­n©M espa043 ·¾³qªº®É­Ô¡M´N»Ý­n°e¥X¥t¥~ªº ARP ½Ð¨D¡C¦P®É¡M±zÁÙ·|±q¤W­±ªº¿é¥Xµ²ªG¤¤µo²{¡R espagate(9.3.76.1) ¤w¸gÅÜ¬° "stale" ª¬ºA¡C³o¬O»¡¡M¸ÓÅã¥Ü¦ì¸m¤´µM¦³®Ä¡M¦ý¦b²Ä¤@¦¸¦V¸Ó¾÷¾¹¶Ç°eªº®É­Ô¡M¥²¶·­n¥ý½T»{´N¬O¤F¡C




\section{³W«h - ¸ô¥Ñ­ì«h¸ê®Æ®w (Rules - routing policy database)}

°²¦p±z¦³¤@­Ó±j¤jªº¸ô¥Ñ¾¹¡M¨º±z©Î³\­nº¡¨¬¦U¾A¨ä¦¡ªº¤£¦P¤Hµ¥¤§»Ý¡C¸ô¥Ñ­ì«h´N¯àÅý±z³z¹L¦h²Õ¸ô¥Ñªí®æ¡M¨£©Û©î©Û¡C

¦pªG±z¯uªº»Ý­n³o­Ó¥\¯à¡M½Ð½T©w±zªº®Ö¤ß¦³±N "IP: advanced router" ©M "IP: policy routing" ¥\¯à½sÄ¶¶i¨Ó¡C

¦b®Ö¤ß¶i¦æ¸ô¥Ñ§PÂ_ªº®É­Ô¡M¥¦­n§ä¥X­þ¤@­Óªí®æ¥H«K¬d¸ß¡C¦b¹w³]±¡ªp¤§¤U¡M·|¦³¤T­Óªí®æ¡CÂÂªº 'route' ¤u¨ã·|­×§ï main ©M local ªí®æ¡M(¹w³]¤W)©M ip ¤u¨ã¤@¼Ë´N¬O¤F¡C

¹w³]³W«h¦p¤U¡R
\begin{tscreen}
\begin{verbatim}
[ahu@home ahu]$ ip rule list
0:      from all lookup local 
32766:  from all lookup main 
32767:  from all lookup default
\end{verbatim}
\end{tscreen}


³o­Óªí®æ¦C¥Ü¥X¥þ³¡³W«hªºÀu¥ý¦¸§Ç¡C§Ú­Ì¤£Ãøµo²{©Ò¦³³W«h³£¾A¥Î©ó©Ò¦³«Ê¥]('from all')¡C'main' ªí®æ§Ú­Ì«e­±¤w¸g¬Ý¹L ¤F¡M¥i¥H¥Î {\ttfamily ip route ls} ¬Ý¨ì¨ä¿é¥Xµ²ªG¡M¤£¹L¡M 'local' ©M 'default' ªí®æ«h¬O·sªº¡C

­Y·Qª±¨Ç°ªÃø«×°Ê§@¡M§Ú­Ì¥i¥H²£¥Í·s³W«h¡MµM«á«ü¦V¤£¦Pªí®æ¡M¦Ó§ï¼g¾ã­Ó¨t²Îªº¸ô¥Ñ³W«h¡C

·í¦s¦b§ó¦h¹ïÀ³³W«h®É¡M®Ö¤ß¬O¦p¦ó½T¤Á³B¸mªº¡M½Ð°Ñ¦Ò Alexey ¥S¤§ ip-cref ¤å¥ó¡C




\subsection{Â²©ö·½¸ô¥Ñ (Simple source routing)}

ÁÙ¬OÅý§Ú­Ì¦A¥Î¤@­Ó¯u¹ê½d¨Ò¨Ó»¡¦n¤F¡M§Ú¦³¨â­Ó(¹ê»Ú¤W¦b§Ú°h±¼¤§«e¦³ 3 ­Ó) cable modem ¡M³s±µ¨ì¤@¥x Linux NAT ('masqauerading') router ¤W­±¥h¡C¦í¦b³o¸Ìªº¤H¥I¿úµ¹§Ú¨Ï¥Î internet¡C°²³]¨ä¤¤¤@­Ó¯²«È¥u³æ¯Âªº±´³X hotmail ¦Ó·Q¤Ö¥I¤@ÂI¿ú¡C¹ï§Ú¨Ó»¡·íµM¨S°ÝÃD°Õ¡M¥u¬O±z·|³Q¤À°t¨ì¸û§C¶¥ªº cable modem ¦Ó¤w¡C

¨º¥x '¸û§Ö' ªº cable mode ªº¦ì§}¬O 212.64.94.251¡M¦P®É¥H PPP ³s±µ¨ì 212.64.94.1 ¨º¸Ì¥h¡C¦Ó¨º¥x '¸ûºC' ªº cable modem ¨Ï¥Îªº¬OÅÜ°Ê¦ì§}¡M¥Ø«e¦b¦¹½d¨Ò¤¤¬O 212.64.78.148¡M¦P®É³s±µ¨ì 195.96.98.253 ¥h¡C

Ãö©ó¥»¾÷ªºªí®æ¡M¦p¤U¡R

\begin{tscreen}
\begin{verbatim}
[ahu@home ahu]$ ip route list table local
broadcast 127.255.255.255 dev lo  proto kernel  scope link  src 127.0.0.1 
local 10.0.0.1 dev eth0  proto kernel  scope host  src 10.0.0.1 
broadcast 10.0.0.0 dev eth0  proto kernel  scope link  src 10.0.0.1 
local 212.64.94.251 dev ppp0  proto kernel  scope host  src 212.64.94.251 
broadcast 10.255.255.255 dev eth0  proto kernel  scope link  src 10.0.0.1 
broadcast 127.0.0.0 dev lo  proto kernel  scope link  src 127.0.0.1 
local 212.64.78.148 dev ppp2  proto kernel  scope host  src 212.64.78.148 
local 127.0.0.1 dev lo  proto kernel  scope host  src 127.0.0.1 
local 127.0.0.0/8 dev lo  proto kernel  scope host  src 127.0.0.1 
\end{verbatim}
\end{tscreen}


¤j³¡¥÷§Ú­Ì³£ª¾¹D¬O¤°»ò¤F¡M¥u¦³¨ä¤¤¤@³¡¥÷»Ý­n¯S§O«ü©w¦Ó¤w¡C¶â¡M¤]¤£Ãø§ä°Õ¡C¨ä '¹w³](default)' ªí®æ¥Ø«e¬OªÅªº¡C

¨º¥ýÅý§Ú­Ì¬Ý¬Ý 'main' ªí®æ§a¡R
\begin{tscreen}
\begin{verbatim}
[ahu@home ahu]$ ip route list table main 
195.96.98.253 dev ppp2  proto kernel  scope link  src 212.64.78.148 
212.64.94.1 dev ppp0  proto kernel  scope link  src 212.64.94.251 
10.0.0.0/8 dev eth0  proto kernel  scope link  src 10.0.0.1 
127.0.0.0/8 dev lo  scope link 
default via 212.64.94.1 dev ppp0 
\end{verbatim}
\end{tscreen}


§Ú­Ì²{¦b¥ý²£¥Í¤@±ø·s³W«h¡M¨ú¦W¬° 'John'¡M¬O¬°§Ú­Ì°²³]ªº©Ð«È¦Ó³]ªº¡CÁöµM¡M§Ú­Ì¥i¥H¥þ³¡¥Î¸¹½X¨Ó°µ¡M¤£¹L¡M¦pªG§Ú­Ì±Nªí®æ¥[¤J \url{/etc/iproute2/rt\_tables} ªº¸Ü¡M·|§ó¥[®e©ö¨Ç¡C

\begin{tscreen}
\begin{verbatim}
# echo 200 John >> /etc/iproute2/rt_tables
# ip rule add from 10.0.0.10 table John
# ip rule ls
0:      from all lookup local 
32765:  from 10.0.0.10 lookup John
32766:  from all lookup main 
32767:  from all lookup default
\end{verbatim}
\end{tscreen}


±µ¤U¨Ó¡M§Ú­Ì¥u»Ý¼W¥[ Johns ªí®æ¡M¦P®É²MªÅ(flush) route cache ´N¦n¡R
\begin{tscreen}
\begin{verbatim}
# ip route add default via 195.96.98.253 dev ppp2 table John
# ip route flush cache
\end{verbatim}
\end{tscreen}


¦n¤F¡M³o¼Ë´N¦æ¤F¡C³Ñ¤Uªº¡M´N§@¬°§Ú­ÌÅªªÌªº½m²ß¡M¦b ip-up ¤U°µ°µ¬Ý§a¡C


\section{GRE ¤Î¨ä¥¦³q¹D§Þ³N (GRE and other tunnels)}

¦b Linux ¸Ì­±ªº tunnel ¦@¤À¤TÃþ¡M§Y IP in IP tunneling¡N GRE tunneling¡N¥H¤Î®Ö¤ß¥H¥~ªº tunnels (¨Ò¦p¡RPPTP)¡C


\subsection{Ãö©ó tunnels ªº´X¶µª`·N (A few general remarks about tunnels):}

Tunnels ¥i¥H¥Î¨Ó°µ¤@¨Ç«D¤ñ´M±`ªº»Åª±·N¡C¤£¹L¡M¦pªG³]©w¤£·V¡M¤]·|±N¨Æ±¡§Ë±o¤@¶ò½kÒ\¡C¦pªG±z¨Ã«D {\bfseries ¯Ý¦³¦¨¦Ë}¡M¨º´N¤d¸U¤£­n±N±zªº¹w³]ºôÃö«ü¦V tunnel ³]³Æ¡CÁÙ¦³¡Mtunneling ¤]·|¼W¥[ÃB¥~ªº overhead¡M¦]¬°¥¦»Ý­nÃB¥~ªº IP ¼ÐÀY(header)¡C¤@¯ë¦Ó¨¥¡M¨C¤@­Ó«Ê¥]¤j·§ 20 byte ¥ª¥k¡M³o¼Ë¡M¤@­Ó¥¿±`ªººô¸ô«Ê¥]Åé¿n (MTU) ·|¬O 1500 bytes¡M¦ý¦p«Ê¥]ªG¸g tunnel ¶Ç°e¡M«o¥u¦³ 14800 byte ¦Ó¤w¡C³o¨ä¹ê¤]¤£ºâ¬O¤°»ò°ÝÃD¡M¦ý¬O·í±z¦³¾÷·|¥Î tunnels ¨Ó³s±µ¤j«¬ºô¸ôªº®É­Ô¡M½Ð°È¥²ÀË¬d IP «Ê¥]ªº¸H¤ù©M­«²Õ(fragmentation/reassembly)²Ó¸`¡C·íµMÅo¡M«Ø¥ß tunnel ªº¸Ü¡M³Ì¦n¬O±q tunnel ªº¨âºÝ¦P®ÉµÛ¤â¡MÂùºÞ»ô¤U¡C






\subsection{IP in IP tunneling}

¦¹Ãþ tunneling §Þ³N¨ä¹ê¦b Linux ¸Ì¤w¦æ¤§¦³¦~¤F¡C¥¦»Ý­n¨â­Ó®Ö¤ß¼Ò²Õ¡Ripip.o ©M new\_tunnel.o¡C

¤ñ¤è»¡¡M±z¦³ 3 ­Óºô¸ô¡RA ©M B ¬Ò¬°¤º³¡ºô¸ô¡M¦Ó³z¹Lºô¸ô C (©Î¤ê Internet) ±N¨âªÌ³s±µ°_¨Ó¡C³o¼Ë¡M§Ú­Ìªººô¸ô A ·|¬O¦p¦¹¡R

\begin{tscreen}
\begin{verbatim}
network 10.0.1.0
netmask 255.255.255.0
router  10.0.1.1
\end{verbatim}
\end{tscreen}

±µºô¸ô C ªººôÃö¦ì§}¬° 172.16.17.18¡C

¦Óºô¸ô B «h³o¯ë¡R
\begin{tscreen}
\begin{verbatim}
network 10.0.2.0
netmask 255.255.255.0
router  10.0.2.1
\end{verbatim}
\end{tscreen}

±µºô¸ô C ªººôÃö¦ì§}¬° 172.19.20.21 ¡C

¹ïºô¸ô C ¦Ó¨¥¡M§Ú­Ì°²³]¥¦¯à°÷Âù¦Vªº±Nºô¸ô A ©M B ¤§¶¡ªº«Ê¥]°e»¼¹ï¤è¡C±z¬Æ¦Ü¥i¥H¥Î Internet °Õ¡C

¦n¤F¡MµM«á±z­n°µªº¨Æ±¡¬O¡R

­º¥ý¡M½T©w©Ò¦³¼Ò²Õ³£¸Ë¦n¤F¡R

\begin{tscreen}
\begin{verbatim}
insmod ipip.o
insmod new_tunnel.o
\end{verbatim}
\end{tscreen}

µM«á¡M¦bºô¸ô A ªº router ¤W¡M³o¼Ë°µ¡R
\begin{tscreen}
\begin{verbatim}
ifconfig tunl0 10.0.1.1 pointopoint 172.19.20.21
route add -net 10.0.2.0 netmask 255.255.255.0 dev tunl0
\end{verbatim}
\end{tscreen}

µM«á¦bºô¸ô B ªº router ¤W¡R
\begin{tscreen}
\begin{verbatim}
ifconfig tunl0 10.0.2.1 pointopoint 172.16.17.18
route add -net 10.0.1.0 netmask 255.255.255.0 dev tunl0
\end{verbatim}
\end{tscreen}

§¹¦¨«á¡M±N tunnel ¼È®ÉÃö³¬¡R
\begin{tscreen}
\begin{verbatim}
ifconfig tunl0 down
\end{verbatim}
\end{tscreen}

¼u«ü¶¡¡M´N³o¼Ë·d©w¤F¡CµM¦Ó¡M±z¤£¯à³z¹L IP-in-iP tunnel ¶Ç°e¼s¼½©Î IPv6 ¸ê°T¡C±z­èÅ×±N¨â­Ó¥»¨Ó¤£¯à¬Û¤¬·¾³qªº IPv4 ºô¸ô³s±µ°_¨Ó¤F¡MµM¶È¦¹¦Ó¤w¡C°ò©ó­Ý®e¦Ò¶q¡M¦¹µ{¦¡½X¥Ñ¨Ó¤w¤[¡M¦]¦Ó°f·¹¦Ü 1.3 ª©®Ö¤ß¬Ò­ÝÄw¨ÃÅU¡C¾Ú§Ú©Òª¾¡M Linux ¤§ IP-in-IP tunneling ¨Ã¤£¯à¦b¨ä¥¦ªº§@·~¨t²Î©Î router ¤W¤u§@¡CµM¦Ó¥¦µu¤pºë®«¡M¹êÄÝ­º¿ï¡M°£«D±z¦Ò¼{¥Î GRE¡C




\subsection{GRE tunneling}

GRE ¬O¤@­Ó­ì¥»¥Ñ Cisco ¶}µoªº tunneling ¨ó©w¡M¸û©ó IP-in-IP tunneling¡M¥¦²¤¬°¯à­@¤@¨Ç¡C¨Ò¦p¡M±z¯à°÷³z¹L GRE tunnel ¶Ç°e multicast ©M IPv6 ¸ê°T¡C

¦b Linux ¸Ì¡M±z±o­É§U ip\_gre.o ¼Ò²Õ¡C




\subsubsection{IPv4 Tunneling}

¤£¦p¥ýÅý§Ú­Ì±N IPv4 tunneling °µ°_¨Ó§a¡R

¤ñ¤è»¡¡M±z¦³ 3 ­Óºô¸ô¡RA ©M B ¬Ò¬°¤º³¡ºô¸ô¡M¦Ó³z¹Lºô¸ô C (©Î¤ê Internet) ±N¨âªÌ³s±µ°_¨Ó¡C

Ãö©óºô¸ô A ¡M¦p¤U¡R
\begin{tscreen}
\begin{verbatim}
network 10.0.1.0
netmask 255.255.255.0
router  10.0.1.1
\end{verbatim}
\end{tscreen}

¦bºô¸ô C ¤Wªº router ¦ì§}¬° 172.16.17.18¡C
µM«áÅý§Ú­ÌºÙ³o­Óºô¸ô¬° neta (¦n¤F¡M¸U¨Æ°_ÀYÃø)¡C

µM«á¡MÃö©óºô¸ô B¡R
\begin{tscreen}
\begin{verbatim}
network 10.0.2.0
netmask 255.255.255.0
router  10.0.2.1
\end{verbatim}
\end{tscreen}

¦bºô¸ô C ¤Wªº router ¦ì§}¬° 172.19.20.21¡C
µM«áÅý§Ú­ÌºÙ³oºô¸ô¬° netb ¦n¤F(­²©R©|¥¼¦¨¥\¡M¦P§Ó¤´»Ý§V¤O)¡C

¹ïºô¸ô C ¦Ó¨¥¡M§Ú­Ì°²³]¥¦¯à°÷Âù¦Vªº±Nºô¸ô A ©M B ¤§¶¡ªº«Ê¥]°e»¼¹ï¤è¡C¦Ü©ó¦ó¥HµM¤Î¦ó©Ò¥HµM¡M«h«D§Ú­Ì©Ò­n¾Þ¤ßªº¡C

±µ¤U¨Ó¡M¦bºô¸ô A ªº router ¤W¡M±z¦p¦¹°µ¡R
\begin{tscreen}
\begin{verbatim}
ip tunnel add netb mode gre remote 172.19.20.21 local 172.16.17.18 ttl 255
ip link set netb up
ip addr add 10.0.1.1 dev netb
ip route add 10.0.2.0/24 dev netb
\end{verbatim}
\end{tscreen}


³o¸Ì¡M§Ú­Ì¤£§«¬ã¨s¤@¤U¡C¦b²Ä¤@¦æ¸Ì­±¡M§Ú­Ì·s¼W¤F¤@­Ó tunnel ³]³Æ¡MºÙ¤§¬° netb (Åã¦Ó©ö¨£¡M¦]¬°³o¥¿¬O§^¤§©Ò±ý¤])¡C¦A¨Ó¡M§Ú­ÌÅý¥¦¨Ï¥Î GRE ¨ó©w(mode gre)¡M¨ä»·ºÝ¦ì§}¬° 172.19.20.21 (©ó¥t¤@ºÝªº router)¡M³o¼Ë§Ú­Ìªº tunneling «Ê¥]±N±q 172.16.17.18 ±q¥X(±zªº router ¦bºô¸ô C ¤W¥i¥H¨ã¦³¦n´X­Ó IP ¦ì§}¡M¨Ã¥Ñ±z¨M©w¥Î­þ¤@­Ó¨Ó°µ tunneling)¡M¦Ó¥B¡M«Ê¥]ªº TTL Äæ¦ì³Q³]©w¬° 255 (ttl 255)¡C

²Ä 2 ¦æ§Ú­Ì±N³o­Ó³]³Æ±Ò°Ê°_¨Ó¡C

¦b²Ä 3 ¦æ¡M§Ú­Ì¬°·s¼Wªº¬É­± netb ³]©w¤@­Ó¦ì§}¬° 10.0.1.1¡C¥Î³o­Ó¦b¤pºô¸ô¤W¤]¥¼¹Á¤£¥i¡M¥u¬O·í±z½ñ¤W±Äª÷®Èµ{¤§»Ú¡M±z©Î»Ý¥Î¨ä¥¦ IP ½d³ò¨Óµ¹ tunneling ¬É­±´N¬O¤F(¨Ò¦p¦b¦¹½d¨Ò¤¤¡M±z¥i¥H¨Ï¥Î 10.0.3.0)¡C



¦b²Ä 4 ¦æ¡M§Ú­Ì¬°ºô¸ô B ³]©w¦n router¡C½Ð¯d·N¡M¦¹³B¨Ï¥Îªº netmask ªí¥Üªk¨Ã¤£¤@¼Ë¡C¦pªG±z¤£¤Ó¤F¸Ñ¨ä·N©Ò¦b¡M¥i¥H³o¼Ë¨Ó²z¸Ñ¡R±N netmask ´«ºâ¬°¤G¶i¦ì(binary)¡MµM«á¼Æ¤@¼Æ¦³¦h¤Ö­Ó 1 ´N¬O¤F¡C¦pªG±z³s³o­Ó¤]¤£·|¡M¸U¤@¤S·Qª¾¹D¡M¨º´N³o¼Ë±j°O§Y¥i¡R255.0.0.0 ¬O /8¡N255.255.0.0 ¬O /16¡NÁÙ¦³ 255.255.255.0 ¬O /24¡N¦Ó 255.255.253.0 «h¬O /23¡C

°÷¤F¯u¬Oªº¡MÁÙ¬OÅý§Ú­Ì¬Ý¬Ýºô¸ô B ªº router §a¡C
\begin{tscreen}
\begin{verbatim}
ip tunnel add neta mode gre remote 172.16.17.18 local 172.19.20.21 ttl 255
ip link set neta up
ip addr add 10.0.2.1 dev neta
ip route add 10.0.1.0/24 dev neta
\end{verbatim}
\end{tscreen}

°²¦p±z­n®³±¼ router A ¤Wªº tunnel¡M«h¡R
\begin{tscreen}
\begin{verbatim}
ip link set netb down
ip tunnel del netb
\end{verbatim}
\end{tscreen}

·íµM¡M±z¤]¥i¥H´À router B ±N netb ´«¦¨ neta¡C



GRE tunnels ¥Ø«e©Ò¿ï¥Îªº tunneling Ãþ«¬¡C¥¦¤w¦¨¼Ð·Ç¨Ã¥B¤]³Q¼sªxªº²¾´Ó¨ì Linux ªÀ¸s¤§¥~¡M¸Û¬O¬ü¨Æ¤@¼Î¡C




\subsection{Userland tunnels}

¦b®Ö¤ß¤§¥~¡MÁÙ¦³¦¨¥´§Î§Î¦â¦âªº tunneling ¹ê§@¡Mµ´«D¸Ø±i¤§½Í¡C¨ä¤¤ªíªíªÌ«D PPP ©M PPTP ²öÄÝ¡MµM¦Ó¨ä¥¦ªº¤]¬°¼Æ²³¦h (¦³ªº¬°±MÄÝªº¡M¦³ªº¬O«O±Kªº¡M¦³ªº¬Æ¦Ü¤£¬O¨Ï¥Î IP)¡M¤£¹L¡M³o¨Ç¹ê¦b¶W¹L¥» HOWTO ªº½dÃ¥¤F¡C




\section{¥Î Cisco ©M/©Î 6bone ¶i¦æ IPv6 tunneling (IPv6 tunneling with Cisco and/or 6bone)}

By Marco Davids $<$marco@sara.nl$>$

ºûÅ@ªÌ»Ýª¾¡R

¾Ú§Ú©Òª¾¡M¥Ø«e³o­Ó IPv6-IPv4 tunneling ¨Ã«D¥Ñ GRE tunneling ©w¸q¡CÁöµM¡M±z¥i¥H¥Î GRE tunnel ³]³Æ¶i¦æ IPv6 over IPv4 ªº tunnel (GRE ¥i¦b IPv4 ¤W§@¥ô¦óªº tunnel)¡M¦ý¦b³o¸Ì¨Ï¥Îªº³]³Æ("sit")¡M¶È¹ï IPv6 over IPv4 ¶i¦æ tunnel ¦Ó¤w¡M¦]¦¹©Î©M¨ä¥¦§Þ³N¦³§O¡C




\subsection{IPv6 Tunneling}

³o¬O Linux ¦b tunneling §Þ³N¤Wªº¥t¤@À³¥Î¡C³o¦b¤w¸g¨Ï¥Î IPv6 ªº¬É­±¤W«Ü´¶¹M¡M·íµMÅo¡M±z»{¬°«Ü«e½Ã¤]¥¼¹Á¤£¥i¡C«á­±ªº '¹ê§@' ½d¨Òµ´¹ï¤£¬O°ß¤@ªº IPv6 tunneling ¤èªk¡C¤£¹L¡M¥¦«o¬O¦b Linux »P Cisco IPv6 ­Ý®e¸ô¥Ñ¾¹¤§¶¡¶i¦æ tunnel ªº³Ì±`¥ÎªZ¾¹¡M¦Ó¹êÅçÃÒ©ú³\¦h¤H¹ï¦¹¤]ÁÍ¤§­YÄE¡C§Ú¤£©È¥H¤@½ß¤Q©M±z½ä¤@½ä ;-)



{\bfseries Ãö©ó IPv6 ªº¤p¯µ³Z}

¤ñ¸û°_ IPv4 ¦ì§}¡MIPv6 ¦ì§}Åã¦pÃeµM¤jª«¡R128 bits ¹ï¤ñ 32 bits¡C³o¦P®É¤]¥u´£¨Ñ§Ú­Ì»Ý­nªº¨Æª«¡R´N¬O³\¦h¡N³\¦hªº IP ¦ì§}¡R340,282,266,920,938,463,463,374,607,431,768,211,465 ¬O¤@­Ó¤Q¤Àºë½Tªº¨Ò¤l¡C°£¦¹¥H¥~¡M IPv6(©Î IPng¡M¤]´N¬O IP Next Generation)¡M³Q»{¬°¥i¥H¦b Internet backbone ¸ô¥Ñ¾¹¤WºûÅ@§ó¤pªº¸ô¥Ñªí¡N§óÂ²³æªº³]³Æ³]©w¡N§ó¦nªº IP ¼h¯Å¦w¥þ¡N¥H¤Î§ó¨Îªº QoS ¤ä´©¡C

¨Ò¦p¡R2002:836b:9820:0000:0000:0000:836b:9886

¨C¦¸¼g³o»òªøªº IPv6 ¦ì§}¡M¨Æ¹ê¤WÆZ²Ö¤Hªº¡C¦]¦¹¡M¤£§«°Ñ¦Ò¦p¤U³W«h¨ÓÂ²¤Æ¤@¤U¡R
\begin{itemize}
\item ¤£­n¥H¹s¶}©l(©M IPv4 ¤@¼Ë)¡C
\item ¥Î«_¸¹¨Ó°Ï¹j³o 16 ­Ó bit (©Î¨â­Ó byte)¡C
\item ·í¹J¨ì³sÄòªº¹sªº®É­Ô¡M±z¥i¥H³o¼Ë¼g :: ¡M¦ý¬O¥u¯à¦b¤@­Ó¦ì§}¤W°µ¤@¦¸¡M¦Ó¥B¦ì§}¼Æ¶q¤@©w­n¬° 16 ­Ó bit¡C
\end{itemize}

°Ñ¦Ò¦¹³W«h¡M¤@­Ó¦p 2002:836b:9820:0000:0000:0000:836b:9886 ªº¦ì§}¡M¤]¥i¥H¼g¦¨ 2002:836b:9820::836b:9886¡MÅãµMÂ²¼ä±o¦h¡C

{\bfseries ¥Î©ó tunnels ¤W­±}

IPv6 ¤@­P³Q»{¬°¯à°÷¨ú¥N IPv4 ªº¦a¦ì¡C¥Ñ©ó¥¦¬Û¹ï¦Ó¨¥ÁÙ¬O¤@ºØ¹ñ·s§Þ³N¡M¥Ø«e©|Ãø§ä¨ì¯Â IPv6 ªº­ì©lºô¸ô¡C¬°¤FÅý§Ú­Ì§ó¨³³tªº¹L´ç¡M©ó¬O¦³¤F 6bone ªº¥X²{¡C

­ì©lªº IPv6 ºô¸ôÁpµ²¡M¬O³z¹L±N IPv6 ¨ó©w«Ê¸Ë¦b IPv4 «Ê¥]¤¤¡MµM«á§Q¥Î²{¦³ªº IPv4 ¬[ºc±q¤@­Ó IPv6 ¯¸ÂI°e¨ì¨ä¥¦¯¸ÂI¥h¡C

«ê¦n¡M³o¥¿¬O tunnels ¤Á¤J¤§³B¡C

¬°¤F¨Ï¥Î IPv6¡M§Ú­Ì¥²¶·­n¥ý¦³¤@­Ó¤ä´©¥¦ªº®Ö¤ß¡C¥Ø«e¤w¸g¦³«D±`¦hªºÀu¨q¤å¥ó§i¶D§Ú­Ì¦p¦ó°µ¨ì³oÂI¡M¤£¹L¡M¦ü¥G¥þ³£¤£¥~¥G³o´X¸ôªO©ò¡R
\begin{itemize}
\item ¨Ï¥Î·sªº Linux ª©¥»¡M¥H¤Î¦X¾Aªº blibc¡C
\item µM«á§ì¨ú³Ì·sªº®Ö¤ß­ì©l½X¡C
\end{itemize}

¦pªG±z¥þ³£·Ç³Æ§´·í¡M¨º±z´N¥i¥HÄ~Äò¤W¸ô¡M½sÄ¶¥X¤@­Ó IPv6 ­Ý®eªº®Ö¤ß¡R
\begin{itemize}
\item Âà¨ì /usr/src/linux ¨Ã¿é¤J¡R
\item make menuconfig
\item ¿ï¾Ü "Networking Options"
\item ¿ï¾Ü "The IPv6 protocol",¡M"IPv6: enable EUI-64 token format"¡M"IPv6: disable provider based addresses"
\end{itemize}

´£¥Ü¡R¤£­n¨Ï¥Î¡¥¼Ò²Õ¡¦ªº¤è¦¡¡M³o³q±`¤u§@°_¨Ó¤£«Ü§¹µ½¡C

Á`¦Ó¨¥¤§¡M±N IPv6 ¥H '¤º«Ø' ¤è¦¡½s¶i®Ö¤ß´N¬O¤F¡CµM«á±z¥i¥H¦p±`¯ë±N³]©w«O¦s¦n¡M¦AÄ~Äò®Ö¤ßªº½sÄ¶¡C

´£¥Ü¡R¦b¯u¥¿½sÄ¶¤§«e¡M¤£§«­×§ï¤@¤U Makefie¡R
EXTRAVERSION = -x ; --{$>$} ; EXTRAVERSION = -x-IPv6

Ãö©ó®Ö¤ßªº½sÄ¶©M¦w¸Ë¡MÀ³¸Ó¦³«Ü¦hÀu¨q¤å¥ó¤F¡M¥»¤å¥ó´N¤£¦AÂØ¨¥¡C¦pªG±z¦b³o¸Ì¸I¨ì³Â·Ð¡M½Ð«ö·Ó±z¦Û¤vªº³W®æ°Ñ¦Ò Linux ®Ö¤ß½sÄ¶ªº¬ÛÃö¤å¥ó¡C

/usr/src/linux/README ³o­ÓÀÉÀ³¸Ó¬O­Ó¤£¿ùªº°_ÂI¡Cµ¥±z¹L¤F³o¤@Ãö¡M¦A¥Î·sªº®Ö¤ß­«·s±Ò°Ê¨t²Î¡MµM«á±z¥i¥H¿é¤J '/sbin/ifconfig -a' ©R¥O¡M©Î³\·|µo²{¤@­Ó¥þ·sªº'sit0-device'¡C SIT ´N¬O  Simple Internet Transition ªº·N«ä¡CªG¯u¦p¦¹ªº¸Ü¡M¤£§«¶}­»Âb¦Û§Ú¼y¯¬¤@µf¡R±z¤w¸g¶ZÂ÷¤U¤@¥Nªº IP ÁÚ¥X¤F«Ü¤j¤@¨B¤F ;-)

±µ¤U¨Ó¡M±z©Î³\·Q­n±N¾÷¾¹³s±µ°_¨Ó¡M©Î¬O¬Æ¦Ü±N¾ã­Óºô¸ô³s±µ¨ì¨ä¥¦ IPv6 ­Ý®eºô¸ô¥h¡C¦Ó "6bone" ¥¿¬OÀ³¦¹¹B¦Ó¥Íªº¡C

°²³]±zÀò±o¤@­Ó³o¼Ëªºªº IPv6 ºô¸ô¡R3ffe:604:6:8::/64 ¡M¦Ó±z·Q­n³s±µ 6bone ¡M©Î¬O±zªºªB¤Í¡C½Ðª`·N¡R¨º­Ó /64 ¤lºô¼Ð°Oªº¨Ï¥Î¿ìªk°Ñ·Ó±`³Wªº IP ¦ì§}¬É©w¤è¦¡´N¥i¥H¤F¡C

±zªº IPv4 ¦ì§}¬° 172.16.17.181¡M¦Ó 6bone ªº router ¤]¦³¤@­Ó¦ì§}¬° 145.100.1.5¡C
\begin{tscreen}
\begin{verbatim}
# ip tunnel add sixbone mode sit remote 145.100.1.5 [local 145.100.24.181 ttl 225]
# ip link set sixbone up
# ip addr add 3FFE:604:6:7::2/126 dev sixbone
# ip route add 3ffe::0/16 dev sixbone
\end{verbatim}
\end{tscreen}


Åý­Ì¬ã¨s¤@¤U¤W­±ªº¥y¤l¡C²Ä¤@¦æ¡M§Ú­Ì«Ø¥ß¤F¤@­Ó tunnel ³]³Æ¡M¥s°µ sixbone¡CµM«á³]©w¬° sit ¼Ò¦¡(IPv6 in IPv4 tunneling)¡M¨Ã¥B­n³s¨ì­þ¸Ì¥h (remote)¡MÁÙ¦³±q­þ¸Ì¨Ó (local)¡C¦Ó TTL ©O¡M¤w³]¨ì³Ì°ª¡R255¡C

±µ¤U¨Ó¡M§Ú­Ì±N³]³Æ¶]°_¨Ó (up)¡C¦A¤U¨Ó¡M§Ú­Ì·s¼W¦Û¤vªººô¸ô¦ì§}¡M¦P®É³z¹L³o­Ó tunnel ¬° 3ffe::/15 ³]©w¤@­Ó¸ô¥Ñ (¥Ø«e§¡¬° 6bone)¡C¦pªG±z¥Ø«eªº°õ¦æ¥D¾÷¬O±zªº IPv6 ºôÃöªº¸Ü¡M½Ð¼W¥[¦p¤U¼Æ¦æ¡R

\begin{tscreen}
\begin{verbatim}
# echo 1 >/proc/sys/net/ipv6/conf/all/forwarding
# /usr/local/sbin/radvd
\end{verbatim}
\end{tscreen}

