Re: DNAT in freebsd

2013-07-06 Thread Ian Smith
On Sat, 6 Jul 2013 18:37:55 +0700, Eugene Grosbein wrote: On 06.07.2013 14:47, Sami Halabi wrote: Hi, Any hope? Have you used intedmediate ipfw count log rules between ipfw nat rules I recommended? If yes, why have not you show that logs yet? Include tcpdump output from external

Re: it's the output, not ack coalescing (Re: TSO and FreeBSD vs Linux)

2013-08-18 Thread Ian Smith
On Sun, 18 Aug 2013 14:03:27 -0700, Barney Cordoba wrote: Criticism is the bedrock of innovation. Constructive criticism, with clear design even without code, can be. Relentless negativity achieves nothing, and fails to compile. Ian ___

Re: impact of disabling firewall on performance?

2013-09-18 Thread Ian Smith
On Wed, 18 Sep 2013 12:00:30 +0430, h bagade wrote: Hi all, I've heard that disabling firewall with commands or setting related sysctl parameter wouldn't increase performance and still firewalls participate in forwarding process. The only way to reach a better performance is making

Re: impact of disabling firewall on performance?

2013-09-18 Thread Ian Smith
On Wed, 18 Sep 2013 11:18:38 +0200, Luigi Rizzo wrote: On Wed, Sep 18, 2013 at 10:07 AM, Ian Smith smi...@nimnet.asn.au wrote: On Wed, 18 Sep 2013 12:00:30 +0430, h bagade wrote: Hi all, I've heard that disabling firewall with commands or setting related sysctl

Re: ipfw / routing issue on 9.2-RELEASE

2014-03-05 Thread Ian Smith
On Wed, 5 Mar 2014 20:44:51 +0100, Andreas Nilsson wrote: On Wed, Mar 5, 2014 at 7:49 PM, Andrey V. Elsukov bu7c...@yandex.ru wrote: On 04.03.2014 09:58, Andreas Nilsson wrote: Why do I need the explict fwd rule? As far as I can see the ipfw man page says nothing about skipto

Re: TCP packets remain unsent

2014-03-29 Thread Ian Smith
On Sat, 29 Mar 2014 15:02:29 +0100, Willy Offermans wrote: Dear FreeBSD friends, On Fri, Mar 28, 2014 at 05:25:54PM +0100, Willy Offermans wrote: Dear FreeBSD friends, I have a problem with my relatively new FreeBSD server. I came across the problem when sending e-mails of

Re: netmap and other discussions on freebsd-net: please be open minded.

2014-05-19 Thread Ian Smith
On Mon, 19 May 2014 01:02:42 _0200, Luigi Rizzo wrote: Folks, i have two requests for you: 1. please do not complain about questions on this list related to a core network-related FreeBSD subsystem (netmap, dummynet, netgraph, tcp stack...) even if they are concerned with ports

RE: [CFT]: ipfw named tables / different tabletypes

2014-06-06 Thread Ian Smith
On Fri, 6 Jun 2014 00:10:26 +0800, bycn82 wrote: Hi Bill, Sorry for waste you time to explain it again, I will read the code first. Especially the code provided in free tutorials by your busy professor .. And the latest patch of `PPS` should be OK, I checked the logic carefully this

Re: How can sshuttle be used properly with FreeBSD (and with DNS) ?

2014-09-09 Thread Ian Smith
On Sat, 6 Sep 2014 02:52:22 +, John Case wrote: I would like to use sshuttle (http://github.com/apenwarr/sshuttle) on FreeBSD. I have it working for TCP connections, but it does not properly tunnel DNS requests. The documentation for sshuttle says that ipfw forward rules will

Re: How can sshuttle be used properly with FreeBSD (and with DNS) ?

2014-09-09 Thread Ian Smith
On Tue, 9 Sep 2014 19:33:05, Ian Smith wrote: add 1000 divert natd ip from any to any in recv xl0 add 2000 divert natd ip from any to any out xmit xl0 Oops, 'ip' should nowadays be 'ip4|ipv4' for divert rules, if ip6 is configured on that interface. Last I heard, ip6 packets break

Re: how to debug non-working hole in nat

2012-01-03 Thread Ian Smith
On Tue, 3 Jan 2012 17:52:53 +0900, Randy Bush wrote: ignore. i sorted it. Too late, sucked in .. diff from prior config might be bone enough? cheers, Ian ___ freebsd-net@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-net

