255.255.255.255 broadcast changed from 4.x to 5.x

2005-10-13 Thread Brian Candler
I've noticed a change in behaviour between FreeBSD 4.9 and FreeBSD 5.4 When sending an undirected broadcast to 255.255.255.255, FreeBSD 4.9 encapsulates this with the broadcast MAC address (ff:ff:ff:ff:ff:ff) as the destination. However, FreeBSD 5.4 encapsulates the packet using the MAC address o

Re: For advice in tcp implementation

2005-10-16 Thread Brian Candler
On Sat, Oct 15, 2005 at 09:16:56PM -0700, shafi kamal wrote: > I am wishing to implement tcp minimally .I have taken it as a project > work. Good for you. That has nothing to do with FreeBSD, of course. > Is it possible to do that? Of course it is possible, depending on a suitable d

Re: Bind 8

2005-10-19 Thread Brian Candler
On Tue, Oct 18, 2005 at 07:54:02PM +0200, Anton Bester wrote: > The following is a tcpdump from the secondary when bind is running: You really want to use tcpdump -n. Otherwise, every packet seen will trigger a new reverse DNS lookup, which in turn will trigger your nameserver to make further look

Re: openssl & gmail problem

2005-11-02 Thread Brian Candler
On Wed, Nov 02, 2005 at 09:35:04AM +0100, Meka[ni] wrote: > Why doesn't this work: > openssl s_client -starttls smtp -connect smtp.gmail.com:25 > > I've tried adding -CApath /usr/local/share/ssl/certs (that's where I keep > certs), but nothing changed. This is the error I get: > CONNECTED(

Re: openssl & gmail problem

2005-11-02 Thread Brian Candler
On Wed, Nov 02, 2005 at 02:17:15PM +0100, Meka[ni] wrote: > On Wed, 2 Nov 2005 12:35:29 + > Brian Candler <[EMAIL PROTECTED]> wrote: > > > Run tcpdump and/or ktrace to see what's happening. > > > > # tcpdump -i nv0 -n -s1500 -X tcp port 25 > >

Re: openssl & gmail problem

2005-11-03 Thread Brian Candler
On Thu, Nov 03, 2005 at 12:16:51AM +0100, Meka[ni] wrote: > > > 14:07:04.306017 IP 64.233.183.109.25 > 82.208.205.163.59631: P 82:129(47) > > > ack 153 win 5720 > > > 0x: 4510 0057 c387 3206 ac3f 40e9 b76d [EMAIL PROTECTED] > > > 0x0010: 52d0 cda3 0019 e8ef 6674 b5e2 a714 7dc4 R..

Re: volunteer computer-geek to help us for FREE? please contact !

2005-11-03 Thread Brian Candler
On Thu, Nov 03, 2005 at 11:44:08AM +0100, jan tore wrote: > Example 1: a clock-file that limits the speed for sending group mail.(we > bought the most excpencive version)makes us BIG problem. > a program limit-send-speed file in the group mail program we bought > is set to 6 thousand per hour ma

Re: arp-proxy

2005-11-10 Thread Brian Candler
On Wed, Nov 09, 2005 at 02:06:28PM +0100, Jon Otterholm wrote: > I want to create a bridge-interface (if_bridge) with a bunch (500+) of > sub-interfaces (vlan) as members. All members of the bridge should be > able to "talk" to each other but MAC-addresses must be isolated to their > "own" vlan. T

Re: arp-proxy

2005-11-10 Thread Brian Candler
On Thu, Nov 10, 2005 at 02:25:07PM +0100, Jon Otterholm wrote: > In all this - our role is similar to an ISP, but we are buying access to > our customers from an external part. Every customer is delivered on a > separate vlan trunked. > > - Our DSL customers cannot be set on the same VLAN i a sin

Re: arp-proxy

2005-11-10 Thread Brian Candler
On Thu, Nov 10, 2005 at 03:08:34PM +0100, Jon Otterholm wrote: > The point in all this is to reduce administration on my hand and in some > cases to offer a service to customers with the feeling that they reside > "on the same layer". That is, customer A *wants* to see all the Netbios broadcasts f

NFS clearing attribute cache in nfs_open

2002-04-26 Thread Brian Candler
t invalidate the cache unless the file has been modified. However that doesn't help much if the cache is going to get invalidated anyway the next time the file is opened :-) Many thanks, Brian Candler. P.S. I am working to FreeBSD-4.5-STABLE-20020426 To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-net" in the body of the message

Re: NFS clearing attribute cache in nfs_open

2002-04-27 Thread Brian Candler
On Fri, Apr 26, 2002 at 04:42:48PM -0700, Andrew P. Lentvorski wrote: > > ... Could it safely be made less restrictive, e.g. don't > > clear the cache when opening a file for read? > > In a word, no. Why couldn't the sysadmin be running "make installworld" > on the NFS server while you're runnin

Re: NFS clearing attribute cache in nfs_open

2002-04-29 Thread Brian Candler
Thanks for comments so far. It looks like the best solution for me is going to be to boot diskless into a ramdisk. It's been quite a job finding out how to do that; there doesn't seem to be much in the way of documentation. Reverse-engineering the source suggests that the following methods exist

