This section describes the IPQoS architecture and how IPQoS implements the differentiated services (Diffserv) model that is defined inRFC 2475, An Architecture for Differentiated Services (http://www.ietf.org/rfc/rfc2475.txt?number=2475). The following elements of the Diffserv model are included in IPQoS:
Classifier
Meter
Marker
In addition, IPQoS includes the flow-accounting module and the dlcosmk marker for use with virtual local area network (VLAN) devices.
In the Diffserv model, the classifier is responsible for organizing selected traffic flows into groups on which to apply different service levels. The classifiers that are defined in RFC 2475 were originally designed for boundary routers. In contrast, the IPQoS classifier ipgpc is designed to handle traffic flows on hosts that are internal to the local network. Therefore, a network with both IPQoS systems and a Diffserv router can provide a greater degree of differentiated services. For a technical description, refer to the ipgpc(7ipp) man page.
The ipgpc classifier does the following:
Selects traffic flows that meet the criteria specified in the IPQoS configuration file on the IPQoS-enabled system
The QoS policy defines various criteria that must be present in packet headers. These criteria are called selectors. The ipgpc classifier compares these selectors against the headers of packets that are received by the IPQoS system. ipgpc then selects all matching packets.
Separates the packet flows into classes, network traffic with the same characteristics, as defined in the IPQoS configuration file
Examines the value in the packet's differentiated service (DS) field for the presence of a differentiated services codepoint (DSCP)
The presence of the DSCP indicates whether the incoming traffic has been marked by the sender with a forwarding behavior.
Determines what further action is specified in the IPQoS configuration file for packets of a particular class
Passes the packets to the next IPQoS module specified in the IPQoS configuration file, or returns the packets to the network stream
For an overview of the classifier, refer to Classifier (ipgpc) Overview. For information on invoking the classifier in the IPQoS configuration file, refer to IPQoS Configuration File.
The ipgpc classifier supports a variety of selectors that you can use in the filter clause of the IPQoS configuration file. When you define a filter, always use the minimum number of selectors that are needed to successfully retrieve traffic of a particular class. The number of filters you define can impact IPQoS performance.
The following table lists the selectors that are available for ipgpc.
|
The meter tracks the transmission rate of flows on a per-packet basis. The meter then determines whether the packet conforms to the configured parameters. The meter module determines the next action for a packet from a set of actions that depend on packet size, configured parameters, and flow rate.
The meter consists of two metering modules, tokenmt and tswtclmt, which you configure in the IPQoS configuration file. You can configure either module or both modules for a class.
When you configure a metering module, you can define two parameters for rate:
committed-rate – Defines the acceptable transmission rate in bits per second for packets of a particular class
peak-rate – Defines the maximum transmission rate in bits per second that is allowable for packets of a particular class
A metering action on a packet can result in one of three outcomes:
green – The packet causes the flow to remain within its committed rate.
yellow – The packet causes the flow to exceed its committed rate but not its peak rate.
red – The packet causes the flow to exceed its peak rate.
You can configure each outcome with different actions in the IPQoS configuration file.
The tokenmt module uses token buckets to measure the transmission rate of a flow. You can configure tokenmt to operate as a single-rate or two-rate meter. A tokenmt action instance maintains two token buckets that determine whether the traffic flow conforms to configured parameters.
The tokenmt(7ipp) man page explains how IPQoS implements the token meter paradigm.
Configuration parameters for tokenmt are as follows:
committed_rate – Specifies the committed rate of the flow in bits per second.
committed_burst – Specifies the committed burst size in bits. The committed_burst parameter defines how many outgoing packets of a particular class can pass onto the network at the committed rate.
peak_rate – Specifies the peak rate in bits per second.
peak_burst – Specifies the peak or excess burst size in bits. The peak_burst parameter grants to a traffic class a peak-burst size that exceeds the committed rate.
color_aware – Enables the awareness mode for tokenmt.
color_map – Defines an integer array that maps DSCP values to green, yellow, or red.
