Setting DSCP using iptables – 1


If our hardware/software (i.e. IP Phone, gateway) doesn’t set proper DSCP value it can be done using iptables in the nearest linux machine. In scenario there are two hosts:

  • Ping Request is a linux (CentOS 5.3, 2.6.18-128.e15) with iptables v1.3.5
  • Ping Response is Windows 7 with Wireshark on board
In example, just for simplification, all traffic from Ping Request host is mark with DSCP value 46 (Critical).
Changes in firewall were done after fresh install (default iptables rules):
iptables -t mangle -N wawit-mark-dscp-46
iptables -t mangle -A POSTROUTING -j wawit-mark-dscp-46
iptables -t mangle -A wawit-mark -j DSCP --set-dscp 46
After ping command on Ping Response host we captured:
DSCP value 0×2e in hex is equal to 46 in decimal.
Example is trivial. Of course we should set DSCP value in packets according to available criteria, i.e. src/dst IP address, port, protocol etc.
After having proper DSCP values we can implement QoS mechanism in our network nodes according to them.

Comments

Post a Comment