¦b³Ì«á­±ªº radvd ¬O¤@­Ó¸ô¥Ñ¾¹¼s§iµ{¦¡(advertisement daemon) - like zebra -¡M¥H¤ä´© IPv6 ªº¦Û°Ê³]©w¥\¯à¡C¦pªG±z¦³¿³½ì¡M½Ð¥Î·j¯Á¤ÞÀº´M§ä¥¦ªº¬ÛÃö¸ê°T¡C±z¥i¥H¥Î¦p¤U©R¥O¨ÓÀË¬d¤@¤U¡R

\begin{tscreen}
\begin{verbatim}
# /sbin/ip -f inet6 addr
\end{verbatim}
\end{tscreen}


°²¦p±z¤w¸g¦b IPv6 ºôÃö¤W±N radvd ¶]°_¨Ó¡M¨Ã¦b¥»¦aºô¸ô¤W±Ò°Ê IPv6 ­Ý®eªº Linux ¾÷¾¹¡M¨º±zÀ³¸Ó¥i¥H¨É¨ü¨ì IPv6 ªº¦Û°Ê³]©w¥\¯à¤F¡R
\begin{tscreen}
\begin{verbatim}
# /sbin/ip -f inet6 addr
1: lo: <LOOPBACK,UP> mtu 3924 qdisc noqueue inet6 ::1/128 scope host

3: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 100
inet6 3ffe:604:6:8:5054:4cff:fe01:e3d6/64 scope global dynamic
valid_lft forever preferred_lft 604646sec inet6 fe80::5054:4cff:fe01:e3d6/10 
scope link
\end{verbatim}
\end{tscreen}


±zÁÙ¥i¥H¶i¦Ó¥Î bind ³]©w IPv6 ¦ì§}¡C­ì¨Óªº A °O¿ý¡M¦b IPv6 ¸Ì­±¬°¡RAAAA¡C¦Ó in-addr.arpa «h§ï¬° ip6.int¡C¨þ¡M¥ú¬O³o­ÓÃD¥Ø´N¦³¤@¤j°ï¸ê®Æ¤F¡C

¶V¨Ó¶V¦hªºÀ³¥Îµ{¦¡¤w¸g¶}©l¤ä´© IPv6 ¤F¡M¥]¬A secure shell¡Ntelnet¡Ninetd¡NMozilla Âsø°¾¹¡NApache ºô¯¸¦øªA¾¹¡N¥H¤Î¨ä¥¦¡M¼Æ¤£³Ó¼Æ¡C¤£¹L¡M³o¨Ç³£¤£¬O¥»¸ô¥Ñ¤å¥ó©Ò­n°Q½×ªº°Õ ;-)

¦b Cisco ¨ºÃä¡M³]©wÀÉ©Î³\·|ªø±o¦³ÂI¹³¤U­±ªº¼Ë¤l¡R
\begin{tscreen}
\begin{verbatim}
!
interface Tunnel1
description IPv6 tunnel
no ip address
no ip directed-broadcast
ipv6 enable
ipv6 address 3FFE:604:6:7::1/126
tunnel source Serial0
tunnel destination 145.100.24.181
tunnel mode ipv6ip
!
ipv6 route 3FFE:604:6:8::/64 Tunnel1
\end{verbatim}
\end{tscreen}

¦ý¬O¡M¦pªG±z¨S¦³ Cisco ¥i¨Ñ³]©w¡M¨º´N¹Á¸Õ§ä Internet ¤Wªº²³¦h IPv6 tunnel ¸g¬öÀ°¦£¡C¬Û«H¥L­Ì³£«D±`¼Ö·N¦b¥L­Ìªº Cisco ¤W­±¬°±z³]©wÃB¥~ªº tunnel ªº¡C¦Ó¥B¤j³¡¥÷³£¥i¥H³z¹L¤Íµ½ªº web ¬É­±¶i¦æ¡C±z¥i¥H¥Î·j¯Á¤ÞÀº§ä§ä "ipv6 tunnel broker" ¬Ý¡C


\section{IPsec¡R internet ¤W¤§¦w¥þ IP (IPsec: secure IP over the internet)}

FIXME¡R½s¿èªÅ¯Ê¡C½Ð°Ñ¦Ò¡R \nameurl{http://www.freeswan.org/}{The FreeS/WAN project}¡C




\section{¦h­«¶Ç¼½¸ô¥Ñ (Multicast routing)}

FIXME¡R½s¿èªÅ¯Ê¡T




\section{¥Î CBQ ¶i¦æÀW¼eºÞ²z (Using Class Based Queueing for bandwidth management)}

²{¶¥¬q¥Ñ§Ú¨Óµo±¸³o¥\¯à¡M{\itshape ©e¹ê\/}¬O§é±þ¤p§Ì¤F¡CLinux 2.2 ¥»¨­´N¦Û±a¦³³\¦hÀW¼eºÞ²z¿ìªk¡M¨ä¹ê¤w°÷±o¤W¨º¨Ç°ª¯Å±MÄÝªºÀW¼eºÞ²z¨t²Î¤F¡C

Linux ©Ò´£¨Ñªº¡M¬Æ¦Ü¤ñ Frame ¤Î ATM ÁÙ­n§ó¦h¡C

¬y¶q±±ºÞªº¨â­Ó°ò¥»³æ¤¸¬O¹LÂo¾¹(filters) ©M¦î¦C(queues)¡C«eªÌ±N¬y¶q¦w±Æ¦Ü«áªÌ¡M«áªÌ«h¦¬¶°¬y¶qµM«á¨M©w­þ¨Ç­n¥ý°e¡N­þ¨Ç­n±ß°e¡N©Î¬O¥á±ó±¼(drop)¡C¦Ó¨âªÌ³£¦U¦³¨ä¤£¦P¨t¦C¡C

³Ì±`¨£ªº¹LÂo¾¹¬O fwmark ©M u32¡M«eªÌÅý±z¥i¥H¨Ï¥Î Linux netfilter µ{¦¡¿ï¾Ü¬y¶q¡Q¦Ó«áªÌ«h¤¹³\±z¨Ì¾Ú¥ô¦ó¼ÐÀY(header)¿ï¾Ü¬y¶q¡C¦Ü©ó³Ì±`Å¥¨ìªº¦î¦Cºtºâªk´N¬O Class Based Queue ¤F¡CCBQ ¥i¥H»¡¬O¤@­Ó super-queue¡M¦b¨ä¸Ì­±¥]§t¤F¨ä¥¦¦î¦C (¬Æ¦Ü¨ä¥¦ CBQs)¡C

©Î³\¡MÃö©ó¦î¦Cºtºâªk(queueing)¦bÀW¼eºÞ²z¤Wªº¹B¥Î¡M¤@®É¶¡©|Ãø¤@¿s¥þ°\¡M¤£¹L¡M¥¦ÁÙ¯uªº¤£­t²³±æ´N¬O¤F¡C

§@¬°§Ú­Ìªº°Ñ¦Ò¸ê®Æ®Ø¬[¡M§Ú§â¥Ø«e³o­Ó³¹¸`®M¥Î¦b¤@­Ó ISP ¼Ò¦¡¤§¤W¡M¤]´N¬O§Ú°½®v¾ÇÃÀ¤§©Ò¡M¼È¥BºÙ¤§¬° Casema Internet in The Netherlands §a¡CCasema¡M¨Æ¹ê¤W¬O¤@®a cable ¤½¥q¡M¥L­Ìªº«È¤á©M¥L­Ì¦Û¤vªº¿ì¤½«Ç³£¦³ internet ªº»Ý¨D¡C¤j¦h¼Æ¤½¥q¹q¸£³£¦³ internet ªº³s½u¡C¹ê»Ú¤W¡M¥L­Ì¦³¤j§âª÷¿ú¥i¥Hªá¦Ó¤£¬O¥Î Linux ¨Ó°µÀW¼eºÞ²zªº¡C

¨ºÅý§Ú­Ì¬Ý¬Ý§Ú­Ìªº ISP ¬O«ç¼Ë¥Î Linux ¨ÓºÞ²z¨äÀW¼e§a¡C




\subsection{¦î¦Cºtºâªk¬O¤°»òªFªF¡S(What is queueing?)}

§Ú­Ì¥Î¦î¦Cºtºâªk¨Ó§P©w¼Æ¾Ú {\itshape ³Q¶Ç°e\/} ªº¶¶§Ç¡C¦³¤@­Ó«Ü­«­nªº·§©À§Ú­Ì­nª¾¹D¡M´N¬O§Ú­Ì¥u¯à³B²z¨º¨Ç§Ú­Ì­n¶Ç°eªº¼Æ¾Ú¡C¨º¥¦¤S¬O¦p¦ó¼vÅT¶Ç°e³t«×¤§§P©w¶¶§Ç©O¡S±z¥i¥H·Q¹³¬°¤@¦ì¦¬´Ú­û¨C¤@¤ÀÄÁ¥i¥H³B²z 3 ­Ó«È¤H¡C

µM«á­n¥I´Úªº«È¤H´N­n¶]¨ì¶¤¦Cªº '§À¤Ú' ¥h±Æ¶¤¡C³o¬O©Ò¿×ªº 'FIFO quequeing' (First IN, First Out --- ¥ý¤J¥ý¥X)¡C¤£¹L¡M°²³]§Ú­ÌÅý¬Y¨Ç«È¤H´¡¤J¶¤¦C¤¤¶¡¡M¦Ó¤£¬O±Æ¦b³Ì«á¡MµM«á³o¨Ç«È¤H´N¥i¥Hªá§ó¤Ö®É¶¡¦b¶¤¦C¤¤¡M¦]¦Ó¤]¥i¥H§ó§ÖªºÁÊª«¡C

¦b inetnet ªºÀô¹Ò¤¤¡M§Ú­Ì¨S¿ìªkª½±µ±±¨î§O¤H­n°e¤°»òªF¦è¹L¨Ó¡C³o¦³ÂI¹³±z®a¤¤ªº(¹êÅé)«H½c¡M±z¨S¿ìªk¼vÅT¥þ¥@¬É¥h­×§ï¥L­Ì­n°e«Hµ¹±zªº¼Æ¶q¡M°£«D±z¦³¯à¤O³qª¾©Ò¦³¤H¡C

µM¦Ó¡Minternet ¿à¥H¬°Ä~ªº TCP/IP¡M«o¦³¬Y¨Ç¥\¯à¥i¥H¨ó§U§Ú­Ìªº¡CTCP/IP ¥»¨­¬O¨S¿ìªkª¾¹D¨â¥x¥D¾÷¤§¶¡ªººô¸ô®e¶qªº¡M©Ò¥H¥¦·|¶V¨Ó¶V§Ö('­è¶}©l«ÜºC')ªº±N¼Æ¾Ú°e¥X¥h¡M¦Ó·í«Ê¥]¶}©l¥á¥¢ªº®É­Ô¡M¦]¬°¨S¦³ªÅ¶¡±N¥L­Ì°e¥X¥h¤F¡MµM«á´N·|¶}©l´îºC¤U¨Ó¡C

³o±¡§Î¡M´N¦³ÂI¹³±zÁÙ¨SÅª§¹¤@¥b«H¥óªº®É­Ô¡M·|§Æ±æ§O¤H¤£­n¦A±H«Hµ¹±z¤@¼Ë¡C¤£¦P¤§³B¡M³o¸Ì¬O¦b internet ¤W­±¦Ó¤w¡C

FIXME¡R¸ÑÄÀ¾Ö¶ëµøµ¡ (congestion windows)

\begin{tscreen}
\begin{verbatim}
[The Internet] ---<E3, T3, whatever>--- [Linux router] --- [Office+ISP]
                                      eth1          eth0
\end{verbatim}
\end{tscreen}


²{¦b¡M§Úªº Linux router ¦³¨â±i¬É­±¡Meth0 ©M eth1¡Ceth1 ¥Î¨Ó³s±µ§Ú­Ìªº router¡M¥¦­t³d±N«Ê¥]°e¦Ü¥úÅÖ½u¸ô¥H¤Î±N«Ê¥]±µ¦¬¶i¨Ó¡C

eth0 «h¥Î¨Ó³s±µ¥t¥~¤@­Ó subnet¡M¤º¦³¤½¥q¨¾¤õÀð¤Î§Ú­Ìªººô¸ô«eºÝ¡M§Ú­Ì³z¹L¥¦¨Ó³s±µ«È¤á¡C

¥Ñ©ó§Ú­Ì¶È¯à­­¨î°e¥Xªº³¡¥÷¡M§Ú­Ì»Ý­n¨â®M¿W¥ß¦ý«D±`ªñ¦üªº³W«h¡C³z¹L­×§ï eth0 ªº¦î¦C¡M§Ú­Ì¥i¥H§P©w¸ê°T­n¦h§Ö°e¦Ü§Ú­Ì«È¤á¨ºÃä¡M¦]¦Ó­n¤À°t¦h¤Ö¤U¶Ç(downstream) ÀW¼eµ¹¥L­Ì¡M©Ò¿×ªº¡¥¤U¸ü³t«×¡¦¬O¤]¡C

¦b eth1 ¤W­±¡M§Ú­Ì§P©w¼Æ¾Ú­n¦h§Ö°eµ¹ Internet¡N¦h§Öµ¹§Ú­Ìªº¨Ï¥ÎªÌ¡M¦Ó¥B¤½¥q¤º³¡©M·~°È¤è­±§¡»Ý­n¤W¶Ç¼Æ¾Ú¡C




\subsection{¥ý·d©wÀW¼e¤Á³Î (First attempt at bandwidth division)}

CBQ ¥i¥HÅý§Ú­Ì²£¥Í¦n¨Ç¤£¦PÃþ§O(classes)¡M¬Æ¦ÜÃþ§O¤¤ªºÃþ§O¡C¦Ü©ó§ó¤jªº¤Á³Î¡M©Î³\¥i¥HºÙ¬° '¥N²z(agencies)'¡C¦Ó¦b³o¨ÇÃþ§O¸Ì­±¡M©ÎªÌ¥i¥H§ä¨ì½Ñ¦p 'bulk' ©Î 'interactive' ¤§Ãþªº¦WºÙ¡C

¨Ò¦p¡M§Ú­Ì©Î¦³¤@±ø 10 megabit ªº 'internet' ³s½u¡M¥H¤À¨Éµ¹§Ú­Ìªº«È¤á¤Î¤½¥q¤§»Ý¡C¦ý§Ú­Ì¤£¯àÅý¿ì¤½«Ç¸Ìªº¤Ö¼Æ¦P¤¯µs¨ú¤j¶qªº¥»¨Ó­n½æµ¹«È¤áªºÀW¼e¡C

¦b¥t¤@Ãä¡M¤ñ¤è»¡§Ú­Ìªº«È¤á¡M¤]¤£¯à¦û¥Î¥»¨Óµ¹§Ú­Ìªºªù¥«³q©¹«È¤á¸ê®Æ®wªºÀW¼e¡C

¦b¹L¥h¡M¥Î¨Ó¸Ñ¨Mªº¿ìªk¡M²ö¹L©ó¨Ï¥Î Frame Relay/ATM ©Î«Ø¥ßµêÀÀ¹q¸ô(Virtual Circuits)¡C³oªº½T¯à¸Ñ¨M°ÝÃD¡M¥u¤£¹L frame ¨Ã¤£®e©ö¤Q¤À²Ó½o½Õ¾ã¡M¦Ó ATM ¦bÄâ±a IP ¬y¶q¤Wªº®Ä¯à¤]«D±`®t±j¤H·N¡M¦Ó¥B¡M¨âªÌ³£¥¼¦³¼Ð·Çªk«h¥H²£¥Í¤£¦PÃþ«¬ªº¬y¶q¶i¤J¤£¦Pªº VCs ¡C

¤£¹L¡M°²¦p±z¯uªº¨Ï¥Î  ATM ªº¸Ü¡MLinux ¦P¼Ë¯à¬[»´´N¼ôªº¬°±zªíºt°ªÃø«×ªº¬y¶q¤ÀÃþ§Þ¥©¡C¦Ó¥t¤@¤èªk¬O²o¨â±ø¿W¥ßªº½u¸ô¡M¦ý¦ü¥G¤£«ç»ò¹ê¥Î¡M¤]¤£¤Q¤À§¹µ½¡M¥B¤]¤£¨£±o¯à§¹¥þ¸Ñ¨M±zªº©Ò¦³°ÝÃD¡C

³o®É­Ô¡M±z´N­n¨D§U©ó CBQ ³o´LµÐÂÄ¤F¡C

Åã¦Ó©ö¨£¡M§Ú­Ì³o¸Ì¥D­n¦³¨â­ÓÃþ§O¡R 'ISP' ©M 'Office' ¡C­è¶}©lªº®É­Ô¡M§Ú­Ì¯uªº¤£¥²¤Q¤ÀÁ¿¨s¥L­ÌÀW¼eªº¤Á³Î¡M©Ò¥H§Ú­Ì´N¤£¦A©ó¨äÃþ§O¤U²Ó¤À¤F¡C

§Ú­Ì¨M©w«È¤áªº¤U¶Ç¬y¶q¥²¶·«OÃÒ¦b 8 megabits ªº½d³ò¡M¦Ó§Ú­Ìªº¿ì¤½«Ç¥u¦³ 2 megabits¡C

¥i¥H¥Î iproute2 ¤§ {\ttfamily tc} ¤u¨ã¨Ó³]©w°_¬y¶q±±ºÞ¡C
\begin{tscreen}
\begin{verbatim}
# tc qdisc add dev eth0 root handle 10: cbq bandwidth 10Mbit avpkt 1000
\end{verbatim}
\end{tscreen}


¦n¤F¡M³o¸Ì¦³¤@°ï¼Æ¦r¡C¨s³º¦p¦ó©O¡S§Ú­Ì¤w¸g³]©w°_ eth0 ªº '¦î¦C§Ù«ß (queueing discipline)' ¤F¡C§Ú­Ì¥H 'root' ¨Ó«Å§i³o¬O³»¼h(root) discipline¡C§Ú­ÌÁÙ±N¨ä handle ³]¬° '10'¡C¦]¬°§Ú­Ì³o¸Ì­n°µ CBQ¡M©Ò¥H§Ú­Ì¤]¦P®É¦b©R¥O¦æ¤¤«ü©ú¡C§Ú­Ì§i¶D®Ö¤ß¡M¥¦¥i¥H¤ä°t 10M bit ¡M¦P®É¥­§¡«Ê¥]Åé¿n¤j¬ù¬° 1000 ­Ó octet¡C

¦n¡M²{¦b§Ú­Ì´N²£¥Í§Ú­Ìªº³»¼hÃþ§O¡M¥¦­â¬[©ó¨ä¥¦ªº©Ò¦³Ãþ§O¤§¤W¡C
\begin{tscreen}
\begin{verbatim}
# tc class add dev eth0 parent 10:0 classid 10:1 cbq bandwidth 10Mbit rate \
  10Mbit allot 1514 weight 1Mbit prio 8 maxburst 20 avpkt 1000
\end{verbatim}
\end{tscreen}


«z¡M³o¸Ìªº¼Æ¦r§ó¦h¡TLinux ªº CBQ ¦b¹ê§@¤W¨ä¹êÆZ¨ã³q¥Î©Êªº¡C§Ú­Ì¥Î 'parent 10:0' ¨Ó«ü©w¦¹Ãþ§O¬O·½¦Û§Ú­Ì­èÅ×²£¥Íªº qdisc handel '10:' ³o­Ó³»¼hÃþ§O¦Ó¨Óªº¡C¦Ó 'classid 10:1' ©O¡M«h¬O§Ú­Ì±Â¤©³o­ÓÃþ§Oªº¦WºÙ¡C

§Ú­Ì³o¸ÌµL¶·§i¶D®Ö¤ß§ó¦h¸ê°T¡M³æ¯Â²£¥Í¤@­ÓÃþ§O¥Hº¡¨¬¥i¥Î³]³Æ´N¬O¤F¡C§Ú­Ì¦P®ÉÁÙ«ü©w¥X MTU(¥~¥[¤@¨Ç overhead) ¬° 1514 ­Ó octet¡C¦Ó¥B¡M§Ú­Ì¶q©w¦¹Ãþ§Oªº '¤ñ­«(weight) ' ¬° 1Mbit¡M¦¹¬°¤@­Ó·L½Õ°Ñ¼Æ¦Ó¤w¡C

²{¦b¡M¦AÅý§Ú­Ì²£¥Í ISP Ãþ§O§a¡R
\begin{tscreen}
\begin{verbatim}
# tc class add dev eth0 parent 10:1 classid 10:100 cbq bandwidth 10Mbit rate \
  8Mbit allot 1514 weight 800Kbit prio 5 maxburst 20 avpkt 1000 \
  bounded
\end{verbatim}
\end{tscreen}


§Ú­Ì¥ý¼·¥X 8Mbit¡M¦P®É¥Î 'bounded' °Ñ¼Æ¨Ó«ü©w¦¹Ãþ§O¤@©w¤£¯à¶W¹L¦¹­­¨î¡C§_«h¦¹Ãþ§O©Î·|±q¨ä¥¦Ãþ§O¨º¸Ì­É¥ÎÀW¼e¡M§Ú­Ì«á­±±N·|°Q½×¨ì¡C

ÁÙ¬OÅý§Ú­Ì²£¥ÍOffice ¤§³»¼hÃþ§O¡M»°§Ö¦¬Ær§a¡R
\begin{tscreen}
\begin{verbatim}
# tc class add dev eth0 parent 10:1 classid 10:200 cbq bandwidth 10Mbit rate \
  2Mbit allot 1514 weight 200Kbit prio 5 maxburst 20 avpkt 1000 \
  bounded
\end{verbatim}
\end{tscreen}


¬°¤FÀ°§U§Ú­Ì§ó¦nªº²z¸Ñ¡M¤U­±ªº¹Ï¥Ü¦C¥X¤F©Ò¦³ªºÃþ§O¡R

\begin{tscreen}
\begin{verbatim}
+-------------[10: 10Mbit]-------------------------+
|+-------------[10:1 root 10Mbit]-----------------+|
||                                                ||
|| +-----[10:100 8Mbit]---------+ [10:200 2Mbit]  ||
|| |                            | |            |  ||
|| |          ISP               | |   Office   |  ||
|| |                            | |            |  ||
|| +----------------------------+ +------------+  ||
||                                                ||
|+------------------------------------------------+|
+--------------------------------------------------+
\end{verbatim}
\end{tscreen}


¦n¤F¡M²{¦b§Ú­Ì¤w¸g§i¶D®Ö¤ß¦³¤°»òÃþ§O¦s¦b¡M¦ýÁÙ¨S»¡­n«ç¼Ë¥hºÞ²z¦î¦C¡C§Ú­Ì¤£¦p°¨¤W°_¦Ó¦æ¡M¤@¦¸·d©w¨â­ÓÃþ§O§a¡C

\begin{tscreen}
\begin{verbatim}
# tc qdisc add dev eth0 parent 10:100 sfq quantum 1514b perturb 15
# tc qdisc add dev eth0 parent 10:200 sfq quantum 1514b perturb 15
\end{verbatim}
\end{tscreen}


¥Ø«eªº½d¨Ò¤¤¡M§Ú­Ì¦w¸Ëªº¬O Stochastic Fairness Queueing discipline (sfq)¡MÁöµM¤£¬O«Ü¶K¤Á¡M¤£¹L¥¦«o¥i¥H¦b¤£¯Ó¶O§ó¦h CPU ¹BÂà¤§¤U¡M«Ü¦nªº³B²z¤j¶qÀW¼e¡C¦Ó§Ú­Ì³q±`¨Ï¥Îªº·|¬O The Token Bucket Filter¡C

¨ì¥Ø«e¬°¤î¡M§Ú­Ì¶È³Ñ¤@¥ó¨Æ±¡­n°µ¦Ó¤w¡M´N¬O¦V®Ö¤ß¸ÑÄÀ¤°»ò¼Ëªº«Ê¥]ÄÝ©ó¤°»ò¼ËªºÃþ§O¡C­è¶}©l¡M§Ú­Ì¯Âºé¥Î iproute2 ¨Ó°µ´N¦n¡M¦ý¬O¡M°t¦X netfilter Âù¼C¦XÂzªº¸Ü¡M§ó¬O¦pªê²KÁl¡C

\begin{tscreen}
\begin{verbatim}
# tc filter add dev eth0 parent 10:0 protocol ip prio 100 u32 match ip dst \
  150.151.23.24 flowid 10:200

# tc filter add dev eth0 parent 10:0 protocol ip prio 25 u32 match ip dst \
  150.151.0.0/16 flowid 10:100
\end{verbatim}
\end{tscreen}


³o¸Ì¡M§Ú­Ì°²³]¿ì¤½«Çºô¸ô¸ú¦b¦ì§}¬° 150.151.23.24 ªº¨¾¤õÀð¤§«á¡M¦Ó§Ú­Ì¨ä¥¦ IP ¦ì§}«hÄÝ©ó ISP ªº¡C

¨Ï¥Î u32 ¤ñ¹ï(match) §ó¬O®e©ö¡M¦Ó¥Î netfilter ¨Ó¼ÐÃÑ«Ê¥]¤]§ó¯à°÷³]©w¥Xºë±Kªº¤ñ¹ï³W«h¡MµM«á§Ú­Ì¥i¥H¦b tc ¸Ì¶i¦æ¤ñ¹ï¡C

¦n¤F¡M²{¦b§Ú­Ì¤w¸g±N¤U¶ÇÀW¼e¤Á³Î§¹²¦¡M¦P¼Ëªº¡M§Ú­Ì¦b¤W¶ÇÀW¼e¤W­±¨Ì¼Ëµe¸¬Äª¡C¬°¨DÂ²±¶¡M³o¦¸Åý§Ú­Ì¤@¹ª§@®ð¡R

\begin{tscreen}
\begin{verbatim}
# tc qdisc add dev eth1 root handle 20: cbq bandwidth 10Mbit avpkt 1000

# tc class add dev eth1 parent 20:0 classid 20:1 cbq bandwidth 10Mbit rate \
  10Mbit allot 1514 weight 1Mbit prio 8 maxburst 20 avpkt 1000

# tc class add dev eth1 parent 20:1 classid 20:100 cbq bandwidth 10Mbit rate \
  8Mbit allot 1514 weight 800Kbit prio 5 maxburst 20 avpkt 1000 \
  bounded

# tc class add dev eth1 parent 20:1 classid 20:200 cbq bandwidth 10Mbit rate \
  2Mbit allot 1514 weight 200Kbit prio 5 maxburst 20 avpkt 1000 \
  bounded

# tc qdisc add dev eth1 parent 20:100 sfq quantum 1514b perturb 15
# tc qdisc add dev eth1 parent 20:200 sfq quantum 1514b perturb 15

# tc filter add dev eth1 parent 20:0 protocol ip prio 100 u32 match ip src \
  150.151.23.24 flowid 20:200

# tc filter add dev eth1 parent 20:0 protocol ip prio 25 u32 match ip src \
  150.151.0.0/16 flowid 20:100
\end{verbatim}
\end{tscreen}





\subsection{¦p¦ó³B²zÀW¼e³z¤ä (What to do with excess bandwidth)}

¦b§Ú­Ì³o­Óµêºc½d¨Ò¤¤¡M§Ú­Ìµo²{¤@­Ó²{¶H¡M´N¬O¦b ISP «È¤á¤j³£Â÷½uªº®É­Ô(¤ñ¤è»¡¡M¦­¤W 8 ÂI)¡M§Ú­Ìªº¿ì¤½«Ç«o¥u¦³ 2Mbit¡MÅãµM¬O·¥¨ä®ö¶Oªº¡C

¦pªG±N 'bounded' ±Ô­z®³±¼¡M¨º»òÃþ§O´N¯à°÷­É¨ú¨ä¥¦Ãþ§OªºÀW¼e¨Ó¥Î¡C

¦Ó¦³¨ÇÃþ§O©Î³\¤£Ä@·N±N¥L­ÌªºÀW¼e¥~­É¡M¨Ò¦p¨â­Ó¯²¥Î¦P¤@½u¸ôªº¼Ä¹ï ISP¡M¬Oµ´¹ï¤£·|¦V¹ï¤è¶i°^ªº¡C¦b¨º¼Ëªºª¬ªp¤U¡M±z¥i¥H¦b 'tc class add' ªº¥y¤l«áºÝ¡M¥[¤W¤@­ÓÃöÁäµü 'isolated' §Y¥i¡C 




\subsection{Ãþ§O¦A¤À (Class subdivisions)}

FIXME¡R¦¹ºc«ä¨Ã¨S¸g¹L´ú¸Õ¡T¤p¤ß¹Á¸Õ¡T

§Ú­Ì³o¸ÌÁÙ¥iºë¯q¨Dºë¡C¦pªG©Ò¦³¿ì¤½«Ç­û¤u¦P®É¶}±Ò¥L­ÌªºªÑ²¼µ{¦¡¡MÁÙ¬O¦³¥i¯à§â¸ê®Æ®wªºÀW¼eµ¹¦Y±¼ªº¡C©Ò¥H¡M§Ú­Ì¥i¥H¦A«Ø¨â­Ó¤lÃþ§O¡R'Human' ©M 'Database'¡C

§Ú­Ìªº¸ê®Æ®w¥Ã»·»Ý­n 500Kbit¡M©Ò¥H´N³Ñ¤U 1.5M µ¹§Ú­Ìªº­û¤u¨Óªá¶O¡C

§Ú­Ì­n¦b Office ³o­ÓÃþ§O¸Ì­±¦A«Ø¨â­ÓÃþ§O¡R
\begin{tscreen}
\begin{verbatim}
# tc class add dev eth0 parent 10:200 classid 10:250 cbq bandwidth 10Mbit rate \
  500Kbit allot 1514 weight 50Kbit prio 5 maxburst 20 avpkt 1000 \
  bounded

# tc class add dev eth0 parent 10:200 classid 10:251 cbq bandwidth 10Mbit rate \
  1500Kbit allot 1514 weight 150Kbit prio 5 maxburst 20 avpkt 1000 \
  bounded
\end{verbatim}
\end{tscreen}


FIXME¡R©|»Ý½d¨Ò¡T




\subsection{¦h¬É­±ªº­t¸ü¤À¬y (Loadsharing over multiple interfaces)}

¦³¦n¨Ç¤èªk³£¥i¥H°µ¨ì³oÂI¡C¨ä¤¤³ÌÂ²³æ©ú¤F´N¬O 'TEQL' --- "True" (or "trivial") link equalizer¡C©M¤j¦h¼Æ¥Î¨Ó°µ¦î¦Cªº¿ìªk¤@¼Ë¡M­t¸ü¤À¬y¤]¬OÂù¦Vªº¡C½u¸ôªº¨âºÝ³£»Ý­n°Ñ»P¡M¤~¯àÀò±o§¹¾ãªº®ÄªG¡C

µo´§¤@¤U·Q¹³¤O§a¡R

\begin{tscreen}
\begin{verbatim}
                 +-------+   eth1   +-------+
                 |       |==========|       |
 'network 1' ----|   A   |          |   B   |---- 'network 2'
                 |       |==========|       |
                 +-------+   eth2   +-------+
\end{verbatim}
\end{tscreen}


A ©M B ³£¬O¸ô¥Ñ¾¹¡M¦Ó¥B¡M§Ú­Ì¥Ø«e°²³]¥¦­Ì³£¬O¶] Linux ªº¡C¦pªG¬y¶q±q network 1 °e¨ì network 2 ¨ºÃä¡M¨º»ò router A ´N»Ý­n±N«Ê¥]¤À°e¦Ü B ªº¨â±ø½u¸ô¥h¡C¦Ó router B «h»Ý­n³]©w¬°¯à°÷±µ¨ü³o¼Ëªº¦w±Æ¡C½Õ¹L¨Ó¤]¤@¼Ë¡M·í«Ê¥]±q network 2 ¬y¦V network 1¡Mrouter B ¤]»Ý­n±N«Ê¥]¤À°e¦Ü eth1 ©M eth2 ¥h¡C

­t³d¤À°eªº³¡¥÷¡M´N¬O¥Ñ 'TEQL' ³]³Æ¨Ó°µªº¡M°Ñ¦Ò¦p¤U¼C³Z(©ö¦p«dÄú)¡R

\begin{tscreen}
\begin{verbatim}
# tc qdisc add dev eth1 root teql0
# tc qdisc add dev eth2 root teql0
\end{verbatim}
\end{tscreen}


³o»Ý­n¦b¨âÃäªº¾÷¾¹¤W°µ°Õ¡C¨º­Ó teql0 ªº³]³Æ¡M°ò¥»¤W¥H roundrobin ªº¤è¦¡¦V eth1 ©M eth2 ¶i¦æ¤À°e¡M¨Óµo°e«Ê¥]¡C¼Æ¾Ú¨Ã¤£¬O±q teql ³]³Æ¶i¤Jªº¡M¶È¶È¥H 'raw' ®æ¦¡¥X²{¦b eth1 ©M eth2 ¤W­±¡C

µM¦Ó¡M§Ú­Ì²{¦b¥u¬O§â³]³Æ§Ë°_¨Ó¦Ó¤w¡M§Ú­ÌÁÙ»Ý­n¾A·íªº¸ô¥Ñ¡C¤èªk¤§¤@¬O¥Î¤@­Ó /31 ªººô¸ôµ¹³o¨â±ø½u¸ô¡M¥t¥~¤@­Ó /31 ºô¸ôµ¹ teql0 ³]³Æ¡R

FIXME: ¤£ª¾¹D¬O§_»Ý­n¬Y¨Ç½Ñ¦p 'nobroadcast' ªº³]©w©O¡S¥Î¤@­Ó /31 ¦P®É¥]§tºô¸ô¦ì§}©M¼s¼½¦ì§}¦ü¥G¤Ó¤p¤F --- ¦pªG³o­Ó³]­p¤£¥i¦æ¡M¨º´N¸Õ¥Î /30 §a¡MµM«á¬ÛÀ³ªº½Õ¾ã IP ¦ì§}´N¬O¤F¡C±z©Î³\¬Æ¦Ü³s eth1 ©M eth2 ªº IP ¦ì§}¤]¤£·Qµ¹©O¡T