To configure tokenmt as a single-rate meter, do not specify a peak_rate parameter for tokenmt in the IPQoS configuration file. To configure a single-rate tokenmt instance to have a red, green, or a yellow outcome, you must specify the peak_burst parameter. If you do not use the peak_burst parameter, you can configure tokenmt to have only a red outcome or green outcome. For an example of a single-rate tokenmt with two outcomes, see Example 6, Sample IPQoS Configuration File for an Application Server.
When tokenmt operates as a single-rate meter, the peak_burst parameter is actually the excess burst size. committed_rate and either committed_burst or peak_burst must be nonzero positive integers.
To configure tokenmt as a two-rate meter, specify a peak_rate parameter for the tokenmt action in the IPQoS configuration file. A two-rate tokenmt always has the three outcomes (red, yellow, and green). The committed_rate, committed_burst, and peak_burst parameters must be nonzero positive integers.
To configure a two-rate tokenmt to be color aware, you must add parameters to specifically add “color awareness.” The following is an example action statement that configures tokenmt to be color aware.
Example 9 Color-Aware tokenmt Action for the IPQoS Configuration Fileaction {
module tokenmt
name meter1
params {
committed_rate 4000000
peak_rate 8000000
committed_burst 4000000
peak_burst 8000000
global_stats true
red_action_name continue
yellow_action_name continue
green_action_name continue
color_aware true
color_map {0-20,22:GREEN;21,23-42:RED;43-63:YELLOW}
}
}
You enable color awareness by setting the color_aware parameter to true. As a color-aware meter, tokenmt assumes that the packet has already been marked as red, yellow, or green by a previous tokenmt action. Color-aware tokenmt evaluates a packet by using the DSCP in the packet header in addition to the parameters for a two-rate meter.
The color_map parameter contains an array into which the DSCP in the packet header is mapped. Consider the following color_map array:
color_map {0-20,22:GREEN;21,23-42:RED;43-63:YELLOW}Packets with a DSCP of 0–20 and 22 are mapped to green. Packets with a DSCP of 21 and 23–42 are mapped to red. Packets with a DSCP of 43–63 are mapped to yellow. tokenmt maintains a default color map. However, you can change the default as needed by using the color_map parameters.
In the color_action_name parameters, you can specify continue to complete processing of the packet. Or, you can add an argument to send the packet to a marker action, for example, yellow_action_name mark22.
The tswtclmt metering module estimates average bandwidth for a traffic class by using a time-based rate estimator. tswtclmt always operates as a three-outcome meter. The rate estimator provides an estimate of the flow's arrival rate. This rate should approximate the running average bandwidth of the traffic stream over a specific period or time, its time window.
You use the following parameters to configure tswtclmt:
committed_rate – Specifies the committed rate in bits per second
peak_rate – Specifies the peak rate in bits per second
window – Defines the time window, in milliseconds, over which history of average bandwidth is kept
For technical details about tswtclmt, refer to the tswtclmt(7ipp) man page.
IPQoS includes two marker modules, dscpmk and dlcosmk. This section contains information for using both markers. Normally, you should use dscpmk because dlcosmk is available only for IPQoS systems with VLAN devices.
For technical information about these modules, refer to the dscpmk(7ipp) and dlcosmk(7ipp) man pages.
The marker receives traffic flows after the flows are processed by the classifier or by the metering modules. The marker marks the traffic with a forwarding behavior. This forwarding behavior is the action to be taken on the flows after the flows leaving the IPQoS system. Forwarding behavior to be taken on a traffic class is defined in the per-hop behavior (PHB). The PHB assigns a priority to a traffic class, which indicates the precedence flows of that class in relation to other traffic classes. PHBs govern forwarding behaviors only on the IPQoS system's contiguous network. For more information, refer to Per-Hop Behaviors.
Packet forwarding is the process of sending traffic of a particular class to its next destination on a network. For a host such as an IPQoS system, a packet is forwarded from the host to the local network stream. For a Diffserv router, a packet is forwarded from the local network to the router's next hop.
