[Shorewall-users] Ingress policing

[Andrew S. <asu...@su...>]

On Fri, Nov 10, 2006 at 10:11:04AM -0800, Tom Eastep wrote:
> Helder Gaspar Rodrigues wrote:
> > Yes that are packet being dropped:
> > qdisc ingress ffff: ----------------
> >  Sent 22676402 bytes 39464 pkt (dropped 244, overlimits 0 requeues 0)
> >  rate 0bit 0pps backlog 0b 0p requeues 0
> > 
> > why?
> 
> The ingress qdisc is very imprecise. That is why the Shorewall traffic shaping
> instructions tell you to tune your IN-BADNWIDTH.

That reminds me of a related question - tcdevices (and the html
documentation) says this:

#                       If you don't want any traffic to be dropped set this
#                       to a value faster than your interface.

But why can't I tell shorewall just to not bother creating an ingress
qdisc at all? Ingress policing is pretty useless unless you're trying
to work around router braindamage at the other end (which I'm not).