Wash happens after Cake is done with the packet. Cake uses the original DSCP received to determine tin selection, then after the packet gets tinned, the DSCP is washed so that it doesn't get propagated to WiFi WMM.I still want to wash DSCP markings on ingress, in cake's settings, right? I'm assuming that wipes whatever classifications Comcast throws on it and v2.2.0 applies its markings AFTER that.
wash
. But I do it unconditionally, mainly because everything would be in Bulk for we the Comcast customers.Would a catchall be like this (for diffserv8):I do add a catchall filter to force any unmatched traffic into the besteffort tin, to mimic the same effect ofwash
. But I do it unconditionally, mainly because everything would be in Bulk for we the Comcast customers.
ipset=/./tin2_4,tin2_6
No, that isn't good. You'll only cause problems for yourself if you try to load all domains into an ipset. Please remove that.Would a catchall be like this (for diffserv8):
Code:ipset=/./tin2_4,tin2_6
Difficult to tell if that is working so far.
How would you make a catchall?No, that isn't good. You'll only cause problems for yourself if you try to load all domains into an ipset. Please remove that.
What are you trying to achieve? And why use diffserv8?
It's already created by the script if you use diffserv3 or diffserv4 as a tc filter. Nasty syntax.How would you make a catchall?
# tc filter show dev ifb4eth0 pref 99
filter parent 8006: protocol all matchall
filter parent 8006: protocol all matchall handle 0x1
action order 1: skbedit priority 8006:2 pipe
index 27 ref 1 bind 1
Excellent. Thanks for the guidance. I have a tendency to toil over the most complicated option and work my way down.Only use dnsmasq to identify the important stuff that needs to be prioritized up or down from besteffort. Everything else should end up in besteffort without doing anything else.
Beta 2.20 available on develop branch!
This has the initial groundwork for ipset-based classification for upload and download traffic. How you populate the ipsets is up to you, but I expect most of us to use dnsmasq functionality.
Example/jffs/configs/dnsmasq.conf.add
(just created for my testing, not exhaustive or meant to be your starting point):
The ipset names that CakeQOS-Merlin creates depend on which prioritization scheme you use:Code:ipset=/googlevideo.com/nflxvideo.net/aiv-cdn.net/r.cloudfront.net/aiv-delivery.net/video_4,video_6 ipset=/zoom.us/skype.com/voice_4,voice_6 ipset=/backblaze.com/backblazeb2.com/bulk_4,bulk_6 ipset=/ms-acdc.office.com/windowsupdate.com/update.microsoft.com/bulk_4,bulk_6 ipset=/onedrive.com/1drv.ms/1drv.com/bulk_4,bulk_6
There is no user interface for this, at least for now. I'm not certain yet that I want to take on the responsibility to manage dnsmasq options in CakeQOS-Merlin. But it's pretty darn easy to setup yourself, thanks to the dnsmasq.conf customizations available in Merlin.
- besteffort: (none created)
- diffserv3: bulk_4, besteffort_4, voice_4 (optionally bulk_6, besteffort_6, voice_6 if IPv6 enabled)
- diffserv4: bulk_4, besteffort_4, video_4, voice_4 (optionally bulk_6, besteffort_6, video_6, voice_6 if IPv6 enabled)
- diffserv8: tin0_4, tin1_4, tin2_4, ... tin7_4 (and IPv6 equivalents)
The hardest part may be to find and isolate which domain names you really need to track via the ipset. For example, youtube.com won't give you what you really want (i.e. googlevideo.com), so I strongly suggest using Diversion with logging enabled to look for the domains of interest.