On router A:
\begin{tscreen}
\begin{verbatim}
# ip addr add dev eth1 10.0.0.0/31
# ip addr add dev eth2 10.0.0.2/31
# ip addr add dev teql0 10.0.0.4/31
\end{verbatim}
\end{tscreen}


On router B:
\begin{tscreen}
\begin{verbatim}
# ip addr add dev eth1 10.0.0.1/31
# ip addr add dev eth2 10.0.0.3/31
# ip addr add dev teql0 10.0.0.5/31
\end{verbatim}
\end{tscreen}


²{¦b¡Mrouter A À³¸Ó¥i¥H¦b³o 2 ±ø¯u¹ê½u¸ô©M 1 ­Ó§¡¿Å³]³Æ¤W ping 10.0.0.1¡N10.0.0.3¡N©M 10.0.0.5 ¤F¡C¦Ó router B ¤]À³¸Ó¥i¥H³z¹L½u¸ô ping 10.0.0.0¡N10.0.0.2¡N©M 10.0.0.4 ¡C

¦pªG¤W­±ªº³£¦¨¥\¤F¡Mrouter A ­n±N 10.0.0.5 ³]©w¬°³s±µ network 2 ªº¸ô¥Ñ¡M¦P®É router B «h­n±N 10.0.0.4 ³]¬°³s±µ network 1 ªº¸ô¥Ñ¡C¦b¤@¨Ç¯S®íÀô¹Ò¤¤¡M¨Ò¦p network 1 ¬O±z®a¤¤ªººô¸ô¡M¦Ó network 2 ¬O internet¡M¨º»ò router A ´N­n±N 10.0.0.5 ³]©w¬°¹w³]ºôÃö¤F¡C




\subsubsection{¤@¨Çª`·N¦a¤è (Caveats)}

¥ô¦ó¨Æ±¡³£¬Oª¾©ö¦æÃø¡C¦b router A ©M router B Âù¤è¡M¥¦­Ìªº eth1 ©M eth2 ³£¥²¶·±Nªð¦^¸ô®|ªº¹LÂoÃö³¬¡M§_«h¥¦­Ì·|±N¨º¨Ç¤£¬O¥H¥¦­Ì¥»¨­¬°¥Ø¼Ð IP ¦ì§}ªº«Ê¥]¥á±ó±¼¡R

\begin{tscreen}
\begin{verbatim}
# echo 0 > /proc/net/ipv4/conf/eth1/rp_filter
# echo 0 > /proc/net/ipv4/conf/eth2/rp_filter
\end{verbatim}
\end{tscreen}


µM«á¡M´N¬O°Q¹½ªº«Ê¥]­«±Æ§Çªº°ÝÃD¤F¡C¤ñ¤è»¡¡M¦³ 6 ­Ó«Ê¥]»Ý­n±q A °e¨ì B ¥h --- eth1 ©Î·|±o¨ì 1¡N3¡N©M 5 ¡Q¦Ó eth2 ©Î·|±o¨ì 2¡N4¡N©M 6 ¡C°²¦p¤@¤Á²z·Q¡Mrouter B ·|¦¬¨ì³o¼Ëªº¶¶§Ç¡R1¡N2¡N3¡N4¡N5¡N6¡C¤£¹L¡M²{¹ê¤¤¦³«Ü¤j¾÷·|±N·|¬O¡M®Ö¤ß«ö³o¼Ëªº¶¶§Ç±µ¦¬¡R2¡N1¡N4¡N3¡N6¡N5¡C°ÝÃD¬O³o¼Ë·|Åý TCP/IP ·P¨ì§xÂZ¡C³z¹L½u¸ôÄâ±a¦h­Ó¤£¦Pªº TCP/IP ³s½u¨Ã¤£¦Ü©ó¦³¤°»ò°ÝÃD¡MµM¦Ó±z«o¤£¯à¦X¨Ö¦h±ø½u¸ôÅý¤U¸ü³æ¤@ÀÉ®×ªº FTP ÅÜ±o¤j´T¥[§Ö¡M°£«D±z¥Î¨Ó¶Ç°e©M±µ¦¬ªº§@·~¨t²Î³£¬O Linux¡M¦]¬°¦b¬Y¨ÇÂ²³æªº­«±Æ§Ç¤¤¡M³s½uªº¥æ´¤¨Ã¤£®e©ö³B²z¡C

¤£¹L¡M¹ï³\¦hÀ³¥Îµ{¦¡¦Ó¨¥¡M½u¸ôªº­t¸ü¤À¬yªº½T¬O¤@­Ó«D±`¼F®`ªºªZ¾¹¡C




\section{§ó¦hªº qdisc (More queueing disciplines)}

¨ä¹ê Linux ®Ö¤ß¤w¸g´£¨Ñ§Ú­Ì³\¦h queueing disciplines ¤F¡C¨ì¥Ø«e¬°¤î¡M³Ì¬°¼sªxÀ³¥Îªº¬O pfifo\_fast ¦î¦Cºtºâªk¡M¤]¬O¹w³]¨Ï¥Îªº¡C³o¤]¸ÑÄÀ¤F¬°¦ó³o¨Ç¶i¶¥¥\¯à¦p¦¹±j®«¡C¥L­Ì°£¤F¥u¬O '¥t¥~ªº¦î¦C' ¥H¥~¡M§OµL¥¦ª«¡C

¨C¤@ºØ¦î¦Cºtºâªk³£¦U¦³¤d¬î¡C¤£¹L¨Ã«D¥þ³¡³£¸gÄY±K´ú¸Õ¹Lªº´N¬O¤F¡C


\subsection{pfifo\_fast}

±æ¤å¥Í·N¡M¦¹¦î¦Cºtºâªk´N¬O¥ý¤J¥ý¥X(First In First Out)¡M±µ¦¬¨ìªº«Ê¥]¡M§¡¤@µø¦P¤¯¡C³oºØ¦î¦Cºtºâªk¦³ 3 ­Ó©Ò¿×ªº 'bands'¡C¦b¨C¤@­Ó band ¤¤¡M§¡©^¦æ FIFO ªº³W«h¡CµM¦Ó¡Mz¥u¦³¦b band0 ¤¤ªº«Ê¥]³B²z§¹¤§«á¡M¤~½ü¨ì band1 ¸Ì­±ªº¡C¦b band1 ©M band2 ¤§¶¡¡M¤]¬O¦P¼Ëªº±¡§Î¡C




\subsection{Stochastic Fairness Queueing}

¤@¦p«e­z¡MSFQ ¤]¤£¬O©ñ¤§¥|®ü¬Ò·Çªº¡M¦ý(¥­§¡¨Ó»¡)ÁÙ¬O¥i¥Îªº´N¬O¤F¡C¥¦¥D­nªº¦n³B¬O¥¦©Ò¦û¥Îªº CPU ©M°O¾ÐÅé³£«Ü¤Ö¡M¦Ó¡¥¯u¥¿¡¦ªº¥­µ¥(fair) ¦î¦Cªk»Ý­n®Ö¤ß°lÂÜ©Ò¦³¹B§@¤¤ªº³s½u¡C

¦b¥­µ¥¦î¦Cºtºâªk®a±Ú¤¤¡MStochastic Fairness Queueing (SFQ) ºâ¬O¸û¬°Â²©úªº¹ê§@¡CÁöµM¥¦¤£¦p¨ä¥¦ºtºâªk¨º»òºë½T¡M¤£¹L¦b«O«ù¬Û·í¥­µ¥ªº«e´£¤U¡M¥¦©Ò»Ý­nªº¹Bºâ¤]¸û¤Ö¡C

¦b SFQ ¤¤ªºÃöÁäµü¬O·|½Í(conversation)(©Î¤ê¬yµ{(flow))¡M¦b¤@³s¦êªº¼Æ¾Ú«Ê¥]¤¤§ä¨ì¨¬°÷ªº¤½¬ù¼Æ¡M¥H°Ï¤À¥X¤£¦Pªº conversation¡CIP «Ê¥]¸Ì­±³£±a¦³¨Ó·½©M¥Øªº¦ì§}¡M¥H¤Î¨ó©w¸¹½X¡M¦¹±¡§Î¤U¡M³o¨Ç°Ñ¼Æ´N¬£±o¤W¥Î³õ¤F¡C

SFQ ¥Ñ°ÊºA¤À°tªº FIFO queues ²Õ¦¨¡M¤@­Ó queue ­t³d¤@­Ó conversation¡C¦Ó discipline «h¥H round-robin ªº§Î¦¡°õ¦æ¡M¨C¦¸±q¤@­Ó FIFO ¤¤°e¥X¤@­Ó«Ê¥]¡M³o´N¬O¬°¦óºÙ¤§¬°¥­µ¥(fair)ªº­ì¦]¤F¡CSFQ ªº¥D­n¦n³B¦b©ó¥¦Åý¤£¦Pªºµ{¦¡¥­µ¥ªº¤À¨É³s½u¡M¦ÓÁ×§KÀW¼e³Q³æ¤@ªº«È¤áµ{¦¡©Ò¦û¾Ú¡CµM¦Ó¡MSFQ «o¤£¯à±q bulk flows ¤¤§P©w¥X¤¬°Ê(interactive)ªº³¡¥÷ --- ³o»Ý­n¥ý©ó«e­±ªº CBQ ¶i¦æ¿z¿ï¡MµM«á¤~±N bulk ¬y¶q¾É¤J SFQ ¤¤¡C




\subsection{Token Bucket Filter}

Token Bucket Filter(TBF)¬O¤@ºØÂ²³æªººô¸ô¦î¦Cºtºâªk¡C·íºô¸ô«Ê¥]¸g¹L³o­Ó¦î¦C®É¡M´N·|¨ü¨ì¤@­Ó¹w¥ý³]©wªº³t²v­­¨î(«Ê¥]¼Æ/®É¶¡)¡M§Q¥Î³o­Ó¡M¥i¥H¨Ó´î½wºô¸ôÀþ¼W¬y¶q(buffer short bursts)©Ò³y¦¨ªººô¸ô®Ä¯à­°§C¡C

¦Ü©ó TBF ªº¹ê§@¡M«h¥Ñ¤@­Ó½w½Ä°Ï(bucket) ºc¦¨¡M¤£Â_ªº³Q¤@¨ÇµêÀÀ¸ê°T¡MºÙ¬° tokens ¡M«ö¯S©wªº³t²v(token rate) ¶ñ¥R¡C¦Ó½w½Ä°Ïªº­«­n°Ñ¼Æ¬O¨äÅé¿n¡M¤]´N¬O¥¦©Ò¯à¦sÀxªº token ¼Æ¥Ø¡C

¨C¤@­Ó©è¹Fªº token ©è®ø¤@­ÓÂ÷¶}¦î¦Cªº¶Ç¤J¼Æ¾Ú«Ê¥]¡MµM«á±q½w½Ä°Ï¤¤²M±¼¡C¥t¥~¡M¦³¨â­Ó¬yµ{(flow) »P¦¹ºtºâªk®§®§¬ÛÃöªº¡R token ©M data¡M³o¤@¦@·|±a¥X¤TºØª¬ªp¡R

\begin{itemize}
\item ¼Æ¾Ú«ö {\itshape µ¥©ó(equal)\/} ¶Ç¤J token ³t²v©è¹F TBF¡C¦¹±¡§Î¤§¤U¡M¨C¤@­Ó¶Ç¤J«Ê¥]³£¦U¦ÛÀò±o¨ä¤Ç°tªº token¡M¦P®ÉµL©µ¿ðªº³q¹L¡C
\item ¼Æ¾Ú«ö {\itshape ¤p©ó(smaller)\/}  token ³t²v©è¹F TBF¡C¨C¤@­Ó¼Æ¾Ú«Ê¥]³£¦Û¦î¦C°e¥X¡M¦ý¥u¦³¤@³¡¤À token ¦b¶Ç¥X®É³Q§R°£¡M¦]¦Ó token «h·|¤£Â_ªº¿n²Ö¡Mª½¨ì¶ñº¡½w½Ä°ÏªºÅé¿n¬°¤î¡C¦Ó¨º¨Ç³Q¦sÀx°_¨Óªº token ¡M«h¦bÀþ¼W¬y¶q(short data burst)¥X²{ªº®É­Ô¡M¥H°ª©ó token ªº³t²v¶Ç°e¼Æ¾Ú¡C
\item ¼Æ¾Ú«ö {\itshape ¤j©ó(bigger)\/}  token ³t²v©è¹F TBF¡C¦¹±¡§Î¤U«h·|¤Þ­P¹LÂo¾¹¥X²{¶W­t²ü(filter overrun) --- ¶Ç¤J¼Æ¾Ú¥u¯à¦b¤£¥á¥¢«e´£¤U°e¥X¡Mª½¨ì©Ò¦³¿n²Öªº token ¥þ¼Æ¯ÓºÉ¬°¤î¡CµM¤§«á¡M¶W¹L­­¨îªº«Ê¥]´N·|³Q¥á±ó¡C
\end{itemize}




³Ì«á¤@ºØ±¡§Î¤d¸U¤£¯à±¼¥H»´¤ß¡M¦]¬°³o·|±j¦æ±NÀW¼e¼·µ¹¼Æ¾Ú¡M¦Ó³q¹L¹LÂo¾¹¡C¦Ü©ó token ªº¿n»E¡M«h¤¹³\¶W¥X­­¨î¤§Àþ¼W¬y¶q¤´¥i¤£³Q¿ò¥¢¦a³q¹L¡M¦ý¨ä«áªº«ùÄò¹L¸ü¡M§¡·|¾É­P«Ê¥]³Q«ùÄòªº¥á±ó¡C

(Ä¶ªÌµù¡R³o­Ó TBF ¨ä¹ê¤£Ãø²z¸Ñ¡M´N¬O no token no data ­ì«h¡C¥u¦³·í data Àò±o¬ÛÀ³ªº token ¤~¯à³q¹L¡M¦Ó token ªº¸ü¤J³t²v«h¬O©T©wªº¡C)

Linux ®Ö¤ß¬Ý°_¨Ó¦ü¥G¶W¹L¦¹¤@³W®æ¡M¦Ó¥BÁÙ¤¹³\§Ú­Ì­­¨îÀþ¼W¬y¶qªº³t«×¡CµM¦Ó¡MAlexey Äµ§i§Ú­Ì»¡¡R

\begin{tscreen}
ª`·N¡RTBF ªº³Ì°ª®p­È(peak rate) ¬Û·í°ª¡R·í MTU ¬° 1500 ªº®É­Ô¡MP\_crit = 150Kbytes/sec¡C
©Ò¥H¡M¦pªG±z»Ý­n§ó¤jªº®p­È¡M¨Ï¥Î HZ=1000 ªº alpha ¾÷¾¹Åo :-)
\end{tscreen}


FIXME¡R¤£²M·¡¬O§_¤´¦³ TSC (pentium+) ¡S¶â¡M¬Ý¨Ó¦³¨º»òÂI¨à

FIXME¡R­Y¤£µM¡M­n¬°´£°ªªº HZ ¥tÅP³¹¸` 




\subsection{Random Early Detect}

RED ¥iºâ¬O¨­Ãhµ´§Þ¡C·í¤@­Ó TCP/IP ³s½u«Ø¥ß°_¨Óªº®É­Ô¡M³s½u¨âºÝ³£¤£²M·¡¨ì©³ÀW¼e·|¦³¦h¤j¡C©Ò¥H TCP/IP ·|¥ý¥Ñ§C³t¶}©lµM«á³vº¥¥[§Ö¸}¨B¡M³Ì«á¨ü¨î©ó ACKs ¦^À³ªº©µ¿ð¡C

·í¤@±ø½u¸ôº¡¸üªº®É­Ô¡MRED ´N·|¶}©l¥á±ó«Ê¥]¡M§iª¾ TCP/IP ³o±ø½u¸ô¤w¹F¾Ö¶ëª¬ºA¡M»Ý­n´î§C³t«×¤F¡CÁo©ú¤§³B¦b©ó RED ·|¼ÒÀÀ¯u¥¿ªº¾Ö¶ë¡M¦P®É¦b½u¸ô§¹¥þº¡¸ü¤§«e¶}©l¥á±ó«Ê¥]¡C¤@¥¹½u¸ô§¹¥þ¹¡©M¡M¥¦´N¾á·í°_¥æ³qÄµ¹îªº¨¤¦â¡C

¦p»Ý§ó¸Ô²Óªº¸ê®Æ¡M½Ð°Ñ¦Ò Backbone ¨º³¹¡C




\subsection{Ingress policer qdisc}

 
¦pªG±z¤£·Q­É§U©ó router ©Î¨ä¥¦ Linux ¾÷¾¹¡M¦Ó·Q­n­­¨î¯S©wªº¥D¾÷¡M¨º»ò Ingress qdisc ·|¬O±zªºÀH¨­·t¾¹¡C·íÀW¼e¶W¹L±z©Ò³]©wªº¤ñ²vªº®É­Ô¡M±z¥i¥HºÞ¨î¤J¦VÀW¼e¤Î¥á±ó«Ê¥]¡C¤ñ¤è»¡¡M¥i¥H«OÅ@±zªº¥D¾÷©è¿m SYN flood ªº§ðÀ»¡M¦Ó¥B¤]¥i¥H¥Î¨Ó­°§C TCP/IP ³t«×¡M¤]´N¬O¥H¥á±ó«Ê¥]ªº¤èªk¨Ó´î³t¡C

FIXME¡R°£¤F¥á±ó¤§¥~¡M§Ú­Ì¬O§_¥i¥H±N¤§¤À°tµ¹¤@­Ó¯u¹êªº queue ©O¡S

FIXME¡R¥H¥á±ó«Ê¥]¨Ó¶i¦æºÞ¨î¦ü¥G¨Ã«D¤W¤W¤§Á|¡M­Ë¤£¦p¥Î token ½w½Ä°Ï¹LÂo¾¹¡C¤£´±²õÂ_°Õ¡MCisco CAR ¤]³£¥Î³o­Ó¡M¦Ó¥B¤H­Ì¦ü¥G¤]¨ü¤§­YµM¡C

½Ð°Ñ¦Ò¥»¤å³Ì«á­±ªº \ref{CAR} {(IOS Committed Access Rate)} ¡C



Â²¦Ó¨¥¤§¡R±z¥i¥H¥Î¤§¨Ó­­¨î±z¹q¸£¤U¸üÀÉ®×¦³¦h§Ö¡M¦ÓÄË¥X§ó¦hÀW¼eµ¹¨ä¥¦¥Î³~¡C

½Ð°Ñ¦Ò \ref{SYN} {(À°¶Q¥D¾÷©è¿m SYN floods)} ¨º³¹¡M¨º¸Ì¦³¤@­Ó¨Ò¤l§i¶D±z¥¦¬O¦p¦ó°µ¨ìªº¡C




\subsection{DSMARK}

¥»³¹¥Ñ Esteve Camps $<$esteve@hades.udg.es$>$ ¼¶¼g¡C


\subsubsection{Â²¤¶ (Introduction)}

­º¥ý¡M¦A­º¥ý¡M±z³Ì¦n¥ý¨ì\nameurl{http://www.ietf.org/html.carters/diffserv-charter.html}{IETF DiffServ working Group web site} ©M \nameurl{http://ica1www.epfl.ch/~almesber}{Werner Almesberger web site}(¦b Linux ¤ä´© Differentiated Services ªºµ{¦¡¥¿¬O¥Ñ¥L¼gªº) ¡MÅª¤@Åª RFC ¤å¥ó(RFC2474¡NRFC2475¡NRFC2597¡N¥H¤Î RFC2598)¡C




\subsubsection{Dsmark ¬O½¼¦Ì«z­ô¡S (What is Dsmark related to?)}

Dsmark ¬O¤@ºØ¦î¦Cºtºâ§Ù«ß(discipline)¡M¥D­n¥Î©ó Differentiated Services (¤]ºÙ¬° DiffServ ©ÎÂ²ºÙ DS)¡CDiffServ ¬O¨âºØ actual QoS ¬[ºc¤§¤@ (¥t¥~¤@­Ó¥s°µ Intergrated Services)¡M¥D­n¨Ì¾a IP «Ê¥]¼ÐÀY¤¤ªº DS Äæ¦ì©ÒÄâ±aªº¼Æ­È¶i¦æ§PÂ_¡C



³Ì¦­¦b IP ³]­p¤W©Ò´£¨Ñªº QoS ¼h¯Å¸Ñ¨M¤è®×¡M¨ä¤¤¤§¤@´N¬O IP ¼ÐÀY¤¤ªº Type of Service Äæ¦ì(TOS byte)¡C§ïÅÜ³o¨Ç¼Æ­È¡M§Ú­Ì¥i¥H¿ï¾Ü¤@­Ó °ª/§C µ¥¯Åªº§]¦R¶q¡N©µ¿ð¡N©Î¬O¥i¾a«×¡C¦ý¬O³o¨Ã¤£¯à´£¨Ñ¨¬°÷ªºÆF¬¡©Ê¡M¥Hº¡¨¬¸û·sªA°È(¦p real-time À³¥Îµ{¦¡¡N¤¬°Êµ{¦¡¡N©M¨ä¥¦)ªº»Ý¨D¡C¦³Å³©ó¦¹¡M·sªº¬[ºc¥X²{¤F¡C¨ä¤@´N¬O DiffSserv¡M¥¦·|«O¯d TOS bits ¡M¦P®É­«·s©R¦W DS Äæ¦ì¡C


\subsubsection{DiffServ «ü«n (Differentiated Services guidelines)}

DiffServ ¬O¥H¸s²Õ¬°¾É¦Vªº(group-oriented)¡C§Ú¬O»¡¡M§Ú­ÌµL¶·ª¾¹D¬y¦V(flows)¬O¦p¦ó¹B§@ªº(³o¬O Intergrated Services ªº¨Æ±¡)¡Q§Ú­Ì¥uª¾¹D¬y¦V»E¶°(flow aggregations)¡M¥H¤Î®Ú¾Ú«Ê¥]©ÒÄÝªº»E¶°¦p¦óÀ³¥Î¤£¦Pªº¦æ¬°¯S©Ê¡C



·í«Ê¥]©è¹F¤@­ÓÃä½t¸`ÂI(§Y DiffServ domain ªº¤J¤f¸`ÂI)¡M¨Ã¶i¤J DiffSer Domain ªº®É­Ô¡M§Ú­Ì´N»Ý­n«Ø¥ß¤@¨Ç­ì«h(policy)¡M¤Þ¾É ©M/©Î ¼ÐÃÑ³o¨Ç«Ê¥](©Ò¿×¼ÐÃÑ¡M´N¬O³]©w DS Äæ¦ìªº¼Æ­È)¡CµM«á DiffSer Domain ªº¤º³¡/®Ö¤ß¸`ÂI´NÀË¬d³o¨Ç¼ÐÃÑ/¼Æ­È ¡M¥H§P©wÀ³¥Î¤°»ò¼Ëªº¦æ¬°¯S©Ê©Î QoS µ¥¯Å¡C



¥¿¦p±z©Ò±ÀÂ_ªº¡MDiffServ ·N¨ýµÛ¤@­ÓÀ³¥Î¨ì©Ò¦³ DS ³W«hªº domain¡C¨Æ¹ê¤W¡M±z¥i¥H³o¼Ë·Q¹³{\tt\char`\"}§Ú­Ì·|¹ï©Ò¦³¶i¤J domain ªº«Ê¥]¶i¦æ¤ÀÃþ¡C¤@¥¹¥¦­Ì¶i¤J domain¡M¥¦­Ì´N¶eÄÝ©ó¤ÀÃþ©Ò«ü©wªº³W«h¡M¨Ã¥B¨C¤@­Ó¬ï¶V¸`ÂI³£·|À³¥Î³o­Ó QoS µ¥¯Å{\tt\char`\"}¡C

¹ê»Ú¦Ó¨¥¡M±z¥i¥H¦b¥»¦a domains ¸Ì­±À³¥Î±z¦Û©wªº­ì«h¡M¦ý¬O¡M·í±z³s±µ¨ì¨ä¥¦ DS domains ªº®É­Ô¡M´N»Ý­nÅU¤Î¨ì¬Y¨Ç {\itshape ªA°Èµ¥¯Å¨óÄ³(Service Level Agreements)\/} ¡C



¦Ü¦¹¡M±z©Î³\º¡¸¡ºÃ¹Î§a¡CDiffServ »·¤ñ§Ú©Ò¸ÑÄÀªº­n½ÆÂø±o¦h¡C¨Æ¹ê¤W¡M±z¤£Ãø·Q¹³¡M§Ú¥i¨S¨º¯à­@±N 3 ­Ó¥H¤Wªº RFC À£ÁY¦bµuµu 50 ¦æ¸Ì­±®@ :-)




\subsubsection{¹B¥Î Dsmark (Working with Dsmark)}

®Ú¾Ú DiffServ ¾Ç¬ì©Ò«ü©w¡M§Ú­Ì­n°Ï§O¥XÃä¬É(boundary)¸`ÂI©M¤º³¡(interior)¸`ÂI¡C¦b¬y¶q¸ô®|¤W¦³¨â­ÓÃöÁäÂI¡M¨âªÌ¦b«Ê¥]¨ì¹Fªº®É­Ô§¡·|¶i¦æ¤ÀÃþ¡C¦b«Ê¥]¯u¥¿°e¥Xºô¸ô¤§«e¡M¨äµ²ªG·|¦b DS ³B²z¹Lµ{¤¤ªº¤£¦P¦a¤è¨Ï¥Î¨ì¡C³o¬O¦]¬° DiffServ µ{¦¡´£¨Ñ¤F¤@­ÓºÙ¬° sk\_buff ªº¾÷¨î¡M¥]¬A¤@­Ó·sªºÄæ¦ì¡MºÙ¬° skb-$>$tc\_index¡M¥Î¨ÓÀx¦sªì©l¤ÀÃþªºµ²ªG¡M¥Î©ó DS ³B²z¤¤ªº¤£¦P¥Øªº¡C



¸Ó skb-$>$tc\_index ¼Æ­È·|³Q DSMARK qdisc ¥Î¨Ó°µªì©l³]©w¡M±q¨C¤@­Ó±µ¦¬«Ê¥]ªº IP ¼ÐÀY¤§ DS Äæ¦ì´N¥i¥HÀò±o¡C¥t¥~¡Mcls\_tcindex ¤ÀÃþ¾¹·|Åª¨ú¥þ³¡©Î³¡¥÷ªº skb-$>$tcindex ¼Æ­È¡M¥Î¨Ó¿ï¾Üµ¥¯Å(classes)¡C



µM¦Ó¡M­º¥ý¡M½Ð°Ñ¾\¤@¤U DSMARK qdisc ©R¥O¥H¤Î¥¦ªº°Ñ¼Æ¡R
\begin{tscreen}
\begin{verbatim}
... dsmark indices INDICES [ default_index DEFAULT_INDEX ] [ set_tc_index ]
\end{verbatim}
\end{tscreen}

³o¨Ç°Ñ¼Æ¨s³º¥Nªí¤°»ò©O¡S
\begin{itemize}
\item {\bfseries indices}: ªí®æÅé¿n (mask, value)¡M¤@¹ï¨Ï¥Î¡C³Ì¤j­È¬° 2\^{}n¡M¥B n$>$=0¡C
\item {\bfseries Default\_index}: ¦pªG¤ÀÃþ¾¹§ä¤£¨ì²Å¦Xªº¤ñ¹ï¡M«h¨Ï¥Î¹w³]ªí®æ¶µ¥Ø¯Á¤Þ¡C
\item {\bfseries Set\_tc\_index}: «ü¥Ü dsmark discipline Åª¨ú DS Äæ¦ì¨Ã±N¤§¦s©ñ©ó skb-$>$tc\_index ¤W­±¡C
\end{itemize}


µM«áÅý§Ú­Ì¬Ý¬Ý DSMARK ªº¹B§@¡C




\subsubsection{SCH\_DSMARK ¬O¦p¦ó¤u§@ªº (How SCH\_DSMARK works.)}

¦¹ qdisc ªº¨BÆJ¦p¤U¡R¡R
\begin{itemize}
\item ¦pªG§Ú­Ì¤w¦b qdisc ©R¥O¤¤«Å§i set\_tc\_index ¿ï¶µ¡MDS Äæ¦ì´N·|³QÅª¨ú¨Ã¦s©ñ©ó skb-$>$tc\_index ÅÜ¼Æ¤¤¡C
\item ©I¥s¤ÀÃþ¾¹¡C¤ÀÃþ¾¹·|³Q°õ¦æ¡M¨Ãªð¦^¤@­Ó class ID¡M¦s©ñ©ó skb-$>$tc\_index ÅÜ¼Æ¤¤¡C°²¦p¨S¦³µo²{¤Ç°tªº¹LÂo¾¹¡M¨º»ò±N¥H default\_index  ¿ï¶µ§@¬° classID ¡M§@¬°¦s©ñ¡C°²¦p set\_tc\_index ©Î default\_index ³£¨S¦³³Q«Å§i¡M¨º«áªG´N¹ê¦bÃø®Æ¤F¡C
\item ·í°e¦Ü¤º³¡ qdisc (±z¥i¥H©ó¦¹­«½Æ¨Ï¥Î¹LÂoµ²ªG)¤§«á¡M±q¤º³¡ qdisc ©Òªð¦^ªº classid ±N³Q¦s©ñ©ó skb-$>$tc\_index ¤§¤º¡C¥H«á§Ú­ÌÁÙ¥i¥H¥Î³o­Ó¼Æ­È¨ÓÀË¯Á mask-value ªí®æ¡C¸Ó«Ê¥]Àò±oªº³Ì²×¤À°tµ²ªG¡M«h¨ú¨M©ó¤U¤@­Ó¹Bºâªºµ²ªG¡R
\begin{tscreen}
\begin{verbatim}
New_Ds_field = ( Old_DS_field & mask ) | value
\end{verbatim}
\end{tscreen}

\item ³o¼Ë¡M·sªº¼Æ­È¥Ñ«á­±³o¨Ç¤¸¯À²£¥Í¡R "anding" ³o­Ó DS Äæ¦ì¡Nmask values¡NÁÙ¦³³o­Ó "ORed" µ²ªG¡N¥H¤Î¼Æ­È°Ñ¼Æ¡C½Ð°Ñ¦Ò¤U­±³o­Ó¹Ï¨Ò¡M¥H§ó¦n²z¸Ñ³o­Ó³B²z¹Lµ{¡R
\end{itemize}

\begin{tscreen}
\begin{verbatim}
                         skb->ihp->tos
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - >
     |                                                       |     ^
     | -- If you declare set_tc_index, we set DS             |     |  <-----May change
     |    value into skb->tc_index variable                  |     |O       DS field
     |                                                      A|     |R
   +-|-+      +------+    +---+-+    Internal   +-+     +---N|-----|----+
   | | |      | tc   |--->|   | |-->  . . .  -->| |     |   D|     |    |
   | | |----->|index |--->|   | |     Qdisc     | |---->|    v     |    |
   | | |      |filter|--->| | | +---------------+ |   ---->(mask,value) |
-->| O |      +------+    +-|-+--------------^----+  /  |  (.  ,  .)    |
   | | |          ^         |                |       |  |  (.  ,  .)    |
   | | +----------|---------|----------------|-------|--+  (.  ,  .)    |
   | | sch_dsmark |         |                |       |                  |
   +-|------------|---------|----------------|-------|------------------+
     |            |         | <- tc_index -> |       |
     |            |(read)   |    may change  |       |  <--------------Index to the
     |            |         |                |       |                    (mask,value)
     v            |         v                v       |                    pairs table
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ->
                         skb->tc_index
\end{verbatim}
\end{tscreen}


¨º¦p¦ó°µ¼ÐÃÑ©O¡S¥u»Ý­×§ï±z·Q­«·s¼ÐÃÑªº¤ÀÃþ(class)¤§ mask ©M value ´N¥i¥H¤F¡C½Ð°Ñ¦Ò¤U¤@¦æµ{¦¡¡R
\begin{tscreen}
tc class change dev eth0 classid 1:1 dsmark mask 0x3 value 0xb8
\end{tscreen}

³o·|§ïÅÜ¨º¹ï¦s©óÂø´êªí®æ¤ºªº mask ©M value ¡M¨Ã­«·s±N«Ê¥]¼ÐÃÑ¬°ÄÝ©ó class 1:1 ¡C±z¥²¶· "­×§ï" ³o­Ó¼Æ­È¡M¦]¬°¹w³]ªº¼Æ­È (mask, value) ·|Àò±oªì©l­È(¬Ý«á­±ªºªí®æ)¡C

²{¦b¡M§Ú­Ì±N¸ÑÄÀ¤@¤U TC\_INDEX ¹LÂo¾¹¬O¦p¦ó¤u§@ªº¡M¥H¤Î¦p¦óº¡¨¬¥¦ªº»Ý¨D¡C¥t¥~¡MTCINDEX ¹LÂo¾¹ÁÙ¥i¥H¥Î¦b¨ä¥¦³]©w¤W¡M¨Ã¤£¥u­­©ó DS ªA°È¤§¤¤¡C






\subsubsection{TC\_INDEX ¹LÂo¾¹ (TC\_INDEX Filter)}

«Å§i¤@­Ó TC\_INDEX ¹LÂo¾¹ªº°ò¥»©R¥O¦p¤U¡R
\begin{tscreen}
\begin{verbatim}
... tcindex [ hash SIZE ] [ mask MASK ] [ shift SHIFT ]
            [ pass_on | fall_through ]
            [ classid CLASSID ] [ police POLICE_SPEC ]
\end{verbatim}
\end{tscreen}

