- veth device from CNI/CNM plugin: eth0
- tap device that connects to the VM: tap0
tc qdisc add dev eth0 ingress
tc filter add dev eth0 parent ffff: protocol all u32 match u8 0 0 action mirred egress redirect dev tap0
tc qdisc add dev tap0 ingress
tc filter add dev tap0 parent ffff: protocol all u32 match u8 0 0 action mirred egress redirect dev eth0
tc qdisc add dev eth0 ingress
- Add a queuing discipline
- on
dev eth0
- attach the
ingress qdisc
Here the handle defaults to ffff:
tc filter add dev eth0 parent ffff: protocol all u32 match u8 0 0 action mirred egress redirect dev tap0
- Add a filter
- to device
dev eth0
- to parent (class) handle to which we are attaching, ffff: i.e. ingress which we created before (there is no need for
tc class add
in the ingress case as it does not support classful queuing discplines). - protocol all
- classifier u32
- parameters to the classifier u8 0 0, and the first byte of the packet with 0 and if the result is 0 (which it always will be) (i.e. always true)
- action mirred egress redirect dev eth0, redirect the packet to egress of dev eth0
https://www.tldp.org/HOWTO/html_single/Traffic-Control-HOWTO/
A source of terminology confusion is the usage of the terms root qdisc and ingress qdisc. These are not really queuing disciplines, but rather locations onto which traffic control structures can be attached for egress (outbound traffic) and ingress (inbound traffic).
Each interface contains both. The primary and more common is the egress qdisc, known as the root qdisc. It can contain any of the queuing disciplines (qdiscs) with potential classes and class structures. The overwhelming majority of documentation applies to the root qdisc and its children. Traffic transmitted on an interface traverses the egress or root qdisc.
For traffic accepted on an interface, the ingress qdisc is traversed. With its limited utility, it allows no child class to be created, and only exists as an object onto which a filter can be attached. For practical purposes, the ingress qdisc is merely a convenient object onto which to attach a policer to limit the amount of traffic accepted on a network interface.