Interested users can switch to the develop branch by re-running the installer for that branch:
Code:mkdir -p /jffs/addons/cake-qos && /usr/sbin/curl -s "https://raw.githubusercontent.com/ttgapers/cakeqos-merlin/develop/cake-qos.sh" -o "/jffs/addons/cake-qos/cake-qos" && chmod 755 /jffs/addons/cake-qos/cake-qos && sh /jffs/addons/cake-qos/cake-qos install
Troubleshooting / Debugging:
Please report issues and include the outputs of these commands:
Code:ipset list -n iptables -t mangle -S CakeQOS-Merlin ip6tables -t mangle -S CakeQOS-Merlin tc -s filter show dev ifb4eth0 tc -s qdisc show dev eth0 tc -s qdisc show dev ifb4eth0 grep ^ipset= /jffs/configs/dnsmasq.conf.add
bitmap:port
ipset containing all the Facetime udp ports (3478-3497,16384-16402). Then added another tc filter putting all that into Video. I debated putting it into Voice, but left Voice for WiFi calling.ipset create videoports bitmap:port range 3400-17000
ipset add videoports 3478-3497
ipset add videoports 16384-16402
ipset create voiceports bitmap:port range 500-4500
ipset add voiceports 500
ipset add voiceports 4500
handle="$(tc qdisc show dev ifb4eth0 root | awk ' { print $3 } ')"
tc filter add dev ifb4eth0 parent $handle protocol all prio 31 basic match 'ipset(videoports src)' action skbedit priority ${handle}3
tc filter add dev ifb4eth0 parent $handle protocol all prio 41 basic match 'ipset(voiceports src)' action skbedit priority ${handle}4
It's easy if you have dnsmasq logging enabled (e.g. by using Diversion, even if ad-blocking is disabled). You will see log entries for ipset in the dnsmasq.log.how do i check that hte domains are being actually pulled in? i added a domain and its not being put in the correct tin
# grep ipset /opt/var/log/dnsmasq.log
Oct 8 18:00:01 dnsmasq[31145]: 13783 192.168.1.195/49745 ipset add video_6 2a00:86c0:2044:2044::154 ipv6-c498-ord001-ix.1.oca.nflxvideo.net
Oct 8 18:00:01 dnsmasq[31145]: 13789 192.168.1.195/64693 ipset add video_4 45.57.45.211 ipv6-c012-ord001-dev-ix.1.oca.nflxvideo.net
Oct 8 18:00:01 dnsmasq[31145]: 13789 192.168.1.195/64693 ipset add video_6 45.57.45.211 ipv6-c012-ord001-dev-ix.1.oca.nflxvideo.net
Oct 8 18:00:01 dnsmasq[31145]: 13790 192.168.1.195/62226 ipset add video_4 2a00:86c0:2045:2045::211 ipv6-c012-ord001-dev-ix.1.oca.nflxvideo.net
Oct 8 18:00:01 dnsmasq[31145]: 13790 192.168.1.195/62226 ipset add video_6 2a00:86c0:2045:2045::211 ipv6-c012-ord001-dev-ix.1.oca.nflxvideo.net
k it looks like its working. my only issue now is i'm trying to get DirecTV Stream connections in the right tin and one of the domains they use when making the rule manually i get a warning saying that it resolves to more then 1 IP address so its only resolving the first one? how do add a wildcard or something?It's easy if you have dnsmasq logging enabled (e.g. by using Diversion, even if ad-blocking is disabled). You will see log entries for ipset in the dnsmasq.log.
Code:# grep ipset /opt/var/log/dnsmasq.log Oct 8 18:00:01 dnsmasq[31145]: 13783 192.168.1.195/49745 ipset add video_6 2a00:86c0:2044:2044::154 ipv6-c498-ord001-ix.1.oca.nflxvideo.net Oct 8 18:00:01 dnsmasq[31145]: 13789 192.168.1.195/64693 ipset add video_4 45.57.45.211 ipv6-c012-ord001-dev-ix.1.oca.nflxvideo.net Oct 8 18:00:01 dnsmasq[31145]: 13789 192.168.1.195/64693 ipset add video_6 45.57.45.211 ipv6-c012-ord001-dev-ix.1.oca.nflxvideo.net Oct 8 18:00:01 dnsmasq[31145]: 13790 192.168.1.195/62226 ipset add video_4 2a00:86c0:2045:2045::211 ipv6-c012-ord001-dev-ix.1.oca.nflxvideo.net Oct 8 18:00:01 dnsmasq[31145]: 13790 192.168.1.195/62226 ipset add video_6 2a00:86c0:2045:2045::211 ipv6-c012-ord001-dev-ix.1.oca.nflxvideo.net
I addedk it looks like its working. my only issue now is i'm trying to get DirecTV Stream connections in the right tin and one of the domains they use when making the rule manually i get a warning saying that it resolves to more then 1 IP address so its only resolving the first one? how do add a wildcard or something?
