spoofed MAC on a dhcp interface

2004-07-25 Thread Charlie Schluting
Hi :) /etc/rc.conf: ifconfig_xl0="ether 00:11:11:11:11:11" ifconfig_xl0="DHCP" The above doesn't work.. I'm trying to set the mac, and then dhcp.. is this the correct way? With this config, its not getting the mac assigned to xl0, so I have to stop dhclient, run "ifconfig ether 00:11:11:11:11:11"

Re: spoofed MAC on a dhcp interface

2004-07-26 Thread Charlie Schluting
James Housley wrote: The key was created /etc/start_if.xl0: #!/bin/sh Yep! Someone else also responded with a similar suggestion. Thank you very much, everyone, problem solved. I didn't know you could make start_if. ...very cool. I also now know its in rc.conf(5) :)

packet order, ipf or ipfw

2004-07-28 Thread Charlie Schluting
Hello.. I'm running ipf because I like it ...but now I need to use ipfw's pipe feature. I was thinking that I could just run both, and keep all my rules in ipf, then in ipfw: limit bandwidth for a few vlans, then allow all. It didn't work (no rate-limiting happened).. and I'm thinking that ipf

Re: packet order, ipf or ipfw

2004-07-30 Thread Charlie Schluting
Dinesh Nair wrote: by default the flow is: wire -> ipnat -> ipfilter -> ipfw -> kernel -> ipfilter -> ipnat ->ipfw the patch in the above PR changes it to: wire -> ipnat -> ipfilter -> ipfw -> kernel -> ipfw -> ipfilter -> ipnat Interesting! Thanks for all the great info guys. I don't really need t

vlan module loading...

2004-11-18 Thread Charlie Schluting
mkay, I have to ask a possibly stupid question. There's a recent bug where freebsd hangs with if_vlan.ko loaded when using bpf. I'm being bitten by said bug. BUT I have 'device vlan' in my kernel. Why is the module loading?! rc.conf is the only thing I've modified, WRT vlan config: dmz# grep vlan

firewalling with tunnels, and/or ipv6

2004-12-20 Thread Charlie Schluting
Ok, I've got a v6 tunnel, and to make it work I had to "allow ipv6 from " in ipfw. From what I understand, I have to make a completely different set of rules for ipv6, and load them using the -6 flag. Correct so far? Ok, so I want to set up an ipip v4 tunnel to another box (that runs ipf), and

vlans changed?

2005-01-19 Thread Charlie Schluting
Did something change from 5.2.1 to 5.3? In 5.2.1 I used to have a config where the parent device, em(4), didn't have an IP, and the vlan dev had the IP address. (yes, the parent device was "UP") I then configured the trunk (on the switch) to have a native vlan of something other than the vlan in

Re: vlans changed?

2005-01-19 Thread Charlie Schluting
Jon Simola wrote: On Wed, 19 Jan 2005 13:01:52 -0800, Charlie Schluting <[EMAIL PROTECTED]> wrote: Now, in 5.3, the only thing I can get working is to configure the em0 int with the IP, and set the trunk to have the native vlan corresponding to that IP. Weird. Sounds like you're not

Re: vlans changed?

2005-01-19 Thread Charlie Schluting
Mike Wolman wrote: I had major grief with the em driver and vlans, i have found by tcpdumping on the em0 interface actually causes more problems. there are some more posts about this a couple of months ago, my resolution was to swap the em card for an fxp instead as the box was in production and i

Re: vlans changed?

2005-01-26 Thread Charlie Schluting
On 1/20/2005 2:33 AM, Robert Watson wrote: On Wed, 19 Jan 2005, Charlie Schluting wrote: Now, in 5.3, the only thing I can get working is to configure the em0 int with the IP, and set the trunk to have the native vlan corresponding to that IP. Weird. Also, is there a way to stop em(4) from

vlan + promisc + em(4)

2005-01-27 Thread Charlie Schluting
On 1/20/2005 2:33 AM, Robert Watson wrote: Try "ifconfig em0 -vlanhwtag" and see if that helps. If not, take a look in if_em.c:em_setup_interface(), and you'll see two lines like this: #if __FreeBSD_version >= 50 ifp->if_capabilities |= IFCAP_VLAN_HWTAGGING | IFCAP_VLAN_MTU;

Re: puzzled network scheme

2005-02-15 Thread Charlie Schluting
hydros wrote: The general question is how to combine the real IP addresses and the private on the same physical interface. Well, if you have a switch capable of vlans (and 802.1q trunks) you can just run a trunk to the firewall, and have many interfaces. My setup has one real IP, and 5 interna

ALTQ statistics?

2005-02-20 Thread Charlie Schluting
Does anyone know of any statistics tools that do a good job summarizing ALTQ queuing? Perhaps with an rrd graph of some sort? I just started using shaping, and its great.. but some time-based view of the following data (or more) would be really interesting to see. -Charlie dmz# pfctl -s queue -

tcpdump/bpf and seeing .1q tags

2005-03-09 Thread Charlie Schluting
Hi, So with tcpdump -e it somehow magically sees vlan tags.. even if hardware stripping of the tags is enabled. How? More importantly, I'm trying to figure out if a bpf read will see them as well. Any insight on this? TIA -Charlie ___ freebsd-net@free

Re: tcpdump/bpf and seeing .1q tags

2005-03-09 Thread Charlie Schluting
Charles Swiger wrote: On Mar 9, 2005, at 2:22 PM, Charlie Schluting wrote: More importantly, I'm trying to figure out if a bpf read will see them as well. Any insight on this? Yes, or it will if you use promisc mode and an appropriate BPF filter: So promisc is enabled in my case. This see

Re: tcpdump/bpf and seeing .1q tags

2005-03-09 Thread Charlie Schluting
Charlie Schluting wrote: Charles Swiger wrote: On Mar 9, 2005, at 2:22 PM, Charlie Schluting wrote: More importantly, I'm trying to figure out if a bpf read will see them as well. Any insight on this? Yes, or it will if you use promisc mode and an appropriate BPF filter: So promisc is enabl

Re: tcpdump/bpf and seeing .1q tags

2005-03-09 Thread Charlie Schluting
Kelly Yancey wrote: You'll have a similar issue with BPF programs you write: you'll either need to skip over the vlan tag header or not, depending on whether you snagged the packet from the parent interface or the vlan interface. Indeed. Thanks! We skipped 12 bits ahead and everything is working

Re: High ping latency using two ethernet under FreeBSD 4.11 ...

2005-03-15 Thread Charlie Schluting
Marc G. Fournier wrote: On Tue, 15 Mar 2005, dima wrote: ng_fec is the NetGraph module which implements Cisco FastEtherChannel technology. This actually means you have 1 virtual interface fec0 representing 2 or more physical interfaces. The load balancing scheme can be assigned by a Catalyst, bu

Re: Resolving MAC address

2005-03-23 Thread Charlie Schluting
Olivier Nicole wrote: ? (10.0.0.1) at 00:e0:29:ad:5a:aa on em0 [ethernet] will do the trick, but it is a bit too heavy for the purpose, I'd prefer a solution that only send an ARP request. If you just want to avoid the DNS lookup, you can use arp -an. Its much faster :) -Charlie ___

Re: route metric

2005-06-03 Thread Charlie Schluting
> it would be nice to have a feature like this, where you could have > multiple same-prefix, same-metric routes in a FIB, and the packets would > be balanced to the next hop, either on a per-flow or per-packet basis. > i have seen a lot of answers to this request over the years along the > lines of