³o¸Ì¡M§Ú­Ìªu¥Î¹L©¹¨Ò¤l¸ÑÄÀ TC\_INDEX ªº¹Bºâ¼Ò¦¡¡C½Ð¯S§O¯d·N¼Ð¬°²ÊÅéªº¤å¦r¡R\\ \\ 
tc qdisc add dev eth0 handle 1:0 root dsmark indices 64 {\bfseries set\_tc\_index}\\ 
tc filter add dev eth0 parent 1:0 protocol ip prio 1 tcindex {\bfseries mask 0xfc  shift 2}\\ 
tc qdisc add dev eth0 parent 1:0 handle 2:0 cbq bandwidth 10Mbit cell 8 avpkt 1000 mpu 64\\ 
\# EF traffic class\\ 
tc class add dev eth0 parent 2:0 classid 2:1 cbq bandwidth 10Mbit rate 1500Kbit avpkt 1000 prio 1 bounded isolated allot 1514 weight 1 maxburst 10\\ 
\# Packet fifo qdisc for EF traffic\\ 
tc qdisc add dev eth0 parent 2:1 pfifo limit 5\\ 
tc filter add dev eth0 parent 2:0 protocol ip prio 1 {\bfseries handle 0x2e} tcindex {\bfseries classid 2:1 pass\_on}\\ \\ \\ 
(³o­Óµ{¦¡©|¤£§¹¾ã¡C¥¦¶È¶È¬O¨ú§÷©ó iproute2 ®M¥ó¤¤ªº EFCBQ ½d¨Ò¦Ó¤w)¡C

­º¥ý¡M°²³]§Ú­Ì¦¬¨ì¤@­Ó¼ÐÃÑ¬° EF ªº«Ê¥]¡C¦pªG±zÅª¹L RFC2598¡M¨º±zÀ³¸Ó¬Ý¨ì EF ¬y¶qªº DSCP «ØÄ³­È¬° 101110¡C³oªí¥Ü DS Äæ¦ì±N·|¬O 10111000 (­nª¾¹D TOS byte ¤¤ªº¦¸­«­n¦ì¤¸¨Ã¤£·|¥Î©ó DS ¤¤)¡M©Î¬O¥H¤Q¤»¶i¦ìªí¥Ü¬° 0xb8 ¡C

\begin{tscreen}
\begin{verbatim}
              TC INDEX
              FILTER
   +---+      +-------+    +---+-+    +------+                +-+    +-------+
   |   |      |       |    |   | |    |FILTER|  +-+    +-+    | |    |       |
   |   |----->| MASK  | -> |   | | -> |HANDLE|->| |    | | -> | | -> |       |
   |   |  .   | =0xfc |    |   | |    |0x2E  |  | +----+ |    | |    |       |
   |   |  .   |       |    |   | |    +------+  +--------+    | |    |       |
   |   |  .   |       |    |   | |                            | |    |       |
-->|   |  .   | SHIFT |    |   | |                            | |    |       |-->
   |   |  .   | =2    |    |   | +----------------------------+ |    |       |
   |   |      |       |    |   |       CBQ 2:0                  |    |       |
   |   |      +-------+    +---+--------------------------------+    |       |
   |   |                                                             |       |
   |   +-------------------------------------------------------------+       |
   |                          DSMARK 1:0                                     |
   +-------------------------------------------------------------------------+
\end{verbatim}
\end{tscreen}


«Ê¥]©è¹F¤§«á¡M±N DS Äæ¦ì³]©w¬° 0xb8¡C¥¿¦p§Ú­Ì«e­±©Ò¸ÑÄÀªº¡M¨Ò¤¤ªº dsmark qdisc ³QÅ³©w¬° id 1:0 ¡MÅª¨ú DS Äæ¦ì¡M¨Ã¦s©ñ©ó skb-$>$tc\_index ÅÜ¼Æ¤§¤º¡C¨Ò¤¤ªº¤U¤@¨B¡M¬Û·í©ó¸Ó qdisc ÃöÁpªº¹LÂo¾¹(¨Ò¤¤²Ä 2 ¦æ)¡C³o±N¶i¦æ¤U¤@­Ó¹Bºâ¡R
\begin{tscreen}
\begin{verbatim}
Value1 = skb->tc_index & MASK
Key = Value1 >> SHIFT
\end{verbatim}
\end{tscreen}




¨Ò¤¤¡MMASK=0xFC i SHIFT=2¡C
\begin{tscreen}
\begin{verbatim}
Value1 = 10111000 & 11111100 = 10111000
Key = 10111000 >> 2 = 00101110 -> 0x2E in hexadecimal
\end{verbatim}
\end{tscreen}




©Òªð¦^ªº¼Æ­È´N¬O qdisc ¤º³¡¹LÂo¾¹¤§ handle(¥»¨Ò¤¤¬° identifier 2:0)¡C°²¦p§ä¨ì³o­Ó ID ªº¹LÂo¾¹¡M­ì«h©M´ú¶q±ø¥ó´NÀò±o½T»{ (¥»¨Ò¤¤ªº¹LÂo¾¹´N¥]¬A³o­Ó)¡M¦P®É·|ªð¦^ classid(¥»¨Ò¤¤¬°¡Rclassid 2:1)¡M¨Ã¥B¦s©ñ©ó skb-$>$tc\_index ÅÜ¼Æ¸Ì­±¡C



¤£¹L¡M°²¦p§ä¨ì¥ô¦ó±a¦¹ ID ªº¹LÂo¾¹¡M¨äµ²ªG±N¨ú¨M©ó fall\_through ºX¼Ðªº«Å§i¡CµM«h¡Mªð¦^ªº classid «h¥H¼Æ­ÈÁä­È(value key)¬°·Ç¡C§_«h¡M±Nªð¦^¤@­Ó¿ù»~¡M¦P®É³B²zµ{§Ç±NÄ~Äò³Ñ¾lªº¹LÂo¾¹¡C¤p¤ß®@¡M¦pªG±z¨Ï¥Î fall\_through ºX¼Ðªº¸Ü¡M°²¦p skb-$>$tc\_index ÅÜ¼Æ¤§¼Æ­È©M class id ¤§¶¡¦s¦b¤@­ÓÂ²³æªºÃöÁp¡M§Y¥i§¹¦¨¡C



³Ì«á­nµù¸Ñªº°Ñ¼Æ¬O hash ©M pass\_on¡C«eªÌÃö¥GÂø´êªí®æªºÅé¿n¡Q¦Ó pass\_on «h«ü¥Ü¡R¦pªG¨S¦³µo²{»P¸Ó¹LÂo¾¹µ²ªG¬Ûµ¥ªº classid¡M«h¹Á¸Õ¤U¤@­Ó¹LÂo¾¹¡C¹w³]°Ê§@¬° fall\_through (¬Ý¤U¤@­Óªí®æ)



³Ì«á¡MÅý§Ú­Ì¬Ý¬Ý¦³­þ¨Ç¥i¯àªº¼Æ­È¡M¬O¥i¥H¥Î¨Ó³]©w¥þ³¡ TCINDEX ¼Æ­Èªº¡R
\begin{tscreen}
\begin{verbatim}
TC Name                 Value           Default
-----------------------------------------------------------------
Hash                    1...0x10000     Implementation dependent
Mask                    0...0xffff      0xffff
Shift                   0...15          0
Fall through / Pass_on  Flag            Fall_through
Classid                 Major:minor     None
Police                  .....           None
\end{verbatim}
\end{tscreen}


¦¹Ãþ¹LÂo¾¹¹ê¦b«D±`¼F®`¡C¥¦¥²¶·±´°É©Ò¦³ªº¥i¯à©Ê¡C¥t¥~¡M³o­Ó¹LÂo¾¹¤£¶È¥i¥H¥Î¦b DiffServ ³]©w¤¤¡MÁÙ¥i¥HÀ³¥Î¦b¨ä¥¦ºØÃþªº¹LÂo¾¹¤W­±¡C

§Ú«ØÄ³±z©âªÅ¬Ý¬Ý iproute2 ®M¥ó¤¤ªº©Ò¦³ DiffServ ½d¨Ò¡C§Ú¦V¦U¦ì«OÃÒ¡M§Ú±N·|ºÜºÉ¥þ¤O¾¨§Ö§¹¦¨¤å¦rªº³¡¥÷¡C¥t¥~¡M§Ú©Ò§@ªº¸ÑÄÀ¥þ³£¬O³\³\¦h¦h´ú¸Õªºµ²ªG¡C




\section{¨ä¥¦¸ê°T(Other information)}

Esteve Camps Chust $<$marvin@grn.es$>$\\ 
¥»¤å¨ú§÷©ó§Úªº½×¤å"QoS Support in Linux", September 2000.\\ 

·½¤å¥ó¡R\\ 
\begin{itemize}
\item \nameurl{http://ica1www.epfl.ch/~almesber}{Draft-almesberger-wajhak-diffserv-linux-01.txt}¡C
\item iptoute2 ®M¥ó¤¤ªº½d¨Ò¡C
\item \nameurl{http://www.qosforum.com/white-papers/qosprot_v3.pdf}{White Paper-QoS protocols and architectures} ©M 
\nameurl{http://www.qosforum.com/docs/faq}{IP QoS Frequently Asked Questions}¡C¨âªÌ§¡ÄÝ©ó {\itshape Quality of Service Forum\/}¡C
\end{itemize}









\subsection{WRR}

¦¹¤@ qdisc ¨Ã¤£¥]¬A¦b¼Ð·Çªº®Ö¤ß¸Ì­±¡M¦ý¥i¥H±q \nameurl{http://wipl-wrr.dkik.dk/wrr/}{³o¸Ì} ¤U¸ü¡C¥Ø«e¨Ó»¡¡M¦¹ qdisc ¶È¦b Linux 2.2 ®Ö¤ß¤W­±´ú¸Õ¹L¡MÀ³¸Ó¤]¥i¥H¦b 2.4 ®Ö¤ß¤u§@ªº¡C

WWR qdisc ±NÀW¼e¥H weighted round robin ªº§Î¦¡¤À°tµ¹¦UÃþ§O¡C¤]´N¬O¡M¹³ CBQ qdisc ¨º¼Ë¡M¥¦±NÃþ§O(classes)¥]§t¦b¥i´¡¤Jªº¦h¼Ë¤Æ qdiscs ¤¤¡C©Ò¦³Ãþ§O§¡¦³¨¬°÷ªº½Ð¨D¯à¤OÀò±oÀW¼e¡M¦A§¡¿Åªº«ö¤ñ­«¤À°tµ¹¬ÛÃöÃþ§O¡C¤ñ­«³q±`¥i¥H¥Î {\ttfamily tc} µ{¦¡¨Ó³]©w¡C¦ý¬O¥¦­Ì(¤ñ­«)¯à°÷¦Û°Êªº­°§C¡M¥HÅýµ¹¶i¦æ¤j¶q¼Æ¾Ú¶Ç°eªºÃþ§O¨Ï¥Î¡C

¦¹ qdisc ¤º«Ø¦³¤@­Ó¤ÀÃþ¾¹(classifier)¡M±N¨Ó¦Û©Î°e©¹¤£¦P¾÷¾¹ªº«Ê¥]¤À°t¦Ü¤£¦PªºÃþ§O¸Ì¥h¡CµL½× MAC ÁÙ¬O IP¡N¤£ºÞ¨Ó·½ÁÙ¬O¥Øªº¦ì§}¡M³£¥i¥H¨Ï¥Î¡C¤£¹L¡MMAC ¦ì§}¥u¯à¦b³o¥x Linux ¥D¾÷§@¬° ethernet bridge ªº®É­Ô¡M¤~¯à¨Ï¥Î¡C©Ò¦³Ãþ§O§¡¦Û°Êªº¨Ì¾Ú©Ò¨£«Ê¥]¤À°tµ¹¤£¦Pªº¾÷¾¹¡C

¦b¨º¨Ç½Ñ¦p±JªÙ¨º¼Ëªº¯¸¥x¡M¦s¦b¬°¼Æ²³¦h¥B¤S¤¬¤£¬Û¤zªº­ÓÅé¤À¨É¦P¤@ Internet ³s½uÀô¹Ò¤¤¡M¦¹ qdisc Â²ª½¬OÆF¤¦§®ÃÄ¡C³z¹L¤@®M script¡M¬°³o¼Ë¤@­Ó¯¸¥x³]©w¥X¤@­Ó«ê¦p¨ä¤Àªº¹BÂàª¬ºA¡M¥¿¬O WRR ®M¥óªººëÅè©Ò¦b¡C




\section{Netfilter »P iproute - «Ê¥]¼ÐÃÑ (Netfilter \& iproute - marking packets)}

¨ì¥Ø«e¬°¤î¡M§Ú­Ì¤w¸g¨£ÃÑ¹L iproute ªº¯à­@¤F¡M¦Ó netfilter ¤]´¿¼Æ«×´£¤Î¡C²{¦b¬O­n¦n¦nªº¬Ý¬Ý\nameurl{http://netfilter.samba.org/unreliable-guides/}{Rusty's Remarkably Unreliable Guides} ªº®É­Ô¤F¡C¦Ó netfilter ªºªÚÂÜ¡M¥i¥H±q  \nameurl{http://netfilter.filewatcher.org/}{³o¸Ì} ³V±o¡C

Netfilter ¥i¥HÅý§Ú­Ì¹LÂo«Ê¥]¡M©Î¬O­×§ï¥¦­Ìªº¼ÐÀY(headers)¡C¨ä¤¤¤@µ´¬O§Ú­Ì¥i¥H¥Î¸¹½X±N«Ê¥]¼ÐÃÑ°_¨Ó¡M¥Î --set-mark ´N¥i¥H°µ¨ì¡C

Á|­Ó¨Ò¤l¡M¤U­±ªº©R¥O±N©Ò¦³°eµ¹ port 25 ªº«Ê¥]¼Ð¡M¤]´N¬O¥~°e¶l¥ó¡Mµ¹ÃÑ°_¨Ó¡R

\begin{tscreen}
\begin{verbatim}
# iptables -A PREROUTING -i eth0 -t mangle -p tcp --dport 25 \
 -j MARK --set-mark 1
\end{verbatim}
\end{tscreen}


Åý§Ú­Ì°²³]¦³¦h±ø³s½u¡M¨ä¤¤¤@­Ó¤ñ¸û§Ö(·íµM¨C¤@ magabyte ¤]¸û¶Q)¡M¦Ó¥t¤@­Ó¤ñ¸ûºC¡M¦ý¨Ï¥Î©T©w»ù®æ¡C§Ú­Ì²z©ÒÀ³·í·Q§â¥~°e¶l¥ó¨«¨º­Ó¸û«K©yªº router ¡C

§Ú­Ì¤w¸g±N«Ê¥]¼ÐÃÑ¬° '1' ¤F¡M²{¦b´N«ü¤Þ¸ô¥Ñ­ì«h¸ê®Æ®w°µ¦p¤U¨Æ±¡¡R

\begin{tscreen}
\begin{verbatim}
# echo 201 mail.out >> /etc/iproute2/rt_tables
# ip rule add fwmark 1 table mail.out
# ip rule ls
0:      from all lookup local 
32764:  from all fwmark        1 lookup mail.out 
32766:  from all lookup main 
32767:  from all lookup default 
\end{verbatim}
\end{tscreen}


²{¦b§Ú­Ì²£¥Í mail.out ªí®æ¡M±N­Ó¸ô¥Ñ«ü¦V¸ûºC¦ý¤]¸û«K©yªº½u¸ô¡R
\begin{tscreen}
\begin{verbatim}
# /sbin/ip route add default via 195.96.98.253 dev ppp0 table mail.out
\end{verbatim}
\end{tscreen}


¤j¥\§i¦¨¡T°²¦p§Ú­Ì·Q­nºô¶}¤@­±¡M¦³«Ü¦h¿ìªk¥i¥H°µ¨ìªº¡C§Ú­Ì¥i¥H­×§ï netfilter ªº±Ô­z¡M±N¬Y¨Ç¯S©w¥D¾÷ÁÅ§K¥X¨Ó¡M©Î¬O¬°¨º¨ÇÁÅ§K¥D¾÷´¡¤J¤@±ø³W«h¡M¨Ï¥Î¸û§CªºÀu¥ý­È«ü¦V main ªí®æ¡C

§Ú­ÌÁÙ¥i¥H¹B¥Î¦¹¤@µ´§Þ¨Ó¹ê½î TOS ¦ì¤¸(bits)¡M¥u»Ý±N«Ê¥]¥H¤£¦P¼Æ¦r¼ÐÃÑ¬°¤£¦Pµ¥ªA°ÈÃþ«¬¡M¦P®É«Ø¥ß³W«h±N¤§¶]°_¨Ó§Y¥i¡C¥Î¦¹¿ìªk¡M§Ú­Ì¬Æ¦Ü«ü©w¤@±ø ISDN ½u¸ôµ¹¤¬°Ê³s½u©O¡C

­È±o¤@´£ªº¬O¡M¦¹ªk¦b NAT('masquerading') ¥D¾÷¤W¤]¦P¨ã¥\®Ä®@¡C

«D±`­«­n¡R§Ú­Ì¦¬¨ì¤@­Ó³ø§i«ü¥X MASQ ©M SNAT ¦Ü¤Ö©M«Ê¥]¼ÐÃÑ·|¦³©Ò©èÄ²¡CRusty Russel ¤w¦b¦p¤Uºô­¶§@¹L¸ÑÄÀ¡R\nameurl{http://lists.samba.org/pipermail/netfilter/2000-November/006089.html}{this posting}¡C½ÐÃö³¬°f¦V¸ô®|¹LÂo¥\¯à¡M¥H¸Ñ¨M¦¹¤@°ÝÃD¡C

½Ð¯d·N¡R±z»Ý­n±N¬Y¨Ç®Ö¤ß¿ï¶µ¥´¶}¤~¦æ¡R

\begin{tscreen}
\begin{verbatim}
IP: advanced router (CONFIG_IP_ADVANCED_ROUTER) [Y/n/?]
 IP: policy routing (CONFIG_IP_MULTIPLE_TABLES) [Y/n/?]
  IP: use netfilter MARK value as routing key (CONFIG_IP_ROUTE_FWMARK) [Y/n/?]
\end{verbatim}
\end{tscreen}


¥t¥~¡MÁÙ½Ð¬Ý¬Ý Cookbook ¤¤ªº \ref{SQUID} {(Transparent web-caching using netfilter, iproute2, ipchains and squid)} ¡C








\section{§ó¦hªº¤ÀÃþ¾¹ (More classifiers)}

¤ÀÃþ¾¹(classifier)´N¬O®Ö¤ß¥Î¨Ó¨M©w«Ê¥]»Ý­n°e¤J­þ¤@­Ó¦î¦Cªº¤èªk¡C¦³³\¦h§Î§Î¦â¦âªº¤ÀÃþ¾¹¡M¦U¥q¨äÂ¾¡C

\begin{description}
\item[fw] \mbox{}

®Ú¾Ú¨¾¤õÀð¦p¦ó¼ÐÃÑ«Ê¥]¨Ó§@§PÂ_¡C



\item[u32] \mbox{}

®Ú¾Ú«Ê¥]¸Ì­±ªºÄæ¦ì§@§PÂ_ (¨Ò¦p¡R¨Ó·½ IP ¦ì§}¡Mµ¥)¡C



\item[route] \mbox{}

®Ú¾Ú«Ê¥]¤§¸ô¥Ñ§@§PÂ_¡C



\item[rsvp, rsvp6] \mbox{}

®Ú¾Ú¥Ø¼Ð(¥Øªº¦ì§}¡M¨ó©w)¡M©Î¥H¨Ó·½§@§PÂ_¡C



\item[tcindex] \mbox{}

FIXME¡R¦³«Ý¸É¥R

\end{description}


½Ðª`·N¡M¤jÅé¤W±z¦³¦hºØ¿ìªk¨Ó¤ÀÃþ«Ê¥]¡M¦ý·|­°§C¨t²Î¤§¾ãÅé°õ¦æ®Ä¯à¡C

¤@¯ë¦Ó¨¥¡M¤ÀÃþ¾¹³£¯à±µ¨ü¤£¦P°Ñ¼Æ¡C¬°¤è«K°_¨£¡M¯÷¦C¦p¤U¡R

\begin{description}
\item[protocol] \mbox{}

¤ÀÃþ¾¹©Ò¯à±µ¨üªº¨ó©w¡C³q±`±z¥i¯à¥u·|±µ¨ü IP ¬y¶q¡C¥²¶·«ü©w¡C



\item[parent] \mbox{}

¬°¤ÀÃþ¾¹«ü©w±µºÞ(handle)¡M¥u¯à¬O¤w¸g¦s¦bªºÃþ§O(class)¡C¥²¶·«ü©w¡C



\item[prio] \mbox{}

¤ÀÃþ¾¹ªºÀu¥ýµ¥¯Å¡C¼Æ­È¶V°ª¶V§Ö¡C



\item[handle] \mbox{}

«ü©w¤£¦P¨Æª«¨ì¤£¦Pªº¹LÂo¾¹¥h¡C



FIXME¡R¼W¥[¿ï¶µ

\end{description}


¤U­±ªº³¹¸`§¡°²³]±z­n±N¬y¶q¤Þ¾É¦Ü {\ttfamily HostA} ¡MÁÙ°²³]³»¼h(root)Ãþ§O¤w¸g³]©w¬° 1¡R¡M¦P®É±z­n±N¬D¿ï¥X¨Óªº¬y¶q°e¦Ü 1:1 ¥h¡C




\subsection{"fw" ¤ÀÃþ¾¹ (The "fw" classifier)}

 "fw" ¤ÀÃþ¾¹­n¨Ì¾a¨¾¤õÀð§â»Ý­n¤Þ¾Éªº«Ê¥]¼ÐÃÑ°_¨Ó¡C©Ò¥H¡M§Ú­Ì¥²¶·¥ý³]©w¦n¨¾¤õÀð¡M¬°¥¦­Ì¥´¼ÐÅÒ¡C

\begin{tscreen}
\begin{verbatim}
# iptables -I PREROUTING -t mangle -p tcp -d HostA \
 -j MARK --set-mark 1
\end{verbatim}
\end{tscreen}


¦n¤F¡M©Ò¦³¶Çµ¹¸Ó¥D¾÷ªº«Ê¥]³£³Q¼ÐÃÑ¬° 1¡C²{¦b§Ú­Ì«Ø¥ß³W«h¡M¥H¯u¥¿¤Þ¾É«Ê¥]¡M§Ú­Ì¥u­n«ü©w¦n³Q¼ÐÃÑ¬° 1 ªº«Ê¥]­n°e¨ìÃþ§O 1:1 ¨ºÃä¥h¡C³z¹L¦p¤U©R¥O´N¥i¥H¡R

\begin{tscreen}
\begin{verbatim}
# tc filter add dev eth1 protocol ip parent 1:0 prio 1 handle 1 fw classid 1:1
\end{verbatim}
\end{tscreen}


©R¥O¥»¨­À³¸Ó»¡±oÆZ²M·¡ªº¤F¡Cªþ¦b 1:0 Ãþ§Oªº¹LÂo¾¹Àò±oªºÀu¥ý­È¬° 1¡M¹LÂo¨º¨Ç³Q¨¾¤õÀð¼ÐÃÑ¬° 1 ªº«Ê¥]¡M¦A°e¨ìÃþ§O 1:1 ¨ºÃä¥h¡Cª`·N¡M³o¸Ìªº handle ­n¦p¦ó¨Ï¥Î¡M¨ú¨M©ó«Ê¥]¦p¦ó¼ÐÃÑ¡C

¤£¸g´H¹ý°©¡M­þ±o±öªá­»¡S³o¤w¬O¸û¬°Â²³æªº¤èªk¤F¡M¦Ü©ó¨ä¥¦¤èªk¡M§ÚÄ±±o§ó¬°ÃøÀ´¡Cª`·N¡M±z¥i¥H§¹¥þ±N¨¾¤õÀðµ{¦¡ªº¥\¯àÀ³¥Î¦b¦¹¤ÀÃþ¾¹¤W­±¡M¥]¬A¤ñ¹ï MAC ¦ì§}¡N¥Î¤á¨­¥÷¡N¥H¤Î©Ò¦³¨ä¥¦¨¾¤õÀð©Ò¯à¤ñ¹ïªº¨Æª«¡C




\subsection{"u32" ¤ÀÃþ¾¹ (The "u32" classifier)}

U32 ¹LÂo¾¹¬O¥Ø«e¹ê§@¤¤©Ò¯à§ä¨ìªº³Ì±j«lªº¹LÂo¾¹¡C¥¦§¹¥þ¨Ì¾aÂø´êªí(hashing tables)¡M°t¦X²³¦h¹LÂo³W«h¦ÓÅÜ±o¤ã¹ê­@¥Î¡C

³ÌÂ²³æªº°µªk¬O¡MU32 ¹LÂo¾¹¦³¤@¾ã¦Cªº°O¿ý(records)¡M¦U¦Û¥]§t¨â­ÓÄæ¦ì¡R¿ï¾Ü¾¹(selector)©M°Ê§@(action)¡C¿ï¾Ü¾¹(«á­±·|¤¶²Ð)¡M·|»P·í«e³B²zªº IP «Ê¥]°µ¤ñ¸û¡M·í¸I¨ì²Ä¤@­Ó²Å¦Xªº«Ê¥]¡MµM«á´N§@¥X¬ÛÀ³ªº°Ê§@¡C³ÌÂ²³æªº°Ê§@¡M¬O±N«Ê¥]°e¦Ü«ü©wªº CBQ Ãþ§O¥h¡C

§Ú­Ì¥i¥Î {\ttfamily tc filter} ©R¥Oµ{¦¡¥h³]©w¹LÂo¾¹¡M¤@¦@¦³ 3 ­Ó³¡¥÷¡R¹LÂo¾¹ªº³W®æ(specification)¡N¿ï¾Ü¾¹¡N¥H¤Î°Ê§@¡C¹LÂo¾¹³W«h¥i¥H¦p¤U©w¸q¡R

\begin{tscreen}
\begin{verbatim}
tc filter add dev IF [ protocol PROTO ]
                     [ (preference|priority) PRIO ]
                     [ parent CBQ ]
\end{verbatim}
\end{tscreen}


¨ä¤¤ªº {\ttfamily protocol} Äæ¦ì»¡©ú¹LÂo¾¹©Ò¾A¥Îªº¨ó©w¡M§Ú­Ì³o¸Ì¥u´N {\ttfamily ip} ¨ó©w¶i¦æ°Q½×¡C¦Ü©ó {\ttfamily preference(°¾¦n­È)} Äæ¦ì(¤]¥i¥H¥Î{\ttfamily priority} ¨Ó¥N´À)¡M³]©w·í«e¹LÂo¾¹ªºÀu¥ý­È¡C³o«Ü­«­n¡M¦]¬°±z©Î³\·|¦³¦n´X­Ó¹LÂo¾¹(³W«h¦Cªí)¡M¦U¦Û¾Ö¦³¤£¦PªºÀu¥ý­È¡C¨C¤@¦C³W«h«ö·Ó³W«h·s¼W¶¶§Ç³q¹L¡MµM«á¤~³B²z§CÀu¥ý­È(°ª°¾¦n­È)ªº³W«h¦C¡C³Ì«áªº {\ttfamily parent} Äæ¦ì©w¸q¥X¹LÂo¾¹©ÒÄÝªº CBQ ¾ð³»(¦p 1:0)¡C

¥H¤W¿ï¶µ§¡¾A¥Î©ó©Ò¦³¹LÂo¾¹¡M«D U32 ¿W¬ü¡C




\subsubsection{U32 ¿ï¾Ü¾¹ (U32 selector)}

U32 ¿ï¾Ü¾¹¥]§t¦¡¼Ë(pattern)©w¸q¡M¥H¤ñ¹ï·í«e³B²zªº«Ê¥]¡C¥¦¤@µ·¤£­eªº©w¸q¥X­þ¨Ç«Ê¥]¼ÐÀYªº¦ì¤¸(bits) ­n¥Î¨Ó¤ñ¹ï¡M¤ßµL®ÇÄE¡MµM«o¥|¨â¼·¤d¤ç¡C¤£¦pÅý§Ú­Ì¬Ý¬Ý¥H¤U½d¨Ò¡Mª½±µ¨ú¦Û¤@­Ó½ÆÂø¥B¯u¹êªº¹LÂo¾¹¡R

\begin{tscreen}
\begin{verbatim}
# filter parent 1: protocol ip pref 10 u32 fh 800::800 order 2048 key ht 800 bkt 0 flowid 1:3 \
  match 00100000/00ff0000 at 0
\end{verbatim}
\end{tscreen}




§Ú­Ì¼È®É¤£¥ÎºÞ²Ä¤@¦æ --- ¥þ³¡°Ñ¼Æ«×¬O¥Î¨Ó´y­z¹LÂo¾¹¤§Âø´êªí¦Ó¤w¡C¥BÅý§Ú­Ì¥J²Ó¬Ý¬ÝÃö©ó¿ï¾Ü¾¹¨º¤@¦æ¡M¤]´N¬O±a {\ttfamily match} ÃöÁä¦rªº¨º¦æ¡C¿ï¾Ü¾¹·|¤ñ¹ï²Ä 2 ­Ó byte ¬° 0x10(0010) ªº IP ¼ÐÀY¡C©Î³\±z¤w²q¨ì¡M¨º­Ó 00ff ¼Æ¦r´N¬O¤ñ¹ï¾B¸n(mask)¡C¥Ø«e¬° 0xff¡M©Ò¥H¡M³o­Ó byte ¥u¯à¬O 0x10¡CµM«á {\ttfamily at} ÃöÁä¦r·N«ä¬O»¡¡M³o­Ó¤ñ¹ï¬O±q«ü©wªº offset(¥H bytes ºâ)¶}©l --- ¦b¥Ø«e½d¨Ò¤¤¡M¦b«Ê¥]ªº¤@¶}©l³B¡C´«¦¨§Ú­Ìªº¤HÃþ»y¨¥¨Ó»¡ªº¸Ü¡M¦pªG«Ê¥]ªº Type of Serice Äæ¦ì±a¦³ `low delay` ¦ì¤¸³]©w¡M¨º³o­Ó¤ñ¹ï´N²Å¦X¤F¡CÅý§Ú­Ì¦b¬Ý¬Ý¥t¤@­Ó³W«h§a¡R

\begin{tscreen}
\begin{verbatim}
# filter parent 1: protocol ip pref 10 u32 fh 800::803 order 2051 key ht 800 bkt 0 flowid 1:3 \
  match 00000016/0000ffff at nexthdr+0
\end{verbatim}
\end{tscreen}




¦¹³B¡M¦³¤@­Ó {\ttfamily nexthdr} ¿ï¶µ¡M¥Nªí IP «Ê¥]¸Ì­±ªº¤U¤@­Ó¼ÐÀY¡M¨Ò¦p¤W¼h¨ó©wªº¼ÐÀY¡C³o­Ó¤ñ¹ï¤]¬O±q¤U¤@­Ó¼ÐÀYªº¤@¶}©l³B¶i¦æ¡C¤ñ¹ïÀ³¸Ó¥X²{¦b¼ÐÀY­º 32-bit ¤¤ªº²Ä¤G­Ó¦r(word)¡C¦b TCP ©M UDP ¨ó©w¸Ì¡M¦¹Äæ¦ì¥]§t«Ê¥]¥ØªººÝ°ð¤f(port)¡C¦¹¼Æ¦r¥H big-endian ®æ¦¡Åã¥Ü¡M¨Ò¦p older ¦ì¤¸±Æ«e­±¡M©Ò¥H§Ú­Ì¥u­n±N 0x0016  ´«¦¨¤Q¶i¦ì´N¬O 22 ¤F¡M´«¦Ó¨¥¤§¡M¦pªG³o¬O TCP ªº¸Ü¡M¨º¥L´N¬O SSH ªA°È¡C¥¿¦p±z©Ò²qªº¡M¦pªGÂ÷¶}¬ÛÃö©Ó±µ(§Ú­Ì«á­±¦A­z)¡M³o­Ó¤ñ¹ï·|ÅÜ±o¤£©ú©Ò¥H¡C



·í§Ú­Ì¹ï«e­z³£¦³¤@©w¤F¸Ñ¤§«á¡M´N·|µo²{¦p¤U³o­Ó¿ï¾Ü¾¹¨ä¹êÆZ¦n²z¸Ñªº¡R{\ttfamily match c0a80100/ffffff00 at 16} ¡C§Ú­Ì¥u­n±q IP ¼ÐÀY¶}©l¡M¤ñ¹ï²Ä 17 ­Ó byte °_ªº 3 ­Ó byte §Y¥i¡C³o·|¤ñ¹ï©Ò¦³¥Øªº¦a¬°ºô¸ô 192.168.1/24 ªº«Ê¥]¡C¬Ý¹L³o¨Ç½d¨Ò¤§«á¡MµM«áÅý§Ú­Ì±N©Ò¾ÇªºÂk¯Ç¤@¤U§a¡C




\subsubsection{³q¥Î¿ï¾Ü¾¹ (General selectors)}

³q¥Î¿ï¾Ü¾¹©w¸q¥X¦¡¼Ë(pattern)¡N¾B¸n(mask)¡NÁÙ¦³«Ê¥]¤º®e¸ÌÃö©ó¤ñ¹ï¦¡¼Ëªº offsest¡C¨Ï¥Î³q¥Î¿ï¾Ü¾¹¡M±z¹ê»Ú¤W¥i¥H¤ñ¹ï IP (©Î¤W¼h) ¼ÐÀY¸Ìªº¨C¤@­Ó³æ¿Wªº¦ì¤¸(bit) ¡C¤ñ¸û«á­±¤¶²Ðªº¯S©w¿ï¾Ü¾¹¡M¥¦­Ì§óÃøÅª¼g¡C³q¥Î¿ï¾Ü¾¹ªº»yªk¦p¤U¡R

\begin{tscreen}
\begin{verbatim}
match [ u32 | u16 | u8 ] PATTERN MASK [ at OFFSET | nexthdr+OFFSET]
\end{verbatim}
\end{tscreen}




{\ttfamily u32}¡N{\ttfamily u16}¡N©Î {\ttfamily u8} ³o¨ÇÃöÁä¦r¡M¦U¦Û«ü©w¦ì¤¸¸Ìªº¦¡¼Ëªø«×¡CPATTERN ©M MASK ¥²¶·±µ¦b«e­±ÃöÁäµü©w¸qªºªø«×«á­±¡C¦Ü©ó OFFSET °Ñ¼Æ¡M«h¥H byte ¬°³æ¦ì¡M«ü©w¶}©l¤ñ¹ïªº offset ©Ò¦b¡C¦pªG {\ttfamily nexthdr+} ¦³³]©w¡M¨º»ò offset «h¬Û¹ïªº±q¤W¼h¨ó©w¼ÐÀY¶}©lºâ°_¡C



