Re: IPSec troubles

2004-03-30 Thread Crist J. Clark
On Tue, Mar 30, 2004 at 11:22:08AM +, Bjoern A. Zeeb wrote: > On Mon, 29 Mar 2004, Crist J. Clark wrote: > > > > I have troubles setting up an IPSec Host-to-Host connection between > > > FreeBSD 5.2.1 and MacOS X 10.3.3: > > > > Last I knew, 5.2.1 still had broken IPsec. Specifically, the syst

Re: Looking for switch recommendations ...

2004-03-30 Thread Steven Stremciuc
Wes Peters wrote: Info about the 3348's problems: http://forums.us.dell.com/supportforums/board/message?board.id=pc_managed&message.id=1425 The guy who posted the message in the Dell forum you linked above sounds like he has no idea what he's doing. It's not possible to use a switch port mirro

Re: Looking for switch recommendations ...

2004-03-30 Thread Wes Peters
On Sunday 28 March 2004 11:37 pm, Steven Stremciuc wrote: > Has anyone tested port mirroring on these switches (2524) and run into > any problems? Many people seem to recommend these ProCurve switches here > and so far they seem like a great buy (only one I saw that cheap that > does 802.1x). I'm a

Re: Disabling VLAN_HWTAGGING

2004-03-30 Thread Jacob S. Barrett
On Tuesday 30 March 2004 11:48 am, Ruslan Ermilov <[EMAIL PROTECTED]> wrote: > On Tue, Mar 30, 2004 at 11:19:00AM -0800, Jacob S. Barrett wrote: > > Now what have I done wrong. I noticed this yesterday and I can't figure > > out what I have done wrong. VLAN tagged ARP requests coming into if_nge

Re: Disabling VLAN_HWTAGGING

2004-03-30 Thread Ruslan Ermilov
On Tue, Mar 30, 2004 at 11:19:00AM -0800, Jacob S. Barrett wrote: > Now what have I done wrong. I noticed this yesterday and I can't figure out > what I have done wrong. VLAN tagged ARP requests coming into if_nge are not > visible anymore (tcpdump). Non VLAN tagged ARP requests are visible.

Re: Disabling VLAN_HWTAGGING

2004-03-30 Thread Jacob S. Barrett
Now what have I done wrong. I noticed this yesterday and I can't figure out what I have done wrong. VLAN tagged ARP requests coming into if_nge are not visible anymore (tcpdump). Non VLAN tagged ARP requests are visible. Debug statements are showing the frame doesn't make it into the driver.

Another complaint about the tcp security fix

2004-03-30 Thread Colin Percival
There's another PR accusing the TCP security fix of causing problems: http://www.freebsd.org/cgi/query-pr.cgi?pr=kern/64826 I can't see how there could be any connection here, but it's certainly suspicious that a 140-day stable box became unstable after applying the security fix. Could someo

Re: IPSec troubles

2004-03-30 Thread Bjoern A. Zeeb
On Tue, 30 Mar 2004, Hajimu UMEMOTO wrote: > > On Tue, 30 Mar 2004 13:15:34 + (UTC) > > "Bjoern A. Zeeb" <[EMAIL PROTECTED]> said: > > bzeeb> just for the archives (and to let me sleep well again ;-) can you > bzeeb> please point me to the commit in question ? > > Okay, the commits are

Re: ste(4) NIC's RX ring head may get ahead of the driver [PATCH]

2004-03-30 Thread Doug Ambrisko
Ruslan Ermilov writes: | To make the long story short, under a heavy RX load, the ste(4) NIC's | RX ring head may get ahead of what driver thinks, bringing all sort | of havoc like stuck traffic, disordered packets, etc. The NIC never | gets out of this state, and the only workaround is to reset t

ste(4) NIC's RX ring head may get ahead of the driver [PATCH]

2004-03-30 Thread Ruslan Ermilov
Hey Doug, I'm writing to you because you were the last who touched this driver seriously, but since it's been 1,5 years ago, I'm also Cc:ing the freebsd-net mailing list, as I'm not sure if you're still interested in this driver. To make the long story short, under a heavy RX load, the ste(4) NIC

Re: IPSec troubles

2004-03-30 Thread Hajimu UMEMOTO
Hi, > On Tue, 30 Mar 2004 13:15:34 + (UTC) > "Bjoern A. Zeeb" <[EMAIL PROTECTED]> said: bzeeb> just for the archives (and to let me sleep well again ;-) can you bzeeb> please point me to the commit in question ? Okay, the commits are: src/sys/netinet/ip_output.c 1.205

Re: IPSec troubles

2004-03-30 Thread Bjoern A. Zeeb
On Tue, 30 Mar 2004, Hajimu UMEMOTO wrote: Hi, > > On Tue, 30 Mar 2004 12:33:08 + (UTC) > > "Bjoern A. Zeeb" <[EMAIL PROTECTED]> said: > > bzeeb> What I had to do had been "excluding IKE traffic" by doing s.th. > bzeeb> like this (router side config): > bzeeb> spdadd ROUTER[500] NOT

Re: IPSec troubles

2004-03-30 Thread Hajimu UMEMOTO
Hi, > On Tue, 30 Mar 2004 12:33:08 + (UTC) > "Bjoern A. Zeeb" <[EMAIL PROTECTED]> said: bzeeb> What I had to do had been "excluding IKE traffic" by doing s.th. bzeeb> like this (router side config): bzeeb> spdadd ROUTER[500] NOTEBOOK[500] udp bzeeb> -P out none ; bzeeb> spda

Re: IPSec troubles

2004-03-30 Thread Bjoern A. Zeeb
On Tue, 30 Mar 2004, Cyrill Rüttimann wrote: Hi, > > If this is the remaining problem apart from the yet known (where KAME > > people cannot find the time to review at the moment) I may look into > > this; have setup my wireless connection on a 5.2.1 notebook (being > > updated to HEAD soon) to u

Re: IPSec troubles

2004-03-30 Thread Cyrill Rüttimann
Hello, If this is the remaining problem apart from the yet known (where KAME people cannot find the time to review at the moment) I may look into this; have setup my wireless connection on a 5.2.1 notebook (being updated to HEAD soon) to use IPSec lately so I have a 'testbed' now. Please can you

Re: IPSec troubles

2004-03-30 Thread Bjoern A. Zeeb
On Mon, 29 Mar 2004, Crist J. Clark wrote: > > I have troubles setting up an IPSec Host-to-Host connection between > > FreeBSD 5.2.1 and MacOS X 10.3.3: > > Last I knew, 5.2.1 still had broken IPsec. Specifically, the system > tries to apply the IPsec policy to the IKE traffic giving us a chicken

Re: Disabling VLAN_HWTAGGING

2004-03-30 Thread Ruslan Ermilov
On Mon, Mar 29, 2004 at 09:36:49AM -0800, Jacob S. Barrett wrote: > On Monday 29 March 2004 12:12 am, Ruslan Ermilov <[EMAIL PROTECTED]> wrote: > > No, this is not of course expected. Can you add some debug printfs > > in the ng_vlan.c:ng_vlan_rcvdata() and see if it ever receives the > > VLAN tag

Re: Disabling VLAN_HWTAGGING

2004-03-30 Thread Ruslan Ermilov
On Mon, Mar 29, 2004 at 01:14:46PM -0800, Julian Elischer wrote: > > > On Mon, 29 Mar 2004, David Gilbert wrote: > > > > "Julian" == Julian Elischer <[EMAIL PROTECTED]> writes: > > > > >> itself. No matter how it's set, in both Linux and FreeBSD, many > > >> nge chipsets will not show vlan