Re: arp-proxy

2005-11-17 Thread Brian Candler
On Thu, Nov 17, 2005 at 04:06:03PM +0100, Jon Otterholm wrote: > Not a big fan of Linux though. I will have to wait for this to be ported > to BSD. Anyone with info if this is being done? ... > > [1] http://www.sjdjweis.com/linux/proxyarp/ You can do proxyarp like that with FreeBSD now. However yo

Re: arp-proxy

2005-11-17 Thread Brian Candler
On Thu, Nov 17, 2005 at 04:52:03PM +0100, Jon Otterholm wrote: > Scenario#1: > -I have a range of ip's, for example 215.10.10.0 - 215.10.10.255. > -I want to distrubute theese ip's to my customers via DHCP. > -They are all atached to me via a VLAN-trunk on a unique VID > -I have 200+ customers. >

Re: arp-proxy

2005-11-17 Thread Brian Candler
On Thu, Nov 17, 2005 at 05:35:35PM +, Baldur Gislason wrote: > I've also wanted to have multiple interfaces on the same physical network > with > different addresses on the same subnet. That's a reasonable thing to want to do, and I remember seeing a statement saying that FreeBSD plans to a

Re: arp-proxy

2005-11-21 Thread Brian Candler
> > On Thu, Nov 17, 2005 at 04:52:03PM +0100, Jon Otterholm wrote: > > > Scenario#1: > > > -I have a range of ip's, for example 215.10.10.0 - 215.10.10.255. > > > -I want to distrubute theese ip's to my customers via DHCP. > > > -They are all atached to me via a VLAN-trunk on a unique VID > > > -I

Re: arp-proxy

2005-11-21 Thread Brian Candler
On Mon, Nov 21, 2005 at 01:45:44PM +0100, Jon Otterholm wrote: > The reason why I have to proxy-arp mac between VLANs is that one mac > cannot end up mapped to more than one port in the switches FDB. If they > do - we get something called "host-flapping" on IOS-language. Or put it another way - Ci

Re: Bug in routing tables ?

2005-11-25 Thread Brian Candler
On Thu, Nov 24, 2005 at 02:28:37PM -0200, Ricardo A. Reis wrote: >I insert this route in my workstation for network test, > > #route add -net 200.144.xx.xx 255.255.254.0 172.22.x.x Linux user I bet ;-) For FreeBSD you need: #route add -net 200.144.xx.xx -netmask 255.255.254.0 172.22.x.x

Re: Bug in routing tables ?

2005-11-26 Thread Brian Candler
On Fri, Nov 25, 2005 at 01:20:01PM -0200, Ricardo A. Reis wrote: > But i use route add 200.144.xx.xx/[mask] 172.22.xx.xx for > many year, and this work perfectly on freebsd and linux. Yes it does (as of a couple of years ago, I think). However if you want to specify the netmask ex

Re: proposal: TCP rendevous

2005-11-27 Thread Brian Candler
On Sat, Nov 26, 2005 at 10:18:49PM -0800, Julian Elischer wrote: > In this world of P2P apps it would be neat to have a way that two P2P apps > could attach to each other even though each is through a firewall. Most > firewalls only allow > "outgoing" connections. > > It would of course be possib

Re: natd redirected ports from LAN

2005-11-29 Thread Brian Candler
On Tue, Nov 29, 2005 at 12:46:10PM +0200, asko wrote: > I'm searching for a better, faster solution.. > Does it exist? Do your constraints allow you switch to 'pf' instead of 'ipfw'? I think you may be able to do it that way. I had a similar situation where I wanted traffic originating from the l

Re: FBSD 6.0 ipfw weirdness with ssh x-forwarding

2005-12-11 Thread Brian Candler
On Sat, Dec 10, 2005 at 10:43:16AM -0500, Eric W. Bates wrote: > Dec 9 23:15:33 gertrude kernel: ipfw: 510 Deny TCP > [::0001]:6010 [::0001]:61310 out via lo0 Note that ::0001 is the IPv6 "localhost" address (equivalent to IPv4 127.0.0.1) > I was hoping someone smarter than I could point me to

Re: high interrupts by network interfaces

2005-12-11 Thread Brian Candler
On Sun, Dec 11, 2005 at 03:26:50AM -0800, kamal kc wrote: > i modified the bridge.c file and added a routine to > compress/decompress > ip packet. i put my code in bdg_forward(). And ran the > pc in bridge mode. > > The modified kernel is deployed in network where the > datarate is > about 4 to

Re: Router on 6.0-stable fails to route tcp packets due to NAT?? malfunction

2005-12-27 Thread Brian Candler
On Mon, Dec 26, 2005 at 01:41:50PM +0200, Oleg Tarasov wrote: > mpd configuration is attached in mpd.conf and mpd.links. Shortly, ng0 > is a PPPoE connection on rl1 interface. ^ Sounds to me like an MTU problem. Windows machine sends a 1500-byte packet, but it can't fit into an ethernet

