Traffic shaping using dummynet

Question

I'm trying to create a set of firewall rules to shape the traffic coming out of my Mini. It's running a web server, and I'd like to prioritize ssh traffic over http. I set up an incoming and outgoing pipe with:
# Download pipe
ipfw pipe 1 config bw 1024kbit/s
# Upload pipe
ipfw pipe 2 config bw 256kbit/s
I then make a few queues:
# High priority queues
ipfw queue 1 config pipe 1 weight 75
ipfw queue 2 config pipe 2 weight 75
# Medium priority queues
ipfw queue 11 config pipe 1 weight 25
ipfw queue 12 config pipe 2 weight 25
# Low priority queues
ipfw queue 101 config pipe 1 weight 5
ipfw queue 102 config pipe 2 weight 5
The problem then occurs when attempting to match traffic. I've tried variations on a theme like the following in an attempt to match outgoing web traffic:
ipfw add queue 11 tcp from any src-port 80 to any out xmit en0
The only rule that ever manages to match anything is:
ipfw add queue 101 ip from any to any in recv en0
The corresponding outgoing rule never catches anything:
ipfw add queue 102 ip from any to any out xmit en0
Any idea what I'm missing? Is there something I need to enable via sysctl?
Thanks,
Andreas

Answer 1

1. when you have traffic shapping and the limit
for the shaped value is exeeeded, all traffic arriving at the interface with
no token in the token bucket is queued using the configured queue to thier appropriate queue..
hence any type of queueing is not invoken unless some sort of trafiic conjestion exist either
via shapping or otherwise.
2. If you have a granular shaping instruction per protocol per bandwidth. The traffic over
its shapped value would be queued and sent at maximun shape rate configured. ( that's one of the uses of shaping, to trim rate at which
a specific traffic is sent). If its just queuing that is enable not shaping, then
a traffic for a specific queue can use as much bandwidth as availabel when there is no other traffic, hence no congestion.
3. if you have shaped and non-shaped traffic on an interface using GTS, the shaped traffic can use as much bandwidht as the maximum of the shaped
value while not-shaped traffic will also use bandwidht on as see bandwidth without the need to be controlled, however non-shaped traffic will use
all the bandwidht it needs till the interface start droping packet but the shaped traffic would be queued till there is enough token to start outputing
from that queue. if the there are non-shaped traffic, it could be possible that they may overwelm the interface
and prevent even shaped traffic from geting enough bandwidht to the shaped value.