Re: stateful firewall implementation in FreeBSD

2012-01-27 Thread Ian Smith
On Fri, 27 Jan 2012, Nikolay Denev wrote: On Jan 27, 2012, at 4:41 AM, Kevin Oberman wrote: On Thu, Jan 26, 2012 at 11:41 AM, Chuck Swiger cswi...@mac.com wrote: Hi-- On Jan 26, 2012, at 9:24 AM, satish amara wrote: I have question regarding the size of the state table kept in

Re: Stateful IPFW - too many connections in FIN_WAIT_2 or LAST_ACK states

2012-04-21 Thread Ian Smith
On Sat, 21 Apr 2012 15:41:30 +0400, Dmitry S. Kasterin wrote: [..] 9.0-STABLE / custom kernel Also, if you choose to use stateful TCP filtering, it is probably best to do it in the manner shown in the ipfw(8) man page under DYNAMIC RULES. This is very different from the way you

Re: B.a.t.m.a.n.

2012-05-15 Thread Ian Smith
On Mon, 14 May 2012 16:02:40 +0300, Ivo Vachkov wrote: Hello all, On Mon, May 14, 2012 at 1:52 PM, Monthadar Al Jaberi montha...@gmail.comwrote: On Sun, May 13, 2012 at 2:49 PM, Ivan Voras ivo...@gmail.com wrote: On 13 May 2012 06:46, Ivo Vachkov ivo.vach...@gmail.com wrote:

Re: problem with mac option on ipfw rule

2012-08-05 Thread Ian Smith
On Sun, 5 Aug 2012 13:40:21 +0430, h bagade wrote: Hi all, I have problem with setting mac option on ipfw rule. I want to drop all traffic but the traffic with source mac for example 11:22:33:44:55:66. I thought it would be possible using the not option to do the work and I have a set

Re: ipfw, ip|all proto and PPPoE -- does PPPoE packets passed to ipfw?

2012-08-30 Thread Ian Smith
On Wed, 29 Aug 2012 22:31:25 +0400, Lev Serebryakov wrote: Hello, Michael. You wrote 29 ??? 2012 ?., 19:01:08: I have interface (vr1), most of traffic on which is PPPoE. I have ipfw firewall, which splits traffic by interfaces via: add 2000 skipto 5000 all from any to

Re: kernel: arpresolve: can't allocate llinfo for 65.59.233.102

2012-09-13 Thread Ian Smith
On Thu, 13 Sep 2012 21:53:23 +0300, ? ??? wrote: Then my guess is wrong. I found the message, where similiar problem was described in ipfw mailling list http://lists.freebsd.org/pipermail/freebsd-ipfw/2011-March/004582.html, with no answer. Maybe it will be usefull for somebody.

Re: [RFC] Enabling IPFIREWALL_FORWARD in run-time

2012-10-19 Thread Ian Smith
On Fri, 19 Oct 2012 15:25:24 +0400, Andrey V. Elsukov wrote: Hi All, Many years ago i have already proposed this feature, but at that time several people were against, because as they said, it could affect performance. Now, when we have high speed network adapters, SMP kernel and

Re: MAC cloning available like Linux has?

2012-12-15 Thread Ian Smith
On Sat, 15 Dec 2012 12:51:11 -0800, Chris H wrote: in rc.conf, adding the following (order is important!), everything works as expected/desired/anticipated; --- begin rc,conf -- ifconfig_ue0=ether ##:##:##:##:##:##

Re: To SMP or not to SMP

2013-01-08 Thread Ian Smith
On Tue, 8 Jan 2013 07:57:04 -0800, Garrett Cooper wrote: On Jan 8, 2013, at 7:50 AM, Barney Cordoba wrote: --- On Mon, 1/7/13, Erich Dollansky erichsfreebsdl...@alogt.com wrote: From: Erich Dollansky erichsfreebsdl...@alogt.com Subject: Re: To SMP or not to SMP To: Barney

Re: high cpu usage on natd / dhcpd

2013-02-07 Thread Ian Smith
On Thu, 7 Feb 2013 08:08:59 +, Eggert, Lars wrote: On Jan 31, 2013, at 16:03, Matthew Luckie m...@luckie.org.nz wrote: 00510 allow ip from me to not me out via em1 00550 divert 8668 ip from any to any via em1 Rule 510 fixes it. Yep, it does. Can I ask someone to commit