Re: DHCP oddity

2005-12-27 Thread Brian Candler
On Mon, Dec 26, 2005 at 12:15:14PM -0600, Skylar Thompson wrote: > While doing some network stress-tests from a dual-CPU x86 FreeBSD 5.4 > server, I noticed that a "ping -f" drives dhcpd's CPU usage way up. I > put dhcpd into debug mode and didn't get any error messages. I then ran > dhcpd with

Re: tcp performance

2005-12-27 Thread Brian Candler
On Tue, Dec 27, 2005 at 07:56:51PM +0900, Zongsheng Zhang wrote: > Hi, *, > > For testing throughput of a TCP connection, the following topology is used: > Host-A ---GB Ethernet--- Dummynet ---GB Ethernet--- Host-B > > Host-A/B use FreeBSD v6.0. Sysctl parameters of Host-A/B are: > kern.ipc.

Re: Router on 6.0-stable fails to route tcp packets due to NAT?? malfunction

2005-12-28 Thread Brian Candler
On Tue, Dec 27, 2005 at 10:31:48PM +0300, Gleb Smirnoff wrote: > O> I have the latest version of ported mpd (3.18_3) installed and tried > O> to insert > O> set iface enable tcpmssfix > O> but no positive result, but I understand that this option should help > O> in this situation. > > Un

IPSEC documentation

2005-12-28 Thread Brian Candler
The IPSEC documentation at http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/ipsec.html is pretty weird. It suggests that you encapsulate your packets in IP-IP (gif) encapsulation and THEN encapsulate that again using IPSEC tunnel mode. e.g. notice where it shows spdadd W.X.Y.Z/32 A.B

Re: IPSEC documentation

2005-12-28 Thread Brian Candler
On Wed, Dec 28, 2005 at 10:08:54AM -0500, Matt Emmerton wrote: > While correct, note the scenario for which the configuration is describing: > > 14.10.3 The Scenario: Two networks, connected to the Internet, to behave as > one. > > This is something I do all the time to connect retail outlets to

Re: IPSEC documentation

2005-12-28 Thread Brian Candler
On Wed, Dec 28, 2005 at 04:26:43PM +0100, Eric Masson wrote: > gif/gre tunnels and ipsec transport mode are quite convenient when > associated with dynamic routing protocols. OK, I'll buy gif + IPSEC transport mode as an option. [Although in that case, perhaps what you want is an external IPSEC tu

Re: IPSEC documentation

2005-12-28 Thread Brian Candler
On Wed, Dec 28, 2005 at 04:04:04PM +0100, Phil Regnauld wrote: > > This is a really strange approach which is almost guaranteed not to > > interoperate with other IPSEC gateways. > > It's probably for FreeBSD <-> FreeBSD setups, where it might make sense > to have an interface endpoint

Re: IPSEC documentation

2005-12-28 Thread Brian Candler
On Wed, Dec 28, 2005 at 05:15:39PM +0100, Eric Masson wrote: > Brian Candler <[EMAIL PROTECTED]> writes: > > > OK, I'll buy gif + IPSEC transport mode as an option. [Although in that > > case, perhaps what you want is an external IPSEC tunnel mode implementation

Re: IPSEC documentation

2005-12-28 Thread Brian Candler
On Wed, Dec 28, 2005 at 05:43:39PM +0100, VANHULLEBUS Yvan wrote: > > Also excellent would be "bump in the wire" bridging, where the gateway > > negotiates transport-mode security on behalf of clients without their being > > aware of it, but as far as I know only OpenBSD supports that. > > What is

Re: IPSEC documentation

2005-12-29 Thread Brian Candler
On Wed, Dec 28, 2005 at 06:04:37PM +0100, Eric Masson wrote: > > Did someone tried such a setup ? > > I plan to do so. > > Just have to find ios images that support l2tp and ipsec for my 1601R > or 2611 and bigger flash modules (I've been given them two weeks ago, > hardware upgrade is the easy p

Re: IPSEC documentation

2005-12-29 Thread Brian Candler
On Thu, Dec 29, 2005 at 09:50:47AM +0300, Alexey Popov wrote: > If we would also have NAT-T support, FreeBSD would be the best choice > of VPN concentrator. /usr/ports/security/ipsec-tools/pkg-descr says: "Known issues: - Non-threaded implementation. Simultaneous key negotiation performance s

Re: IPSEC documentation

2005-12-30 Thread Brian Candler
On Thu, Dec 29, 2005 at 01:35:21PM +0100, VANHULLEBUS Yvan wrote: > > As it happens this FreeBSD box is also acting as a NAT gateway using pf > > (myhost is on a private IP) and actually its external IP is also private - > > it sits behind a second NAT firewall. So maybe that's where the problem >

Re: IPSEC documentation

2005-12-30 Thread Brian Candler
On Thu, Dec 29, 2005 at 01:38:15PM +0100, VANHULLEBUS Yvan wrote: > > "Known issues: > > - Non-threaded implementation. Simultaneous key negotiation performance > > should be improved." > > > > I think that would limit its usefulness as a scalable concentrator, if the > > comment is still valid

Re: forwarding icmp redirects.

