|
发表于 2010-3-11 22:09:32
|
显示全部楼层
本帖最后由 TheHorizon 于 2010-3-11 22:19 编辑
如果用NTH,直接看官方实例即可。有说明各种用法。对了,说明一下,这是3.0之后的变化的地方。大概看懂这里,其它也就按步就搬就可以了。如SRCNAT那里填啥,如IP ROUTER那里填啥,那种翻来翻去讲了太多了。关键是这个例子里讲的百分比。
以下是本论坛的朋友翻译过来的。呵呵。引用一下。
xiaowill21 (2008-12-09 11:15:43)
In v3.0 it is a little different implementation (执行)of NTH.
NTH在执行上有一点点不同之处
It has only two parameters(参数) 'every' and 'packet'.
它只有俩个参数,每一个和包
[edit] How it works in v3.0
在3.0这个个版本是怎么工作的呢?
Every rule has its own counter(计数器).
每一条规则都有它自己的计数器
When rule(规则) receives(接受) packet counter(包计数器) for current(通用?) rule is increased (增加)by one.
If counter(计数器) matches(比赛,对比,匹配) value(值) of 'every' packet will be matched and counter will be set to zero.(包会被匹配并且计数器会置为0)
If passthrough (路径)is not set then packets will be marked (做匹配?)as follows:
first rule nth=2,1 rule will match(匹配) every first packet of 2, hence(因此), 50% of all the traffic that is matched by the rules (50%的流量被这条规则匹配)
second rule if passthrough=no(路径=NO) will match ONLY 25% of traffic because in 3.0 you need only one rule to catch traffic not like 2.9 [edit] Example(2:如果路径=N0,将会匹配少许的25%的流量,因为在3.0的版本你需要仅仅一条规则去控制流量而不像2.9版本的)
Now it is possible to match 50% of all traffic only with one rule:
现在仅仅通过一条规则来匹配50%的流量是可能的
/ip firewall mangle
add action=mark-packet chain=prerouting new-packet-mark=AAA nth=2,1;
If more than one rule is needed, then there are two ways to match packets:
如果多条规则被需要,那这里就有两张种方式去匹配包
first rule sees all packets and matches 1/3 of all, 第一条规则,检查所有的包,并且匹配其中的3分子1
second rule sees 2/3 of packets and matches 1/2, 第二条规则检查3分子2,匹配一半
third rule sees and matches all packets that passed through first two rules ( 1/3 of all packets ).第三条规则查看匹配剩下的,
/ip firewall mangle
add action=mark-packet chain=prerouting new-packet-mark=AAA nth=3,1 passthrough=no;
add action=mark-packet chain=prerouting new-packet-mark=BBB nth=2,1 passthrough=no;
add action=mark-packet chain=prerouting new-packet-mark=CCC ;
all rules can see all packets and each rule matches every 3-rd packet. 所有的规则都可以检查到所有的包,每一规则匹配3分之1的包
/ip firewall mangle
add action=mark-packet chain=prerouting new-packet-mark=AAA nth=3,1 passthrough=yes;
add action=mark-packet chain=prerouting new-packet-mark=BBB nth=3,2 passthrough=yes;
add action=mark-packet chain=prerouting new-packet-mark=CCC nth=3,3 passthrough=yes;
一年之后我来翻译 |
|