\
this is the domain
api.cld.dtvce.com
i tried just doing dtvce.com and also *.dtvce.com but i dont think its working cuz its not part of the output of the grep of the log file...
ipset=/api.cld.dtvce.com/video_4,video_6
(since I have IPv6 enabled). I found this in the log:Oct 8 19:25:59 dnsmasq[11453]: 3 127.0.0.1/50390 ipset add video_4 44.224.68.212 prod-apigee-alb-1283653329.us-west-2.elb.amazonaws.com
Oct 8 19:25:59 dnsmasq[11453]: 3 127.0.0.1/50390 ipset add video_6 44.224.68.212 prod-apigee-alb-1283653329.us-west-2.elb.amazonaws.com
Oct 8 19:25:59 dnsmasq[11453]: 3 127.0.0.1/50390 ipset add video_4 44.225.117.96 prod-apigee-alb-1283653329.us-west-2.elb.amazonaws.com
Oct 8 19:25:59 dnsmasq[11453]: 3 127.0.0.1/50390 ipset add video_6 44.225.117.96 prod-apigee-alb-1283653329.us-west-2.elb.amazonaws.com
Oct 8 19:25:59 dnsmasq[11453]: 3 127.0.0.1/50390 ipset add video_4 54.203.185.228 prod-apigee-alb-1283653329.us-west-2.elb.amazonaws.com
Oct 8 19:25:59 dnsmasq[11453]: 3 127.0.0.1/50390 ipset add video_6 54.203.185.228 prod-apigee-alb-1283653329.us-west-2.elb.amazonaws.com
Oct 8 19:25:59 dnsmasq[11453]: 3 127.0.0.1/50390 ipset add video_4 35.82.128.104 prod-apigee-alb-1283653329.us-west-2.elb.amazonaws.com
Oct 8 19:25:59 dnsmasq[11453]: 3 127.0.0.1/50390 ipset add video_6 35.82.128.104 prod-apigee-alb-1283653329.us-west-2.elb.amazonaws.com
Oct 8 19:25:59 dnsmasq[11453]: 3 127.0.0.1/50390 ipset add video_4 44.236.128.225 prod-apigee-alb-1283653329.us-west-2.elb.amazonaws.com
Oct 8 19:25:59 dnsmasq[11453]: 3 127.0.0.1/50390 ipset add video_6 44.236.128.225 prod-apigee-alb-1283653329.us-west-2.elb.amazonaws.com
Oct 8 19:25:59 dnsmasq[11453]: 3 127.0.0.1/50390 ipset add video_4 44.240.74.133 prod-apigee-alb-1283653329.us-west-2.elb.amazonaws.com
Oct 8 19:25:59 dnsmasq[11453]: 3 127.0.0.1/50390 ipset add video_6 44.240.74.133 prod-apigee-alb-1283653329.us-west-2.elb.amazonaws.com
Oct 8 19:25:59 dnsmasq[11453]: 3 127.0.0.1/50390 ipset add video_4 44.241.155.133 prod-apigee-alb-1283653329.us-west-2.elb.amazonaws.com
Oct 8 19:25:59 dnsmasq[11453]: 3 127.0.0.1/50390 ipset add video_6 44.241.155.133 prod-apigee-alb-1283653329.us-west-2.elb.amazonaws.com
Oct 8 19:25:59 dnsmasq[11453]: 3 127.0.0.1/50390 ipset add video_4 35.166.158.121 prod-apigee-alb-1283653329.us-west-2.elb.amazonaws.com
Oct 8 19:25:59 dnsmasq[11453]: 3 127.0.0.1/50390 ipset add video_6 35.166.158.121 prod-apigee-alb-1283653329.us-west-2.elb.amazonaws.com
Ok so don't worry about the arming I saw . Cool. Since I have your attention can you look this over and tell me if it's adaquite ?I addedipset=/api.cld.dtvce.com/video_4,video_6
(since I have IPv6 enabled). I found this in the log:
