انت هنا الان : شبكة جامعة بابل > موقع الكلية > نظام التعليم الالكتروني > مشاهدة المحاضرة

Mangle

الكلية كلية تكنولوجيا المعلومات     القسم قسم شبكات المعلومات     المرحلة 3
أستاذ المادة وسام سمير عبد علي بهيه       29/05/2013 19:38:24
Mangle

Mangle is a kind of marker that marks packets for future processing with special marks. Many other facilities in RouterOS make use of these marks, e.g. queue trees, NAT, routing. They identify a packet based on its mark and process it accordingly. The mangle marks exist only within the router, they are not transmitted across the network.

Additionally, the mangle facility is used to modify some fields in the IP header, like TOS (DSCP) and TTL fields.


Marking packets

Marking each packet is quite resource expensive especially if rule has to match against many parameters from IP header or address list containing hundreds of entries.

Lets say we want to

mark all tcp packets except tcp/80 and match these packets against first address list
mark all udp packets and match them against second address list.

/ip firewall mangle
add chain=forward protocol=tcp port=!80 dst-address-list=first action=mark-packet new-packet-mark=first
add chain=forward protocol=udp dst-address-list=second action=mark-packet new-packet-mark=second

Setup looks quite simple and probably will work without problems in small networks. Now multiply count of rules by 10, add few hundred entries in address list, run 100Mbit of traffic over this router and you will see how rapidly CPU usage is increasing. The reason for such behavior is that each rule reads IP header of every packet and tries to match collected data against parameters specified in firewall rule.

/ip firewall mangle
add chain=forward protocol=tcp port=!80 dst-address-list=first connection-state=new action=mark-connection \
new-connection-mark=first
add chain=forward connection-mark=first action=mark-packet new-packet-mark=first passthrough=no

add chain=forward protocol=udp dst-address-list=second connection-state=new action=mark-connection \
new-connection-mark=second
add chain=forward connection-mark=second action=mark-packet new-packet-mark=second passthrough=no

Now first rule will try to match data from IP header only from first packet of new connection and add connection mark. Next rule will no longer check IP header for each packet, it will just compare connection marks resulting in lower CPU consumption. Additionally passthrough=no was added that helps to reduce CPU consumption even more.


المادة المعروضة اعلاه هي مدخل الى المحاضرة المرفوعة بواسطة استاذ(ة) المادة . وقد تبدو لك غير متكاملة . حيث يضع استاذ المادة في بعض الاحيان فقط الجزء الاول من المحاضرة من اجل الاطلاع على ما ستقوم بتحميله لاحقا . في نظام التعليم الالكتروني نوفر هذه الخدمة لكي نبقيك على اطلاع حول محتوى الملف الذي ستقوم بتحميله .