Master Linux Traffic Shaping with TC: Control Bandwidth per IP and Port

1. Linux Traffic‑Control Principles

Linux shapes traffic by queuing packets, allowing operations such as adding delay, dropping packets, reordering, duplication, corruption, and rate limiting. The qdisc‑class‑filter hierarchy implements these controls in three steps:

Create a qdisc queue.

Create class classifications (e.g., two tiers of 10 MBps and 20 MBps).

Create filter rules that bind specific IPs or ports to the classes.

The tc utility is the primary Linux tool for traffic control and underpins components like Cilium/eBPF.

2. Limiting Access Speed for Specific IP/Port (Egress)

2.1 View Network Interface

ifconfig

eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 1.1.1.1  netmask 255.255.254.0  broadcast 1.1.1.1
        inet6 1::1:1:1:1  prefixlen 64  scopeid 0x20<link>
        ether 1:1:1:1:1:1  txqueuelen 1000  (Ethernet)
        RX packets 2980910  bytes 2662352343 (2.4 GiB)
        TX packets 1475969  bytes 122254809 (116.5 MiB)

2.2 Configuration

Create the root qdisc:

tc qdisc add dev eth0 root handle 1: htb default 1

Create the first‑level class that holds all bandwidth:

tc class add dev eth0 parent 1:0 classid 1:1 htb rate 6MBps burst 15k

Create a child class for finer control (example rate 6 MBps, ceiling 10 MBps):

tc class add dev eth0 parent 1:1 classid 1:10 htb rate 6MBps ceil 10MBps burst 15k

Create a filter that binds a destination IP to the child class (e.g., 1.2.3.4):

tc filter add dev eth0 protocol ip parent 1:0 prio 1 u32 match ip dst 1.2.3.4 flowid 1:10

2.3 View and Clean Up Configuration

Show class configuration:

tc class show dev eth0

class htb 1:10 parent 1:1 leaf 10: prio 0 rate 48Mbit ceil 80Mbit burst 15Kb cburst 1600b
class htb 1:1 root rate 48Mbit ceil 48Mbit burst 15Kb cburst 1590b

Show filter configuration:

tc filter show dev eth0

filter parent 1: protocol ip pref 1 u32 chain 0
filter parent 1: protocol ip pref 1 u32 chain 0 fh 800: ht divisor 1
filter parent 1: protocol ip pref 1 u32 chain 0 fh 800::800 order 2048 key ht 800 bkt 0 flowid 1:10 not_in_hw
  match 01020304/ffffffff at 16

Delete all settings:

tc qdisc del dev eth0 root

3. Limiting Inbound Traffic (Ingress) for Specific IP/Port

Since qdisc rules apply only to egress traffic, inbound traffic must be redirected to an ifb (Intermediate Functional Block) device, then shaped on its egress side.

3.1 Enable Virtual Interface

Load the ifb module with one instance: modprobe ifb numifbs=1 Bring up ifb0:

ip link set dev ifb0 up

3.2 Configuration

Add an ingress qdisc to the physical NIC: tc qdisc add dev eth0 handle ffff: ingress Redirect all incoming traffic to ifb0:

tc filter add dev eth0 parent ffff: protocol ip u32 match u32 0 0 action mirred egress redirect dev ifb0

On ifb0, create a root qdisc and classes, then bind a destination IP to a class:

tc qdisc add dev ifb0 root handle 1: htb default 10
tc class add dev ifb0 parent 1:0 classid 1:1 htb rate 6Mbps
tc class add dev ifb0 parent 1:1 classid 1:10 htb rate 6Mbps
tc filter add dev ifb0 parent 1:0 protocol ip prio 16 u32 match ip dst 1.2.3.4 flowid 1:10

3.3 View and Clean Up

Monitoring image (traffic limited to 6 MBps inbound):

Show class configuration on ifb0:

tc class show dev ifb0

class htb 1:10 parent 1:1 prio 0 rate 48Mbit ceil 48Mbit burst 1590b cburst 1590b
class htb 1:1 root rate 48Mbit ceil 48Mbit burst 1590b cburst 1590b

Show filter configuration on ifb0:

tc filter show dev ifb0

filter parent 1: protocol ip pref 16 u32 chain 0
filter parent 1: protocol ip pref 16 u32 chain 0 fh 800: ht divisor 1
filter parent 1: protocol ip pref 16 u32 chain 0 fh 800::800 order 2048 key ht 800 bkt 0 flowid 1:10 not_in_hw
  match 01020304/ffffffff at 16

Delete all configurations and unload the module:

tc qdisc del dev eth0 ingress
tc qdisc del dev ifb0 root
modprobe -r ifb

4. References

https://arthurchiao.art/blog/lartc-qdisc-zh/

https://serverfault.com/questions/350023/tc-ingress-policing-and-ifb-mirroring