Re: high cpu usage on natd / dhcpd

2013-02-08 Thread Ian Smith
On Thu, 7 Feb 2013 12:50:51 +, Eggert, Lars wrote: Hi, On Feb 7, 2013, at 13:40, Ian Smith smi...@nimnet.asn.au wrote: On Thu, 7 Feb 2013 08:08:59 +, Eggert, Lars wrote: On Jan 31, 2013, at 16:03, Matthew Luckie m...@luckie.org.nz wrote: 00510 allow ip from me to not me

Re: Problems with 8.1, PPPoE server, and Cisco client

2010-10-20 Thread Ian Smith
On Wed, 20 Oct 2010, Paul Thornton wrote: [..] With a Windows XP client (I know, it was nearby though) the following things happen: Server - Client PPP CHAP Success (Welcome!! message). Server - Client PPP CCP config request Server - Client IPCP Config request (setting IP address

Re: Tcpdump showing ghost traffic

2010-10-22 Thread Ian Smith
On Fri, 22 Oct 2010, Thomas Sevestre wrote: Le 21 oct. 10 à 19:04, Julian Elischer a écrit : On 10/21/10 8:26 AM, Thomas Sevestre wrote: Hi all, I'm using freebsd 8 as a router. Say I have a sis0 interface. The

Re: [patch] WOL support for nfe(4)

2010-11-09 Thread Ian Smith
On Tue, 9 Nov 2010, Pyun YongHyeon wrote: On Tue, Nov 09, 2010 at 10:01:36PM +0100, Yamagi Burmeister wrote: On Tue, 9 Nov 2010, Pyun YongHyeon wrote: [..] You can switch to suspend mode with acpiconf -s1. If all goes well, driver would put the controller into suspend mode after

Re: routed source code

2010-11-13 Thread Ian Smith
On Sun, 14 Nov 2010, Milen Dzhumerov wrote: Hi all, We're investigating some ways to perform symbolic execution of distributed systems and we're looking for real-world programs to test. The routed daemon[1] which is included with FreeBSD seemed like a good candidate and I was

Re: An IPFW problem when going from release to stable on 8.2/ Maybe bge0 network card?

2011-03-06 Thread Ian Smith
On Sun, 6 Mar 2011, Dave Johnson wrote: Hi all An IPFW problem when going from release to stable on 8.2 An help gladly accepted LOG ON Flushed all rules. 00010 allow ip from 127.0.0.1 to 127.0.0.1 via lo0 00030 divert 8668 ip from any to any via bge0 ipfw:

Re: Setting up Novatel Mifi 2200 on 8.2-REL

2011-03-15 Thread Ian Smith
On Mon, 14 Mar 2011, Ryan Coleman wrote: I've searched high and low and have no idea where to start to get this thing going... It's recognizing it now but I am not finding any details online (like people who have shared their full configuration details) on how they got the VirginMobile

Re: natd starting after firewall rules are loaded

2011-04-16 Thread Ian Smith
On Sat, 16 Apr 2011, rondzie...@comcast.net wrote: After the firewall rules are loaded, the rc script then loads natd, Once the system is up, i can ipfw list and the divert command is, in fact, not there, but by this time natd is running. If I run the rc.firewall script

Re: natd starting after firewall rules are loaded

2011-04-17 Thread Ian Smith
On Sun, 17 Apr 2011, J. Hellenthal wrote: On Sun, Apr 17, 2011 at 03:36:40PM +1000, Ian Smith wrote: On Sat, 16 Apr 2011, rondzie...@comcast.net wrote: After the firewall rules are loaded, the rc script then loads natd, Once the system is up, i can ipfw list and the divert command

Re: Bridging + VLANS

2011-05-22 Thread Ian Smith
On Sat, 21 May 2011, Doug Barton wrote: On 05/21/2011 01:58, Matthew Bowman wrote: I have an uplink to my ISP on a 2 IP /30 network (1.1.1.0/30 in the diagram) No help for your actual problem, sorry. I just wanted to point out that 1/8 has been assigned by IANA to APNIC, so it

Re: porting nozomi driver (Option N.V. GlobeTrotter 3G+ UMTS datacard) to FreeBSD 7.0R

2008-05-09 Thread Ian Smith
On Fri, 9 May 2008, Matthias Apitz wrote: El día Tuesday, May 06, 2008 a las 07:43:59PM +0200, Matthias Apitz escribió: Hello, I'm on the way to port the above mentioned driver to FreeBSD 7.0-REL; the work is based on the Linux driver of this card and of some help I've got