½d¨Ò¡R

\begin{tscreen}
\begin{verbatim}
# tc filter add dev ppp14 parent 1:0 prio 10 u32 \
     match u8 64 0xff at 8 \
     flowid 1:4
\end{verbatim}
\end{tscreen}




¦pªG¦s¬¡´Á(TTL)¬° 64 ªº¸Ü¡M«Ê¥]´N²Å¦X¤ñ¹ï¡C±q IP ¼ÐÀY¼Æ°_¡M²Ä 8 ­Ó byte ¶}©l´N¬O TTL Äæ¦ì¤F¡C

\begin{tscreen}
\begin{verbatim}
# tc filter add dev ppp14 parent 1:0 prio 10 u32 \
     match u8 0x10 0xff at nexthdr+13 \
     protocol tcp \
     flowid 1:3 \
\end{verbatim}
\end{tscreen}




¦¹³W«h¶È¤ñ¹ï±a ACK ¦ì¤¸³]©wªº TCP «Ê¥]¡C³o¸Ì§Ú­Ì¥i¥H¬Ý¨ì¤@­Ó½d¨Ò¤¤¨Ï¥Î¨â­Ó¿ï¾Ü¾¹¡M³Ì²×µ²ªG«h±N¨â­Óµ²ªG¥Î AND ÅÞ¿è¹Bºâ±o¥X¡C¦pªG§Ú­Ì¥J²Óªº¬Ý¬Ý TCP ¼ÐÀYµ²ºc¹Ï¡M§Ú­Ì·|µo²{ ACK ¦ì¤¸¡M¬O TCP ¼ÐÀY²Ä 14 ­Ó byte ºâ°_({\ttfamily at nexthdr+13})²Ä 2 ­Ó older ¦ì¤¸(0x10)¡C¦Ü©ó²Ä¤G­Ó¿ï¾Ü¾¹¡M¦pªG§Ú­Ì·Q¸Õ¸Õ§JÃøªº¤èªk¡M¤£«ü©w¿ï¾Ü¾¹¨Ï¥Î {\ttfamily protocol tcp}¡M¥i³o¼Ë¼g¡R {\ttfamily match u8 0x06 0xff at 9}¡M¦]¬° TCP ªº¨ó©w¸¹½X¬O 6¡M¦ì©ó IP ¼ÐÀYªº²Ä 10 ­Ó byte¡C¬Û¹ï¦Ó¨¥¡M¦b¦¹½d¨Ò¤¤¡M§Ú­Ì¤£¯à¥Î¯S©w¿ï¾Ü¾¹¨Ó°µ²Ä¤@­Ó¤ñ¹ï --- ³o¬O¦]¬°¨S¦³¯S©w¿ï¾Ü¾¹¥i¥H¤ñ¹ï TCP ACK ¦ì©ó¤§¬G¡C




\subsubsection{¯S©w¿ï¾Ü¾¹ (Specific selectors)}

¦p¤Uªí®æ¦C¥X¤F¥»³¹§@ªÌ©Ò±q {\ttfamily tc} µ{¦¡¤¤µo²{ªº¥þ³¡¯S©w¿ï¾Ü¾¹¡C¥L­ÌÀ°±z¬Ù±¼³\¦h¤u§@¡M¦P®ÉÅý±zªº¹LÂo¾¹³]©w§ó¨ã¥iÅª©Ê¡C

FIXME: ªí®æ¦s©ñ¦ì¸m --- ¦s©ó¥t¥~ªºÀÉ®×¡Rselector.html¡C

FIXME: ¥u¦³ªiÄõ»y :-(

FIXME: ¦³«ÝÂà¦¨ sgml ®æ¦¡¡C

½d¨Ò:

\begin{tscreen}
\begin{verbatim}
# tc filter add dev ppp0 parent 1:0 prio 10 u32 \
     match ip tos 0x10 0xff \
     flowid 1:4
\end{verbatim}
\end{tscreen}


¥H¤W³W«h·|¤ñ¹ï¨º¨Ç TOS Äæ¦ì³]¬° 0x10 ªº«Ê¥]¡CTOS Äæ¦ì±q«Ê¥]ªº²Ä 2 ­Ó byte ¶}©l¡M¨Ã¦û¤@­Ó byte ªºªø«×¡M³o¼Ë¦n¤ñ§Ú­Ì¥t¼g¤@­Ó¬Ûµ¥ªº³q¥Î¿ï¾Ü¾¹¡R{\ttfamily match u8 0x10 0xff at 1}¡C¥Ñ¦¹¡M§Ú­Ì´N¥i¥H¤@¿s U32 ¹LÂo¾¹ªº¤º¸Ì°®©[ --- ¯S©w³W«h³£·|³QÂà´«¬°³q¥Î³W«h¡M¦P®É¥H¦¹§Î¦¡¦s©ó®Ö¤ß°O¾ÐÅé¤§¤º¡CÁ|¤@¤Ï¤T --- {\ttfamily tcp} ©M {\ttfamily udp} ¿ï¾Ü¾¹¤]¬O¦pªkªw¨î¡M³o¤]¬O¬°¦ó±z¤£¯à¥Î³æ¿Wªº {\ttfamily match tcp dst 53 0xffff} ¿ï¾Ü¾¹¡M¨Ó¤ñ¹ï¨º¨Ç°eµ¹¯S©w°ð¤f(port) ªº TCP «Ê¥] --- ¥¦­Ì¤]¦P®É¤ñ¹ï°e¦Ü¦¹°ð¤fªº UDP «Ê¥]¡C¥t¥~¡M±z¤£­n§Ñ¤F«ü©w¨ó©w®@¡M¨Ã¥B³Ì«á²£¥Í¦p¤U³W«h¡R

\begin{tscreen}
\begin{verbatim}
# tc filter add dev ppp0 parent 1:0 prio 10 u32 \
        match tcp dst 53 0xffff \
        match ip protocol 0x6 0xff \
        flowid 1:2
\end{verbatim}
\end{tscreen}







\subsection{"route" ¤ÀÃþ¾¹ (The "route" classifier)}

¦¹¤ÀÃþ¹LÂo¾¹®Ú¾Ú¸ô¥Ñªí®æ(routing tables)¦Ó©w¡C·í¤@­Ó«Ê¥]¬ï¶V¤ÀÃþ(classes)©è¹F³Q¼ÐÃÑ¬° "route" ªº¹LÂo¾¹¤§«á¡M¥¦·|«ö·Ó¸ô¥Ñªí®æªº¸ê°T¤ÀÂ÷(split)³o­Ó«Ê¥]¡C

\begin{tscreen}
\begin{verbatim}
# tc filter add dev eth1 parent 1:0 protocol ip prio 100 route
\end{verbatim}
\end{tscreen}


³o¸Ì¡M§Ú­Ì·s¼W¤@­Ó route ¤ÀÃþ¾¹µ¹¤W´å¸`ÂI(parent node) 1:0 ¡M¨äÀu¥ý­È¬° 100¡C·í«Ê¥]©è¹F³o­Ó¸`ÂI«á(¦]¬°³o¬O³»¼h(root) ¤ÀÃþ¡M©Ò¥H°¨¤W¥Í®Ä)¡M¥¦·|¬d¸ß¸ô¥Ñªí®æ¡M¨Ã¥B¡M¦pªG¦³¤@­Ó¤ñ¹ï²Å¦Xªº¸Ü¡M´N§â¥¦°eµ¹«ü©wªº¤ÀÃþ¡M¦P®É½á¤© 100 ªºÀu¥ý­È¡C³Ì«á¡M±z¼W¥[¤@­Ó«ê·íªº¸ô¥Ñ°O¿ý¡M¥æ¥Ñ°Ê§@(action)³B²z¡R

³o¸Ìªº³ZÂ¬¬O¡M­n®Ú¾Ú¥Øªº(destination)©Î¨Ó·½(source)¨Ó©w¸q¤@­Ó©Ò¿×ªº 'realm' ¡M°Ñ¦Ò¦p¤U¡R

\begin{tscreen}
\begin{verbatim}
# ip route add Host/Network via Gateway dev Device realm RealmNumber
\end{verbatim}
\end{tscreen}


¤ñ¤è»¡¡M§Ú­Ì¥i¥H©w¸q¥Øªººô¸ô 192.168.10.0¡M¥¦ªº realm ¸¹½X¬O 10¡R  

\begin{tscreen}
\begin{verbatim}
# ip route add 192.168.10.0/24 via 192.168.10.1 dev eth1 realm 10
\end{verbatim}
\end{tscreen}
  

¦b¼W¥[ route ¹LÂo¾¹¤§«á¡M§Ú­Ì¥i¥H¨Ï¥Î realm ¸¹½X¨Ó¥Nªíºô¸ô©Î¥D¾÷¡M¦P®É«ü©w¸ô¥Ñ¦p¦ó°t¹ï(match)¹LÂo¾¹¡C

\begin{tscreen}
\begin{verbatim}
# tc filter add dev eth1 parent 1:0 protocol ip prio 100 \
  route to 10 classid 1:10
\end{verbatim}
\end{tscreen}
  

¥H¤W³W«h¬O»¡¡M°eµ¹ºô¸ô 192.168.10.0 ªº«Ê¥]¡M·|°t¹ï class id 1:10¡C

Route ¹LÂo¾¹ÁÙ¥i¥H¥Î¨Ó¤ñ¹ï·½¸ô¥Ñ(source routes)¡C¨Ò¦p¡M¦³¤@­Ó¤lºô±µ¨ì Linux router ªº eth2 ¬É­±¡R

\begin{tscreen}
\begin{verbatim}
# ip route add 192.168.2.0/24 dev eth2 realm 2
# tc filter add dev eth1 parent 1:0 protocol ip prio 100 \
  route from 2 classid 1:2
\end{verbatim}
\end{tscreen}


³o¸Ì¡M¹LÂo¾¹«ü©w¥X¨Ó¦Û¤lºô 192.168.2.0 (realm 2) ªº«Ê¥]¡M´N°t¹ï class id 1:2 ¡C




\subsection{"rsvp" ¤ÀÃþ¾¹ (The "rsvp" classifier)}

FIXME: ¦³«Ý¸É¥R




\subsection{"tcindex" ¤ÀÃþ¾¹ (The "tcindex" classifier)}

FIXME: ¦³«Ý¸É¥R




\section{®Ö¤ßºô¸ô°Ñ¼Æ (Kernel network parameters)}

®Ö¤ß¦³«Ü¦h°Ñ¼Æ¥i¥H½Õ¸`¡M¥H¾A¥Î©ó¤£¦Pªºª¬ªp¡C³q±`¡M 99\% ªº¦w¸Ë¡M¨Ï¥Î¹w³]°Ñ¼Æ´N¥i¥H¤F¡M¤£¹L¡M»P¨ä³o¼Ëªº¸Ü¡M¦¹ºÙ¬° Advanced ªº HOWTO ´N®ö±oµê¦W¤F¡T

¦³ªÅ½Ð¬Ý¬Ý /proc/sys/net¡M©Î¦³·N¥~¦¬Ã¬®@¡C¥u¬O¡M­è¶}©lªº®É­Ô¡M¨Ã«D©Ò¦³ªF¦è³£·|¼g¦b³o¸Ì¡M§Ú­ÌºÉ¤O¦Ó¬°´N¬O¤F¡C


\subsection{°f¦V¸ô®|¹LÂo (Reverse Path Filtering)}

¹w³]±¡ªp¤U¡Mrouter ·|¸ô¥Ñ©Ò¦³ªF¦è¡M´Nºâ¸Ó«Ê¥]¡¥ÅãµM¡¦¤£ÄÝ©ó¶Qºô¸ôªº¡C±`¨£ªº¨Ò¤l¡M²ö¹L©ó±N¨p¦³ IP ªnº|¨ì internet ¤W¥h¡C°²¦p±z¦³¤@­Ó¬É­±¡M¨ä¤W³]©wªº¸ô¥Ñ¬° 195.96.96.0/24¡M¨º±z¤£·|¹w´Á¨Ó¦Û 212.64.94.1 ªº«Ê¥]·|¨ì¹F³o¸Ì¡C

³\¦h¤H³£·QÃö³¬¦¹¤@¥\¯à¡M¦]¦¹®Ö¤ß³]­pªÌ¤]¥´¶}¤F¤è«K¤§ªù¡C¦b \url{/proc} ¸Ì­±¦³¨ÇÀÉ®×¡M³z¹L¥¦­Ì±z¥i¥HÅý®Ö¤ß¬°±z°µ¨ì³oÂI¡C¦¹¤èªk³QºÙ¬° "°f¦V¸ô®|¹LÂo(Reverse Path Filtering)"¡C°ò¥»¤W¡M°²¦p¹ï¦¹«Ê¥]§@¥Xªº¦^À³¡M¤£¬O´`¨ä¶i¤Jªº¬É­±°e¥X¥h¡M¨º¥¦´N³Qµø¤§¬°¤@­Ó bogus «Ê¥]¡M¦Ó³Q¸m¤§¤£²z¡C

\begin{tscreen}
\begin{verbatim}
# for i in /proc/sys/net/ipv4/conf/*/rp_filter ; do
{  echo 2 > $i 
} done
\end{verbatim}
\end{tscreen}


§Ú­Ì¥Î¤W­±ªº¨Ò¤l¨Ó¬Ý¬Ý¡M¦pªG¤@­Ó«Ê¥]±q eth1 ¨ì¹F Linux router¡M¦ÛºÙ¨Ó¦Û Office+ISP ³o­Ó subnet¡M¨º¥¦´N·|³Q¥á±ó¡C¦P¼Ë¦a¡M¦pªG«Ê¥]¨Ó¦Û Office ³o­Ó subnet¡M«o¦ÛºÙ¨Ó¦Û¨¾¤õÀð¥~³¡¡M¨º¥¦¤]¦P¼Ë·|³Q¥á±ó¡C

¤W­±¬O§¹¥þ(full) °f¦V¸ô®|¹LÂo¡C¹w³]¬O¥u®Ú¾Úª½±µ¬Û³sºô¸ôªº IP ¶i¦æ¹LÂo¡M³o®É¦]¬°§¹¥þ¹LÂo·|¥´Â_©Ò¿×ªº«D¹ïºÙ¸ô(asymmetric routing)±¡§Î (¤]´N¬O¡M«Ê¥]±q¤@ºÝ¶i¤J¡M¦Ó±q¥t¤@ºÝ¥X¥h¡M¨Ò¦p½Ã¬P¬y¶q¶Ç°e¡M©Î¬O±zªººô¸ô¨Ï¥Î°ÊºA (bgp¡Nospf¡Nrip)¸ô¥Ñ¡C¸ê®Æ±q½Ã¬P±µ¨üºÐ¤U¶Ç¶i¨Ó¡M¦Ó¦^À³«h±q¥¿±`ªº±M½u°e¦^¥h)¡C

°²¦p±zÄÝ©ó³oºØ¨Ò¥~(±zÀ³¸Ó¤ß¤¤¦³¼Æ)¡M¨º±z¥i¥HÂ²³æªº¦b½Ã¬P¼Æ¾Ú¶i¤Jªº¬É­±¤WÃö³¬ \url{rp\_filter}¡C¦pªG±z·Q­n¬Ý¬Ý«Ê¥]¬O§_¯uªº·|³Q¥á±ó¡M¨º¥i¥H³z¹L¦P¤@¥Ø¿ýªº \url{log\_martians} ÀÉ®×¡M§i¶D®Ö¤ß±N¤§°O¿ý¨ì syslog ¤W­±¥h¡C

\begin{tscreen}
\begin{verbatim}
# echo 1 >/proc/sys/net/ipv4/conf/<interfacename>/log_martians
\end{verbatim}
\end{tscreen}


FIXME: ¤£²M·¡³]©w conf/$\{$default,all$\}$/* ¤U­±ªºÀÉ®×¬O§_¨¬°÷¡S --- martijn




\subsection{©|¤£©ú½Tªº³]©w (Obscure settings)}

¶â¡M¤Ó¦h°Ñ¼Æ¨ä¹ê³£¥i¥H­×§ï°Õ¡C§Ú­Ì·|¸ÕµÛ±N¥¦­Ì¾¨¼ÆÃ¹¦C¥X¨Ó¡M¦Ó¥B(³¡¥÷)·|¼g¦b\url{Documentation/ip-sysctl.txt} ¤¤¡C

¨ä¤¤¦³¨Ç³]©wªº¹w³]­È·|¦³¤£¦P¡M¬Ý±z¦b½sÄ¶®Ö¤ßªº®É­Ô¡M¬O§_¥H 'Yes' ¨Ó¦^µª 'Configure as router and not host' Åo¡C




\subsubsection{¤@¯ëªº ipv4 (Generic ipv4)}

½Ð¯d·N¡M¤j¦h¼Æªº³t²v(rate)­­¨î¥\¯à³£¤£¾A¥Î©ó loopback ¤§¤W¡M©Ò¥H½Ð¤Å¦b¥»¾÷¤W¶i¦æ´ú¸Õ¡C³o­Ó­­¨î¨ü¨î©ó©Ò¿×ªº 'jiffies' ¡M¥B¥¦­Ìµw©Êªº¥u¯à¨Ï¥Î«e­zªº token bucket filter¡C

®Ö¤ß¦³¤@­Ó¤º³¡®ÉÄÁ¡M¨C¬í¶] 'HZ' ¸õ(©Î¤ê 'jiffies' )¡C¦b intel ¤W­±¡M'HZ' ¤j·§¬° 100 (Ä¶ªÌµù¡R§Ú²q³o¸Ì«ü©Ò¿×ªº '¤ºÀW' ¦Ó¨¥§a¡S·sªº¥D¾÷ªO¤j³£¤ä´© 133 ³o­Ó³t«×)¡C¤ñ¤è»¡¡M³]©w¤@­Ó *\_rate ÀÉ®×¬° 50 ¦n¤F¡M«h¥i¨C¬í³B²z 2 ­Ó«Ê¥]¡C¦Ó token bucket filter ¤]¥i¥H³Q³]©w¬°¡M¦pªG¦³¨¬°÷ªº tokens ¦sÀxªº¸Ü¡M¯àÅý¨C¤@­Ó burst (Àþ¼W¬y¶q)¥i¹F 6 ­Ó«Ê¥]¡C

¦p¤U¦Cªí¤¤ªº¤@¨Ç¶µ¥Ø¡M«þ¨©¦Û /usr/src/linux/Documentation/networking/ip-sysctl.txt¡M¥Ñ Alexey Kuznetsov $<$kuznet@ms2.inr.ac.ru$>$ and Andi Kleen $<$ak@muc.de$>$ ©Ò¼¶¼g¡C

\begin{description}
\item[/proc/sys/net/ipv4/icmp\_destunreach\_rate] \mbox{}

¦pªG®Ö¤ß»{¬°¥¦¤£¯à¶Ç°e¬Y¤@«Ê¥]¡M«h±N¤§¥á±ó¡M¦P®É¦V«Ê¥]¨Ó·½°e¥X¤@­Ó ICMP §iª¾¨äµ²ªG¡C



\item[/proc/sys/net/ipv4/icmp\_echo\_ignore\_all] \mbox{}

¹ï©Ò¦³«Ê¥]§¡¤£§@¥X echo ¡C½Ð¤Å±N¹w³]­È³]¬°±Ò°Ê¡M°£«D±z³Q§Q¥Î¬°¤@­Ó DoS ¤u¨ãªº¸õ¯¸¡M¨º©Î³\¦³¥Î¡C



\item[/proc/sys/net/ipv4/icmp\_echo\_ignore\_broadcasts {[}Useful{]}] \mbox{}

¦pªG±z ping ºô¸ôªº¼s¼½¦ì§}¡M¨º©Ò¦³¥D¾÷³£·|°µ¥X¦^À³¡M³o±N¬O¤@­Ó«D±`«K§Qªº dinal-of-servie ¤u¨ã¡C±N³o¸Ì³]©w¬° 1 «h·|©¿²¤³o¨Ç¼s¼½°T®§¡C



\item[/proc/sys/net/ipv4/icmp\_echoreply\_rate] \mbox{}

°e¥X echo ¦^À³¦Ü¥ô·N¥ØªººÝ¤§³t²v



\item[/proc/sys/net/ipv4/icmp\_ignore\_bogus\_error\_responses] \mbox{}

³]©w¥¦·|©¿²¤¦]ºô¸ô¥D¾÷¹ï¨º¨Ç°e¦Ü²z¸Ñ¬°¼s¼½¦ì§}¤§®Ø¥]§@¥X©è§Ü¦Ó¤Þ°_ªº ICMP ¿ù»~¡C



\item[/proc/sys/net/ipv4/icmp\_paramprob\_rate] \mbox{}

¤@­Ó¬Û¹ï¥¼ª¾ªº ICMP «H®§¡M¨äµo°e¬O¦]·l·´ªº IP ©Î TCP ¼ÐÀY«Ê¥]¦Ó¤Þµoªº¡C³z¹L³o­ÓÀÉ¡M±z¥i¥H±±¨î¨äµo°eªº³t²v¡C



\item[/proc/sys/net/ipv4/icmp\_timeexceed\_rate] \mbox{}

³o¥i¥H¦¨¬°¾É­P traceroute ¥X²{ '¬P¬P(* * *)' ªº¥D¦]¡C³o¸Ì­­¨î°e¥X ICMP Time Exceeded °T®§ªº¼Æ¥Ø¡C



\item[/proc/sys/net/ipv4/igmp\_max\_memberships] \mbox{}

¥D¾÷¤W©Ò¶ÉÅ¥ªº³Ì¤j igmp (multicast) socket ¼Æ¶q¡C\\ 
FIXME: ¤£ª¾¹D¬O§_¯uªº?



\item[/proc/sys/net/ipv4/inet\_peer\_gc\_maxtime] \mbox{}

FIXME: ¼W¥[¤@­ÓÃö©ó inet peer storage ¤§Â²µu»¡©ú?\\ 
¼oª«¦¬¶°(garbage collection)³q¹Lªº³Ìªø¶¡¹j¡C³o­Ó¶¡¹j·|¼vÅT¨ì pool ¤¤°O¾ÐÅéªº§C¦ì(©Î¯Ê¤Ö)À£¤O(pressure )¡C ¥H jiffies ´ú¶q¡C



\item[/proc/sys/net/ipv4/inet\_peer\_gc\_mintime] \mbox{}

¼oª«¦¬¶°(GC)³q¹Lªº³Ìµu¶¡¹j¡C³o­Ó¶¡¹j·|¼vÅT¨ì pool ¤¤°O¾ÐÅéªº°ª¦ìÀ£¤O¡C ¥H jiffies ´ú¶q¡C\\ \\ 
(Ä¶ªÌµù¡R¤£²M·¡¤W­±¨â­Ó¸ÑÄÀ¬O§_¥¿½T¡M¦]¬°­ì¤å¤¤¡M§@ªÌ§¡¸ÑÄÀ¬°"Minimum interval between garbage collection passes"¡M§Ú³o¸Ì¨p¦Û±N²Ä¤@­Ó§ï¬°¡§³Ìªø¶¡¹j¡¨¡C)



\item[/proc/sys/net/ipv4/inet\_peer\_maxttl] \mbox{}

³Ì°ª¦s¬¡´Á¶µ¥Ø¡C¦b¦¹´Á­­¨ì¹F¤§«á¡M¦pªG¨S¦³¦b pool ¤Wºc¦¨°O¾ÐÅéÀ£¤Oªº¸Ü(¨Ò¦p¡Mpool ¤¤ªº¶µ¥Ø¼Æ¥Ø«D±`¤Ö)¡M¤£¨Ï¥Îªº¶µ¥Ø±N·|¹O®É¡C¥H jiffies ´ú¶q¡C



\item[/proc/sys/net/ipv4/inet\_peer\_minttl] \mbox{}

³Ì§C¦s¬¡´Á¶µ¥Ø¡C¦b­«²ÕºÝ¥²¶·­n¦³¨¬°÷ªº¸H¤ù(fragment)¦s¬¡´Á¡C³o­Ó³Ì§C¦s¬¡´Á¥²¶·«OÃÒ pool Åé¿n¬O§_¤Ö©ó inet\_peer\_threshold¡C¥H jiffies ´ú¶q¡C



\item[/proc/sys/net/ipv4/inet\_peer\_threshold] \mbox{}

INET peer storage ªº¾A·íÅé¿n¡C¥Ñ¦¹¥XµoÂI¶}©lªº¶µ¥Ø³£·|³Q±j¨î©ß±ó¡C¦¹¥XµoÂIÁÙ§P©w¶µ¥Øªº¦s¬¡´Á¡M¥H¤Î¼oª«¦¬¶°³q¹Lªº®É¶¡¶¡¹j¡C¶µ¥Ø¶V¦h¡M¦s¬¡´Á¶V§C¡MGC ¶¡¹j¶Vµu¡C



\item[/proc/sys/net/ipv4/ip\_autoconfig] \mbox{}

¦pªG¥D¾÷³z¹L RARP¡NBOOTP¡NDHCP¡N©ÎÃþ¦ü¤è¦¡Àò±o¨ä IP ³]©w¡M³oÀÉ·|³]¬° 1¡M§_«h¬° 0¡C



\item[/proc/sys/net/ipv4/ip\_default\_ttl] \mbox{}

«Ê¥]ªº¦s¬¡´Á¡C³]¬° 64 À³¬O¦w¥þªº¡C¦pªG±zªººô¸ô¶W¤jªº¡M¨º´N´£ª@¦¹­È¡C¤d¸U¤£­nÀH«K¶Ãª± --- ¦p¹J¨ì¸ô¥Ñ°j°é(routing loop)±N¾É­P§óÄY­«ªº¨aÃø¡C¦b¬Y¨Ç±¡§Î¤§¤U¡M±z¬Æ¦Ü·|­°§C¦¹­È¡C



\item[/proc/sys/net/ipv4/ip\_dynaddr] \mbox{}

°²¦p±z­n¥Î°ÊºA¬É­±¦ì§}°µ dial-on-demand ¡M¨º´N³]©w¥¦¡C¤@¥¹±zªº½Ð¨D¬É­±°_¨Ó¤§«á¡M©Ò¦³¬Ý¤£¨ì¦^À³ªº¥»¦a TCP socket ³£·|­«·s®¹¸j(rebound)¡M¥HÀò±o¥¿½Tªº¦ì§}¡C°²¦p¹J¨ì±Ò°Ê¬É­±ªº³s½u¦Û¤v¤£¤u§@¡M¦ý¦A¸Õ¤@¦¸«o¤S¥i¥Hªº±¡§Î¡M³]©w³o­Ó¥i¸Ñ¨M³o­Ó°ÝÃD¡C



\item[/proc/sys/net/ipv4/ip\_forward] \mbox{}

¬O§_­n®Ö¤ß¶Ç°e«Ê¥]¡C¹w³]¬OÃö³¬ªº¡C



\item[/proc/sys/net/ipv4/ip\_local\_port\_range] \mbox{}

¹ï¥~³s½u®É©Ò¨Ï¥Îªº¥»¦a°ð¤f½d³ò¡C¹w³]­È¨Æ¹ê¤WÆZ¤pªº¡R1024 ¨ì 4999¡C



\item[/proc/sys/net/ipv4/ip\_no\_pmtu\_disc] \mbox{}

¦pªG±z­nÃö³¬ Path MTU discovery --- ¤@ºØ¦b¸ô®|¤W§P©w¥i±µ¨üªº³Ì¤j¶Ç°e³æ¦ì(Maximum Transfer Unit)¼Æ­Èªº§Þ³N¡M¨º´N³]©w³o¸Ì¡C



\item[/proc/sys/net/ipv4/ipfrag\_high\_thresh] \mbox{}

IP ¸H¤ù­«²Õ©Ò»Ýªº³Ì¤j°O¾ÐÅé¡C·í°O¾ÐÅéªº ipfrag\_high\_thresh bytes ¦]¦¹¥ØªºÀò±o¤À°t¤§«á¡M¸H¤ù³B²zµ{§Ç·|ÀÁ¸m«Ê¥]¡Mª½¨ì¹F¨ì ipfrag\_low\_thresh ¬°¤î¡C



\item[/proc/sys/net/ipv4/ip\_nonlocal\_bind] \mbox{}

¦pªG±z·QÅýÀ³¥Îµ{¦¡¯à°÷®¹¸j¨ì¤@­Ó¤£ÄÝ©ó¸Ó¨t²Îªº¦ì§}¡M´N»Ý­n³]©w³o¸Ì¡C·í¾÷¾¹¨Ï¥Î«D©T©w(©Î¬O°ÊºA)½u¸ôªº®É­Ô¡M³o¥\¯à´N«Ü¦³¥Î¤F¡M¦]¦Ó¡M·í±zªº½u¸ôÂ_±¼¤§«á¡M±zªºªA°È¤´¥i±Ò°Ê¦Ó¥B®¹¸j¨ì¯S©wªº¦ì§}¤§¤W¡C



\item[/proc/sys/net/ipv4/ipfrag\_low\_thresh] \mbox{}

IP ¸H¤ù­«²Õ©Ò»Ýªº³Ì¤p°O¾ÐÅé¡C



\item[/proc/sys/net/ipv4/ipfrag\_time] \mbox{}

IP ¸H¤ù«O¯d¦b°O¾ÐÅé¤¤ªº¬í¼Æ¡C



\item[/proc/sys/net/ipv4/tcp\_abort\_on\_overflow] \mbox{}

¤@­Ó boolean ºX¼Ð¡M³B©ó¤j¶q¶i¤J³s½uªº®É­Ô±±¨î¨ä¦æ¬°¯S©Ê¡C·í¥´¶}¤§«á¡M·|Åý®Ö¤ß¦bªA°È¥X²{¶W¸üªº®É­Ô¥D°Ê°e¥X RST «Ê¥]¡C



\item[/proc/sys/net/ipv4/tcp\_fin\_timeout] \mbox{}

¦pªG socket ¬O¦³§Ú­Ì³oºÝµ²§ôªº¡Msocket «O«ù FIN-WAIT-2 ª¬ºAªº®É¶¡¡C³s½uºÝ©Î·|±¾Â_¥B¤£·|±q¥¦¨ººÝµ²§ô¡M©Î¬O¬Æ¦Ü·N¥~²×µ²(died)¡C¹w³]­È¬° 60 ¬í¡C¹L¥h¦b 2.2 ®Ö¤ß¤¤¬O 180 ¬í¡M±z¥i¥H´_­ì¥¦¡M¦ý½Ð°O¦í¡M¦pªG±zªº¾÷¾¹¬°¤@¥x¬Õ­t¸ü(underloaded) ºô­¶¦øªA¾¹¡M±z¥i¯à­n«_µÛ°O¾ÐÅé³Q¤j¶q¦º¤`«Ê¥]¶ñº¡ªº­·ÀI¡MFIN-WAIT-2 sockets ªº¦MÀI©Ê§C©ó FIN-WAIT-1  ¡M¦]¬°¥¦­Ì³Ì¦h¥u¦Y 1.5K ªº°O¾ÐÅé¡M¦ý¬O¥¦­Ì¦s¦b®É¶¡§óªø¡C¥t¥~°Ñ¦Ò tcp\_max\_orphans¡C



\item[/proc/sys/net/ipv4/tcp\_keepalive\_time] \mbox{}

·í keepalive ¥´¶}¤§«á¡MTCP ­n¦h¤[°e¥X keepalive «H®§¡C\\ 
¹w³]¬° 2 ¤p®É¡C



\item[/proc/sys/net/ipv4/tcp\_keepalive\_intvl] \mbox{}

·í¤@­Ó±´´ú(probe)¨S¦³Àò±o½T»{¤§«á¡M¹j¦h¤[­n³Q­«°e¡C\\ 
¹w³]¬O 75 ¬í¡C



\item[/proc/sys/net/ipv4/tcp\_keepalive\_probes] \mbox{}

¦b¨M©w±¾Â_³s½u¤§«e¡M­n°e¥X¦h¤Ö­Ó keepalive ±´´ú¡C\\ 
¹w³]­È¬°¡R9 ¡C\\ 
¦A­¼¤W tcp\_keepalive\_intvl¡M´N¬O¦b¤@±ø½u¸ô¦b°e¥X keepalive ¤§«á¡M©Ò¤¹³\ªº¤£¦^À³®É¶¡¡C



\item[/proc/sys/net/ipv4/tcp\_max\_orphans] \mbox{}

¹ï©ó¨º¨Ç¨S¦³ªþÄÝ©ó¥ô¦ó¨Ï¥ÎªÌÀÉ®× handle ªº TCP sockets¡M¨t²Î©Ò¯à³B²zªº³Ì¤j¼Æ¶q¡C°²¦p¶W¹L³o­Ó¼Æ¶q¡M¨º»ò³o¨ÇµL¤H¬ÝºÞªº³s½u±N·|³Q¥ß§Y­«³](reset)¡M¨Ã¦P®ÉÅã¥ÜÄµ§i«H®§¡C¤§©Ò¥H­n³]©w³o­Ó­­¨î¡M¯Âºé¬°¤F©è¿m¨º¨ÇÂ²³æªº DoS §ðÀ»¡M¤d¸U¤£­n¨Ì¿à³o­Ó©Î¬O¤H¬°ªº­°§C³o­Ó­­¨î¡M¤£¹L¡M¦pªGºô¸ô±ø¥ó»Ý­n¤ñ¹w³]­È§ó¦h¡M¦Ó¥B½Õ¾ãºô¸ôªA°ÈÀò±o©ì©µ¨Ã±j¨î©Ê¬å±¼³oÃþª¬ºA¡M«h¥i¥H´£°ª¥¦(©Î³\ÁÙ­n¼W¥[°O¾ÐÅé)¡C¦A´£¿ô¤@¦¸¡R¨C¤@­Ó³o¼Ëªº orphan ³£·|¦Y±¼ ~64K ¤£¯à¸m´«ªº°O¾ÐÅé¡C



