Linux – IPTables Match for hashing IP addresses

iptableslinux

So I'm trying to do roughly this

http://wiki.mikrotik.com/wiki/PCC

on Linux.

To explain a little further: PCC just takes, say, source address of the packet, hashes it, divides the hash by some number, and if the remainder is equal to some other number, it makes a rule match.

I'm actually using this to mostly randomly divide my network into several almost-equally-big groups. More specifically, six such groups would look like this:

Group 1: pcc_hash(source IP) % 6 = 0
Group 2: pcc_hash(source IP) % 6 = 1
... etc

The groups are then given some kind of common resource to share (say, bandwidth, or public IP address) that they don't like to change very often (esp. with public IP address).

My question is that if there is some good method to divide the network into any number of stochastically-equal subnets using some similar, preferably easy iptables rules.

I've succeeded in splitting the network into powers of two using u32 (2^n networks just by matching last n bits of source IP address). But some randomness would be great too, and having a network split into anything like exact thirds is impossible to do with this. Moreover, mikrotiks are essentially linux-based, so there has to be a way to do that 😀

Is someone here aware of a good method, or at least of some good u32 documentation that would make this possible?

Thanks in advance

-mk

Best Answer

Moreover, mikrotiks are essentially linux-based, so there has to be a way to do that :D

Well, then Mikrotik™ has to go GPL or be sued for going not whilst selling a product based on GPLed software. In case they're GPLed already, you can look into the source code. In case they're not — help'em. ;-)

I doubt there's a module like this available for Netfilter, but I think it wouldn't be too hard to write it using any similar as an example.

having a network split into anything like exact thirds is impossible to do with this.

Why makes you think so? Suppose you're masking with 0xF [0..15]; what then makes you unable to split it into ranges [0..5], [6..11], [12..15]? Yeah, not preciselly but quite close to 1/3. The wide range you'duse, the closer division you'd get.

Related Topic