Re: Understanding where dummynet fits into an ipfw ruleset

2008-06-28 Thread Ian Smith
On Fri, 27 Jun 2008, Chuck Swiger wrote: On Jun 27, 2008, at 3:01 PM, Freddie Cash wrote: [ ... ] If net.inet.ip.fw.one_pass is true, then you definitely want to apply your deny rules first, as once something matches a pipe rule, it's going to be passed. The tradeoff is

Re: too many open file descriptors messages since bind 9.4.2-P1 (port dns94)

2008-07-15 Thread Ian Smith
On Tue, 15 Jul 2008, Kris Kennaway wrote: Thomas Vogt wrote: Hello Since i updated my FreeBSD 6.3 dns server with the latest bind version in the ports (dns/bind94) my system is flooding my log with too many open file descriptors messages. Is there something i can do?

Re: mpd5.1 MTU problem

2008-07-17 Thread Ian Smith
On Thu, 17 Jul 2008, Wasily Lin wrote: Hello, I set up a PPPoE server on FreeBSD 7.0(amd64) with mpd 5.1 and it works fine for all clients except for my FreeBSD 7.0(i386) Notebook. Connecting has no problem and I get ip but all website can not be access even on PPPoE server

Re: Requesting comments on Multi-routing table usage

2008-07-17 Thread Ian Smith
On Thu, 17 Jul 2008, Julian Elischer wrote: The current code in -current will add a new interface to all FIBs. Consider yanking/reinserting cardbus NICs as one source of fun. So for example when you add a gre interface irt shows up everywhere. This behaviour is probbaly correct for

Re: Requesting comments on Multi-routing table usage

2008-07-18 Thread Ian Smith
On Thu, 17 Jul 2008, Julian Elischer wrote: Julian Elischer wrote: Ian Smith wrote: On Thu, 17 Jul 2008, Julian Elischer wrote: The current code in -current will add a new interface to all FIBs. [..] Yes in addition to 'setfib N command' it would be likely useful to have

Re: Application layer classifier for ipfw

2008-08-02 Thread Ian Smith
On Fri, 1 Aug 2008, Mike Makonnen wrote: Patrick Tracanelli wrote: Mike Makonnen escreveu: Hi, An Internet Cafe I do some work for was recently having problems with very slow internet access. It turns out customers were running P2P file sharing applications which were hogging

Re: permissions on /etc/namedb

2008-08-03 Thread Ian Smith
On Sun, 3 Aug 2008, Eugene Grosbein wrote: I need /etc/namedb to be owned by root:bind and have permissions 01775, so bind may write to it but may not overwrite files that belong to root here, and I made it so. Suprise! # /etc/rc.d/named restart

Re: permissions on /etc/namedb

2008-08-03 Thread Ian Smith
On Sun, 3 Aug 2008, Eugene Grosbein wrote: On Sun, Aug 03, 2008 at 10:32:22PM +1000, Ian Smith wrote: I need /etc/namedb to be owned by root:bind and have permissions 01775, so bind may write to it but may not overwrite files that belong to root here, and I made it so. Suprise

Re: Application layer classifier for ipfw

2008-08-03 Thread Ian Smith
On Sun, 3 Aug 2008, Mike Makonnen wrote: Ian Smith wrote: On Fri, 1 Aug 2008, Mike Makonnen wrote: Patrick Tracanelli wrote: Mike Makonnen escreveu: [..] /* * Inform divert(4) what rule to send it to by * modifying the port

Re: permissions on /etc/namedb

2008-08-04 Thread Ian Smith
On Sun, 3 Aug 2008, Doug Barton wrote: Eugene Grosbein wrote: On Sun, Aug 03, 2008 at 10:54:05PM -0700, Doug Barton wrote: [..] Well, I just want bind be allowed to write to is working directory. I think that your idea of BIND's working directory is probably flawed That's not

Re: permissions on /etc/namedb

2008-08-05 Thread Ian Smith
On Mon, 4 Aug 2008, Doug Barton wrote: Adrian Penisoara wrote: On Mon, Aug 4, 2008 at 12:57 PM, Ian Smith [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] wrote: With the notable exception of making standard functions rndc trace and querylog work, writing to the default file

Re: Named Listen IP

2008-08-11 Thread Ian Smith
On Mon, 11 Aug 2008, Onur Aslan wrote: I am using named for a ns server. Named listening all ips for my machine. But when i reboot machine, my ppp network connecting after started named. named doesn't listening my ppp network's ip. Do you have a solution? Assuming you have a fixed IP

Re: Named Listen IP

2008-08-12 Thread Ian Smith
On Mon, 11 Aug 2008, Paul Schmehl wrote: --On Tuesday, August 12, 2008 01:08:46 +1000 Ian Smith [EMAIL PROTECTED] wrote: On Mon, 11 Aug 2008, Onur Aslan wrote: I am using named for a ns server. Named listening all ips for my machine. But when i reboot machine, my ppp network

Re: ipfw add skipto tablearg....