\item[/proc/sys/net/ipv4/tcp\_orphan\_retries] \mbox{}

¦b§Ú­Ì³oºÝ¬å±¼ TCP ³s½u¤§«e¡M­n¶i¦æ¦h¤Ö¦¸­«¸Õ¡C¹w³]¬O 7 ­Ó¡M¬Û·í©ó ~50¬í - 16¤ÀÄÁ¡Mµø RTO ¦Ó©w¡C¦pªG±z¾÷¾¹¬°­t¸ü(loaded)ºô­¶¦øªA¾¹¡M±z©Î³\·|¥´ºâ­°§C³o­Ó¼Æ­È¡M³oÃþ sockets ¥i¯à·|¯Ó¶O¤j¶qªº¸ê·½¡C¥t¥~°Ñ¦Ò tcp\_max\_orphans ¡C



\item[/proc/sys/net/ipv4/tcp\_max\_syn\_backlog] \mbox{}

¹ï©ó¨º¨Ç¨ÌµMÁÙ¥¼Àò±o«È¤áºÝ½T»{ªº³s½u½Ð¨D¡M»Ý­n°O¾Ðªº³Ì¤j¼Æ¥Ø¡C¹ï©ó¶W¹L 128Mb °O¾ÐÅéªº¨t²Î¡M¹w³]­È¬O 1024 ¡M§C©ó 128Mb ªº«h¬° 128¡C¦pªG¦øªA¾¹¸g±`¥X²{¹L¸ü¡M¥i¥H¹Á¸Õ¼W¥[³o­Ó¼Æ¦r¡CÄµ§i¡T°²¦p±z±N¦¹­È³]¬°¤j©ó 1024¡M³Ì¦n­×§ï include/net/tcp.h ¸Ì­±ªº TCP\_SYNQ\_HSIZE ¡M¥H«O«ù TCP\_SYNQ\_HSIZE*16$<$=tcp\_max\_syn\_backlog ¡M¨Ã¥B½s¶i®Ö¤ß¤§¤º¡C



\item[/proc/sys/net/ipv4/tcp\_max\_tw\_buckets] \mbox{}

¨t²Î¦b¦P¤@®É¶¡¤º©Ò³B²zªº³Ì¤j timewait sockets ¼Æ¥Ø¡C¦pªG¶W¹L¦¹¼Æ¦rªº¸Ü¡Mtime-wait socket ·|³Q¥ß§Y¬å°£¨Ã¥BÅã¥ÜÄµ§i«H®§¡C¤§©Ò¥H­n³]©w³o­Ó­­¨î¡M¯Âºé¬°¤F©è¿m¨º¨ÇÂ²³æªº DoS §ðÀ»¡M¤d¸U¤£­n¤H¬°ªº­°§C³o­Ó­­¨î¡M¤£¹L¡M¦pªGºô¸ô±ø¥ó»Ý­n¤ñ¹w³]­È§ó¦h¡M«h¥i¥H´£°ª¥¦(©Î³\ÁÙ­n¼W¥[°O¾ÐÅé)¡C



\item[/proc/sys/net/ipv4/tcp\_retrans\_collapse] \mbox{}

°w¹ï¬Y¨Ç·lÃa¦Lªí¾÷ªº bug-to-bug ­Ý®e©Ê¡C©ó­«¶Ç¤W¹Á¸Õ°e¥X§ó¤jªº«Ê¥]¡M¥H¸Ñ¨M¯S©w TCP °ïÅ|¤¤ªº¯äÂÎ¡C



\item[/proc/sys/net/ipv4/tcp\_retries1] \mbox{}

·í¬Y¨Ç¨Æ±¡¤£¹ï«l¦Ó¥²¶·¦Vºô¸ô¼h³ø§i³o­Ó¥iºÃª¬ªp¤§«e¡M»Ý­n¶i¦æ¦h¤Ö¦¸­«¸Õ¡C³Ì§Cªº RFC ¼Æ­È¬O 3 ¡M³o¤]¬O¹w³]­È¡M¬Û·í©ó ~3¬í - 8¤ÀÄÁ¡Mµø RTO ¦Ó©w¡C



\item[/proc/sys/net/ipv4/tcp\_retries2] \mbox{}

¦b¬å±¼¦s¬¡ TCP ³s½u¤§«e¡M»Ý­n¶i¦æ¦h¤Ö¦¸­«¸Õ¡CRFC1122 ¸Ì­±»¡¡M³o­Ó­­¨î¥²¶·¤j©ó 100¬í¡C¦¹¼Æ¦r«D±`¤p¡C¹w³]­È¬° 15 ¡M¬Û·í©ó ~13-30¤ÀÄÁ¡Mµø RTO ¦Ó©w¡C



\item[/proc/sys/net/ipv4/tcp\_rfc1337] \mbox{}

³o­Ó boolean ·|±Ò°ÊÃö©ó 'time-wait assassination hazards in tcp' ªº­×¥¿¡M½Ð°Ñ¦Ò RFC 1337¡C¦pªG³Q¥´¶}¡M·|Åý®Ö¤ß¥á±ó¨º¨Ç³B©ó time-wait ª¬ºA sockets ¤§ RST «Ê¥]¡C\\ 
¹w³]¬° 0 ¡C



\item[/proc/sys/net/ipv4/tcp\_sack] \mbox{}

¨Ï¥Î Selective ACK¡M¥¦¥i¥H¥Î¨Ó§ä¥X¯S©wªº¿ò¥¢«Ê¥] --- ¦]¦Ó¦³§U©ó¨³³t´_­ì¡C



\item[/proc/sys/net/ipv4/tcp\_stdurg] \mbox{}

¨Ï¥Î TCP urg pointer Äæ¦ì¤¤ªº¥D¾÷½Ð¨D¸àÄÀ¥\¯à¡C\\ 
¤j³¡¥÷ªº¥D¾÷³£¨Ï¥Î¦ÑÂÂªº BSD ¸àÄÀ¡M¦]¦Ó¡M¦pªG±z¦b Linux ¥´¶}¥¦¡M©Î·|¾É­P¤£¯à©M¥¦­Ì¥¿½T·¾³q¡C\\ 
¹w³]¬°¡RFALSE



\item[/proc/sys/net/ipv4/tcp\_syn\_retries] \mbox{}

¹ï©ó¤@­Ó·s«Ø³s½u¡M®Ö¤ß­n°e¦h¤Ö­Ó SYN «Ê¥]¼Æ¤~¨M©w©ñ±ó¡C



\item[/proc/sys/net/ipv4/tcp\_synack\_retries] \mbox{}

¬°¤F»P¥t¤@ºÝ«Ø¥ß³s½u¡M®Ö¤ß·|³s¦P SYN ¤@°_°e¥X ACK ¡M¥H½T»{¦¬¨ì¤W¤@­Ó SYN¡C³o¬O©Ò¿×ªº¤T¬q¥æ´¤( threeway handshake) ªº²Ä¤G­Ó¨BÆJ¡C³o¸Ì¨M©w®Ö¤ß¦b©ñ±ó³s½u¤§«e©Ò°e¥Xªº SYN+ACK ¼Æ¥Ø¡C



\item[/proc/sys/net/ipv4/tcp\_timestamps] \mbox{}

Timestamps ¥Î¦b¨ä¥¦¤@¨ÇªF¦è¤¤¡M¥i¥H¨¾½d¨º¨Ç°°³yªº sequence ¸¹½X¡C¤@±ø 1 gigabit ªº½u¸ô©Î³\·|­«¹J¨ì±a out-of-line ¼Æ­ÈªºÂÂ sequence ¸¹½X(°²¦p¥¦¬O¥Ñ©ó¤W¦¸²£¥Íªº)¡CTimestamp ·|Åý¥¦ª¾¹D³o¬O­Ó 'ÂÂ«Ê¥]'¡C



\item[/proc/sys/net/ipv4/tcp\_tw\_recycle] \mbox{}

±Ò°Ê§Ö³t TIME-WAIT sockets ¦^¦¬¡C¹w³]­È¬O 1 ¡C°£«D±o¨ì§Þ³N±M®aªº«ØÄ³©Î­n¨D¡M½Ð¤£­n­×§ï³o­Ó­È¡C



\item[/proc/sys/net/ipv4/tcp\_window\_scaling] \mbox{}

¥¿±`¨Ó»¡¡MTCP/IP ¥i¥H±µ¨ü¤j¦Ü 65535 byte ªº windows¡C¹ï©ó°ª³tºô¸ô¡M³o©Î³\ÁÙ¬O¤£°÷ªº¡C³o­Ó windows scaling ¿ï¶µ«h¤¹³\±µªñ gigabyte ªº windows¡M³o±N¦³§U§ïµ½°ªÀW¼e©µ¿ð²£«~¡C



\end{description}



\subsubsection{³v­Ó³]³Æ³]©w (Per device settings)}

DEV ¥i¥H¥u¥Nªí¤@­Ó¯u¹ê¬É­±¡M¤]¥i¥H¬O '¥þ³¡' ©Î '¹w³]­È'¡C¦Ó¹w³]­È¤]©Î³\·|§ïÅÜ«Ø¥ßªº¬É­±³]©w¡C
\begin{description}
\item[/proc/sys/net/ipv4/conf/DEV/accept\_redirects] \mbox{}

¦pªG router »{¬°±z¦b¤£¾A·íªº¨Ï¥Î¥¦(ie¡M»Ý­n¦b¦P¤@¬É­±¤W­«°e«Ê¥])¡M¨º¥¦´N·|°e¥X¤@­Ó ICMP Redirect¡C³o©Î³\·|³y¦¨»´«×ªº¦w¥þ­·ÀI¡M©Ò¥H±z³Ì¦nÃö³¬¥¦¡M©Î¬O¨Ï¥Î secure redirects¡C



\item[/proc/sys/net/ipv4/conf/DEV/accept\_source\_route] \mbox{}

¦¹¥\¯à¨Ã¤£±`¥Î¡C¹L¥h¡M±z¥i¥Hµ¹¥X¤@­Ó IP ¦ì§}¦Cªí¡MÅý¥¦´£¨Ñ¦¹¥\¯à¡CLinux ¤]¥i¥H¹ê½î³o­Ó IP ¿ï¶µ¡C



\item[/proc/sys/net/ipv4/conf/DEV/bootp\_relay] \mbox{}

FIXME: ¦³«Ý¸É¥R



\item[/proc/sys/net/ipv4/conf/DEV/forwarding] \mbox{}

FIXME: ¦³«Ý¸É¥R



\item[/proc/sys/net/ipv4/conf/DEV/log\_martians] \mbox{}

½Ð°Ñ¦Ò°f¦V¸ô®|¹LÂo³¹¸`¡C



\item[/proc/sys/net/ipv4/conf/DEV/mc\_forwarding] \mbox{}

¬O§_¦b¸Ó¬É­±¤W¶i¦æ multicast forwarding¡C



\item[/proc/sys/net/ipv4/conf/DEV/proxy\_arp] \mbox{}

¦pªG³]¬° 1¡M¨º»ò©Ò¦³¨ä¥¦¬É­±³£·|¦^À³¥H¦¹¬É­±¬°¥Øªº¤§ arp ½Ð¨D¡C·í¬[³] 'ip pseudo bridges' ®É¬Û·í¦³¥Î¡C±Ò¥Î¦¹¥\¯à¤§«e¡M½Ð½T©w±zªº netmasks ­n«D±`¥¿½T¡C



\item[/proc/sys/net/ipv4/conf/DEV/rp\_filter] \mbox{}

½Ð°Ñ¦Ò°f¦V¸ô®|¹LÂo³¹¸`¡C



\item[/proc/sys/net/ipv4/conf/DEV/secure\_redirects] \mbox{}

FIXME: ¦³«Ý¸É¥R



\item[/proc/sys/net/ipv4/conf/DEV/send\_redirects] \mbox{}

¬O§_­n°e¥X«e­±´£¨ìªº redirects¡C



\item[/proc/sys/net/ipv4/conf/DEV/shared\_media] \mbox{}

FIXME: ¦³«Ý¸É¥R



\item[/proc/sys/net/ipv4/conf/DEV/tag] \mbox{}

FIXME: ¦³«Ý¸É¥R



\end{description}





\subsubsection{¾F±µ­ì«h (Neighbor pollicy)}

DEV ¥i¥H¥u¥Nªí¤@­Ó¯u¹ê¬É­±¡M¤]¥i¥H¬O '¥þ³¡' ©Î '¹w³]­È'¡C¦Ó¹w³]­È¤]©Î³\·|§ïÅÜ«Ø¥ßªº¬É­±³]©w¡C
\begin{description}
\item[/proc/sys/net/ipv4/neigh/DEV/anycast\_delay] \mbox{}

FIXME: ¦³«Ý¸É¥R



\item[/proc/sys/net/ipv4/neigh/DEV/app\_solicit] \mbox{}

FIXME: ¦³«Ý¸É¥R



\item[/proc/sys/net/ipv4/neigh/DEV/base\_reachable\_time] \mbox{}

FIXME: ¦³«Ý¸É¥R



\item[/proc/sys/net/ipv4/neigh/DEV/delay\_first\_probe\_time] \mbox{}

FIXME: ¦³«Ý¸É¥R



\item[/proc/sys/net/ipv4/neigh/DEV/gc\_stale\_time] \mbox{}

FIXME: ¦³«Ý¸É¥R



\item[/proc/sys/net/ipv4/neigh/DEV/locktime] \mbox{}

FIXME: ¦³«Ý¸É¥R



\item[/proc/sys/net/ipv4/neigh/DEV/mcast\_solicit] \mbox{}

FIXME: ¦³«Ý¸É¥R



\item[/proc/sys/net/ipv4/neigh/DEV/proxy\_delay] \mbox{}

FIXME: ¦³«Ý¸É¥R



\item[/proc/sys/net/ipv4/neigh/DEV/proxy\_qlen] \mbox{}

FIXME: ¦³«Ý¸É¥R



\item[/proc/sys/net/ipv4/neigh/DEV/retrans\_time] \mbox{}

FIXME: ¦³«Ý¸É¥R



\item[/proc/sys/net/ipv4/neigh/DEV/ucast\_solicit] \mbox{}

FIXME: ¦³«Ý¸É¥R



\item[/proc/sys/net/ipv4/neigh/DEV/unres\_qlen] \mbox{}

FIXME: ¦³«Ý¸É¥R



\end{description}





\subsubsection{¸ô¥Ñ³]©w (Routing settings)}

\begin{description}
\item[/proc/sys/net/ipv4/route/error\_burst] \mbox{}

FIXME: ¦³«Ý¸É¥R



\item[/proc/sys/net/ipv4/route/error\_cost] \mbox{}

FIXME: ¦³«Ý¸É¥R



\item[/proc/sys/net/ipv4/route/flush] \mbox{}

FIXME: ¦³«Ý¸É¥R



\item[/proc/sys/net/ipv4/route/gc\_elasticity] \mbox{}

FIXME: ¦³«Ý¸É¥R



\item[/proc/sys/net/ipv4/route/gc\_interval] \mbox{}

FIXME: ¦³«Ý¸É¥R



\item[/proc/sys/net/ipv4/route/gc\_min\_interval] \mbox{}

FIXME: ¦³«Ý¸É¥R



\item[/proc/sys/net/ipv4/route/gc\_thresh] \mbox{}

FIXME: ¦³«Ý¸É¥R



\item[/proc/sys/net/ipv4/route/gc\_timeout] \mbox{}

FIXME: ¦³«Ý¸É¥R



\item[/proc/sys/net/ipv4/route/max\_delay] \mbox{}

FIXME: ¦³«Ý¸É¥R



\item[/proc/sys/net/ipv4/route/max\_size] \mbox{}

FIXME: ¦³«Ý¸É¥R



\item[/proc/sys/net/ipv4/route/min\_adv\_mss] \mbox{}

FIXME: ¦³«Ý¸É¥R



\item[/proc/sys/net/ipv4/route/min\_delay] \mbox{}

FIXME: ¦³«Ý¸É¥R



\item[/proc/sys/net/ipv4/route/min\_pmtu] \mbox{}

FIXME: ¦³«Ý¸É¥R



\item[/proc/sys/net/ipv4/route/mtu\_expires] \mbox{}

FIXME: ¦³«Ý¸É¥R



\item[/proc/sys/net/ipv4/route/redirect\_load] \mbox{}

FIXME: ¦³«Ý¸É¥R



\item[/proc/sys/net/ipv4/route/redirect\_number] \mbox{}

FIXME: ¦³«Ý¸É¥R



\item[/proc/sys/net/ipv4/route/redirect\_silence] \mbox{}

FIXME: ¦³«Ý¸É¥R

\end{description}







\section{¬y¶q±±ºÞ¤§ backbone µ{¦¡ (Backbone applications of traffic control)}

¥»³¹¶È§@¬° backbone routing ªº²L¤¶¡M³q±`¥Î¦b {$>$}100 megabit ÀW¼e¤W¡M¦Ó¥B¥¦©Ò»Ýªº§Þ³N©M±z®a¤¤ªº ADSL ¤j¬Û®|®x¡C




\subsection{¸ô¥Ñ¾¹¦î¦C (Router queues)}

¦b Internet ¤W­±¡Mrouter queue ªº¥¿±`¦æ¬°¯S©ÊºÙ¬° tail-drop¡CTail-drop ´N¬O·í¦î¦C¹F¨ì¤@©w¼Æ¶q¤§«á¡M´N¶}©l±N©Ò¦³ '·¸¥X' ªº¬y¶q¥á±ó±¼¡C³o¨ä¹ê«Ü¤£¤½¥­¡M¦Ó¥B¤]·|¾É­P¦P¨B­«¶Ç(retransmit synchronisation)¡C·í¦P¨B­«¶Çµo¥Í¤§«á¡M¤w¸gº¡¸üªº¸ô¥Ñ©Ò¥á±óªºÀþ¶¡¬y¶q¡M·|¾É­P¥t¤@ªi©µ¿ðªºÀþ¶¡¬y¶q­«¶Ç¡M³o¼Ë¤S·|­«·s¶ñº¡¤w¸g¾Ö¶ëªº router¡C

¬°¤F§´µ½³B²z½u¸ôªºÀþ¶¡¾Ö¶ë¡Mbackbone routers ³q±`·|¸Ë³Æ¸û¤jªº¦î¦C¡CµM¤£©¯ªº¬O¡M³o¨Ç¦î¦CÁöµM¥i§ïµ½§]¦R¶q(throughput)¡M¦ý«o¤j¤jªº¥[­«©µ¿ð¡M¥B¾É­P TCP ³s½u¦b¾Ö¶ëªº®É­ÔÅÜ±o¸g±`©Êªº¬y¶qÀþ¼W¡C

³o¨Ç¦ñÀHµÛ tail-drop ¦Ó¨Óªº¹úºÝ¡M¤w¦b Internet ¤W¤£Â_ªº³y¦¨§xÂZ¡M³o¬O¥Ñ©ó¤@¨Ç¤£¤Q¤À¤Íµ½(unfriendly)ªººô¸ôµ{¦¡¨Ï¥Î¶q¤£Â_¼W¥[¤§¬G¡C¦³¨£¤Î¦¹¡MLinux ®Ö¤ß¦V§Ú­Ì´£¨Ñ©Ò¿×ªº RED (Random Early Detect) ¾÷¨î¡C

RED ¨Æ¹ê¤W¤]¤£¬O¤°»ò¸UÆFÃÄ¡M¤£·V²_¬°¹ê§@«ü¼Æ­Ë°h(implement exponential backoff)ªºµ{¦¡¡M¨ÌµM¤Þ°_ÀW¼eªº¤À°t¤£¤½¡MµM¦Ó¡M¦³¤F RED¡M¥iÅý¥L­Ì¤£¦Ü¹ï¨ä¥¦³s½uªº§]¦R¶q©M©µ¿ð³y¦¨¤Ó¤j¶Ë®`¡C

²Î­p¤W¡M RED ¦b¥¦¹F¨ìµw¬É­­(hard limit)¤§«e¡M´N·|±q¬yµ{(flows)¤W¥á±ó«Ê¥]¡C³o·|Åý¤w¾Ö¶ëªº°©·F½u¸ô·Å©M¦a©ñºC¡M¨Ã¨¾¤î¦P¨B­«¶Ç¡C³o¤]¦³§U©ó TCP §ó¨³³tªº¥á±ó³¡¥÷«Ê¥]¡M¥H«O«ù¦î¦CÅé¿n©ó¸û§C­È¡M¤Î¦³®Ä±±¨î©µ¿ð¡M±q¦Ó§ó§Öªº§ä¥X¨ä '¤½¥­' ³t«×¡C«Ê¥]±q¯S©w³s½u¤W³Q¥á±óªº¾÷²v¡M¤]¦¨¤ñ¨Òªº¬ÛÀ³©ó¨äÀW¼e¨Ï¥Î¶q¡M¦Ó«D«Ê¥]ªº¶Ç°e¼Æ¶q¡C

Ãö©ó backbone¡M¥ú¬O¤½¥­©Ê¦î¦C©Ò»Ýªº per-session ª¬ºA°lÂÜ¤§½ÆÂø©Ê¡M´N¥O±z·q¦Ó»·¤§¡M´N³oÂI¦Ó¨¥¡M RED µLºÃ¬O«D±`Àu¨qªº¦î¦C§Þ³N¡C

¦p­n¨Ï¥Î RED¡M±z¥²¶·¨M©w¦n¤T­Ó°Ñ¼Æ¡RMin¡NMax¡N¤Î burst¡CMin ¥Î¨Ó³]©w¶}©l¥á±ó¬y¶q¤§«eªº³Ì¤p¦î¦CÅé¿n¡M¥H byte ¬°³æ¦ì¡QMax «h¬O¦¹ºtºâªk©Ò¯à«O«ùªº³n©Ê(soft)³Ì¤j­È¡Q¦Ó burst «h³]©w 'Àþ¼W§]¦R¬y¶q' ªº³Ì¤j«Ê¥]¼Æ¥Ø¡C

±z­n®Ú¾Ú¹w­pªº¦î¦C©µ¿ð¡M¦A­¼¥H±zªºÀW¼e¡M¨Ó­pºâ¥X min ªº³]©w­È¡C¤ñ¤è»¡¡M¦b§Úªº 64kbit/s ªº ISDN ½u¸ô¤W¡M§Ú·Q­n¦î¦Cªº°ò¥»©µ¿ð¬° 200ms¡M¨º§Ú´N±N min ³]¬° 1600 bytes¡C¦pªG min ³]±o¤Ó¤p¡M·|­°§C§]¦R¶q¡Q¦p¤Ó¤j¡M«h¥[­«©µ¿ð¡C¦b¤@±ø§C³t½u¸ô¤W¡M¥H­°§C MTU ¨Ó§ï¶i¤¬°Ê¦^À³(interactive response)ªº¿ìªk¡M¨Ã¤£¯à¾a­°§C min ³]©w¨Ó§@¬°´À¥N¤è®×¡C

±z³Ì¦n±N max ³]¬° min ªº°_½X¨â­¿¥H¤W¡M¥H¹w¨¾¦P¨B¡C¦b¸û§Cªº min ­Èªº§C³t½u¸ô¤W¡M±N max ³]¬° min ªº¥|­¿©Î§ó¦h¡MÀ³¬O©ú´¼¤§Á|¡C

¦Ü©ó burst¡M«h¬O¥Î¨Ó±±¨î RED ºtºâªk¦p¦ó¹ïÀþ¼W¬y¶q°µ¥X¤ÏÀ³¡CBusrt ¥²¶·³]©w¬°¤j©ó min/avpkt¡C¹êÅç¤W¡M§Úµo²{ (min+min+max)/(3*avpkt) ¤]¦æ±o³q¡C

¥t¥~¡M±zÁÙ­n³]©w limit ©M avpkt ¡CLimit ¬O¤@­Ó¦w¥þ­È¡M·í¦î¦C¨ì¹F limit bytes ¤§«á¡MRED ´N·| 'ÅÜ¦¨' tail-drop ¼Ò¦¡¡C§Ú³q±`±N limit ³]¬° max ªº 8 ­¿¼Æ¡C¦Ó avpkt ´N¬O¥­§¡«Ê¥]Åé¿n¡C¦b 1500byte MTU ªº°ª³t Internet ½u¸ô¤W³]¬° 1000 ¬O¥i¥H±µ¨üªº¡C

¬ÛÃö§Þ³N¸ê®Æ¡M½Ð°Ñ¦Ò Sally Floyd ©M Van Jacobson ªº \nameurl{http://www.aciri.org/floyd/papers/red/red.html}{the paper on RED queueing} ¡C

FIXME: ¦h¦h¯qµ½¡C¨S¿ù¡M´N¬O greg ¥S *±z* °Õ :-) - «¢






\section{­¹ÃÐ (Cookbook)}

¥»³¹©Ò¥]§tªº 'cookbook' ³æ¤¸¡MÀ³¥iÀ°±z¸Ñ¨M¤@¨Ç°ÝÃD¡CµM¦Ó¡MÂ÷¶}¤F­ì²zªº²z¸Ñ¡MÁa¦³ cookbook ¤]ªPµM¡M©Ò¥H¡M½Ð¥ý·Å¬G¦Óª¾·s¡C






\subsection{¥H¤£¦Pªº SLA ¨Ó¶]¦h­Ó¯¸ÂI (Running multiple sites with different SLAs)}

±z¥i¥H¥Î¦n¦h¤èªk¨Ó°µ°Õ¡CApache ´N¥i¥H³z¹L¼Ò²Õ¨Ó¹F¨ì¬Y¨Ç¤ä´©¡M¤£¹L§Ú­Ì³o¸Ì­n±Ð±z¥Î Linux «ç¼Ë°µ¡M¨Ã¥BÁ|¤@¤Ï¤T¡M±N¨ä¥¦ªA°È¤]¤@¨Ö·d©w¡C³o¨Ç©R¥O³£°½®v¦Û¤U­±´£¨ìªº Jamal Hadi ªººtÁ¿ ¡C

°²³]§Ú­Ì¦³¨â­Ó«È¤á¡M­n´£¨Ñ http¡Nftp¡NÁÙ¦³ streaming audio ªA°È¡M§Ú­Ì¥u¥´ºâ½æµ¹¥L­Ì¤@©w¼Æ¶qªºÀW¼e¦Ó¤w¡C¨º§Ú­Ì¥i¥H¦b¦øªA¾¹¤W­±°µ¤â¸}¡C

«È¤á A ³Ì¦h¥u¦³ 2 megabits¡M¦Ó«È¤á B ¤w¸g¤ä¥I 5 megabits ªº¿ú¤F¡C¨º§Ú­Ì¦b¦øªA¾¹¤W«Ø¥ßµêÀÀ IP ¦ì§}¡M¨Ó±N«È¤á¤À¶}¨Ó¡C

\begin{tscreen}
\begin{verbatim}
# ip address add 188.177.166.1 dev eth0
# ip address add 188.177.166.2 dev eth0
\end{verbatim}
\end{tscreen}


¥H­þ¨Ç¾A¦Xªº¦ì§}¨Ó¤À°tµ¹¤£¦Pªº¦øªA¾¹¡M«h±x±q´L«K¤F¡C©Ò¦³±`¥Î daemon ³£¤ä´©³oª±·N¡C

±µµÛ¡M§Ú­Ì­º¥ý±N CBQ adisc «ü¬£µ¹ eth0¡R
\begin{tscreen}
\begin{verbatim}
# tc qdisc add dev eth0 root handle 1: cbq bandwidth 10Mbit cell 8 avpkt 1000 \
  mpu 64
\end{verbatim}
\end{tscreen}


µM«á¡M¬°§Ú­Ìªº«È¤á«Ø¥ßÃþ§O(classes)¡R

\begin{tscreen}
\begin{verbatim}
# tc class add dev eth0 parent 1:0 classid 1:1 cbq bandwidth 10Mbit rate \
  2MBit avpkt 1000 prio 5 bounded isolated allot 1514 weight 1 maxburst 21
# tc class add dev eth0 parent 1:0 classid 1:2 cbq bandwidth 10Mbit rate \
  5Mbit avpkt 1000 prio 5 bounded isolated allot 1514 weight 1 maxburst 21
\end{verbatim}
\end{tscreen}


¦A¨Ó¡M§Ú­Ì¬°³o¨â­ÓÃþ§O¼W¥[¹LÂo¾¹¡R
\begin{tscreen}
\begin{verbatim}
##FIXME: Why this line, what does it do?, what is a divisor?:
##FIXME: A divisor has something to do with a hash table, and the number of
##       buckets - ahu
# tc filter add dev eth0 parent 1:0 protocol ip prio 5 handle 1: u32 divisor 1
# tc filter add dev eth0 parent 1:0 prio 5 u32 match ip src 188.177.166.1
  flowid 1:1
# tc filter add dev eth0 parent 1:0 prio 5 u32 match ip src 188.177.166.2
  flowid 1:2
\end{verbatim}
\end{tscreen}


³o¼Ë¡M´N¤j¥\§i¦¨¤F°Õ¡C

FIXME: ¬°¦ó¤£¥Î token bucket ¹LÂo¾¹¡SÁÙ¬O¹w³]ªº pfifo\_fast ºM¥X¤F¡S

\label{SYN}


\subsection{À°¶Q¥D¾÷©è¿m SYN floods (Protecting your host from SYN floods)}

®Ú¾Ú Alexey ªº iproute ¤å¥ó¡M¤w¥i¥H©M netfiler ·f°t¤F¡M¥B¦³¦n¨Ç¬Ý¨Ó¤£¿ùªº³~¸g¡C¦pªG±z­n¨Ï¥Î³o­Ó¡M½Ð¤p¤ß½Õ¾ã¨º¨Ç¼Æ¦r¡M°w¹ï±zªº¨t²Îµ¹¤©¦X²zªº¼Æ­È¡C

°²¦p±z·Q­n«OÅ@¾ã­Óºô¸ô¡M¥i¥H¸õ¹L³o¸Ì¡M³o¸Ì¬O°w¹ï³æ¤@¥D¾÷¦Ó¤wªº¡C

\begin{tscreen}
\begin{verbatim}
#! /bin/sh -x
#
# sample script on using the ingress capabilities
# this script shows how one can rate limit incoming SYNs
# Useful for TCP-SYN attack protection. You can use
# IPchains to have more powerful additions to the SYN (eg 
# in addition the subnet)
#
#path to various utilities;
#change to reflect yours.
#
TC=/sbin/tc
IP=/sbin/ip
IPTABLES=/sbin/iptables
INDEV=eth2
#
# tag all incoming SYN packets through $INDEV as mark value 1
############################################################ 
$iptables -A PREROUTING -i $INDEV -t mangle -p tcp --syn \
  -j MARK --set-mark 1
############################################################ 
#
# install the ingress qdisc on the ingress interface
############################################################ 
$TC qdisc add dev $INDEV handle ffff: ingress
############################################################ 

#
# 
# SYN packets are 40 bytes (320 bits) so three SYNs equals
# 960 bits (approximately 1kbit); so we rate limit below
# the incoming SYNs to 3/sec (not very useful really; but
#serves to show the point - JHS
############################################################ 
$TC filter add dev $INDEV parent ffff: protocol ip prio 50 handle 1 fw \
police rate 1kbit burst 40 mtu 9k drop flowid :1
############################################################ 


#
echo "---- qdisc parameters Ingress  ----------"
$TC qdisc ls dev $INDEV
echo "---- Class parameters Ingress  ----------"
$TC class ls dev $INDEV
echo "---- filter parameters Ingress ----------"
$TC filter ls dev $INDEV parent ffff:

#deleting the ingress qdisc
#$TC qdisc del $INDEV ingress
\end{verbatim}
\end{tscreen}



\subsection{¥H ICMP ³t²v­­¨î©è¾× dDoS (Ratelimit ICMP to prevent dDoS)}

¥Ø«e¨Ó»¡¡M¤À´²¦¡ªA°ÈÅõºÈ(distributed denial of service)§ðÀ»¤w¸g¦¨¬° Internet ¤WÀY¸¹ÄÌÂZ¦æ¬°¡C¹ï¶Qºô¸ô¨Ï¥Î¾A·íªº¹LÂo©M³t²v­­¨î¡M¥iÅý±z¬JÁ×§K¦¨¬°¯¥¦Ç¡M¤]Á×§K¦¨¬°¯¥¤â¡M¤@½bÂùÀJ¡C

¦pªG±z­n¹ïºô¸ô°µ¹LÂo¡M¨º±z©Î³\·|¤£Åý«D¥»¦a IP ¨Ó·½¦ì§}ªº«Ê¥]Â÷¶}¶Qºô¸ô¡C³o¥i¥H¨î¤î§O¤H¥H°Î¦W¨­¥÷¹ï internet µo°e©U§£¡C





¦p«e­±¤¶²Ðªº¡M³t²v­­¨î¦Ò¼{±o§ó¬O¶gªø¡C¦A¬Ý¬Ý¤U­±ªº ASCII ¹Ï¨Ò¡MÀ°±z­«·Å¤@¤U¡R

\begin{tscreen}
\begin{verbatim}
[The Internet] ---<E3, T3, whatever>--- [Linux router] --- [Office+ISP]
                                      eth1          eth0
\end{verbatim}
\end{tscreen}


Åý§Ú­Ì¥ý±N«e´£³¡¥÷³]©w°_¨Ó§a¡R

\begin{tscreen}
\begin{verbatim}
# tc qdisc add dev eth0 root handle 10: cbq bandwidth 10Mbit avpkt 1000
# tc class add dev eth0 parent 10:0 classid 10:1 cbq bandwidth 10Mbit rate \
  10Mbit allot 1514 prio 5 maxburst 20 avpkt 1000
\end{verbatim}
\end{tscreen}


°²¦p±z¦³ 100Mbit¡M©Î¬O§ó§Öªº¬É­±¡M½Ð½Õ¾ã³o¨Ç¼Æ¦r¡C²{¦b±z»Ý­n§P©w­n¤¹³\¦h¤jªº ICMP ¬y¶q¡C±z¥i¥H¥Î tcpdump ¶i¦æ´ú¶q¡M±Nµ²ªG¼g¶i¤@­ÓÀÉ®×¡MµM«á¹L¤@·|¬Ý¬Ý¦³¦h¤Ö ICMP «Ê¥]³q¹Lºô¸ô¡C½Ð¤£­n§Ñ°O±N´ú¶q®É¶¡©Ôªø¤@ÂI¡C

