rolf
Considering this filter:
tc filter add dev eth0 protocol ip parent 1:0 prio 1 u32 \
match ip src 1.2.3.4 \
match ip dport 80 0xffff \
flowid 1:10
Now I dont know...
Does this u32 filter mean
"match packets with src 1.2.3.4 AND dport 80"
or
"match packets with src 1.2.3.4 OR dport 80"
?
Also something else that I dont understad... what is the "0xffff" for?
Thanks :)
teodorgeorgiev
The first. The rules are "ANDed" --> "match packets with src 1.2.3.4 AND dport 80".
The 0xFFFF is the mask that you apply on the argument. FFFF goes to (ALL-1s... 1111111111111111).
Since the socket ports are 16bit integers, you apply a 16bit mask on it. If you were to match a protocol, you will use 0xFF, cause protocols are 8bit integers (0-255). Get a description of the IP packet and see the length of each field. By the length of the field you want to match you will make your mask.
that is.