2005-12-30 Thread Brian Candler
On Thu, Dec 29, 2005 at 09:01:50PM -0800, Julian Elischer wrote: > >IMHO we should disable emitting and acting upon ICMP redirects by default. > > I know many places that rely on them heavily.. please don't do that.. > Cisco PIX doesn't generate them.. it makes that machine a pain in the > to

Re: FreeBSD 6.0 release,

2006-01-03 Thread Brian Candler
On Sat, Dec 31, 2005 at 02:52:14AM +, Paul wrote: > I've just installed FreeBSD 6.0 Release yesterday, I've spend the last > two days trying to resolve a networking problem, the problem is this: > when I try and connect to a domain or an IP for that matter, it takes > several minutes for it to

Re: /usr/src/lib/libc/net/res_debug.c: compile problem fixed

2006-01-03 Thread Brian Candler
On Mon, Jan 02, 2006 at 12:39:26PM +1030, Aluminium Oxide wrote: > Below is the output of `diff res_debug.org.c res_debug.c` > > I've also attached this. > = > 574,575c574,575 > < precsize_aton(strptr) > < char **strptr; > --- > > precsize_

sl2tps, MRU, MTU, and MSS

2006-01-05 Thread Brian Candler
I've done a bit more debugging on the MSS problem I'm having with sl2tps running with IPSEC transport layer security. The client is Windows XP out-of-the-box. Here's what happens: 1. PPP negotiates an MRU of 1400 2. However, ifconfig ng0 shows an MTU of 1376 (where does that come from?) 3. When t

Re: DHCPD + Relay

2006-01-10 Thread Brian Candler
On Mon, Jan 09, 2006 at 08:59:56PM +0100, Jon Otterholm wrote: > I am having trouble to get isc-dhcp-server to start up without a > subnet-declaration for a local subnet. Write empty subnet declarations for those subnets. ___ freebsd-net@freebsd.org mai

Re: NAT over IPSECed WLAN

2006-01-16 Thread Brian Candler
On Mon, Jan 16, 2006 at 11:13:32AM +0100, Przemyslaw Szczygielski wrote: > Well, for me the config is so complex, that I doubt anyone will > waste time on going into my config files, but, well... There's > always hope... A diagram helps lots. Tell me if this is correct: \|/ - - - - - - - \|/

Re: NAT over IPSECed WLAN

2006-01-16 Thread Brian Candler
On Mon, Jan 16, 2006 at 02:30:08PM +0100, Przemyslaw Szczygielski wrote: > > ipseccmd -f 0=* -t 10.2.0.1 -a PRESHARE:"foo" > > ipseccmd -f *=0 -t 10.2.0.2 -a PRESHARE:"foo" > > > > XP: (configured by wizard, from MMC): > > "InboundIPsec" prot: ANY, src port: ANY, dst port: ANY, src IP: >

Re: NAT over IPSECed WLAN

2006-01-17 Thread Brian Candler
On Mon, Jan 16, 2006 at 08:55:18PM +0100, Przemys?aw Szczygielski wrote: > Well - both ways work. The one from the wizard and the one by > ipseccmd. The difference is i don't know how to deactivate ipseccmd > filters ;-) ipseccmd -u > From XP I pinged 10.2.0.1 with IPSEC on > > tcpdump -i ndis0

Re: pf: redirect packets from localhost

2006-01-19 Thread Brian Candler
On Wed, Jan 18, 2006 at 03:49:18PM +0100, Sebastian Schwerdhoefer wrote: > Short question: > Is it possible to redirect packets from localhost with "rdr"? Short answer: yes. Longer answer: perhaps this is the kind of thing you're looking for. http://lists.freebsd.org/pipermail/freebsd-pf/2005-Sep

Re: IPSEC documentation

2006-01-20 Thread Brian Candler
> On Thu, Dec 29, 2005 at 09:50:47AM +0300, Alexey Popov wrote: > > If we would also have NAT-T support, FreeBSD would be the best choice > > of VPN concentrator. I just saw this patch posted on the ipsec-tools-devel list: http://ipsec-tools.sf.net/freebsd6-natt.diff It's for FreeBSD 6 but also

Re: sl2tps, MRU, MTU, and MSS

2006-01-27 Thread Brian Candler
On Thu, Jan 05, 2006 at 11:04:04AM +, Brian Candler wrote: > I've done a bit more debugging on the MSS problem I'm having with sl2tps > running with IPSEC transport layer security. The client is Windows XP > out-of-the-box. > > Here's what happens: > >

Re: Named could not listen on UDP socket: permission denied

2006-01-27 Thread Brian Candler
On Thu, Jan 26, 2006 at 05:01:50PM +0200, Oleg Tarasov wrote: > I run FreeBSD 6.0 and I have begun to recieve quite periodic error messages > like these: > > Jan 25 19:45:50 central named[728]: could not listen on UDP socket: > permission denied > Jan 25 19:45:50 central named[728]: creating IPv

