accf_{data,http} defaults?

2003-06-06 Thread Conrad Sabatier
Perusing the accf_* man pages, I'm left with the impression that there's little use in loading these modules unless one explicitly modifies the code that creates new sockets in a given application, as well as, perhaps, writing one's own filters. Is this impression correct, or will accf_data and ac

Re: Does Netgraph in FBSD 5.x SMP requires GIANT lock?

2003-06-06 Thread Michael Shiu
I am using DEVICE_POLLING by Lugzi Rizzo and connecting 2 em devices using NG_ETHER with NG_BRIDGE. Actually, I am planning to make a netgraph node to do some filtering but as a performance prototype, I am getting those results mentioned. i.e. em0 - NG_ETHER - NG_BRIDGE - NG_ETHER - em1 The polli

netgraph hook for iface node

2003-06-06 Thread Khoa To
Hello, I need to implement a routing protocol on top of IP (i.e. the packet is encapsulated within an IP packet). I'm new to network programming, and from searching the web, it looks like netgraph can help me a lot. But I have some problems with applying netgraph to my implementation, and I am w

Re: Choices for security

2003-06-06 Thread Barney Wolff
On Fri, Jun 06, 2003 at 10:34:19AM +0200, Kristian Rask wrote: > > snort is listening for 80,443 setups on DMZ and logging to a MySQL server Since the database is deliberately ephemeral, I would keep it in an in-core hash table. > Another thing that has me wondering is something that would look

IPSec + gre

2003-06-06 Thread Mike Futerko
Hi, This is bug or feature that gre tunnel doesn't work under IPSec? I use gif tunnels for the following circuit - they do works just fine, except that I can't filter (ipfw) incoming packets that comes from gif. So I tried gre without IPSec and it works OK - I can filter incoming and outgoing pac

Re: fxp0: device timeout | SCB already complete (me too)

2003-06-06 Thread Mike Hoskins
On Tue, 3 Jun 2003, Shaun Jurrens wrote: > I hate to say it, but I've had these for months starting at 4.6-stable > and continuing up to at least the latest 4.7-RRELEASE-p* . I have one > dual -current box that has exibited the same behaviour as well. FWIW, I had similar issues (similar messages,

Re: fxp0: device timeout | SCB already complete (me too)

2003-06-06 Thread Shaun Jurrens
On Thu, Jun 05, 2003 at 10:54:14AM -0600, Justin T. Gibbs wrote: #> After that the box didn't find 3 of the 5 fxp nic's until a new #> >boot and a cleared ESCD. Not sure why an fxp card should bitch #> >about SCB's anyway. #> #> Perhaps because fxp devices have SCBs too? Not the sam

Re: Does Netgraph in FBSD 5.x SMP requires GIANT lock?

2003-06-06 Thread Vincent Jardin
Maybe one giant2thread node could be introduced into the graphs. It could put the messages and the mbufs into a queue from a giant context, then they could be processed from a thread. Is it a possible architecture or do I forget something ? Regards, Vincent Le Jeudi 5 Juin 2003 13:38, Julian

Request for documenting IPSec, NAT/divert, ipfw, ipfilter ... inkernel flow ?

2003-06-06 Thread Bjoern A. Zeeb
Hi, sorry for cross-mailing. Reply-to: set to freebsd-net. I have seen some discussion on freebsd-security etc. about some parts of the subject. I have seen older messages in archives. Regularly the same questions seem to come up. I have not found an all-including description of the answer to s.

Re: fxp0: device timeout | SCB already complete (me too)

2003-06-06 Thread Nate Lawson
On Thu, 5 Jun 2003, Shaun Jurrens wrote: > On Wed, Jun 04, 2003 at 06:32:46PM +0200, Palle Girgensohn wrote: > #> Hi Shaun, > #> > #> Thanks for the input! Glad to hear I'm not the only one > #> > #> In my case, both the SCSI and NIC are integrated on the motherboard, so I > #> cannot really move t

Re: fxp0: device timeout | SCB already complete (me too)

2003-06-06 Thread Justin T. Gibbs
After that the box didn't find 3 of the 5 fxp nic's until a new > boot and a cleared ESCD. Not sure why an fxp card should bitch > about SCB's anyway. Perhaps because fxp devices have SCBs too? Not the same SCBs that the Adaptec SCSI controllers have, but a different data str

Choices for security

2003-06-06 Thread Kristian Rask
Hi In the ongoing saga a new question arises... Presently the system is configured as follows 100 MBit WAN <--> FreeBSD Gateway <--> /28 DMZ-Net incl. 2 MS-IIS ipfw is used to make basic protection for the Windows 2000 / IIS servers ipfw is used kill setups from certain IP's to DMZ/28 80,443

Re: polling in 5.1-RC1 causes 100% CPU usage

2003-06-06 Thread Damian Gerow
Thus spake Damian Gerow ([EMAIL PROTECTED]) [04/06/03 17:52]: > I just upgraded a home firewall from 4.8-STABLE to 5.1-RC1. In the process > of updating, I also brought in a new motherboard, CPU, and memory. However, > all the NICs in the box are the same. > > The problem is that with polling tu

Re: Does Netgraph in FBSD 5.x SMP requires GIANT lock?

2003-06-06 Thread Julian Elischer
On Fri, 6 Jun 2003, Vincent Jardin wrote: > > > > it should not require Giant. > > However there are some locking 'holes' that come when locked resources > > are accessed by external code that is executed from other contexts.. > > e.g. many drivers do not know about the locks in their netgraph h