2008-08-19 Thread Ian Smith
On Thu, 31 Jul 2008, Julian Elischer wrote: looking int he code I noticed that the following command gave no error but didn't work.. ipfw add 1000 skipto tablearg ip from any to table(31) Content addressible branching is an elegant and useful idea, thanks for making it work. A simple

Re: ipfw add skipto tablearg....

2008-08-19 Thread Ian Smith
On Tue, 19 Aug 2008, Luigi Rizzo wrote: On Tue, Aug 19, 2008 at 11:12:04PM +1000, Ian Smith wrote: On Thu, 31 Jul 2008, Julian Elischer wrote: ... ipfw add 1000 skipto tablearg ip from any to table(31) ... see attached patch... (hopefully not stripped) Of course

Re: rc.firewall quick change

2008-11-13 Thread Ian Smith
On Thu, 13 Nov 2008, Julian Elischer wrote: At home I use the following change. basically, instead of doing 8 rules before and after the nat, use a table and to 1 rule on each side. any objections? Only that if people are already using tables for anything, chances are they've

Re: Speaking of rc.firewall .. (fwd)

2008-11-13 Thread Ian Smith
-- Forwarded message -- Date: Fri, 17 Oct 2008 05:24:43 +1100 (EST) From: Ian Smith [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: Re: Speaking of rc.firewall .. On Thu, 16 Oct 2008, Ian Smith wrote: I see that both HEAD and RELENG_7 rc.firewall have been updated

Re: rc.firewall quick change

2008-11-14 Thread Ian Smith
On Fri, 14 Nov 2008, Julian Elischer wrote: Julian Elischer wrote: Ian Smith wrote: On Thu, 13 Nov 2008, Julian Elischer wrote: At home I use the following change. basically, instead of doing 8 rules before and after the nat, use a table and to 1 rule on each side

Re: Heads up --- Thinking about UDP and tunneling

2008-12-12 Thread Ian Smith
On Fri, 12 Dec 2008, Randall Stewart wrote: Bruce: So lets see: 1) I went ahead and fixed the comments.. even added a ! instead of :-( Personally: emoticons ARE punctuation; adding a period is totally anal. 2) No problem using func_t.. changed to that.. seems nicer :-D I guess

Re: Heads up --- Thinking about UDP and tunneling

2008-12-13 Thread Ian Smith
On Sat, 13 Dec 2008, Peter Jeremy wrote: On 2008-Dec-13 13:55:18 +1100, Ian Smith smi...@nimnet.asn.au wrote: I guess submitting patches for style(9) is considered a suicide method? Not necessarily but you need to have very good justification for any change. It's much easier to read

Re: tun0 not responding to ping

2009-01-02 Thread Ian Smith
On Fri, 2 Jan 2009, per...@pluto.rain.com wrote: Why would a local interface, reported as up in ifconfig, not respond to a ping of its own IP address? The tun0 reported below doesn't, and I have no idea how to debug it. (I've overwritten the two most- significant octets of its IP

Re: tun0 not responding to ping

2009-01-03 Thread Ian Smith
On Fri, 2 Jan 2009, per...@pluto.rain.com wrote: Ian Smith nimnet.asn.au!smi...@agora.rdrop.com wrote: uucp .. how quaint :) ... tun0: flags=8051UP,POINTOPOINT,RUNNING,MULTICAST mtu 1412 inet6 fe80::2b0:d0ff:fe28:ad4f%tun0 prefixlen 64 scopeid 0x4 inet

Re: tun0 not responding to ping

2009-01-04 Thread Ian Smith
On Sat, 3 Jan 2009, per...@pluto.rain.com wrote: Ian Smith nimnet.asn.au!smi...@agora.rdrop.com wrote: On Fri, 2 Jan 2009, per...@pluto.rain.com wrote: Ian Smith nimnet.asn.au!smi...@agora.rdrop.com wrote: uucp .. how quaint :) Yep, but running over ssh since agora no longer