Re: sl2tps, MRU, MTU, and MSS

2006-01-27 Thread Brian Candler
On Fri, Jan 27, 2006 at 08:39:41AM -0600, Archie Cobbs wrote: > Brian Candler wrote: > >>1. PPP negotiates an MRU of 1400 > >>2. However, ifconfig ng0 shows an MTU of 1376 (where does that come from?) > >>3. When the client opens a TCP connection, it offers an

Re: sl2tps, MRU, MTU, and MSS

2006-01-28 Thread Brian Candler
On Fri, Jan 27, 2006 at 10:39:08AM -0600, Archie Cobbs wrote: > First of all, let's be clear about terminology.. there are two different > MRU's negoatiated in opposite directions and those negoations are done > independently. The problem, which is basically "the FreeBSD->WinXP MTU > is causing a P

Re: /usr/src/lib/libc/net/res_debug.c: compile problem fixed

2006-01-29 Thread Brian Candler
On Sun, Jan 29, 2006 at 06:50:06PM +1030, Aluminium Oxide wrote: > > Suggestion: use unified diff (diff -u res_debug.org.c res_debug.c). It's > > *much* easier to read. > > > > Regards, > > > > Brian. > > Thankyou Brian, I've done as you suggested. > > Q: How can I edit the new PR title to ref

Re: multiple natd + ipfw, with 2 internal ip's

2006-01-30 Thread Brian Candler
On Sat, Jan 28, 2006 at 01:01:53PM +0100, Unix-Solutions - Steven wrote: > Hi you guy's, > > I have a little problem with my natd or ipfw configuration. This may not be what you want to hear, but in my experience if you have a configuration with multiple external interfaces and multiple NAT insta

Re: /usr/src/lib/libc/net/res_debug.c: compile problem fixed

2006-01-30 Thread Brian Candler
On Mon, Jan 30, 2006 at 08:50:00AM +1030, Aluminium Oxide wrote: > A... > > You're right, but there's only a handlful of these that stop buildworld > with -O3 I think the issue is that although you may be able to get FreeBSD to *build* using -O3, it's quite unlikely that it will *work* pr

Re: Network client is the same from server

2006-01-31 Thread Brian Candler
On Mon, Jan 30, 2006 at 10:51:28AM -0800, Julian Elischer wrote: > Tiago Cruz wrote: > > >On Fri, 2006-01-27 at 13:19 -0800, Julian Elischer wrote: > > > > > > > >>it is definitly possible > >>but you will have to do some reading > >>natd can do it. > >> > >> > > it should be in the natd man

Re: Network client is the same from server

2006-02-01 Thread Brian Candler
On Tue, Jan 31, 2006 at 12:42:36PM -0800, Julian Elischer wrote: > >And, If I have't not control about the second gateway? Because my client > >have a notebook, and he can try connect at anyplace, anytime :-( > > > >So, I think that is impossible to to... is true? > > > > > no, > you should be abl

Re: freebsd 6.0 network card / route fail over question

2006-02-04 Thread Brian Candler
On Fri, Feb 03, 2006 at 01:33:44PM -0600, Matthew Lineen wrote: > I'm trying to workout the specifics of NIC/route fail over on FreeBSD > 6.0 and hoped someone here could point me in the right direction. > > We have 2 ServerIron load balancers and each of our application servers > is plugged int

Re: fastforward problem

2006-02-12 Thread Brian Candler
On Sat, Feb 11, 2006 at 05:35:33PM +0100, GiZmen wrote: > I would like to use fastforward option on my freebsd 6.0-stable > box. But i have strange problem with it. My box is a router for LAN > with IP visible to internet. I am managinc C class network. > When i turn on fastforward option any of th

Re: fastforward problem

2006-02-13 Thread Brian Candler
On Sun, Feb 12, 2006 at 09:53:44PM +0100, GiZmen wrote: > Yes, clients can ping google IPs. > > ping 64.233.187.99 > PING 64.233.187.99 (64.233.187.99): 56 data bytes > 64 bytes from 64.233.187.99: icmp_seq=0 ttl=238 time=155.613 ms > 64 bytes from 64.233.187.99: icmp_seq=1 ttl=238 time=152.681 ms

Re: socket / bind - specific address

2006-02-25 Thread Brian Candler
On Sat, Feb 25, 2006 at 06:07:22PM +1100, Edwin Groothuis wrote: > The situation is as follows: > > We have a couple of FreeBSD routers, with RFC1918 addresses on the > ethernets and a public address on the loopback. This works fine for > connecting to the routers, but is problematic for locally o

Re: nfs locking broken

2006-02-26 Thread Brian Candler
On Fri, Feb 24, 2006 at 03:58:09PM +0100, Palle Girgensohn wrote: > It seems that NFS locking is broken for the combo of 4.11 or 5.4 server and > 6.x client. Apps like eclipse and firefox fail to start with my home dir on > a 4.11 server and a 6.x client. This in interesting to me - I'll explain

Re: floating a server room... how do you deal with ethernet connections?

