Quality of Service

From DD-WRT Wiki

Revision as of 11:17, 10 August 2009 by Pbix (Talk | contribs)
Jump to: navigation, search

Quality of Service (QoS) is a method to guarantee a bandwidth relationship between individual applications or protocols. This is very handy when you max out your connection so that you can allow for each application to have some bandwidth and so that no single application can take down the internet connection. This allows, for example, a full speed download via FTP without causing jittering on a VOIP chat. The FTP will slow down slightly as bandwidth is needed for the VOIP, provided VOIP was given greater priority.

If you would like to set hard coded bandwidth limits (throttling), this can be done using the tc command

NOTE: Ethernet Port Priority only works on older, ADM based, chipsets. That is, the Linksys WRT54G v1.0, 1.1, 2.0 and the WRT54GS v1.0.


Initial Setup

  • Log into the Web Interface
  • Select the NAT/QoS tab and then the QoS sub-tab.
  • Tick "Enable"
  • Set Port to "WAN" or "LAN & WLAN". The term WAN here refers to the WAN connection on your router while the term "LAN & WLAN" refers to the combination of your local ports and Wifi connections. Normally the selection should not really matter since all traffic coming in the one end is going out the other. However, I recommend you select "LAN & WLAN" (See Application considerations below).
  • Select HTB as your Packet Scheduler. (See Application considerations below)
  • You can use a speed test like DSL Reports to check your actual connection speed. The uplink/downlink setting in DD-WRT are with respect to the port selected above. Its a common error to get confused. When WAN is selected these match the uplink/downlink measured. When you select "LAN & WLAN" these are reversed. It is required that you enter 90% of the values you measure into the proper field. After you have everything set run the speed test again. If you geet 90% of your previous measurement in each direction of then things are cool. If you get results which are way off then chances are that you have reversed these values.
  • Ignore Optimize for gaming. It does not do anything and hopefully will be deleted one day.

You must enter a value for the downlink field but if you want you can enter 0 for the uplink field in which case no QoS will occur in that direction. I do not recommend setting you uplink field to zero.

I know it bugs you to set only 90% of your available bandwidth in these fields but this is required. There will be a bottleneck somewhere in the system and QoS can only work if the bottleneck is in your router where it has some control. The goal is to force the bottleneck to be in your router as opposed to some random location out on the wire over which you have no control.

Prioritizing by Application (Skype, Http) or Port Range (P2P)

  • Choose an available Service or Port Range from the list, or create one.
  • For P2P Applications, due to evolving protocols, encryption and obfuscation, it can be much better to define a Port Range [such as TCP/UDP, 60000-61000]. Set your P2P applications to operate within this range. This can significantly reduce the load on the router, avoid mis-identifying packets, and more efficiently shape your network traffic.
  • For Service definitions see here.
  • Add all your other selected Services and Port Ranges here
  • Prioritize to Express or Premium, or de-prioritize to Bulk. "Bulk" gives no guaranteed bandwidth, "Standard" ensures 10%, "Express" 15%, "Premium" 75% and "Exempt" 100% (values according to this post).
  • Services not configured are always Standard priority.
  • Choosing a Service (L7 Protocol) can work better than choosing a port range; though the router works harder.
  • Tip: If you have trouble modifying the drop-down list, suggest using Opera 9.x and the BrainSlayer router GUI style (worked for me, firefox, safari, and IE don't)

Prioritizing by IP Address (Netmask Priority)

These are entered in CIDR notation including the network prefix.

For example, to specify a single IP address enter xxx.xxx.xxx.xxx / 32. Be careful to enter netmask prefix as "32" because leaving it zero means something entirely different.

The network prefix is the number of bits of the IP address to use. For example, the entry results in a match against all address on your 192.168.1.xx subnet. An entry of results in all subnets beginning with 192.168.x.x being matched. So now you can see that results in every IP address (x.x.x.x) being matched which is probably not what you want.