Re: (partly) SOLVED: tun0 not responding to ping

2009-01-06 Thread Ian Smith
On Sun, 4 Jan 2009, per...@pluto.rain.com wrote: Ian Smith nimnet.asn.au!smi...@agora.rdrop.com wrote: On Fri, 2 Jan 2009, per...@pluto.rain.com wrote: Why would a local interface, reported as up in ifconfig, not respond to a ping of its own IP address? The tun0 reported below

Re: FreeBSD 7.0R ADSL

2009-01-10 Thread Ian Smith
On Sat, 10 Jan 2009, Skip Ford wrote: Matthias Apitz wrote: El d?a Saturday, January 10, 2009 a las 05:54:56AM -0500, Skip Ford escribi?: Matthias Apitz wrote: What kind of software I could use in FreeBSD? There is some port net/rp-pppoe but the man pages speaks about

Re: BIND 9.4.3-P1: internal_send: 199.7.83.42#53: Device not configured, where 199.7.83.42 is RANDOM IP address

2009-01-25 Thread Ian Smith
On Sun, 25 Jan 2009, Daniel O'Connor wrote: On Sunday 25 January 2009 11:43:48 Mark Andrews wrote: Doug Barton wrote: I've never used mpd myself, but you might want to try adding the following line to /usr/local/etc/rc.d/mpd and see if it helps: # BEFORE: named This

Re: MTU or Fragmentation Problems on 7.0?

2009-01-25 Thread Ian Smith
On Sun, 25 Jan 2009, Len Gross wrote: The following configuration works fine _until_ I make a change in MTU setting on the link between FreeBSD1 and FreeBSD2 Internet | Router x.x.x.x 192.168.0.1/16

Re: BIND 9.4.3-P1: internal_send: 199.7.83.42#53: Device not configured, where 199.7.83.42 is RANDOM IP address

2009-01-26 Thread Ian Smith
On Sun, 25 Jan 2009, Daniel O'Connor wrote: On Sunday 25 January 2009 11:43:48 Mark Andrews wrote: Doug Barton wrote: I've never used mpd myself, but you might want to try adding the following line to /usr/local/etc/rc.d/mpd and see if it helps: # BEFORE: named This

Re: MTU or Fragmentation Problems on 7.0?

2009-01-27 Thread Ian Smith
to two different ISPs. I can live with having a Web Proxy on FreeBSD # 1, but I am concerned that this issue will crop up someplace else. -- Len On Sun, Jan 25, 2009 at 9:51 PM, Ian Smith smi...@nimnet.asn.au wrote: On Sun, 25 Jan 2009, Len Gross wrote: The following

Re: A more pliable firewall

2009-02-20 Thread Ian Smith
On Fri, 20 Feb 2009, Artyom Viklenko wrote: On Thu, 19 Feb 2009, Bakul Shah wrote: I am wondering if there is a more dynamic and scriptable firewall program. The idea is to send it alerts (with sender host address) whenever a dns probe fails or ssh login fails or smtpd finds it

Re: A more pliable firewall

2009-02-20 Thread Ian Smith
On Fri, 20 Feb 2009, Bakul Shah wrote: Thanks to everyone who responded. Looks like all the pieces to do this exist. All I have to do is to package it all in one program sheriff that watches various log files and pulls the trigger on the bad guy(s) at appropriate time. Wild West imagery

Re: IPFW MAX RULES COUNT PERFORMANCE

2009-04-27 Thread Ian Smith
that despite 20 times the CPU clock rate, probably at least 30 times CPU throughput and likely 10 times the tick rate, you appear to be suffering something like 30 to 900 times the increased latency to be expected by traversing 'too many' ipfw rules. Ian Smith escreveu: On Fri, 24 Apr 2009, Daniel

Re: MAC locking and filtering in FreeBSD

2009-05-14 Thread Ian Smith
On Wed, 13 May 2009, Brett Glass wrote: I need to find a way to do MAC address locking in FreeBSD -- that is, to ensure that only a machine with a particular MAC address can use a particular IP address. Unfortunately, it appears that rules in FreeBSD's IPFW are stuck on one layer: rules

Re: MAC locking and filtering in FreeBSD

2009-05-14 Thread Ian Smith
On Thu, 14 May 2009, Brett Glass wrote: At 12:17 AM 5/14/2009, Ian Smith wrote: You can use fixed leases with MAC specified in dhcp for that, This lets you assign specific addresses to machines with specific MAC addresses. But it doesn't inhibit MAC address cloning, and the DHCP