2006-03-13 Thread Brian Candler
On Mon, Mar 13, 2006 at 02:57:35AM -0600, Nikolas Britton wrote: > I'm currently planning renovations for the power mains supplying are > server room. One of the ideas I have is to float the entire room using > a isolation transformer. The only problem to this solution, that I can > think of, is th

Re: is NFS production-ready ?

2006-04-11 Thread Brian Candler
On Mon, Apr 10, 2006 at 11:26:40PM +0400, dima wrote: > 3. Is at least implementation of NFS client (either kernel-side or > user-space) stable enough for production use? Client OS replacement is > impossible (hardly suitable, really) in my project. I built a big mail/web cluster a few years ago u

Re: is NFS production-ready ?

2006-04-12 Thread Brian Candler
On Tue, Apr 11, 2006 at 05:59:50PM +0400, dima wrote: > > I built a big mail/web cluster a few years ago using FreeBSD 4.x (4.6.2 I > > think), where all the front-ends used NFS to access data on a shared > > fileserver platform (NetApp). It worked without a hitch, and still does. > > What is the

Re: PPPoE question.

2006-04-12 Thread Brian Candler
On Wed, Apr 12, 2006 at 11:27:00AM +0800, fooler wrote: > >what the heck is synchronous pppoe? we connect to pppoe via ethernet so > >it is already synchronous (?) > > set speed sync And how does that change the pppoe ethernet frames? ___ freebsd-net@f

Re: PPPoE question.

2006-04-12 Thread Brian Candler
On Wed, Apr 12, 2006 at 10:59:52PM +0800, fooler wrote: > >>set speed sync > > > >And how does that change the pppoe ethernet frames? > > nothing change and still the same... ethernet frames are at layer 2 while > synchronization (either asynchronous or synchronous) is at layer 1... > synchronou

Re: Libpcap based: packet generator + capture file editor + bridge for IEEE802.3 on FreeBSD

2006-04-17 Thread Brian Candler
On Sun, Apr 16, 2006 at 08:02:04AM -0700, Yeow C.H. wrote: > It is designed to compliment tcpdump, which by itself has done a great > job > in capturing network traffic. With Bit-Twist, you can now regenerate the > captured traffic onto a live network. Packets are generated from save

Re: How to use if_bridge

2006-04-19 Thread Brian Candler
On Tue, Apr 18, 2006 at 01:14:27PM +0200, Sten Daniel Srsdal wrote: > hostap should work, ad-hoc should work. by infrastructure you mean that > the card operates as a 'station'? then it shouldn't work (correctly) as > defined by the standard. commercial products tend to implement "mac-nat" I've se

Re: VLAN interfaces and routing

2006-04-27 Thread Brian Candler
On Wed, Apr 26, 2006 at 01:55:11PM +0100, William wrote: > The switch is a Cisco 3550, trunking is setup on the port and I've > allowed the VLANS I'm interested in using. > > The end result is being able to communicate with all devices on said > VLANS which is fantastic but my next objective is to

Re: DHCP Over PPPoE

2006-04-27 Thread Brian Candler
On Thu, Apr 27, 2006 at 02:38:03PM +0530, JOBY THAMPAN wrote: > > > Hi all , > > > > I have a setup like this > > > > Linux Machine 1 > > Eth0- DHCP Server > > > > > > Linux Machine 2 > > Eth1- Got IP

Re: DHCP Over PPPoE

2006-04-28 Thread Brian Candler
On Thu, Apr 27, 2006 at 11:14:09AM -0700, Julian Elischer wrote: > > > A few things.. > > 1/ thisn is a FreeBSD list so we are not very familiar with linux. > 2/ PPPOE uses PPP which is a point-to-point protocol and does not support > broadcast. > 3/ DHCP is a broadcast protocol and does not s

Re: [fbsd] Re: [fbsd] Network performance in a dual CPU system

2006-05-02 Thread Brian Candler
On Mon, May 01, 2006 at 11:38:39AM +1000, [EMAIL PROTECTED] wrote: > Would it be possible to improve the behaviour of the TCP protocol > implementation so that out-of-order reception was acceptable? Possibly - but if your FreeBSD box is acting as a router, and it re-orders packets in transit to t

Re: How do i send mail to certain domain users over external smtp using sendmail?

2006-05-11 Thread Brian Candler
On Wed, May 10, 2006 at 05:47:48AM -0700, Nash Nipples wrote: >hi, i just dont see any options to make it work > > "| /usr/sbin/sendmail -Ac -t" works fine > but "| /usr/sbin/sendmail -O ConnectOnlyTo=smtp.external.co... -Ac -t" just > wont work: > WARNING: RunAsUser for MSP ignore

Re: How do i send mail to certain domain users over external smtp using sendmail?

