Flower filter in tc

NAME

flower − flow based traffic control filter

SYNOPSIS

tc filter ... flower [ MATCH_LIST ] [ action ACTION_SPEC ] [ classid CLASSID ]

MATCH_LIST := [ MATCH_LIST ] MATCH

MATCH := { indev ifname | skip_sw | skip_hw | { dst_mac | src_mac } mac_address | vlan_id VID | vlan_prio PRIORITY | vlan_eth_type { ipv4 | ipv6 | ETH_TYPE } | ip_proto { tcp | udp | IP_PROTO } | { dst_ip | src_ip } { ipv4_address | ipv6_address } | { dst_port | src_port } port_number }

DESCRIPTION

The flower filter matches flows to the set of keys specified and assigns an arbitrarily chosen class ID to packets belonging to them. Additionally (or alternatively) an action from the generic action framework may be called.

OPTIONS

action ACTION_SPEC

Apply an action from the generic actions framework on matching packets.

classid CLASSID

Specify a class to pass matching packets on to. CLASSID is in the form X:Y, while X and Y are interpreted as numbers in hexadecimal format.

indev ifname

Match on incoming interface name. Obviously this makes sense only for forwarded flows. ifname is the name of an interface which must exist at the time of tc invocation.

skip_sw

Do not process filter by software. If hardware has no offload support for this filter, or TC offload is not enabled for the interface, operation will fail.

skip_hw

Do not process filter by hardware.

dst_mac mac_address
src_mac mac_address

Match on source or destination MAC address.

vlan_id VID

Match on vlan tag id. VID is an unsigned 12bit value in decimal format.

vlan_prio priority

Match on vlan tag priority. PRIORITY is an unsigned 3bit value in decimal format.

vlan_eth_type VLAN_ETH_TYPE

Match on layer three protocol. ETH_TYPE may be either ipv4,ipv6 or an unsigned 16bit value in hexadecimal format.

ip_proto IP_PROTO

Match on layer four protocol. IP_PROTO may be either tcp,udp or an unsigned 8bit value in hexadecimal format.

dst_ip ADDRESS
src_ip ADDRESS

Match on source or destination IP address. ADDRESS must be a valid IPv4 or IPv6 address, depending on ether_type, which has to be specified in beforehand.

dst_port NUMBER
src_port NUMBER

Match on layer 4 protocol source or destination port number. Only available for ip_proto values udp and tcp, which has to be specified in beforehand.

NOTES

As stated above where applicable, matches of a certain layer implicitly depend on the matches of the next lower layer. Precisely, layer one and two matches ( indev,dst_mac,src_mac and eth_type) have no dependency, layer three matches ( ip_proto,dst_ip and src_ip) require eth_type being set to either ipv4 or ipv6, and finally layer four matches ( dst_port and src_port) depend on ip_proto being set to either tcp or udp.

There can be only used one mask per one prio. If user needs to specify different mask, he has to use different prio.