Re: Wireless mesh networking

2009-05-26 Thread Ian Smith
On Sun, 24 May 2009, Rui Paulo wrote: Hi, If anyone is interested in testing out wireless mesh networking under FreeBSD, the project has now reached a point where you can transfer packets between mesh nodes. Always a good point to celebrate :) I try to keep the branch in sync with head

Re: Wireless mesh networking

2009-05-26 Thread Ian Smith
On Tue, 26 May 2009, Brooks Davis wrote: On Tue, May 26, 2009 at 08:06:25PM +1000, Ian Smith wrote: On Sun, 24 May 2009, Rui Paulo wrote: Hi, If anyone is interested in testing out wireless mesh networking under FreeBSD, the project has now reached a point where you can

Re: dummynet dropping too many packets

2009-10-08 Thread Ian Smith
On Wed, 7 Oct 2009, rihad wrote: Robert Watson wrote: I would suggest making just the HZ - 4000 change for now and see how it goes. OK, I will try testing HZ=4000 tomorrow morning, although I'm pretty sure there still will be some drops. Even if there are, I'd like to know

Re: pf tcpdump

2009-11-13 Thread Ian Smith
On Fri, 13 Nov 2009, Stephane D'Alu wrote: Is there a way to have tcpdump only showing packed that have pass the filtering rules, so to check that firewall rules were correctly written and not letting unwanted packets in. tcpdump sees packets before they're passed to the firewall coming in,

Re: pf tcpdump

2009-11-13 Thread Ian Smith
On Fri, 13 Nov 2009, Stephane D'Alu wrote: On 13/11/2009 13:08, Ian Smith wrote: On Fri, 13 Nov 2009, Stephane D'Alu wrote: Is there a way to have tcpdump only showing packed that have pass the filtering rules, so to check that firewall rules were correctly written

Re: RFC: documented and actual behaviour of ipfw tee

2009-12-30 Thread Ian Smith
On Tue, 29 Dec 2009, Julian Elischer wrote: Luigi Rizzo wrote: There a difference between the documented and actual behaviour of ipfw tee which occurs when there are multiple rules with the same number, e.g. rule_id number body r1 500 tee port1 dst-ip

Re: kern/147191: [ppp] Problems with ppp -nat [pppoe], ipfw, dummynet

2010-06-03 Thread Ian Smith
On Wed, 2 Jun 2010, Jose M Rodriguez wrote: The following reply was made to PR kern/147191; it has been noted by GNATS. From: Jose M Rodriguez jos...@freebsd.jazztel.es To: bug-follo...@freebsd.org Cc: Subject: Re: kern/147191: [ppp] Problems with ppp -nat [pppoe], ipfw, dummynet

Re: Poor performance with natd/ipfw and TSO enabled on bce(4) card and 8.1-PRERELEASE

2010-07-01 Thread Ian Smith
On Thu, 1 Jul 2010, Garrett Cooper wrote: On Thu, Jul 1, 2010 at 4:54 PM, Pyun YongHyeon pyu...@gmail.com wrote: On Wed, Jun 30, 2010 at 07:00:53PM -0700, Garrett Cooper wrote: Hi,     Just an observation I made while transferring a file: # time scp floppy.img somehost:

Re: Deterministic lockup / panic in networking stack with ipfw / natd enabled on recent amd64 STABLE / CURRENT

2010-07-02 Thread Ian Smith
On Tue, 15 Jun 2010, Garrett Cooper wrote: Hi, I'm experiencing a deterministic situation on a development box I manage when I do the following to enable ipfw and natd to bridge a network with two bce(4) enabled NICs, where if I do the following steps below, then try to push a few

Re: Deterministic lockup / panic in networking stack with ipfw / natd enabled on recent amd64 STABLE / CURRENT

2010-07-02 Thread Ian Smith
On Sat, 3 Jul 2010, Ian Smith wrote: On Tue, 15 Jun 2010, Garrett Cooper wrote: Hi, I'm experiencing a deterministic situation on a development box I manage when I do the following to enable ipfw and natd to bridge a network with two bce(4) enabled NICs, where if I do

Re: Intel 82574L Gigabit Ethernet Controller

2010-07-09 Thread Ian Smith
On Wed, 7 Jul 2010, Shtorm wrote: Yow, 30 vlans, but only em1 is using vlans not em0? Is only em1 having watchdogs? I noticed you appear to have flow control off, maybe turning it on would help. I would like to see the log messages from the watchdogs. Jack Yes, em0 -

Re: Intel 82574L Gigabit Ethernet Controller

2010-07-09 Thread Ian Smith
On Fri, 9 Jul 2010, Shtorm wrote: Yeah, saw this too, it was first boot for this install and I forgot to run tzsetup during flash image build. As for the latest log, this box connected to internet via em0, ntpd just says it have some peers to sync with after interface flap.