2006-05-11 Thread Brian Candler
On Thu, May 11, 2006 at 06:19:59AM -0700, Nash Nipples wrote: > Upgrade to exim - *any* mail routing policy you can think of can be > implemented in exim. > >lol thanks! i've read about it and i think its awesome but yet i dont >know how do i uninstall sendmail? It's part of the

Re: Can't delete route

2006-05-19 Thread Brian Candler
On Thu, May 18, 2006 at 02:52:19PM -0300, Alexandre Biancalana wrote: > > > # route add 128.110.0.0 255.255.0.0 10.0.0.17 > > > add net 128.110.0.0: gateway 255.255.0.0 ... > > >Running netstat -nr I get the following: > > > > > > 0&0xa11255.255.0.0UGSc 15 332

Re: improving transport over lossy links ?

2006-05-21 Thread Brian Candler
On Fri, May 19, 2006 at 12:38:31PM -0400, Mike Tancsa wrote: > Thanks for the reply. Even at 28.8 I am seeing loss with > the connection dropping and seeing dropped packets (e.g. > May 19 12:04:43 soekris4801 ppp[3404]: tun0: Phase: 1: HDLC errors -> > FCS: 1, ADDR: 0, COMD: 0, PROTO: 0)

Re: improving transport over lossy links ?

2006-05-21 Thread Brian Candler
On Sun, May 21, 2006 at 11:09:23AM -0400, Mike Tancsa wrote: > The internal USR seems to correctly see the carrier drop and PPP > hence sees it. However, the 2 external Intels I am experimenting > with on the USB serial ports do not. USB-serial adaptors tend to be very broken, unfortunately. I

Re: How to Quicken TCP Re-transmission?

2006-05-22 Thread Brian Candler
On Mon, May 22, 2006 at 07:51:33PM +0800, [EMAIL PROTECTED] wrote: > I want to transmit data between host A and host B. The link between > these two hosts is really bad: PING reports 30% packet loss How big are the pings? Try ping -c100 -s1472 x.x.x.x to send 1500-byte pings (20 bytes IP

Re: improving transport over lossy links ?

2006-05-23 Thread Brian Candler
On Tue, May 23, 2006 at 02:10:39PM -0400, Mike Tancsa wrote: > It looks like its an issue with the USB serial device and or driver. > Whether the driver or the actual device (or both) not sure. If I put > the same 2 modems put on 2 regular serial ports, ppp is able to see > the carrier is down a

Re: VPN with FAST_IPSEC and ipsec tools

2006-06-16 Thread Brian Candler
On Fri, Jun 16, 2006 at 01:43:54PM +1000, Michael Vince wrote: > I have setup the GRE tunneling and that is working fine doing pings and > tracerts when I disable ipsec and ipsec-tools, its just the encryption > side thats the problem. Ah, I guess this means you're following the instructions in

Re: Simple LAN IP accounting

2006-06-18 Thread Brian Candler
On Sun, Jun 18, 2006 at 07:26:44AM -0700, Nash Nipples wrote: >ipfw add 5 skipto 500 ip from 192.168.110.1 to any out via tun0 > ipfw add 10 skipto 500 ip from any to 192.168.110.1 to any in via tun0 > ipfw add .. skipto 500 ip from 192.168.110... to any out via tun0 > ... > ipfw add 500 d

Re: Simple LAN IP accounting

2006-06-18 Thread Brian Candler
On Sun, Jun 18, 2006 at 08:21:51PM +0200, Phil Regnauld wrote: > > very efficient way of doing this analysis. You can turn the sflow data into > > simple CSV records using 'sflowtool', or ntop has an sflow module. > > Ntop just seems very unreliable and bloated to me, at least after >

Re: Strange errors from BIND on FreeBSD 4.x system

2006-07-06 Thread Brian Candler
On Wed, Jul 05, 2006 at 09:39:17PM -0600, Brett Glass wrote: > I'm working with a client's FreeBSD system (4.9 with patches) which > is having trouble resolving certain domains but not others. When I > try to execute the same queries using "dig", I see the error message > > res_nsend: Protocol n

Re: strange limitation on rcmd()

2006-07-08 Thread Brian Candler
On Fri, Jul 07, 2006 at 08:30:01PM -0400, Mikhail Teterin wrote: > The manual page says, that rcmd() is only to be used by root's processes. DESCRIPTION The rcmd() function is used by the super-user to execute a command on a remote machine using an authentication scheme based on reserved

Re: strange limitation on rcmd()

2006-07-10 Thread Brian Candler
On Mon, Jul 10, 2006 at 11:47:33AM -0400, Mikhail Teterin wrote: > What I remain upset about, though, is that the rcmdsh(), which is used by > rcmd() ignores the fd2p parameter making it impossible to capture the > remote's stderr... Well, it's probably worth send-pr'ing it. I'd first test whet

Re: counting (not) blocks of IPs in ipfw - please help

2006-07-12 Thread Brian Candler
On Mon, Jul 10, 2006 at 06:40:50PM -0400, Ensel Sharon wrote: > I can't seem to get ipfw to handle a rule like this: > > > ipfw add 00100 count ip from any not { 10.20.0.0/16 or 10.30.0.0/16 } to > any via em0 in > > The error is: > > ipfw: missing ``to'' > ipfw: unrecognised option [-1] 10.20.