After entering the IP address must press "Add" to get it appended to the list.

Prioritizing by MAC Address

In the case you want to prioritize traffic from a particular device without a static IP address on your LAN, you can prioritize by MAC Address.

  • Under 'MAC Priority', enter the MAC Address of the device
  • Click 'add'
  • click 'Save changes'

This method works via the source MAC address only so traffic is only properly prioritized if the connection was initiated from this address. Traffic initiated from somewhere else will not be properly marked even if it is destined for one of the listed MAC addresses.

Priorities explained

Bandwidth classification based on the four categories will be enabled first on MAC addresses, then netmasks and finally services. If prioritizing by MAC addresses, highest priority should be express (exempt is NOT a priority) - up-prioritize programs via the ports (sidenote: regular internet activities are already top prioritized via inherent software). *A higher class does not necessarily mean better performance - match the priority to the needs of the MAC address.

  • Exempt - This class tries to keep the bandwith and packet flow untouched. Use for gaming.
  • Premium - The top bandwidth class. By default handshaking and icmp packets fall into this class. This class should be used sparingly. Occasionally VoIP service may be placed in this class so that voice receives top priority. Use per program requirement only.
  • Express - The Express class is for interactive applications that require bandwidth above standard services so that interactive apps run smoothly. Use for computers who have interactive data.
  • Standard - All services that are not specifically classed will fall under the standard class.
  • Bulk - The bulk class is only allocated bandwidth when the remaining classes are idle. Use this class for P2P services and downloading services like FTP.

Detailed breakdown of traffic

If you'll like to know the specifics, traffic are allocated based on the following percentages of uplink and downlink values on each class:

  • Exempt: untouched
  • Premium: 75% - 100%
  • Express: 15% - 100%
  • Standard: 10% - 100%
  • Bulk: 1.5% - 100%

What this really means is that if you have 10,000kbit of uplink traffic, "Standard" class traffic can be reduced and de-prioritized to 10% or 1,000kbit when a concurrent Express service requires the uplink pipe at the same time.

You can run the following tc command to check breakdown of traffic applied to each interface. Uplink limits are applied on the WAN interface while Downlink limits are applied on the LAN interface. The interface names are device specific so you might have to check by running "ifconfig" to list all interfaces on your router. The following command will check QoS uplink limits applied on a Broadcom device's WAN interface (vlan2):

tc class show dev vlan2

How Do You Check What QoS Priorities Were Applied

The DDWRT web UI doesn't display any live traffic. Short of doing a practical test, you can get your hands dirty by checking the conntrack entries via telnet or ssh access in the router. When you're logged in run:

cat /proc/net/ip_conntrack

It will list out all currently open connection and protocol that is currently being routed by the router. This is what it would look like:

tcp      6 113 ESTABLISHED src= dst= sport=48959 dport=21 src= dst= sport=21 dport=48959 [ASSURED] use=1 rate=73 l7proto=ftp mark=40
udp      17 29 src= dst= sport=56105 dport=53 src= dst= sport=53 dport=56105 use=1 rate=157 l7proto=dns mark=10

What you'll be interested to look at will be the first set of source and destination IP, including the port numbers. Next the presence of l7proto and the "mark" field. The entries indicate the current live connection QoS priority applied on them based on the "mark" field. The "mark" values corresponds to the following:

  • Exempt: 100
  • Premium: 10
  • Express: 20
  • Standard: 30
  • Bulk: 40
  • (no QoS matched): 0

I have "ftp" set to bulk, and "dns" set to premium priority. Thus the conntrack output confirmed that the right QoS rules were applied. Using this method requires that you know the destination IP, and port number of the service, and this must be checked while the connection is active. You may see "mark=0" for some l7proto service even though they are in configured in the list of QoS rules. This may mean that the layer 7 pattern matching system didn't match a new or changed header for that protocol. Custom service on port matches will usually take care of these.