Code:Oct 8 19:25:59 dnsmasq[11453]: 3 127.0.0.1/50390 ipset add video_4 44.224.68.212 prod-apigee-alb-1283653329.us-west-2.elb.amazonaws.com Oct 8 19:25:59 dnsmasq[11453]: 3 127.0.0.1/50390 ipset add video_6 44.224.68.212 prod-apigee-alb-1283653329.us-west-2.elb.amazonaws.com Oct 8 19:25:59 dnsmasq[11453]: 3 127.0.0.1/50390 ipset add video_4 44.225.117.96 prod-apigee-alb-1283653329.us-west-2.elb.amazonaws.com Oct 8 19:25:59 dnsmasq[11453]: 3 127.0.0.1/50390 ipset add video_6 44.225.117.96 prod-apigee-alb-1283653329.us-west-2.elb.amazonaws.com Oct 8 19:25:59 dnsmasq[11453]: 3 127.0.0.1/50390 ipset add video_4 54.203.185.228 prod-apigee-alb-1283653329.us-west-2.elb.amazonaws.com Oct 8 19:25:59 dnsmasq[11453]: 3 127.0.0.1/50390 ipset add video_6 54.203.185.228 prod-apigee-alb-1283653329.us-west-2.elb.amazonaws.com Oct 8 19:25:59 dnsmasq[11453]: 3 127.0.0.1/50390 ipset add video_4 35.82.128.104 prod-apigee-alb-1283653329.us-west-2.elb.amazonaws.com Oct 8 19:25:59 dnsmasq[11453]: 3 127.0.0.1/50390 ipset add video_6 35.82.128.104 prod-apigee-alb-1283653329.us-west-2.elb.amazonaws.com Oct 8 19:25:59 dnsmasq[11453]: 3 127.0.0.1/50390 ipset add video_4 44.236.128.225 prod-apigee-alb-1283653329.us-west-2.elb.amazonaws.com Oct 8 19:25:59 dnsmasq[11453]: 3 127.0.0.1/50390 ipset add video_6 44.236.128.225 prod-apigee-alb-1283653329.us-west-2.elb.amazonaws.com Oct 8 19:25:59 dnsmasq[11453]: 3 127.0.0.1/50390 ipset add video_4 44.240.74.133 prod-apigee-alb-1283653329.us-west-2.elb.amazonaws.com Oct 8 19:25:59 dnsmasq[11453]: 3 127.0.0.1/50390 ipset add video_6 44.240.74.133 prod-apigee-alb-1283653329.us-west-2.elb.amazonaws.com Oct 8 19:25:59 dnsmasq[11453]: 3 127.0.0.1/50390 ipset add video_4 44.241.155.133 prod-apigee-alb-1283653329.us-west-2.elb.amazonaws.com Oct 8 19:25:59 dnsmasq[11453]: 3 127.0.0.1/50390 ipset add video_6 44.241.155.133 prod-apigee-alb-1283653329.us-west-2.elb.amazonaws.com Oct 8 19:25:59 dnsmasq[11453]: 3 127.0.0.1/50390 ipset add video_4 35.166.158.121 prod-apigee-alb-1283653329.us-west-2.elb.amazonaws.com Oct 8 19:25:59 dnsmasq[11453]: 3 127.0.0.1/50390 ipset add video_6 35.166.158.121 prod-apigee-alb-1283653329.us-west-2.elb.amazonaws.com
ASUSWRT-Merlin RT-AX86U 386.4_alpha1-g8f4afe68
90 Wed Aug 11 16:44:26 UTC 2021
albinoman887@RT-AX86U-8EA8:/tmp/home/root# tc
qdisc > tc.log
albinoman887@RT-AX86U-8EA8:/tmp/home/root# tc
qdisc
qdisc pfifo_fast 0: dev eth0 root refcnt 2 ban
ds 3 priomap 1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
qdisc pfifo_fast 0: dev eth1 root refcnt 2 ban
ds 3 priomap 1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
qdisc pfifo_fast 0: dev eth2 root refcnt 2 ban
ds 3 priomap 1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
qdisc pfifo_fast 0: dev eth3 root refcnt 2 ban
ds 3 priomap 1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
qdisc pfifo_fast 0: dev eth4 root refcnt 2 ban
ds 3 priomap 1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
qdisc pfifo_fast 0: dev eth5 root refcnt 2 ban
ds 3 priomap 1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
qdisc pfifo_fast 0: dev spu_us_dummy root refc
nt 2 bands 3 priomap 1 2 2 2 1 2 0 0 1 1 1 1 1
1 1 1
qdisc pfifo_fast 0: dev spu_ds_dummy root refc
nt 2 bands 3 priomap 1 2 2 2 1 2 0 0 1 1 1 1 1
1 1 1
qdisc pfifo_fast 0: dev eth6 root refcnt 2 ban
