Linux Advanced Routing & Traffic Control HOWTO

Netherlabs BV (bert hubert <bert.hubert@netherlabs.nl>)
Gregory Maxwell <greg@linuxpower.cx>
Remco van Mook <remco@virtu.nl>
Martijn van Oosterhout <kleptog@cupid.suninternet.com>
Paul B Schroeder <paulsch@us.ibm.com>
Jasper Spaans <jasper@spaans.ds9a.nl>
howto@ds9a.nl

1. Dedication

2. Introduction

• 2.1 Disclaimer & License
• 2.2 Prior knowledge
• 2.3 What Linux can do for you
• 2.4 Housekeeping notes
• 2.5 Access, CVS & submitting updates
• 2.6 Mailing list
• 2.7 Layout of this document

3. Introduction to iproute2

• 3.1 Why iproute2?
• 3.2 iproute2 tour
• 3.3 Prerequisites
• 3.4 Exploring your current configuration
• 3.5 ARP

4. Rules - routing policy database

• 4.1 Simple source routing

5. GRE and other tunnels

• 5.1 A few general remarks about tunnels:
• 5.2 IP in IP tunneling
• 5.3 GRE tunneling
• 5.4 Userland tunnels

6. IPv6 tunneling with Cisco and/or 6bone

• 6.1 IPv6 Tunneling

7. IPsec: secure IP over the Internet

8. Multicast routing

9. Queueing Disciplines for Bandwidth Management

• 9.1 Queues and Queueing Disciplines explained
• 9.2 Simple, classless Queueing Disciplines
• 9.3 Advice for when to use which queue
• 9.4 Terminology
• 9.5 Classful Queueing Disciplines
• 9.6 Classifying packets with filters

10. Loadsharing over multiple interfaces

• 10.1 Caveats

11. Netfilter & iproute - marking packets

12. Advanced filters for (re-)classifying packets

• 12.1 The "u32" classifier
• 12.2 The "route" classifier
• 12.3 Policing filters
• 12.4 Hashing filters for very fast massive filtering

13. Kernel network parameters

• 13.1 Reverse Path Filtering
• 13.2 Obscure settings

14. Advanced & less common queueing disciplines

• 14.1 bfifo/pfifo
• 14.2 Clark-Shenker-Zhang algorithm (CSZ)
• 14.3 DSMARK
• 14.4 Ingress qdisc
• 14.5 Random Early Detection (RED)
• 14.6 Generic Random Early Detection
• 14.7 VC/ATM emulation
• 14.8 Weighted Round Robin (WRR)

15. Cookbook

• 15.1 Running multiple sites with different SLAs
• 15.2 Protecting your host from SYN floods
• 15.3 Ratelimit ICMP to prevent dDoS
• 15.4 Prioritizing interactive traffic
• 15.5 Transparent web-caching using netfilter, iproute2, ipchains and squid
• 15.6 Circumventing Path MTU Discovery issues with per route MTU settings
• 15.7 Circumventing Path MTU Discovery issues with MSS Clamping (for ADSL,
• 15.8 The Ultimate Traffic Conditioner: Low Latency, Fast Up & Downloads

16. Building bridges, and pseudo-bridges with Proxy ARP

• 16.1 State of bridging and iptables
• 16.2 Bridging and shaping
• 16.3 Pseudo-bridges with Proxy-ARP

17. Dynamic routing - OSPF and BGP

18. Other possibilities

19. Further reading

20. Acknowledgements