Alternatively, you can also check applied QoS on active connections using the following command (pipe to more if output is huge):

cat /proc/net/ip_conntrack | awk '{print $1 " " $5 ":" $7 " " $6 ":" $8 " " $16}' | sed -e 's/sport=//' -e 's/dport=//' -e 's/mark=100/Exempt/' -e 's/mark=10/Premium/' -e 's/mark=20/Express/' -e 's/mark=30/Standard/' -e 's/mark=40/Bulk/' -e 's/mark=0/Default-Standard/'


With all these ways of marking traffic its easy to get confused about how seemingly contradictory requirements are resolved. For example, what happens if you have an IP rule setting IP to priority "exempt" and have a MAC rule setting MAC AA:BB:CC:DD:EE:FF to priority "bulk"?

The order the precendence is as follows:

MAC - If you have specified a MAC address priority then it takes precedence over all others

Netmask - The IP address entries are applied in the order that they appear in your netmask table. Interestingly only the first match applies. For example if you have an entry marking as bulk followed by an entry marking (all 192.168.1 addresses) as premium the traffic from would be marked bulk because it was the first match. Also if a match is found in this table it does not matter what you put in the services table.

Services - The services entries are applied in the order that they appear in your services tables. Again, only the first match will apply.

Ports - Be careful with port priorities. On many routers these have no effect at all. This is the case on my router (WRT54G-TM) so I cannot tell you how to verify that yours works or not. The note at the top of this page indicates specific models and versions.

Note for PPTP Users:

There seems to be a problem by using PPTP and QoS at the same time. If you use DD-WRT with enabled PPTP server and want to activate QoS for the WAN interface then you are no longer able to connect to the PPTP server from your LAN. PPTP, L2TP and IPSec Passthrough also doesn't work.

The problem is reproducible on a WRT54GL 1.1 with DD-WRT v24-sp1.

(update July 2009) tested DD-WRT v24-sp2 Build 12548M on my Asus rotuer- the problem seems to be fixed.

Application Considerations

There are several not so friendly undocumented features of DD-WRT which can affect your success with QoS.

  • The HFSC method of prioritization does not work correctly when enabled through the web interface. This is unfortunate because HSFC is technically superiour to HTB in almost every way. While the underlying functionality is present and working in DD-WRT the scripts executed from the web server as the result of your selections contain errors that will prevent reliable operation. You can use HFSC if you don't mind learning about it and writing scripts that execute from the command line but since this is rather complex I recommend that you stay with HTB. This information is current as of 8/1/09 and v24 pre-SP2. Maybe it will get fixed one day.
  • Even when using HTB there still is another problem with the web interface when you select "WAN" as your port. If you select WAN your router will still function and your QoS will have an effect but due to the nature of the problem you will not get optimum performance. You can resolve this in two ways. 1) Use the "WAN & WLAN" setting or 2) use the "WAN" setting and enter the following commands into your startup script. These instructions wait for QoS to get started and then deletes the offending line from the PREROUTING table. This information is current as of 8/1/09 and v24 pre-SP2. Maybe it will get fixed one day.
 sleep 20
 iptables -t mangle -D PREROUTING -i br0 -j IMQ --todev 0

  • Adding and deleting services, MAC address and netmasks is relatively simple with the web interface which is great, however, DD-WRT is not so good at actually updating its internal runtime data on the fly to reflect your selections. The result can be erroneous and conflicting iptables entries that can seriously hamper your performance. This can be especially confusing if you make a change then test, make another change the test etc. Take my advice, save your changes and reboot your router after you have completed your changes. This information is current as of 8/1/09 and v24 pre-SP2. Maybe it will get fixed one day.


Xipeng Xiao, "Technical, Commercial and Regulatory Challenges of QoS: An Internet Service Model Perspective", Morgan Kaufmann/Elsevier, 2008

Tim Szigeti and Christina Hattingh, "End-to-End QoS Network Design: Quality of Service in LANs, WANs, and VPNs", Cisco Press, 2004

External Links