Re: forcing FTP-uploaded files to be of certain types only

2006-07-18 Thread Brian Candler
On Mon, Jul 17, 2006 at 01:06:01PM -0400, Mikhail Teterin wrote: > How hard would it be to make the stock FreeBSD FTP-server to examine the > first, say, 100Kb of the uploaded file and interrupt transfer if the file is > of a prohibited or is not of an allowed type? > > Anything under 100Kb is f

Re: Multiple NAT router

2006-07-24 Thread Brian Candler
On Fri, Jul 21, 2006 at 11:13:47AM -0600, Brett Glass wrote: > I have an application in which I'd like a FreeBSD router to have > multiple, isolated LANS attached to it, each with the same address > space. The FreeBSD box would take the place of multiple NAT routers. > > For example, I might wan

Re: using loopback address as primary address

2006-07-24 Thread Brian Candler
On Mon, Jul 24, 2006 at 12:38:56PM +0300, Nikos Vassiliadis wrote: > Can I somehow use lo1 address > for connections initiated from Host_2? Options I know of: (1) the application which originates the connection can explicitly bind to the lo1 address (see for example telnet -s and ping -S options)

Re: Multiple NAT router

2006-07-24 Thread Brian Candler
On Mon, Jul 24, 2006 at 04:09:29PM +0200, Marko Zec wrote: > > There's a project called 'vimage' which adds a separate virtual forwarding > > table per jail. This might work for you, although all the natd's "outside" > > interfaces would need to sit on the same interface, and I don't know if it > >

Re: Multiple NAT router

2006-07-25 Thread Brian Candler
On Mon, Jul 24, 2006 at 01:40:13PM -0700, Julian Elischer wrote: > an ng_ip node :-) > I've considerred it. Then all the tools like 'netstat' and 'route' need modifying to talk to a netgraph socket, but in principle I don't see why it couldn't be done. ISTM there are a zillion userland-to-kernel

Re: Multiple NAT router

2006-07-25 Thread Brian Candler
On Mon, Jul 24, 2006 at 09:17:37PM -0600, Brett Glass wrote: > I've been noodling over this for two weeks now, and am thinking > that the easiest thing to do might be is map every address in each > "virtual" router to a unique address from FreeBSD's point of view > (i.e. 192.168.0.2 on LAN 1 bec

Re: No DHCPOFFERS received.

2006-08-01 Thread Brian Candler
On Tue, Aug 01, 2006 at 02:43:22AM +, Alexandre Martins Garcia wrote: > Hello everybody, > I have a modem connected to my freebsd machine in ethernet, so to have a > configuration from my ISP I did: > > hydrus[/home/amg]# dhclient fxp0 > DHCPDISCOVER on fxp0 to 255.255.255.255 port 67 interva

Re: Redundant/failover NFS servers - stale NFS file handle

2006-08-15 Thread Brian Candler
On Mon, Aug 14, 2006 at 08:43:28PM +0200, Attila Nagy wrote: > >We use NetApp Filer clusters (NAS) for that purpose. > >They aren't cheap, but they work very well. > I don't like blackboxes with nice GUIs. :) They have a command-line interface too :) Seriously, these are really excellent devices.

Re: Redundant/failover NFS servers - stale NFS file handle

2006-08-15 Thread Brian Candler
On Tue, Aug 15, 2006 at 02:44:52PM +0200, Attila Nagy wrote: > >>I can solve this problem with Linux > >How? > With a shared filesystem of course. Specifically, which one? If there is a good filesystem for this application perhaps it could be ported. ___

Re: Redundant/failover NFS servers - stale NFS file handle

2006-08-15 Thread Brian Candler
On Tue, Aug 15, 2006 at 11:20:47AM -0700, Chuck Swiger wrote: > On Aug 15, 2006, at 5:30 AM, Phil Regnauld wrote: > >Brian Candler (B.Candler) writes: > >>So to make an update, you would have to unmount from box 2, > >>remount RW on > >>box 1, make the chang

Re: Routing IPSEC packets?

2006-08-18 Thread Brian Candler
On Fri, Aug 18, 2006 at 11:59:39AM +0200, Remko Lodder wrote: > Ofcourse I should do the [1] trick: > > I want to do the following; I have three IPsec endpoints > at this moment, one at home, one in my personal colo environment > and one in another colo environment. > > The machine(s) in the pers

Re: Optimizing a high-latency connection

2006-08-29 Thread Brian Candler
On Fri, Aug 25, 2006 at 03:46:22PM +0200, Morgan wrote: > I'm trying som file transfers across the globe. The RTT is almost 400ms and > the transfer rate is painfully slow. There are 24 router hops on the path > and I assume most of the problem is there The number of routers isn't an issue, as lon

nVidia chipset - ethernet support?

2004-03-28 Thread Brian Candler
I have installed FreeBSD-5.2.1 on my brand new Soltek EQ3702A machine, which has an nVidia chipset. I have got most of the on-board hardware to work: kldload snd_ich -- pcm kldload firewire \ to mount my ipod kldload sbp / but I don't seem to be able to get ethernet to work. A google s

  1   2   >