TOS Bit ManipulationLinux Network Administrators GuidePrevChapter 9. TCP/IP FirewallNextTOS Bit Manipulation The Type Of Service (TOS) bits are a set of four-bit flags in the IP header. When any one of these bit flags is set, routers may handle the datagram differently than datagrams with no TOS bits set. Each of the four bits has a different purpose and only one of the TOS bits may be set at any time, so combinations are not allowed. The bit flags are called Type of Service bits because they enable the application transmitting the data to tell the network the type of network service it requires.The classes of network service available are:Minimum delayUsed when the time it takes for a datagram to travel from the source host to destination host (latency) is most important. A network provider might, for example, use both optical fiber and satellite network connections. Data carried across satellite connections has farther to travel and their latency is generally therefore higher than for terrestrial-based network connections between the same endpoints. A network provider might choose to ensure that datagrams with this type of service set are not carried by satellite.Maximum throughputUsed when the volume of data transmitted in any period of time is important. There are many types of network applications for which latency is not particularly important but the network throughput is; for example, bulk-file transfers. A network provider might choose to route datagrams with this type of service set via high-latency, high-bandwidth routes, such as satellite connections.Maximum reliabilityUsed when it is important that you have some certainty that the data will arrive at the destination without retransmission being required. The IP protocol may be carried over any number of underlying transmission mediums. While SLIP and PPP are adequate datalink protocols, they are not as reliable as carrying IP over some other network, such as an X.25 network. A network provider might make an alternate network available, offering high reliability, to carry IP that would be used if this type of service is selected.Minimum costUsed when it is important to minimize the cost of data transmission. Leasing bandwidth on a satellite for a transpacific crossing is generally less costly than leasing space on a fiber-optical cable over the same distance, so network providers may choose to provide both and charge differently depending on which you use. In this scenario, your “minimum cost” type of service bit may cause your datagrams to be routed via the lower-cost satellite route.Setting the TOS Bits Using ipfwadm or ipchains The ipfwadm and ipchains commands deal with the TOS bits in much the same manner. In both cases you specify a rule that matches the datagrams with particular TOS bits set, and use the -t argument to specify the change you wish to make.The changes are specified using two-bit masks. The first of these bit masks is logically ANDed with the IP options field of the datagram and the second is logically eXclusive-ORd with it. If this sounds complicated, we'll give you the recipes required to enable each of the types of service in a moment.The bit masks are specified using eight-bit hexadecimal values. Both ipfwadm and ipchains use the same argument syntax: -t andmask xormask Fortunately the same mask arguments can be used each time you wish to set a particular type of service, to save you having to work them out. They are presented with some suggested uses in Table 9-3.Table 9-3. Suggested Uses for TOS BitmasksTOSANDmaskXORmaskSuggested UseMinimum Delay0x010x10ftp, telnet, sshMaximum Throughput0x010x08ftp-data, wwwMaximum Reliability0x010x04snmp, dnsMinimum Cost0x010x02nntp, smtpSetting the TOS Bits Using iptables The iptables tool allows you to specify rules that capture only datagrams with TOS bits matching some predetermined value using the -m tos option, and for setting the TOS bits of IP datagrams matching a rule using the -j TOS target. You may set TOS bits only on the FORWARD and OUTPUT chains. The matching and the setting occur quite independently. You can configure all sort of interesting rules. For example, you can configure a rule that discads all datagrams with certain TOS bit combinations, or a rule that sets the TOS bits of datagrams only from certain hosts. Most often you will use rules that contain both matching and setting to perform TOS bit translations, just as you could for ipfwadm or ipchains.Rather than the complicated two-mask configuration of ipfwadm and ipchains, iptables uses the simpler approach of plainly specifying what the TOS bits should match, or to what the TOS bits should be set. Additionally, rather than having to remember and use the hexadecimal value, you may specify the TOS bits using the more friendly mnemonics listed in the upcoming table.The general syntax used to match TOS bits looks like: -m tos --tos mnemonic [other-args] -j targetThe general syntax used to set TOS bits looks like: [other-args] -j TOS --set mnemonicRemember that these would typically be used together, but they can be used quite independently if you have a configuration that requires it.MnemonicHexadecimalNormal-Service0x00Minimize-Cost0x02Maximize-Reliability0x04Maximize-Throughput0x08Minimize-Delay0x10PrevHomeNextNetfilter and IP Tables (2.4 Kernels)UpTesting a Firewall Configuration