¦pªG´ú¶qµ²ªG¬Ý°_¨Ó¤£¤Á¹ê»Ú¡M¨º±z¥i¥H¥H¥i¥ÎÀW¼eªº 5\% ¨Ó­pºâ¡C¨º´NÅý§Ú­Ì§âÃþ§O³]¦n§a¡R
\begin{tscreen}
\begin{verbatim}
# tc class add dev eth0 parent 10:1 classid 10:100 cbq bandwidth 10Mbit rate \
  100Kbit allot 1514 weight 800Kbit prio 5 maxburst 20 avpkt 250 \
  bounded
\end{verbatim}
\end{tscreen}


¥Ø«eªº­­¨î¬° 100Kbit¡C±µ¤U¨Ó§Ú­Ì»Ý­n¤@­Ó¹LÂo¾¹¡M±N ICMP ¬y¶q¼·µ¹³o­ÓÃþ§O¡R
\begin{tscreen}
\begin{verbatim}
# tc filter add dev eth0 parent 10:0 protocol ip prio 100 u32 match ip
  protocol 1 0xFF flowid 10:100
\end{verbatim}
\end{tscreen}





\subsection{¬°¤¬°Ê¬y¶q±ÆÀu¥ý¦¸§Ç (Prioritizing interactive traffic)}

¦pªG¦³¤j¶qªº¼Æ¾Ú¶Ç¤J±zªº½u¸ô¡M©Î¬O¤Ï¦V¶Ç¥X¡M¦Ó±z»Ý­n¥Î telnet ©Î ssh ¶i¦æ¬Y¨ÇºûÅ@¤u§@¡M³o©Î³\¤£¤Q¤À²z·Q¡M¦]¬°¨ä¥¦«Ê¥]©Î·|¥´Â_±zªºÁä½L¾Þ§@¡C°²¦p¦³¿ìªkÅý³o¨Ç¤¬°Ê«Ê¥]±q³o¨Ç¤j¶ôªº¬y¶q©³¤U·t´ç³¯­Ü¡M´N³Ì¦n¤£¹L¤F¡CLinux ¥i¥HÀ°±z°µ¨ì®@¡T

¦p«e¡M§Ú­Ì»Ý­n¾ÞÁaÂù¦Vªº¬y¶q¡CÅãµM¡M¦pªG½u¸ô¨âºÝ³£¦³ Linux ¾÷¾¹´N³Ì²z·Q¤F¡M·íµM¨ä¥¦ UNIX's ¤]¥i¥H°µ±o¨ì°Õ¡C³oÂI¡M´N½Ð±Ð±z¨­Ãäªº Solaris/BSD °ª¤âÅo¡C

¼Ð·Çªº pfifo\_fast ±Æµ{¤èªk±a¦³ 3 ­Ó¤£¦Pªº 'bands'¡C·í band1 ©M band2 ³£¬y¶qÀò±o¤§«á¡M¦b band0 ªº¬y¶q·|¥ý¶Ç°e¡C¦Ü¬°ÃöÁäªº¬O¡M§Ú­Ìªº¤¬°Ê¬y¶q¤@©w­n¦b band0 ¸Ì­±¡T

§Ú­Ì°®¯Ü©ú¥Ø±iÁxªº§ï½s(§Y±N²^¨Oªº) ipchains HOWTO ¦n¤F¡R

¦b IP ¼ÐÀY¤¤¡M¦³ 4 ­Ó¦ì¤¸¨Ã¤£±`¥Îªº¡MºÙ¬° Type of Service (TOS) ¦ì¤¸¡C¥¦­Ì·|¼vÅT«Ê¥]³Q³B²zªºµ{§Ç¡Q³o 4 ­Ó¦ì¤¸¤À§O¬O¡R"Minimum Delay"¡N"Maximum Throughput"¡N"Maximum Reliability"¡N©M "Minimum"¡C¥¦­Ì¥|ªÌ¡M¥u¯à³]©w¨ä¤@¡CIpchains ¤§ TOS-mangling §@ªÌ¡MRob van Nieuwkerk¡M´¿§@¦p¤U­z¡R

\begin{tscreen}
¹ï§Ú¦Ó¨¥¡M"Minimum Delay" µS¬°­«­n¡C§Ú¬°¤F¨º¨Ç¡§¤¬°Ê¡¨«Ê¥]
¦b§Úªº¤W¶Ç(Linux) router ¤W±N¤§¥´¶}¡C§Ú¥u¥Î¤@±ø 33k6 ªº modem 
½u¸ô¦Ó¤w¡CLinux ±N«Ê¥]ªºÀu¥ý¶¶§Ç±Æ¶i 3 ­Ó¦î¦C¤¤¡C³o¼Ë¡M
¦b§Ú¶i¦æ¤j¶q¤U¸üªº®É­Ô¡MÁÙ¥i¥HÀò±o¤@­Ó¥i±µ¨üªº¤¬°Ê®Ä¯à¡C
\end{tscreen}


³Ì±`¨£ªº°µªk¬O±N telnet ©M ftp control ³s½u³]¬° "Minimum Delay" ¡M¦Ó FTP data ³]¬° "Maximum Throughput"¡C¦b±zªº¤W¶Ç router ¤W¡M¥i¥H¦p¤U¨º¼Ë°Ê§@¡R

\begin{tscreen}
\begin{verbatim}
# iptables -A PREROUTING -t mangle -p tcp --sport telnet \
  -j TOS --set-tos Minimize-Delay
# iptables -A PREROUTING -t mangle -p tcp --sport ftp \
  -j TOS --set-tos Minimize-Delay
# iptables -A PREROUTING -t mangle -p tcp --sport ftp-data \
  -j TOS --set-tos Maximize-Throughput
\end{verbatim}
\end{tscreen}


¦n¤F¡M³o¥u¹ï¨º¨Ç telnet ¤Î±q¥~­±°e¨Ó¥»¦a¥D¾÷ªº¼Æ¾Ú¦³®Ä¦Ó¤w¡C¨ä¥¦±z¤]­n¤@¤@³]¦n¡M¨Ò¦p telnet¡Nssh¡NªB¤Íªº¡M©Ò¦³¥~°e«Ê¥]ªº TOS Äæ¦ì¥þ¦Û°Ê³]¦n¡C

¦pªG«È¤áºÝ¨Ã«D³]©w¦p¦¹¡M¨º±z¥i¥H¥Î netfilter ¨Ó°µ¡C©ó±zªº¥»¾÷¤W¡R

\begin{tscreen}
\begin{verbatim}
# iptables -A OUTPUT -t mangle -p tcp --dport telnet \
  -j TOS --set-tos Minimize-Delay
# iptables -A OUTPUT -t mangle -p tcp --dport ftp \
  -j TOS --set-tos Minimize-Delay
# iptables -A OUTPUT -t mangle -p tcp --dport ftp-data \
  -j TOS --set-tos Maximize-Throughput
\end{verbatim}
\end{tscreen}





\subsection{¥Î netfilter¡Niproute2¡Nipchains¡N¤Î squid °µ³q³z©Ê web-caching (Transparent web-caching using netfilter, iproute2, ipchains and squid)}

\label{SQUID}
¥»³¹¸`¥Ñ Internet for Education (®õ°ê) ªºÅªªÌ Ram Narula ´£¨Ñ¡C

¥H Linux ¨Ó°µªº¸Ü¡M±`³W§Þ¥©¤W©Î·|±Ä¥Î ipchains¡M¡M±N "¥~°e" ªº port 80(web) ¬y¶q°e©¹¦øªA¾¹©Ò¶]ªº squid ªA°Èµ{¦¡¡C

¦³ 3 ºØ±`¨£¿ìªk¥i½T©w "¥~°e" ªº port 80(web) ¬y¶q·|°e©¹¦øªA¾¹©Ò¶]ªº squid ªA°Èµ{¦¡¡M¦Ó²Ä 4 ºØ±N¬O³o¸Ìªº­«ÀYÀ¸¡C

\begin{description}
\item[¥ÎºôÃö router ¨Ó°µ] \mbox{}

§i¶DºôÃö router ±N¥~°e¥ØªººÝ°ð¤f¬° 80 ªº«Ê¥]¡M°e¨ì squid ¦øªA¾¹ªº IP ¦ì§}¤W¡C

¦ý¬O

³o·|ÃB¥~¼W¥[ router ªº­t¸ü¡M¦Ó¥B¦³¨Ç°Ó·~ routers ¥¼¥²¤ä´©³oºØ°µªk¡C



\item[¥Î Layer 4 switch ¨Ó°µ] \mbox{}

Layer 4 switch µ´¹ï¯à³Ó¥ô¦¹¶µ¤u§@¡C

¦ý¬O

¦¹Ãþ³]³Æªº¦¨¥»«D±`°ª¡C¤@¯ë¦Ó¨¥¡MLayer 4 switch ªº¦¨¥»¬Æ¦Ü¤ñ router ¥[¤@¥x¦nªº Linux ¦øªA¾¹ÁÙ­n°ª¡C



\item[¥Î cache ¦øªA¾¹¨Ó°µºôÃö] \mbox{}

±z¥i¥H±j­¢©Ò¦³¬y¶q³£¸g¹L cache ¦øªA¾¹¡C

¦ý¬O

³o¦³ÂI«_ÀI¡M¦]¬° Squid ·|¯Ó±¼¬Û·íªº cpu ¸ê·½¡M©Î·|³y¦¨¾ãÅéªººô¸ô®Ä¯à­°§C¡M©Î¬O¦øªA¾¹·í±¼¦Ó½Ö¤]³s¤£¤W internet¡C



\item[Linux+NetFilter router] \mbox{}

NetFilter ¥i¥H´£¨Ñ¥t¤@¥i¦æ¤â¬q¡M´N¬O¥Î NetFilter ¨Ó±N¨º¨Ç¥ØªººÝ°ð¤f¬° 80 ªº«Ê¥] "¼ÐÃÑ" °_¨Ó¡M¦P®É¥Î iproute2 ±N¤w "¼ÐÃÑ" ªº«Ê¥]°e¨ì Squid ¦øªA¾¹¨º¸Ì¡C

\end{description}

\begin{tscreen}
\begin{verbatim}
|----------------|
| Implementation |
|----------------|

 Addresses used
 10.0.0.1 naret (NetFilter server)
 10.0.0.2 silom (Squid server)
 10.0.0.3 donmuang (Router connected to the internet)
 10.0.0.4 kaosarn (other server on network)
 10.0.0.5 RAS
 10.0.0.0/24 main network
 10.0.0.0/19 total network

|---------------|
|Network diagram|
|---------------|

Internet
|
donmuang
|
------------hub/switch----------
|        |             |       |
naret   silom        kaosarn  RAS etc.
\end{verbatim}
\end{tscreen}

­º¥ý¡M½T©w naret ¬°¹w³]ºôÃö(°£ silom ¥~)¡MÅý©Ò¦³¬y¶q§¡³q¹L¥¦¡C¦Ó silom ªº¹w³]ºôÃö¥²¶·¬O donmuang(10.0.0.3)¡M­n¤£µM·|²£¥Í¬y¶q°j°é(loop)¡C



(ºô¸ô¤¤ªº©Ò¦³¦øªA¾¹³£¥H 10.0.0.1 ¬°¹w³]ºôÃö¡M¤]´N¬O donmuang router ªºÂÂ IP ¦ì§}¡M©Ò¥H§Ú±N donmuang ªº IP ³]¬° 10.0.0.3¡M¦Ó±N 10.0.0.1 µ¹ naret ¥Î¡C)

\begin{tscreen}
\begin{verbatim}
Silom
-----
-setup squid and ipchains 
\end{verbatim}
\end{tscreen}




¦b silom ¤W­±³]©w Squid ¦øªA¾¹¡M­n½T©w¥¦¯à¤ä´©³q³z©Ê caching/proxying¡M¨ä¹w³]°ð¤f³q±`¬° 3128¡MµM«á¡M©Ò¦³µ¹ port 80 ªº¬y¶q³£·|³QÂà°e¨ì¥»¾÷°ð¤f 3128¡C¥Î ipchains ªº¸Ü¡M¥i¥H³o¼Ë°µ¡R

\begin{tscreen}
\begin{verbatim}
silom# ipchains -N allow1
silom# ipchains -A allow1 -p TCP -s 10.0.0.0/19 -d 0/0 80 -j REDIRECT 3128
silom# ipchains -I input -j allow1
\end{verbatim}
\end{tscreen}




 

©Î¬O¡Mnetfilter ¨Ó°µ¡R
\begin{tscreen}
\begin{verbatim}
silom# iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128
\end{verbatim}
\end{tscreen}


(ª`·N¡R±z©Î³\ÁÙ¦³¨ä¥¦¶µ¥Øªº³]©w)



Ãö©ó Squid ¦øªA¾¹ªº§ó¦h³]©w¸ê®Æ¡M½Ð°Ñ¦Ò Squid ªº faq ¡R\nameurl{http://squid.nlanr.net}{http://squid.nlanr.net})¡C



½Ð½T©w¦b³o¥x¦øªA¾¹¤W­±±N ip forwarding ¥\¯à¥´¶}¡MÁÙ¦³¡M³o­Ó¦øªA¾¹ªº¹w³]ºôÃö¬O donmuang (¦Ó¤£¬O naret)¡C

\begin{tscreen}
\begin{verbatim}
Naret
-----
-setup iptables and iproute2
-disable icmp REDIRECT messages (if needed)
\end{verbatim}
\end{tscreen}


\begin{enumerate}
\item ±N¥Øªº°ð¤f¬° 80 ªº«Ê¥] "¼ÐÃÑ" ¬°¼Æ­È 2
\begin{tscreen}
\begin{verbatim}
 
naret# iptables -A PREROUTING -i eth0 -t mangle -p tcp --dport 80 \
 -j MARK --set-mark 2
\end{verbatim}
\end{tscreen}
\item ³]©w¦n iproute2¡M±N "¼ÐÃÑ" ¬° 2 ªº«Ê¥]°e¨ì silom ¨ºÃä
\begin{tscreen}
\begin{verbatim}
naret# echo 202 www.out >> /etc/iproute2/rt_tables
naret# ip rule add fwmark 2 table www.out
naret# ip route add default via 10.0.0.2 dev eth0 table www.out
naret# ip route flush cache
\end{verbatim}
\end{tscreen}

¦pªG donmuang ©M naret ³£¦b¦P¤@ subnet ¤Wªº¸Ü¡M¨º naret ´N¤£­n°e¥X REDIRECT ªº icmp °T®§¤F¡C³o®É­Ô¡M«ö¦p¤U¤èªk±N icmp REDIRECT Ãö³¬¡R
\begin{tscreen}
\begin{verbatim}
naret# echo 0 > /proc/sys/net/ipv4/conf/all/send_redirects
naret# echo 0 > /proc/sys/net/ipv4/conf/default/send_redirects
naret# echo 0 > /proc/sys/net/ipv4/conf/eth0/send_redirects
\end{verbatim}
\end{tscreen}


\end{enumerate}


¦p¦¹¡M©Ò¦³³]©w³£§¹¦¨¤F¡M½Ð¦^¥hÀË¬d¤@¤U¡R

\begin{tscreen}
\begin{verbatim}
On naret:

naret# iptables -t mangle -L
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         
MARK       tcp  --  anywhere             anywhere           tcp dpt:www MARK set 0x2 

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

naret# ip rule ls
0:      from all lookup local 
32765:  from all fwmark        2 lookup www.out 
32766:  from all lookup main 
32767:  from all lookup default 

naret# ip route list table www.out
default via 203.114.224.8 dev eth0 

naret# ip route   
10.0.0.1 dev eth0  scope link 
10.0.0.0/24 dev eth0  proto kernel  scope link  src 10.0.0.1
127.0.0.0/8 dev lo  scope link 
default via 10.0.0.3 dev eth0 

(make sure silom belongs to one of the above lines, in this case
it's the line with 10.0.0.0/24)

|------|
|-DONE-|
|------|
\end{verbatim}
\end{tscreen}



\subsubsection{¹ê§@¤§«áªº¬y¶q¬yµ{¹Ï (Traffic flow diagram after implementation)}

\begin{tscreen}
\begin{verbatim}

|-----------------------------------------|
|Traffic flow diagram after implementation|
|-----------------------------------------|

INTERNET
/\
||
\/
-----------------donmuang router---------------------
/\                                      /\         ||
||                                      ||         ||
||                                      \/         ||
naret                                  silom       ||
*destination port 80 traffic=========>(cache)      ||
/\                                      ||         ||
||                                      \/         \/
\\===================================kaosarn, RAS, etc.


ª`·N¡R   ¦]¬°¦b¥¿±`¥~°e¸ô®|¤W¡M¦h¤F¤@­ÓÃB¥~ªº¸õ¯¸(hop)¡M
        ©Ò¥H¦¹ºô¸ô¬°«D¹ïºÙªº¡C

³o¼Ë¡M¦b kaosarn ©M internet ¤§¶¡ªº«Ê¥]¡M¨ì³o¸Ì³£·|¨ü¨ìºÞ¨î¡C

¹ï©ó web/http ¬y¶q¡R
kaosarn http request->naret->silom->donmuang->internet
http replies from internet->donmuang->silom->kaosarn

¹ï©ó «D web/http ½Ð¨D(¦p¡Mtelnet)¡R
kaosarn outgoing data->naret->donmuang->internet
incoming data from internet->donmuang->kaosarn
\end{verbatim}
\end{tscreen}







\subsection{¥H¨C­Ó¸ô¥Ñ MTU ³]©w¨Ó¨¾½d Path MTU Discovery °ÝÃD (Circumventing Path MTU Discovery issues with per route MTU settings)}

¬°¤F¶Ç°e bulk ¼Æ¾Ú¡Minternet ³q±`·|¨Ï¥Î¤j«¬«Ê¥]¥HÀò±o§ó¦nªº®ÄªG¡C¨C¤@­Ó«Ê¥]³£¥²¶·¶i¦æ¸ô¥Ñ§PÂ_¡M°²¦p¶Ç°e¤@¥÷ 1 magabyte ªº¤å¥ó¡M¦pªG¶È¥i¯àªº¨Ï¥Î³Ì¤j«Ê¥]¶i¦æ¶Ç°e¡M¨º¤j·§»Ý­n 700 ­Ó«Ê¥]¡Q¦pªG¹w³]¨Ï¥Î³Ì¤p«Ê¥]¡M«hªñ 4000 ­Ó¡C

µM¦Ó¡Minternet ¤W¨Ã«D©Ò¦³³¡¥÷³£¤ä´©§¹¾ãªº¨C­Ó«Ê¥] 1460 bytes ªº¹L¸ü¡C¦]¦¹¡M¥²¶·§ä¥X '¦X¨­' ªº³Ì¤j«Ê¥]Åé¿n¡M¥H¶i¦æ³s½u³Ì¨Î¤Æ¡C

³o­Ó³B²zºÙ¬° '¸ô®| MTU µo²{(Path MTU Discovery)'¡MMTU ´N¬O 'Maximum Transfer Unit' ªº·N«ä¡C

·í¸ô¥Ñ¾¹¦¬¨ì¤@­Ó«Ê¥]¡M¦]¬°¤Ó¤j¦Ó¤£¯à¤@¦¸°e¥X¡M¦ý¦P®É¥¦ªº "Don't Fragment" ¦ì¤¸¤S³Q³]©w°_¨Ó¡M«h·|¦^°e¤@­Ó ICMP «H®§¡M»¡©ú¥¦¦]¦¹³Q­¢¥á±ó³o­Ó«Ê¥]¡Cµo°eºÝ¥D¾÷¦¬¨ì³o±ø´£¥Ü¤§­Ô¡M·|§ï°e¸û¤pªº«Ê¥]¡M¨Ã¥B¡M³z¹L¦p¦¹¤Ï´_¡M´N¯à©ó¯S©w¸ô®|¤W§ä¥X³Ì¨Îªº«Ê¥]Åé¿n¡C

³o­ì¥»¤u§@±o«D±`¶¶§Q¡M¤£¹L¡M·í internet ¤W¥R¥¸²³¦hµL©Ò¤£¥Î¨ä·¥¶i¦æ³s½u¯}Ãaªº¤£¨v¤§®{¤§«á¡M±¡ªp´N¤@¸¨¤d¤V¤F¡C³\¦hºÞ²z­û³z¹L«ÊÂê©Î¤Þ¾É¿ù»~¾É¤Jªº ICMP ¬y¶q¡M¨Ó§ïµ½¦w¥þ©Î¼W±j¥L­Ìªº internet ªA°È¡C

³o¼Ëªºµ²§½¬O¡MPath MTU Discovery ¦b¬Y¨Ç¸ô¥Ñ¾¹¤W¨C¤U·Uªp¡M¦Ó¾É­P©_©Çªº TCP/IP ³s½u¹L¤@·|´N±¾±¼¤F¡C

¾¨ºÞ§ÚÁÙ¨S¦³ª½±µªºÃÒ¾Ú¨ÓÃÒ©ú³oÂI¡M§Ú¹L¥h±µÄ²¹L¨â­Ó¯¸¥x¡M¦b¨ü¼vÅT¨t²Î¤§«e°õ¦æ Alteon Acedirectors ³£¦³³o¼Ëªº°ÝÃD --- ©Î³\¹ï¦¹§ó¤F¸ÑªºªB¤Í¥i¥H¬°§Ú­ÌµeÀsÂI·ú¡C




\subsubsection{¸Ñ¨M¤è®× (Solution)}

·í±z¸I¨ì¯¸¥x¨ü¦¹°ÝÃD§xÂZªº®É­Ô¡M±z¥i¥H¤â¤uªºÃö³¬ Path MTU discovery ¥\¯à¡CKoos van den Hout ´¿¦p¦¹¼g¹L(µy§@­×§ï)¡R

\begin{tscreen}
¤U¦C°ÝÃD¡R§Ú§â ppp ±M½u¤§ mtu/mrg ³]©w¬° 296¡M¦]¬°¥¦¥u¦³ 33k6 ¦Ó¤w¡M¦Ó¥B§Ú¤]¤£¯à¼vÅT¥t¤@ºÝªº¦î¦C¡C¦b 296 ªº¤ô¥­¡MÁäÀ»¦^À³©|¯à«O«ù¦b¦X²zªº®É¶¡¤§¤º¡C

¦P®É¡M¦b§Ú³oÃä¡M§Ú¥Î Linux (·íµM°Õ)¡M¶i¦æ°°¸Ë¡C

§Ú¥Ø«e±N '¦øªA¾¹' ©M '¸ô¥Ñ¾¹' ¤À¶}¡M©Ò¥H¤j³¡¥÷ªºÀ³¥Îµ{¦¡³£¦b¥t¥~ªº¾÷¾¹¤W­±¶]¡M¦Ó¸ô¥Ñ«h¨ÌÂÂ¶i¦æ¡C

µM«á¡M·í§Ú­n³s¤W irc ªº®É­Ô«o¸I¨ì°ÝÃD¡C¶W³Â·Ðªº´N¬O¤F¡T³z¹L±´¬d¡Mµo²{§Ú¥i¥H³s±µ¤W irc¡M¦Ó¥B¦b irc ¤W¤]Åã¥Ü¬° 'connected' ¡M¦ý´N¬O¦¬¤£¨ì irc ªº«H®§¡C§Ú¶}©lÀË¬d¬O¤°»ò¦a¤è¥Xºl¤F¡M¦Ó¥B¤]ª`·N¨ì¦b¥H«e³s±µ¬Y¨Ç©M MTU ¬ÛÃöªººô¯¸¤]¦³°ÝÃD¡M¦]¬°·í MTU ¬O 1500 ªº®É­Ô¨Ã¨S¦³°ÝÃD¡M¦Ó MTU ¬° 296 ªº®É­Ô´N·|¥Xª¬ªp¡C¦]¬° irc ¦øªA¾¹·|«ÊÂê©Ò¦³§Y®É§@·~¤£»Ý­nªº¬y¶q¡M¦Ó¥B¤]¾×±¼ icmp¡C

§Ú´¿»¡ªA¹L¬Y­Ó¦³¦¹°ÝÃDªººô¯¸ºÞ²z­û¡M¦ý irc ¦øªA¾¹ªººÞ²z­û«o¤£¤jÄ@·N­×¥¿¥¦¡C

¦]¦¹¡M§Ú¥²¶·½T©w¥~°eªº°°¸Ë¬y¶q¨«¥~³¡½u¸ô­n±q§C mtu ¶}©l¡C¦ý¬O§Ú­n¥»¦aªº ethernet ¬y¶q¥i¥HÀò±o¥¿±`ªº mtu (½Ñ¦p nfs ¬y¶q)¡C

¸Ñ¨M¿ìªk¡R
\begin{tscreen}
\begin{verbatim}
ip route add default via 10.0.0.1 mtu 296
\end{verbatim}
\end{tscreen}


(10.0.0.1 ¬°¹w³]ºôÃö¡M¬O°°¸Ë¸ô¥Ñ¾¹ªº¤º³¡¦ì§})

\end{tscreen}


³q±`¡M¹ï¯S©w¸ô¥Ñ¶i¦æ­×§ï¡M¥i¥H¨Ó»\¼g PMTU Discovery ªº­È¡C¤ñ¤è»¡¡M°²¦p¥u¦³¬Y¤@¯S©w subnet ·|¦³°ÝÃD¡M¨º¤U­±ªº¿ìªk©Î³\¦³§U¡R

\begin{tscreen}
\begin{verbatim}
ip route add 195.96.96.0/24 via 10.0.0.1 mtu 1000
\end{verbatim}
\end{tscreen}





\subsection{¥H MMS ¹X¨î¨Ó¨¾½d Path MTU Discovery °ÝÃD (Circumventing Path MTU Discovery issues with MSS Clamping) (for ADSL, cable, PPPoE \& PPtP users)}

¦p«e­±©Ò­z¡MPath MTU Discovery ¤w¸g¤£¦AÀH¤ß©Ò±ý¤F¡C¦pªG±zª¾¹D¨Æ¹ê¤Wºô¸ô¤¤¬Y­Ó¸õ¯¸(hop)¦³­­¨î MTU($<$1500)¡M±z¬O¤£¯à¨Ì¾a PMTU Discovery ¨Óµo²{¥¦ªº¡C

¦b MTU ¤§¥~¡MÁÙ¦³¥t¥~ªº¤èªk³]©w«Ê¥]ªº³Ì¤jÅé¿n¡M³o­Ó´N¬O¶Ç»¡¤¤ªº Maximum Segment Size¡C³o¬OÄÝ©ó SYN «Ê¥]ªº TCP ¿ï¶µ¤¤ªºÄæ¦ì¡C

¥Ø«eªº Linux ®Ö¤ß¡M¥H¤Î¤Ö³¡¥÷ pppoe ÅX°Êµ{¦¡¡M³£´£¨Ñ 'MSS ¹X¨î' ¥\¯à¡C

³]©w MSS ¼Æ­È©Ò±a¨Óªº¦n³B¬O¡M±z¥i¥H©ú½Tªº§i¶D»·ºÝ¡R'°e¨Óªº«Ê¥]¤£­n¶W¹L³o­Ó¼Æ­È'¡M¦ÓµL¶·­Ê­« ICMP ¬y¶q¡C

¨äÃa³B¬O¡M¥L¬O¤@­Ó«D±`©úÅãªº¯}¸Ñ(hack) --- ³z¹L­×§ï«Ê¥]¦Ó¥´Â_ 'ºÝ¹ïºÝ(end to end)' ª¬ºA¡C¥²¶·«ü¥X¡M§Ú­Ì¦b³\¦h³õ¦X¤¤¨Ï¥Î³o­Ó§Þ¥©¡M¦Ó¥¦´N¦p®]®©ªÅÀY¤WªººòãT©G¡C

¬°¤FÅý¥¦¤u§@¡M±z°_½X»Ý­n iptables-1.2.1a ©M Linux 2.4.3 ©Î§ó·sª©¥»¡C°ò¥»©R¥O¦p¤U¡R
\begin{tscreen}
\begin{verbatim}
# iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS  --clamp-mss-to-pmtu
\end{verbatim}
\end{tscreen}


³o·|¬°±zªº½u¸ô­pºâ¾A¦Xªº MSS¡C¦pªG±z¦³«_ÀIºë¯«¡M©Î¦Û»{ÃÀ°ªÁx¤j¡M±z¤]¥i¥H¦A°µ³o¼Ëªº°Ê§@¡R

\begin{tscreen}
\begin{verbatim}
# iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 128
\end{verbatim}
\end{tscreen}


³o¼Ë·|±N©Ò³q¹Lªº SYN «Ê¥]¤§ MMS ³]¬° 128¡C¦pªG±z­n¥Î·L«¬«Ê¥]Äâ¸ü VoIP¡M¦P®É¡MÃe¤jªº httpd «Ê¥]·|«d´î±zªº»y­µ³q°T¡M¨º±z´N¥i¥H¨Ï¥Î¥¦¤F¡C




\section{¥H Proxy ARP ºc«Ø¾ô±µ¾¹©M°°¾ô±µ¾¹ (Building bridges, and pseudo-bridges with Proxy ARP)}

¾ô±µ¾¹(bridges)¬O¤@ºØ¥i¥H¦w¸Ë¦bºô¸ô¤¤¦ÓµL¶·¥ô¦ó­«³]©w(reconfiguration)ªº³]³Æ¡C¤@­Óºô¸ô¥æ´«¾¹(switch)°ò¥»¤W¬O¤@­Ó¦h°ð¤f¾ô±µ¾¹¦Ó¤w¡C³æ¤@ªº¾ô±µ¾¹³q±`¬O¤@­ÓÂù°ð¤fªº¥æ´«¾¹¡CLinux ¤]¤ä´©±a¦h±i¬É­±ªº³æ¤@¾ô±µ¾¹¡M¦Ó¦¨¬°¤@¥x¯u¥¿ªº¥æ´«¾¹¡C

¾ô±µ¾¹ªº³¡¸p¡M¥D­n¬OÀ³¥Î©ó¦p¤U±¡§Î¡R·í­±Á{¤@­Ó°I®zªº(broken)ºô¸ô¡M»Ý­n¶i¦æ­×´_¡M¦ý¤S¤£¯à¶i¦æ¥ô¦óÅÜ§ó(alterations)¡C¦]¬°¾ô±µ¾¹¬O¤@­Ó layer-2 ³]³Æ¡M¦b IP ªº¤U¤@¼h¡M¸ô¥Ñ¾¹©M¦øªA¾¹¬O·PÀ³¤£¨ì¥¦ªº¦s¦bªº¡C´«¦Ó¨¥¤§¡M±z¥i¥H³q³z©Êªº«ÊÂê©Î­×§ï¯S©wªº«Ê¥]¡M©Î¬O¶i¦æ¤Þ¾É¡C

¾ô±µ¾¹ªº¥t¤@¦n³B¬O¡M¤@­Ó¾ô±µ¾¹¦b±¾±¼¤§«á¡M¥i¥H¥Î¤@±ø¸õ±µ½u(cross cable)©Î¬O¤@­Ó¶°½u¾¹(hub)¨Ó¥N´À¡C

¦ÓÃa®ø®§¬O¡M°£«D¥¦³Q©ú´·ªº¼g¦b¤å¥ó¤W¡M§_«h¤@­Ó¾ô±µ¾¹¥i¯à·|¾É­P«D±`¤jªº§xÂZ¡C¦b traceroute ¤¤¤£·|Åã¥Ü¥¦¡M¦ý«Ê¥]«o¦]¬°¬Y¨Ç½t¬G¯«©_¥¢ÂÜ¡M©Î±qÂIA ÅÜ¦¨ÂIB¡C¥t¥~¡M±zÁÙ­nª¾¹D¡M¤½¥q¬O§_Ä@·N­×§ï²{¦æª¬ªp¡C

Ãö©ó Linux 2.4 ¾ô±µ¾¹ªº¤å¥ó¡M¾ã²z©ó¡R\nameurl{http://www.math.leidenuniv.nl/~buytenh/bridge}{this page}¡C




\subsection{¾ô±µ©M iptalbe ªº»¡©ú (State of bridging and iptables)}

¹ï©ó Linux 2.4.3¡M¾ô±µ¾¹©M iptables ¦b¨S¦³¥~´©ªº±¡ªp¤U¡M©¼¦¹³£ '¬Ý' ¤£¨ì¹ï¤è¡C¦pªG±z±N«Ê¥]±q eth0 ¾ô±µ¨ì eth1¡M¥L­Ì¨Ã¤£¯à '³q¹L' iptalbes ®@¡C´«¥y¸Ü»¡¡M±z¤£¯à¶i¦æ¹LÂo¡N©Î NAT¡N©Î­«¾ã(mangling)¡N©Î½Ñ¦p¦¹Ãþ¡C

¥Ø«e¤w¦³¼Æ­Ó­p¹º¶i¦æ¹ï¦¹°ÝÃDªº­×¥¿¡M¦Ó³Ì·Ç½TªºÀ³ºâ¬O Linux 2.4 ¾ô±µµ{¦¡ªº§@ªÌ Lennert Buytenhek ¤F¡C¤£¹L¡M­×¸Éµ{¦¡©|¥¼§¹¦¨¡M¦ý¬Ý¨Ó¬O¥i¦æªº¡C¥¦¥i¥H±q³o­Ó¦a¤è§ä¨ì¡R\nameurl{http://www.math.leidenuniv.nl/~buytenh/bridge/devel/bridge-nf/}{the experimental bridge patches page}¡C

§Ú­Ì´Á«Ý³o­Ó°ÝÃD¥i¥H¾¨§Ö¸Ñ¨M¡C




\subsection{¾ô±µ»P¤Þ¾É (Bridging and shaping)}

³o­Ó¥¿¦p©Ò¨ä¼Ðº]ªº¨º¼Ë¡M¬O¥i¥H¤u§@ªº¡C±z­n½T«O³]©w¦n¨C­Ó¬É­±¬O¦b­þ¤@ºÝ¤§¤W¡M§_«h¡M±z¥i¯à·|±N¥~°eªº¬y¶q¤Þ¾É¦Ü¤º³¡¬É­±¤W¡M³oÅãµM«nÁÕ¥_Âá¡C¥²­n®É½Ð¨Ï¥Î tcpdump ¡C