ds 3 priomap 1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
qdisc pfifo_fast 0: dev eth7 root refcnt 2 ban
ds 3 priomap 1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
qdisc pfifo 8001: dev vlan101 root refcnt 2 li
mit 1p
qdisc cake 8002: dev ppp0 root refcnt 2 bandwi
dth 4710Kbit diffserv3 dual-srchost nat nowash
no-ack-filter split-gso rtt 100ms ptm overhea
d 34
qdisc ingress ffff: dev ppp0 parent ffff:fff1
----------------
qdisc cake 8003: dev ifb4ppp0 root refcnt 2 ba
ndwidth 37888Kbit diffserv4 dual-dsthost nat w
ash ingress no-ack-filter split-gso rtt 100ms
ptm overhead 34
albinoman887@RT-AX86U-8EA8:/tmp/home/root
CakeQOS-Merlin: > Download Status:
qdisc cake 8003: dev ifb4ppp0 root refcnt 2 ba
ndwidth 37888Kbit diffserv4 dual-dsthost nat w
ash ingress no-ack-filter split-gso rtt 100ms
ptm overhead 34
CakeQOS-Merlin: > Upload Status:
qdisc cake 8002: dev ppp0 root refcnt 2 bandwi
dth 4710Kbit diffserv3 dual-srchost nat nowash
no-ack-filter split-gso rtt 100ms ptm overhea
d 34
##############################################
###########
qdisc cake 8003: root refcnt 2 bandwidth 37888
Kbit diffserv4 dual-dsthost nat wash ingress n
o-ack-filter split-gso rtt 100ms ptm overhead
34
Sent 14573586524 bytes 10100020 pkt (dropped
101219, overlimits 17133980 requeues 0)
backlog 65648b 44p requeues 0
memory used: 684288b of 4Mb
capacity estimate: 37888Kbit
min/max network layer size: 28 /
1492
min/max overhead-adjusted size: 63 /
1550
average network hdr offset: 0
Bulk Best Effort Vi
deo Voice
thresh 2368Kbit 37888Kbit 18944K
bit 9472Kbit
target 7.67ms 5ms
5ms 5ms
interval 103ms 100ms 10
0ms 100ms
pk_delay 8.09ms 33.4ms 57.
4ms 0us
av_delay 1.24ms 13.6ms 56.
8ms 0us
sp_delay 6us 6.36ms 32
0us 0us
backlog 0b 65648b
0b 0b
pkts 49137 10134513 17
633 0
bytes 70192685 14627931050 26299
006 0
way_inds 0 723520
0 0
way_miss 188 18816
1 0
way_cols 0 0
0 0
drops 115 100277
827 0
marks 0 0
0 0
ack_drop 0 0
0 0
sp_flows 1 4
1 0
bk_flows 0 2
0 0
un_flows 0 0
0 0
max_len 1492 1492 1
492 0
quantum 300 1156
578 300
albinoman887@RT-AX86U-8EA8:/tmp/home/root# ips
et list -n
bulk_4
besteffort_4
video_4
voice_4
bulk
besteffort
video
voice
albinoman887@RT-AX86U-8EA8:/tmp/home/root#
Imagine what it’s like to try to read it.I'm on my phone right now so it was kinda a PITA to get it all
hey can i set device priority under the Bandwith Monitor Tab in conjunction with qos?Imagine what it’s like to try to read it.
All I can really see is that you’ve duplicated some domains in the dnsmasq.conf.add file. And DTV is in Bulk. Everything else was too messy to interpret.
Welcome To SNBForums
SNBForums is a community for anyone who wants to learn about or discuss the latest in wireless routers, network storage and the ins and outs of building and maintaining a small network.
If you'd like to post a question, simply register and have at it!
While you're at it, please check out SmallNetBuilder for product reviews and our famous Router Charts, Ranker and plenty more!