TC+iptables问题

knuoxy

我利用的是TC+iptables做IP限速，的确可行，每台机器也不抢占它人带宽，
可关键是CPU的使用率太高了。
  PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND
3404 root      25   0  4416 3332  416 R 34.2  0.6   0:01.87 iptables
15935 root      15   0  8148 2440 1948 S 21.4  0.5   2:41.74 sshd

如果我连上去，根本就动不了。这属于正常吗？

有何办法可以缓解？

利用如果内网一台为20KB那么当他在下载后已经就用完20KB 而打开网站相对速度就变慢了，如何应付。

knuoxy

3 root      38  19     0    0    0 R 57.0  0.0 245:36.45 ksoftirqd/0
这个进程使用的CPU率太高。。
tcpdump抓包看了下但不懂的如何分析是否受外网攻击CPU一直都很高。
刚才平稳了一会要升上去了。
05:51:07.608708 IP storage1.flickr.vip.re2.yahoo.com.http > 61.131.13.40.ito-e-gui: . 16265293:16266753(1460) ack 3550144880 win 6432
05:51:09.081406 IP storage1.flickr.vip.re2.yahoo.com.http > 61.131.13.40.ito-e-gui: . 1460:2920(1460) ack 1 win 6432
05:51:09.081422 IP 188.194.175.220.broad.jdz.jx.dynamic.163data.com.cn.28667 > 61.131.13.40.18717: UDP, length 89
05:51:09.589000 IP storage1.flickr.vip.re2.yahoo.com.http > 61.131.13.40.ito-e-gui: . 2920:4380(1460) ack 1 win 6432
05:51:09.589016 IP 61.131.13.40.nvmsgd > 226.237.129.219.broad.mm.gd.dynamic.163data.com.cn.http: . ack 3965695929 win 64463
05:51:09.720173 IP 61.131.13.40.ito-e-gui > storage1.flickr.vip.re2.yahoo.com.http: . ack 2920 win 65535
05:51:09.720198 IP 61.131.13.40.18717 > 188.194.175.220.broad.jdz.jx.dynamic.163data.com.cn.28667: UDP, length 1440
05:51:09.720209 IP 61.131.13.40.18717 > 188.194.175.220.broad.jdz.jx.dynamic.163data.com.cn.28667: UDP, length 1440
05:51:09.720215 IP 61.131.13.40.18717 > 188.194.175.220.broad.jdz.jx.dynamic.163data.com.cn.28667: UDP, length 1440
05:51:09.720221 IP 61.131.13.40.18717 > 188.194.175.220.broad.jdz.jx.dynamic.163data.com.cn.28667: UDP, length 468
05:51:09.720227 IP 61.131.13.40.prm-sm-np > 61.164.143.87.29000: . ack 2266620579 win 65158

knuoxy

现在ping正常路由的CPU也低了
Reply from 218.85.157.99: bytes=32 time=4ms TTL=59
Reply from 218.85.157.99: bytes=32 time=5ms TTL=59
Reply from 218.85.157.99: bytes=32 time=5ms TTL=59
Reply from 218.85.157.99: bytes=32 time=6ms TTL=59
Reply from 218.85.157.99: bytes=32 time=4ms TTL=59
Reply from 218.85.157.99: bytes=32 time=7ms TTL=59
Reply from 218.85.157.99: bytes=32 time=7ms TTL=59
Reply from 218.85.157.99: bytes=32 time=32ms TTL=59
Reply from 218.85.157.99: bytes=32 time=6ms TTL=59
Reply from 218.85.157.99: bytes=32 time=4ms TTL=59
Reply from 218.85.157.99: bytes=32 time=14ms TTL=59
Reply from 218.85.157.99: bytes=32 time=7ms TTL=59
Reply from 218.85.157.99: bytes=32 time=5ms TTL=59
Reply from 218.85.157.99: bytes=32 time=3ms TTL=59
Reply from 218.85.157.99: bytes=32 time=23ms TTL=59
Reply from 218.85.157.99: bytes=32 time=4ms TTL=59
Reply from 218.85.157.99: bytes=32 time=4ms TTL=59
Reply from 218.85.157.99: bytes=32 time=8ms TTL=59
Reply from 218.85.157.99: bytes=32 time=4ms TTL=59
Reply from 218.85.157.99: bytes=32 time=96ms TTL=59
Reply from 218.85.157.99: bytes=32 time=9ms TTL=59
Reply from 218.85.157.99: bytes=32 time=10ms TTL=59
Reply from 218.85.157.99: bytes=32 time=59ms TTL=59
Reply from 218.85.157.99: bytes=32 time=34ms TTL=59

    3 root      34  19     0    0    0 S 24.9  0.0 246:18.74 ksoftirqd/0
4383 root      15   0  2156  880  704 R  1.9  0.2   0:00.03 top
    1 root      15   0  2032  644  552 S  0.0  0.1   0:28.28 init