\subsection{±a Poxy-ARP ªº°°¾ô±µ¾¹ (Pseudo-bridges with Proxy-ARP)}

¦pªG±z¥u·Q¹ê§@¤@¥x°°¾ô±µ¾¹(Pseudo-bridge)¡M¾¨¥i¸õ¹L«á­±¼Æ­Ó¬q¸¨¡Mª½±µ¨ì '§â¥¦¹ê§@¥X¨Ó' ¨º¸Ì¡M¤£¹L¡M¬Ý¤@¬Ý¹ê²ß¤¤¥¦¬O¦p¦ó¤u§@ªº¡Mµ´¹ï¬OÁo©ú¤§Á|¡C

¤@­Ó°°¾ô±µ¾¹¦³©Ò¤£¦P¡C¹w³]¤W¡M¾ô±µ¾¹±q¤@­Ó¬É­±±N¥¼­×§ïªº«Ê¥]¶Ç»¼¨ì¥t¥~ªº¬É­±¥h¡C¥¦¥u°Ñ¦Ò«Ê¥]ªº¹êÅé¦ì§}¦Ó§P©w­n°e¦Ü¦ó¤è¡C´«¦Ó¨¥¤§¡M±z¥i¥H¾ô±µ Linux ¤£¤F¸Ñªº¬y¶q¡M¥u­n¥¦¯à§ì¨ì¹êÅé¦ì§}´N¥i¥H¤F¡C

¦Ó¤@­Ó '°°¾ô±µ¾¹' «h²¤¦³¤£¦P¡M¥¦¬Ý°_¨Ó§ó¹³¤@¥xÁôÂÃªº¸ô¥Ñ¾¹¦Ó«D¾ô±µ¾¹¡M¦ý«o¤S¦³¾ô±µ¾¹ªº¯à¤O¡M¥¦¦bºô¸ô³]­p¤W·|ºc¦¨¤@¨Ç¼vÅT¡C

¨Æ¹ê¤Wªº¤@­ÓÀuÂI¬O¡M¦]¬°¥¦¤£¬O¤@­Ó¾ô±µ¾¹¡M¦Ó«Ê¥]¹ê»Ú¤W·|¸g¹L®Ö¤ß¡M¦]¦Ó¥i¥H³Q¹LÂo¡N­×§ï¡N­«¾É¦V¡N©Î¬O­«¸ô¥Ñ¡C

¤@¥x¯u¥¿ªº¾ô±µ¾¹¡M³z¹L³]©w¤]¯à¦pªkªw¨î¡M¦ý¥¦»Ý­n¬Y¨Ç¯S®íªºµ{¦¡¡M¨Ò¦p Ethernet Frame Diverter¡M©Î«e­±´£¨ìªº­×¸É¡C

°°¾ô±µ¾¹ªº¥t¥~¤@­ÓÀuÂI¬O¡M¥¦¤£·|¶Ç»¼¥¦¤£©ú¥Õªº«Ê¥] --- ¦]¦¹¥i¥H²M²z±¼ºô¸ô¤¤³\¦h¬y¶q¡C°²¦p¦b±z»Ý­n³o¨Ç¬y¶qªº±¡ªp¤U(¨Ò¦p SAP «Ê¥]¡M©Î Netbeui)¡M¨º´N¨Ï¥Î¯u¥¿ªº¾ô±µ¾¹§a¡C




\subsubsection{ARP \& Proxy-ARP}

·í¤@¥x¥D¾÷·Q­n©I¥s¦P¤@¹êÅéºô¬q¤Wªº¥t¤@¥x¥D¾÷ªº®É­Ô¡M¥¦·|°e¥X¤@­Ó Address Resolution Protocol «Ê¥]¡M»¡Åã²L¤@ÂI¡MÅ¥°_¨Ó·|¹³³o¼Ë¡R¡§½Ö¦³ 10.0.0.1 ³o­Ó¦ì§}¡M½Ð§i¶D 10.0.0.7¡¨¡C¦Ó§@¬°¹ï³o­Ó¬d¸ßªº¦^À³¡M10.0.0.1 ·|¦^³ø¤@­ÓÂ²³æªº¡§§Ú¦b³o¸Ì¡¨ªº«Ê¥]¡C

µM«á 10.0.0.7 ´N±N«Ê¥]°e¨ì¡§§Ú¦b³o¸Ì¡¨¨º­Ó«Ê¥]©Ò´£¨ìªº¹êÅé¦ì§}¡C¦P®É¡M¥¦¤]§âµwÅé¦ì§}¦s©ñ¦b cache ¤¤¡M«O¯d¤@¬q¬Û¹ï¸ûªøªº®É¶¡¡Mµ¥¨ì cache ¹O´Á¤§«á¡M«h¦A­«·sµo°Ý´N¬O¤F¡C

·í­n¬[³]¤@­Ó°°¾ô±µ¾¹ªº®É­Ô¡M§Ú­Ì­nÅý¾ô±µ¾¹¦^À³³oÃþªº ARP «Ê¥]¡M³o¼Ë¡Mºô¸ô¤Wªº¥D¾÷¤~·|±N¥¦­Ìªº«Ê¥]°e¨ì¾ô±µ¾¹³oÃä¨Ó¡CµM«á¾ô±µ¾¹³B²z³o¨Ç«Ê¥]¡M¦A°e¨ì¬ÛÃö¬É­±¥h¡C

©Ò¥H¡MÂ²¦Ó¨¥¤§¡M·í¤@¥x¦ì©ó¾ô±µ¾¹¤@ºÝªº¥D¾÷¡M¬d¸ß¥t¤@ºÝ¥D¾÷ªº®É­Ô¡M¾ô±µ¾¹´N·|¦^À³¤@­Ó«Ê¥]¡M§i¤§¡§¥æµ¹§Ú´N¦n¡¨¡C

³z¹L³o­Ó¿ìªk¡M©Ò¦³¼Æ¾Ú¬y¶q³£¯à°÷°e¨ì¥¿½Tªº¦a¤è¥h¡M¦Ó¥B³£·|¸g¹L¸Ó¾ô±µ¾¹¡C




\subsubsection{§â¥¦¹ê§@¥X¨Ó (Implementing it)}

¦b¹L¥h¡M©Î³\·|Åý Linux ®Ö¤ß¹ï©Ò¦³ subnet ¶i¦æ 'proxy-ARP'¡CµM«h¡M­n¬[³]¤@¥x°°¾ô±µ¾¹¡M±z¥²¶·¬°¨âºÝ«ü©w¥¿½Tªº¸ô¥Ñ¡M¨Ã¥B¡M«Ø¥ß¤Ç°tªº proxy-ARP ³W«h¡C³o¹ê¦b¤£¬O¤Q¤À¦nª±¡M¦]¬°¥ú¥´¦r´N°÷²Ö¤Hªº¤F¡M¥B¤]·¥®e©ö¥X¿ù¦Ó¾É­P¾ô±µ¾¹¬°¤£ª¾¹D¦p¦ó¸ô¥Ñªººô¸ô§@¥X ARP ¦^À³¡C

¦b Linux 2.4 ¤W­±(©Î³\¤]¥]¬A 2.2)¡M³o­Ó¥i¯à©Ê¤w¸g±Æ°£¡M¨Ã¥B³Q¤@­Ó /proc ¥Ø¿ý¤¤ªººX¼Ð©Ò¨ú¥N¡MºÙ¬° 'proxy\_arp'¡C¤U­±¡M¬O¬[³]°°¾ô±µ¾¹ªº¨BÆJ¡R

\begin{enumerate}
\item ¬°¨âºÝªº¬É­±¤À°t¤@­Ó IP ¦ì§}¡R '¥ª' «CÀs¡N'¥k' ¥Õªê¡C
\item ±N¸ô¥Ñ«Ø¥ß°_¨Ó¡MÅý¾÷¾¹ª¾¹D­þ¨Ç¥D¾÷¦b¥ªÃä¡M­þ¨Ç¦b¥kÃä¡C
\item ±N¨âºÝªº¬É­±¤§ prox-ARP ¥´¶}¡R
echo 1 {$>$}/proc/sys/net/ipv4/conf/ethL/proxy\_arp; \\ 
echo 1 {$>$} /proc/sys/net/ipv4/conf/ethR/proxy\_arp\\ 
¨ä¤¤ªº L ©M R ¤À§O¬°¥ª¥k¨âÃäªº¬É­±¸¹½X¡C
\end{enumerate}


µM«á¡M¤£­n§Ñ°O±N ip\_forwarding ºX¼Ð¥´¶}¡T°²¦p±q¯u¥¿¾ô±µ¾¹Âà´«¹LÂo¡M±z©Î³\·|µo²{³oºX¼Ð¬OÃö³¬ªº¡M¦]¬°¶i¦æ¾ô±µªº®É­Ô¨Ã¤£»Ý­n¥¦¡C

¥t¥~¡M±z¦b¶i¦æÂà´«ªº®É­ÔÁÙ­nª`·N¡M±z»Ý­n²MªÅºô¸ô¤¤¦U¹q¸£ªº arp cache --- ¦]¬° arp cache ©Î³\¤´«O¯dµÛ¥ý«e¾ô±µ¾¹ªº¹êÅé¦ì§}¡M¦Ó¨Æ¹ê¤W«o¤w¦¨¬Q¤é¶Àªá¤F¡C

¦p¦b¤@¥x Cisco ¤W­±¡M¥i¥H¥Î 'clear arp-cache' ©R¥O¨Ó§¹¦¨¡M¦b Linux ¤W¡M«h¨Ï¥Î 'arp -d ip.address' ¡C·íµM¡M±z¤]¥i¥Hµ¥ cache ¹O®É¡M³o¼Ë»Ý®É§ó¤[¡C




\section{¶i¶¥ Linux Routing (Advanced Linux Routing)}

¥»³¹ªº¹ï¶H¬O¡R·Q¤F¸Ñ¾ã­Ó¨t²Î¬O«ç¼Ë¤u§@ªº¡M©Î¬O²{¦³³]©w¤Ó¹L©Ç²§¦Ó·Q§S®Ú°Ý©³¡M±N¤§·d©w¡C

¥»³¹§¹¥þ¬O¿ïÅª³¹¸`¦Ó¤w¡C³o³¹¸`À³·|¬Û·í½ÆÂø¡M¦Ó¥B¯uªº¨Ã«D°w¹ï´¶³q¨Ï¥ÎªÌ¦Ó³]¡C¦³¨¥¦b¥ý´N¬O¤F¡C

FIXME: ¨M©w³o¸Ì¯u¥¿»Ý­nªº¬O¤°»ò¡C




\subsection{«Ê¥]¦î¦C¨s³º¦p¦ó¤u§@ªº¡S(How does packet queueing really work?)}

³o¸Ì±N¤@±´¨s³º¡M«Ê¥]¦î¦C¨t²Î¬O¦p¦ó¤u§@ªº¡C

¥ý±N®Ö¤ß¤ÀÃþ(classify)«Ê¥]ªº¨BÆJ¦C¥X¨Ó¡M¨Ò¦p...

FIXME: ¦³«Ý¸É¥R




\subsection{«Ê¥]¦î¦C¨t²Îªº¶i¶¥¨Ï¥Î (Advanced uses of the packet queueing system)}

°Ñ¦Ò Alexey ¨º­Ó·¥ºÝ¸Þ²§(tricky)ªº½d¨Ò§a¡M¨º¸Ì²o¯A¨ì¤@¨Ç¦b TOS Äæ¦ì¤¤©|¥¼¥Î¨ìªº¦ì¤¸¡C

FIXME: ¦³«Ý¸É¥R




\subsection{¨ä¥¦«Ê¥]¤Þ¾É¨t²Î (Other packet shaping systems)}

§Ú¥u·Q§ã­nªº»¡©ú¤@¤U¨ä¥¦§@·~¨t²Î¤Wªº«Ê¥]¤Þ¾É¨t²Î¡M¥H¤Î¥¦­Ì»P Linux ¤Wªº¤ñ¸û¡C¥Ñ©ó Linux ¬O¤Ö¼Æ§¹¥þ°ò©ó TCP/IP ¬[ºc(«D BSD¬£¨t)ªº§@·~¨t²Î¤§¤@¡M§Ú»{¬°°Ñ¦Ò¤@¤U§O¤Hªº°µªk¬O«D±`¦³»ù­Èªº¡C

µM¿ò¾Ñªº¬O¡M§Ú¨Ã¨S¦³¨ä¥¦§@·~¨t²Îªº¸gÅç¡M©Ò¥H¨Sªk¦¨¤å¡C

FIXME: ½Ö¦Û§i¾Ä«i¤@¤U¡S - Martijn




\section{°ÊºA¸ô¥Ñ - OSPF ©M BGP (Dynamic routing - OSPF and BGP)}

¤@¥¹¶Qºô¸ô¦¨ªø¨ì«Ü¤jªº®É­Ô¡M©Î¬O±z­n±N¶Qºô¸ô·í¦¨ 'internet' ¨Óª±¡M±z´N»Ý­n¤@¨Ç¤u¨ã¨Ó°ÊºAªº¸ô¥Ñ¼Æ¾Ú¡C¦U¯¸ÂI¤§¶¡³q±`³£·|³z¹L¦h±ø½u¸ô¬Û¤¬³s±µ°_¨Ó¡M¥B¦³¤é¯q¼W¥[ªºÁÍ¶Õ¡C

§Ú­Ìªº Internet ¤@¯ë³£±Ä¥Î OSPF ©M BGP4 (rfc1771) ¬°¼Ð·Ç¡CLinux ¹ï¨âªÌ§¡¯à¤ä´©¡M¬O¥Î {\ttfamily gated} ©M {\ttfamily zebra} ¨Ó°µ¨ìªº¡C

¥Ø«e¨Ó»¡¡M³o¤w¸g¶W¥X¥»¤å¥óªº½dÃ¥¤F¡M§Ú­Ì¥u·Q§i¶D±z¥h­þ¸Ì°µ¥\½Ò¦Ó¤w¡R

Overview:

Cisco Systems
\nameurl{http://www.cisco.com/univercd/cc/td/doc/cisintwk/idg4/nd2003.htm}{Designing large-scale IP internetworks}



For OSPF:

Moy, John T.
"OSPF.  The anatomy of an Internet routing protocol"
Addison Wesley. Reading, MA. 1998.

Halabi ¤]¼g¹L¤@­Ó«D±`´ÎªºÃö©ó OSPF ¸ô¥Ñ³]­pªº«ü«n¡M ¤£¹L¦ü¥G¤w³Q Cisco ºô¯¸®³±¼¤F¡C



For BGP:

Halabi, Bassam
"Internet routing architectures"
Cisco Press (New Riders Publishing). Indianapolis, IN. 1997.

also

Cisco Systems

\nameurl{http://www.cisco.com/univercd/cc/td/doc/cisintwk/ics/icsbgp4.htm}{Using the Border Gateway Protocol for interdomain routing}

ÁöµM½d¨Ò³£¬O Cisco  ¯S©wªº¡M¤£¹L¤j³£¸ò Zebra ªº³]©w»y¨¥«Ü¬Û¹³ :-)




\section{¨ä¥¦¥i¦æ©Ê (Other possibilities)}

¥»³¹©Ò¦C§¡¬° Linux ¸ô¥Ñ©M¬y¶q¤Þ¾É©Ò»Ý¶i¦æªº­p¹º¡CÃö©ó³o¨ÇÁpµ²¡M¦³¨Ç¥i¯à­n§¹¥þ°Ñ¦Ò­ì¤å¥ó¡Q¦³¨Ç«h¦Û¨­´N¼g±o«D±`¦n¡M¦ÓµL¶·§ó¦hªº HOWTO¡C

\begin{description}
\item[802.1Q VLAN Implementation for Linux \nameurl{http://scry.wanfear.com/~greear/vlan.html}{(site)}] \mbox{}

VLAN ¬O¤@­Ó«D±`«l»Åªº¤u¨ã¡M¯à°÷§ó¬°µêÀÀ¦Ó«D¹êÅéªº¹jÂ÷±zªººô¸ô¡CÃö©ó VLAN ªºÀu¨q¸ê®Æ¥i¥H¨ì³o¸Ìµo±¸¡R 

\nameurl{ftp://ftp.netlab.ohio-state.edu/pub/jain/courses/cis788-97/virtual_lans/index.htm}{here}¡C«ö·Ó³o­Ó¹ê§@¡M±z¤]¥i¥HÅý±zªº Linux ¾÷¾¹©M½Ñ¦p Cisco Catalyst¡N3Com: $\{$Corebuilder, Netbuilder II¡NSuperStack II switch 630$\}$¡NExtreme Ntwks Summit 48¡NFoundry: ServerIronXL, FastIron$\}$¡M³o¨Ç¾÷¾¹¶i¦æ VLAN ³s±µ¡C



\item[Alternate 802.1Q VLAN Implementation for Linux \nameurl{http://vlan.sourceforge.net }{(site)}] \mbox{}

¡CAlternative VLAN implementation for linux¡M¸Ó­p¹ºªº°_·½¬O¦]¬°¤£»{¦P '¤w«Ø¥ßªº' VLAN ­p¹º¤§¬[ºc¤Î½sµ{¡M¦Ó¥t°_Äl¨_¡M¶i¦æ³q½Lªº¥þ·s³]­p¡C



\item[Linux Virtual Server \nameurl{http://www.LinuxVirtualServer.org/}{(site)}] \mbox{}



³o¨Ç°ª¤â­Ó­ÓªZÃÀ¶W¸s¡C¨ä¤¤ Linux Virtual Server ¬Oºc«Ø¦b¯u¹ê¦øªA¾¹±ÚÂO¤§¤Wªº¦øªA¾¹¡M¦b Linux §@·~¨t²Î¤W°õ¦æ¥­¦æ­t¸ü¡M·¥¨ã°ª¦ù®i©Ê©M°ª¥i¥Î©Ê¡C¨ä±ÚÂO¬[ºc¹ï²×ºÝ¥Î¤á¨Ó»¡¬O³z©úªº¡M¥L­Ì¥u¬Ý¨ì³æ¤@ªºµêÀÀ¦øªA¾¹¦Ó¤w¡C

¤@¨¥¥H½ª¤§¡M¤£ºÞ±z»Ý­n¦b¤°»òµ¥¯Åªº¬y¶q¤W°õ¦æ¤°»ò¼Ëªº¥­¦æ­t¸ü¡MLVS ³£¦³¿ìªk°µ¨ì¡C¥L­Ì¬Y¨Ç§Þ³N³ôºÙ¤Ñ¤~¤§§@¡M¹ê¦b­ê¦i©Ò«ä¡T¤ñ¤è»¡¡M¥L­ÌÅý¼Æ¥x¦øªA¾¹¦b¤@­Óºô¬q¤W¨Ï¥Î¦P¤@­Ó IP ¦ì§}¡M¦ý§â¥¦­Ìªº ARP Ãö³¬±¼¡C¥u¦³ LVS ¾÷¾¹¶i¦æ ARP --- ¥¦·|¨M©w¶i¤J«Ê¥]¥æ¥Ñ­þ¥x«áºÝ¥D¾÷³B²z¡MµM«áª½±µ±N¥L°e¨ì¥¿½Tªº«áºÝ¦øªA¾¹¤§ MAC ¦ì§}¤W¡C¦Ó¥~°eªº¬y¶q«hª½±µ¬y¸g¸ô¥Ñ¾¹¡M¦Ó¤£¦A¸g¹L LVS ¾÷¾¹¡M¦p¦¹³º¬Ý¤£¨ì 5Gbit/s ªº®e¶q¨ì³B¶ÃÂ«¡M¦Ó¤£·|ºc¦¨²~ÀV¡C

LVS ¬O¥Î Linux 2.0 ©M 2.2 ªº®Ö¤ß­×¸É¨Ó¹ê§@¡MµM¦Ó¡M2.4 ¸Ì¦]¬°¥»¨­¦Û±a Netfilter ¼Ò²Õ¡M©Ò¥H¨Ã¤£»Ý­n®Ö¤ß­×¸É¡T¥L­Ìªº 2.4 ¤ä´©©|³B©óªì´Á¶}µo¶¥¬q¡M©Ò¥H¤£§«»P¥L­Ì¤Á½R¤@¤U¨Ã´£¨Ñ¦^õX©Î­×¸É¡C



\item[CBQ.init \nameurl{ftp://ftp.equinox.gu.net/pub/linux/cbq/}{(site)}] \mbox{}

­n³]©w CBQ ©Î·|Åý¤H¦³©Ä¨B¤§·P¡M¤×¨ä¬O±z©Ò­nªº¶È¶È¬O¦b¤@¥x¸ô¥Ñ¾¹«á­±¤Þ¾É¬Y¨Ç¹q¸£¦Ó¤w¡CCBQ.init ¥i¥HÀ°±z¥ÎÂ²³æªº»yªk³]©w¦n Linux¡C

¨Ò¦p¡M¦pªG±z·Q­n 192.168.1.0/24 ³o­Ó subnet(±µ¦b 10mbit eth1 ¤§¤W) ¸Ì­±ªº©Ò¦³¹q¸£­­¨î¦b 28kbit/s ªº¤U¸ü³t«×¡M¥u»Ý±N¤U­±ªº¤º®e©ñ¶i CBQ.init ³]©wÀÉ¸Ì­±¡R

\begin{tscreen}
\begin{verbatim}
DEVICE=eth1,10Mbit,1Mbit
RATE=28Kbit
WEIGHT=2Kbit
PRIO=5
RULE=192.168.1.0/24
\end{verbatim}
\end{tscreen}


Á`ªº¨ÓÁ¿¡M¦pªG±z¹ï 'how and why' ¤£·P¿³½ì¡M¥Î¦¹µ{¦¡¨¬¨o¡C§Ú­Ì¦b¯u¹êªºÀç¹BÀô¹Ò¤¤¨Ï¥Î CBQ.init¡Mµo²{¥¦ÁÙ¯uªº¤£­t²³±æ¡C¥¦¬Æ¦ÜÁÙ¯àÀ³¥I§ó¶i¶¥ªº¨Æ±¡©O¡M¨Ò¦p«ö®É¤Þ¾É¤§Ãþ¡C¥¦ªº¤å¥ó¤w´O¤J¦b script ¤§¤¤¡M³o¤]´N¬O¬°¬Æ»ò±z§ä¤£¨ì README ªº­ì¦]¡C



\item[Chronox easy shaping scripts \nameurl{http://www.chronox.de}{(site)}] \mbox{}

Stephan Mueller (smueller@chronox.de) ¼g¤F¨â­Ó«D±`¦n¥Îªº script¡R'limit.conn' ©M 'shaper'¡C«eªÌÅý±z»´ÃPªº¹ï³æ¤@¤U¸ü³s½u¶i¦æ¸`¬y¡M¥u»Ý¦p¦¹«h¥i¡R

\begin{tscreen}
\begin{verbatim}
# limit.conn -s SERVERIP -p SERVERPORT -l LIMIT
\end{verbatim}
\end{tscreen}


¥¦¦b Linux 2.2 ©M 2.4 ¤W­±³£¥i¥H¨Ï¥Î¡C

²Ä¤G­Ó script «h§ó¬°½ÆÂø¡M¥i¥H®Ú¾Ú iptables ³W«h°µ¥X³\¦h¤£¦Pªº¦î¦C¡M¤]´N¬O¥ý±N«Ê¥]¼ÐÃÑ°_¨Ó¡M¦A¶i¦æ¤Þ¾É¡C



\item[Virtual Router Redundancy Protocol implementation \nameurl{http://w3.arobas.net/~jetienne/vrrpd/index.html}{(site)}] \mbox{}

³o­Ó§¹§¹¥þ¥þ¬O¬°¤F¤¾¾l(redundancy)©Ò»Ý¡C¥Î¨â¥x¦U¦Û¾Ö¦³ IP ¦ì§}©M MAC ¦ì§}ªº¾÷¾¹¡M¦@¦P«Ø¥ß°_²Ä¤T­Ó IP ¦ì§}©M MAC ¦ì§}¡M·íµM¡M¥¦¬OµêÀÀªº¡C¦p¦¹³]­p¥»¨Ó¯Âºé¬O¬°¸ô¥Ñ¾¹¦Ó³]­pªº¡M¥¦»Ý­n«í©wªº MAC ¦ì§}¡M¦ý¦P®É¤]´À¦øªA¾¹¤u§@¡C



³o­Ó¤èªkªººë§®¤§³B¬O¡M³]©w°_¨Ó¤£¶O§j¦Ç¤§¤O¡C¤£»Ý­n®Ö¤ß½sÄ¶©Î­×¸É¡M¥þ¬°¨Ï¥ÎªÌªÅ¶¡¡C

¥u»Ý¦b©Ò¦³°Ñ»PªA°Èªº¾÷¾¹¤W°õ¦æ¡R
\begin{tscreen}
\begin{verbatim}
# vrrpd -i eth0 -v 50 10.0.0.22
\end{verbatim}
\end{tscreen}


±z¤wº¥¤J¨Î¹Ò¤F¡T10.0.0.22 ²{¦b¥Ñ±z¨ä¤¤¤@¥x¦øªA¾¹¾á·í¡M«Ü¥i¯à¬O­º¥ý°õ¦æ vrrp daemon ªº¾÷¾¹¡C²{¦bÂ_±¼³o¥x¹q¸£ªº³s½u¡M¦b·¥µuÀþ¶¡¤§¤º¡M¨ä¥¦¤@¥x¹q¸£´N·|±µºÞ³o­Ó 10.0.0.22 ¦ì§}¡MÁÙ¦³¥¦ªº MAC ¦ì§}¡C

§Ú´¿¦b³o¸Ì¹Á¸Õ¹L¡M¦Ó¥B¤£¨ì¤@¤ÀÄÁ´N³]©w°_¨Ó¤F¡CµM¦Ó¤£ª¾¹D¤°»ò­ì¦]¡M¥¦·|±N¹w³]ºôÃö¥á±ó±¼¡M¤£¹L¥i¥H¥Î -n ºX¼Ð¨ÓÁ×§K°Õ¡C

³o¬O¤@­Ó '¬¡¥Í¥Í' ªº failover ¾÷¨î¡R

\begin{tscreen}
\begin{verbatim}
64 bytes from 10.0.0.22: icmp_seq=3 ttl=255 time=0.2 ms
64 bytes from 10.0.0.22: icmp_seq=4 ttl=255 time=0.2 ms
64 bytes from 10.0.0.22: icmp_seq=5 ttl=255 time=16.8 ms
64 bytes from 10.0.0.22: icmp_seq=6 ttl=255 time=1.8 ms
64 bytes from 10.0.0.22: icmp_seq=7 ttl=255 time=1.7 ms
\end{verbatim}
\end{tscreen}


³ºµM¨S¦³¥á¥¢ *¥ô¦ó¤@­Ó* ping «Ê¥]¡T§Ú¦b²Ä 4 ­Ó«Ê¥]¤§«á±N§Úªº P200 ³s½u¤ÁÂ_¡Mºò±µµÛ§Úªº 486 ´N±µ¤â¤F¡M±z¥i¥Hµo²{©µ¿ðªº¼W¥[¡C



\end{description}







\section{¶i¶¥°Ñ¾\ (Further reading)}

\begin{description}
\item[\nameurl{http://snafu.freedom.org/linux2.2/iproute-notes.html}{http://snafu.freedom.org/linux2.2/iproute-notes.html}] \mbox{}

¤º¦³¤j¶q§Þ³N¸ê®Æ©M«ØÄ³¡M±q®Ö¤ß¶i¦æ¸ÑÄÀ¡C



\item[\nameurl{http://www.davin.ottawa.on.ca/ols/}{http://www.davin.ottawa.on.ca/ols/}] \mbox{}

Jamal Hadi Salim ªºÁ¿¸q¡M¥L¬O Linux ¬y¶q±±ºÞªº§@ªÌ¤§¤@¡C



\item[\nameurl{http://defiant.coinet.com/iproute2/ip-cref/}{http://defiant.coinet.com/iproute2/ip-cref/}] \mbox{}

Alexeys LaTeX ¥S¤§ HTML ª©¥»¤å¥ó --- «D±`²Ó½oªº¸ÑÄÀ³¡¥÷ iproute2 §Þ³N¡C



\item[\nameurl{http://www.aciri.org/floyd/cbq.html}{http://www.aciri.org/floyd/cbq.html}] \mbox{}

Sally Floyd ´¿¼g¹L«D±`´Îªº CDQ ¤å¥ó¡M¥]¬A¦o­ì©l¤â½Z¡C¨Ã¨S¦³¥ô¦óªF¦è¬O Linux ¯S©wªº¡M¦ýÃö©ó CBQ ªº²z½×©M¨Ï¥Î«o¦³¬Û·í¥¿­±ªº½×­z¡C
«D±`§Þ³N©Ê¡M¦p¦³¿³½ìªº¸Ü¡M«o«D±`­È±o¤@Åª¡C



\item[\nameurl{http://ceti.pl/~kravietz/cbq/NET4_tc.html}{http://ceti.pl/\~{}kravietz/cbq/NET4\_tc.html}] \mbox{}

¥t¥~¤@¥÷ HOWTO ¤å¥ó¡M¬OªiÄõ»yªº¡T¤£¹L¡M¨º¨Ç©R¥O¦æ³£¥i¥H·Ó§Û°Õ¡M¤£ºÞ¬O¥Î¤°»ò»y¨¥³£¤@¼Ë¤u§@¡C¨ä§@ªÌ¥¿©M§Ú­Ì¦X§@¤¤¡M¬Û«H«Ü§Ö·|¬°§Ú­Ì³o­Ó HOWTO ¥t¼g¤@¨Ç³¹¸`¡C



\item[\nameurl{http://snafu.freedom.org/linux2.2/docs/draft-almesberger-wajhak-diffserv-linux-00.txt}{Differentiated Services on Linux}] \mbox{}

°Q½×¦p¦ó¦b diffserv compliant Àô¹Ò¤¤¨Ï¥Î Linux ¡C©M±z¤é±`ªº¸ô¥Ñ»Ý¨D¬Û®t¬Æ»·¡M¤£¹L«D±`¦³½ì´N¬O¤F¡C§Ú­Ì©Î³\µy«á·|¬°¦¹¥tÅP³¹¸`¡C



\item[\nameurl{http://www.cisco.com/univercd/cc/td/doc/product/software/ios111/cc111/car.htm}{IOS Committed Access Rate}] \mbox{}

\label{CAR}
¨Ó¦Û Cisco ªº¼ö¤ß¦¨­û¡M¥L­Ì¸g±`±N¤å¥ó¤½§G¦bºô¯¸¤W¡M¬O¤Q¤À­È±oÆg½àªº¡CCisco ªº»yªk©Î³\¦³§O¡M¦ý·§©À³£¬O¤@¯ß¬Û©Óªº¡M¥u¬O§Ú­Ì¨S¦³¥Î¶Q¦p¶]¨®ªº router¡M ¦Ó»Ý­nªá§ó¦h¥\¤Ò¦Ó¤w :-)



\item[TCP/IP Illustrated, volume 1, W. Richard Stevens, ISBN 0-201-63346-9] \mbox{}

¦pªG»Õ¤U¯uªº·Q­n¤F¸Ñ TCP/IP¡M³o¬O¥²Åªªº¸t¸g¡C·íµM¡M­Y¯à¦Û±o¨ä¼Ö©ó¨ä¤¤¤]¤£¿ù°Õ¡C



\end{description}
 


\section{·PÁÂ (Acknowledgements)}

 
©Ò¦³¹ï¥» HOWTO °µ¹L°^Äm¡M©Î¬OÀ°§Ú­Ì´¦¶}¨Æª«¯«¯µ­±¯½ªº¨C¦ìªB¤Í¡M§Ú­Ì³£·|§â¥L­ÌªºªÚ¦W¦C¥X¨Ó¡C¥Ø«e¨Ó»¡¡M§Ú­ÌÁÙ¨S­p¹º°µ¤@­ÓÃþ¦ü Netfilter ¥L­Ì¨º¼Ëªº­p¤ÀªO¡M¤£¹L¡M¹ï©ó©Ò¦³À°§U¹L§Ú­ÌªºªB¤Í¡M±N¥Ã»·»Ê·P©ó¤ß¡C

\begin{itemize}
\item Ron Brinker $<$service\%emcis.com$>$
\item Lennert Buytenhek $<$buytenh@gnu.org$>$
\item Esteve Camps $<$esteve@hades.udg.es$>$
\item Marco Davids $<$marco@sara.nl$>$
\item Stephan "Kobold" Gehring $<$Stephan.Gehring@bechtle.de$>$
\item Nadeem Hasan $<$nhasan@usa.net$>$
\item Koos van den Hout $<$koos@kzdoos.xs4all.nl$>$
\item Philippe Latu $<$philippe.latu\%linux-france.org$>$
\item Jason Lunz $<$j@cc.gatech.edu$>$
\item Alexey Mahotkin $<$alexm@formulabez.ru$>$
\item Pawel Krawczyk $<$kravietz\%alfa.ceti.pl$>$
\item Wim van der Most 
\item Stephan Mueller $<$smueller@chronox.de$>$
\item Ram Narula $<$ram@princess1.net$>$
\item Jorge Novo $<$jnovo@educanet.net$>$
\item Patrik $<$ph@kurd.nu$>$
\item Jason Pyeron $<$jason\%pyeron.com$>$
\item Rusty Russell (with apologies for always misspelling your name)
\item Jamal Hadi Salim $<$hadi\%cyberus.ca$>$
\item Sheharyar Suleman Shaikh $<$sss23@drexel.edu$>$
\item Nick Silberstein $<$nhsilber\%yahoo.com$>$
\item Konrads Smelkov $<$konrads@interbaltika.com$>$
\item Jason Tackaberry $<$tack@linux.com$>$
\item Charles Tassell $<$ctassell\%isn.net$>$
\item Glen Turner $<$glen.turner\%aarnet.edu.au$>$
\item Song Wang $<$wsong@ece.uci.edu$>$
\end{itemize}




\end{document}