The marker marks the DS field in the packet header with a forwarding behavior that is defined in the IPQoS configuration file. Thereafter, the IPQoS system and subsequent Diffserv-aware systems forward the traffic as indicated in the DS field until the mark changes. To assign a PHB, the IPQoS system marks a value in the DS field of the packet header. This value is called the differentiated services codepoint (DSCP). The Diffserv architecture defines two types of forwarding behaviors, EF and AF, which use different DSCPs. For overview information about DSCPs, refer to DS Codepoint.
The IPQoS system reads the DSCP for the traffic flow and evaluates the flow's precedence in relation to other outgoing traffic flows. The IPQoS system then prioritizes all concurrent traffic flows and releases each flow onto the network by its priority.
The Diffserv router receives the outgoing traffic flows and reads the DS field in the packet headers. The DSCP enables the router to prioritize and schedule the concurrent traffic flows. The router forwards each flow by the priority that is indicated by the PHB. Note that the PHB cannot apply beyond the boundary router of the network unless Diffserv-aware systems on subsequent hops also recognize the same PHB.
Expedited forwarding (EF) guarantees that packets with the recommended EF codepoint 46 (101110) receive the best treatment that is available on release to the network. Expedited forwarding is often compared to a leased line. Packets with the 46 (101110) codepoint are guaranteed preferential treatment by all Diffserv routers en route to the packets' destination.
Assured forwarding (AF) provides four different classes of forwarding behaviors that you can specify to the marker. The following table shows the classes, the three drop precedences that are provided with each class, and the recommended DSCPs that are associated with each precedence. Each DSCP is represented by its AF value, its value in decimal, and its value in binary.
|
Any Diffserv-aware system can use the AF codepoint as a guide for providing differentiated forwarding behaviors to different classes of traffic.
When these packets reach a Diffserv router, the router evaluates the packets' codepoints along with DSCPs of other traffic in the queue. The router then forwards or drops packets depending on the available bandwidth and the priorities that are assigned by the packet's DSCPs. Note that packets that are marked with the EF PHB are guaranteed bandwidth over packets that are marked with the various AF PHBs.
Coordinate packet marking between any IPQoS systems on your network and the Diffserv router to ensure that packets are forwarded as expected. For example, suppose IPQoS systems on your network mark packets with AF21 (010010), AF13 (001110), AF43 (100110), and EF (101110) codepoints. You then need to add the AF21, AF13, AF43, and EF DSCPs to the appropriate file on the Diffserv router.
See your router manufacturer's documentation for information about setting the AF PHB and instructions for setting DS codepoints on your equipment.
The DSCP is 6 bits in length. The DS field is 1 byte long. When you define a DSCP, the marker marks the first 6 significant bits of the packet header with the DS codepoint. The remaining 2 least-significant bits are unused.
To define a DSCP, you use the following parameter within a marker action statement:
dscp_map{0-63:DS-name tcodepoint}The dscp_map parameter is a 64-element array, which you populate with the (DSCP) value. dscp_map is used to map incoming DSCPs to outgoing DSCPs that are applied by the dscpmk marker.
You must specify the DSCP value to dscp_map in decimal notation. For example, you must translate the EF codepoint of 101110 into the decimal value 46, which results in dscp_map{0-63:46}. For AF codepoints, you must translate the various codepoints that are shown in Figure 5, Table 5, Assured Forwarding Codepoints to decimal notation for use with dscp_map.
The dlcosmk marker module marks a forwarding behavior in the MAC header of a datagram. You can use dlcosmk only on an IPQoS system with a VLAN interface.
dlcosmk adds four bytes, which are known as the VLAN tag, to the MAC header. The VLAN tag includes a 3-bit user-priority value, which is defined by the IEEE 801.D standard. Diffserv-aware switches that understand VLAN can read the user-priority field in a datagram. The 801.D user priority values implement the class-of-service (CoS) marks, compatible with commercial switches.
You can use the user-priority values in the dlcosmk marker action by defining the class of service marks that are listed in the following table.
|
For more information, refer to the dlcosmk(7ipp) man page.
This section introduces a simple network scenario that shows how to implement IPQoS on systems with VLAN devices. The scenario includes two IPQoS systems, machine1 and machine2, that are connected by a switch. The VLAN device on machine1 has the IP address 10.10.8.1. The VLAN device on machine2 has the IP address 10.10.8.3.
The following IPQoS configuration file for machine1 shows a simple solution for marking traffic through the switch to machine2.
Example 10 IPQoS Configuration File for a System With a VLAN Devicefmt_version 1.0
action {
module ipgpc
name ipgpc.classify
filter {
name myfilter2
daddr 10.10.8.3
class myclass
}
class {
name myclass
next_action mark4
}
}
action {
name mark4
module dlcosmk
params {
cos 4
next_action continue
global_stats true
}
}
In this configuration, all traffic from machine1 that is destined for the VLAN device on machine2 is passed to the dlcosmk marker. The mark4 marker action instructs dlcosmk to add a VLAN mark to datagrams of class myclass with a CoS of 4. The user-priority value of 4 indicates that the switch between the two machines should give controlled load forwarding to myclass traffic flows from machine1.
The IPQoS flowacct module records information about traffic flows, a process that is referred to as flow accounting. Flow accounting produces data that can be used for billing customers or for evaluating the amount of traffic to a particular class.
Flow accounting is optional. flowacct is typically the final module that metered or marked traffic flows might encounter before release onto the network stream. For an illustration of flowacct's position in the Diffserv model, see Traffic Flow Through the IPQoS Implementation of the Diffserv Model. For detailed technical information, refer to the flowacct(7ipp) man page.
To enable flow accounting, you need to use the Oracle Solaris exacct accounting facility and the acctadm command, as well as flowacct. For more information about flow accounting, refer to Using Flow Accounting and Statistics Gathering Tasks.
The flowacct module gathers information about flows in a flow table that is composed of flow records. Each entry in the table contains one flow record. You cannot display a flow table.
In the IPQoS configuration file, you define the following flowacct parameters to measure flow records and to write the records to the flow table:
timer – Defines an interval, in milliseconds, when timed-out flows are removed from the flow table and written to the file that is created by acctadm
timeout – Defines an interval, in milliseconds, which specifies how long a packet flow must be inactive before the flow times out
max_limit – Places an upper limit on the number of flow records that can be stored in the flow table
For an example of how flowacct parameters are used in the IPQoS configuration file, refer to How to Configure Flow Control in the IPQoS Configuration File.
The flowacct module maintains a flow table that records all packet flows that are seen by a flowacct instance.
A flow is identified by the following parameters, which include the flowacct 8-tuple:
Source address
Destination address
Source port
Destination port
DSCP
User ID
Project ID
Protocol Number
If all the parameters of the 8–tuple for a flow remain the same, the flow table contains only one entry. The max_limit parameter determines the number of entries that a flow table can contain.
The flow table is scanned at the interval that is specified in the IPQoS configuration file for the timer parameter. The default is 15 seconds. A flow “times out” when its packets are not seen by the IPQoS system for at least the timeout interval in the IPQoS configuration file. The default timeout interval is 60 seconds. Entries that have timed out are then written to the accounting file that is created with the acctadm command.
A flowacct record contains the attributes described in the following table.
|
You use the acctadm command to create a file in which to store the various flow records that are generated by flowacct. acctadm works in conjunction with the extended accounting facility. For technical information, refer to the acctadm(1M) man page.
The flowacct module observes flows and fills the flow table with flow records. flowacct then evaluates its parameters and attributes in the interval that is specified by timer. When a packet is not seen for at least the last_seen plus timeout values, the packet times out. All timed-out entries are deleted from the flow table. These entries are then written to the accounting file each time the interval that is specified in the timer parameter elapses.
To invoke acctadm for use with the flowacct module, use the following syntax:
acctadm -e file-type -f filename flow
Invokes acctadm with the -e option. The -e indicates that a resource list follows.
Specifies the attributes to be gathered, either basic or extended. For a list of attributes in each file type, refer to Figure 7, Table 7, Attributes of a flowacct Record.
Creates the file file-name to hold the flow records.
Indicates that acctadm is to be run with IPQoS.