Re: Intel 82574L Gigabit Ethernet Controller

2010-07-09 Thread Ian Smith
On Fri, 9 Jul 2010, Ryan Stone wrote: No, defining EM_WATCHDOG as 10 * hz should mean that the watchdog expires after 10 seconds no matter what your kern.hz is. hz is set to the number of ticks in a second. Ok, one more probably wild punt .. Shtorm you say HZ=4000, giving: === And here

Re: Intel 82574L Gigabit Ethernet Controller

2010-07-09 Thread Ian Smith
On Sat, 10 Jul 2010, Ian Smith wrote: HZ=4000 ticks are 250ns, not 25ms. Up way too late .. that's 250us of course, thanks Ryan. ___ freebsd-net@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-net To unsubscribe, send any

Re: strange resolver behavour

2010-10-12 Thread Ian Smith
On Mon, 11 Oct 2010, Eugene Grosbein wrote: Hi! FreeBSD 8.1-STABLE: # host koin-nkz.com. koin-nkz.com has address 62.231.164.101 Host koin-nkz.com not found: 3(NXDOMAIN) This domain does not have MX records but NXDOMAIN seems to wrong return code to me. Think about MTA that

Re: strange resolver behavour

2010-10-12 Thread Ian Smith
On Tue, 12 Oct 2010, Tom Evans wrote: On Tue, Oct 12, 2010 at 10:05 AM, Ian Smith smi...@nimnet.asn.au wrote: On Mon, 11 Oct 2010, Eugene Grosbein wrote:   Hi!     FreeBSD 8.1-STABLE:     # host koin-nkz.com.   koin-nkz.com has address 62.231.164.101   Host koin-nkz.com

Re: strange resolver behavour

2010-10-12 Thread Ian Smith
On Tue, 12 Oct 2010, Tom Evans wrote: On Tue, Oct 12, 2010 at 3:39 PM, Ian Smith smi...@nimnet.asn.au wrote: On Tue, 12 Oct 2010, Tom Evans wrote:   On Tue, Oct 12, 2010 at 10:05 AM, Ian Smith smi...@nimnet.asn.au wrote: [..]   If a domain has no MX server, how's an MTA supposed

Re: ipfw limit src-addr woes

2007-02-19 Thread Ian Smith
On Mon, 19 Feb 2007, admin wrote: Andre Santos wrote: On 2/18/07, admin [EMAIL PROTECTED] wrote: Hi, I'm trying to use ipfw's limit clause to limit the number of connections a single IP can have at the same time in a transparent web-proxy environment: 00350 skipto 401 tcp

Re: ipfw limit src-addr woes

2007-02-19 Thread Ian Smith
On Mon, 19 Feb 2007, admin wrote: Ian Smith wrote: On Mon, 19 Feb 2007, admin wrote: Andre Santos wrote: On 2/18/07, admin [EMAIL PROTECTED] wrote: Hi, I'm trying to use ipfw's limit clause to limit the number of connections a single IP can have at the same time

Re: ipfw limit src-addr woes

2007-02-20 Thread Ian Smith
On Tue, 20 Feb 2007, Julian Elischer wrote: admin wrote: Wrong: the implied check-state done by the limit lets the connection through (i.e. performs the action) iff there's state recorded for it (src-addr+src-port+dst-addr+dst-port). If however it's a SYN packet incoming and

Re: ipfw limit src-addr woes

2007-02-22 Thread Ian Smith
On Wed, 21 Feb 2007, Julian Elischer wrote: Ian Smith wrote: On Tue, 20 Feb 2007, Julian Elischer wrote: admin wrote: Wrong: the implied check-state done by the limit lets the connection through (i.e. performs the action) iff there's state recorded

mpd 4.1 on 5.5-STABLE

2007-03-03 Thread Ian Smith
I'm having trouble getting mpd 4.1 going, and am a netgraph noobie. FreeBSD paqi.nimnet.asn.au 5.5-STABLE FreeBSD 5.5-STABLE #0: Sat Mar 3 03:14:13 EST 2007 [EMAIL PROTECTED]:/usr/obj/usr/src/sys/PAQI5S_3 i386 paqi# mpd4 -v Version 4.1 ([EMAIL PROTECTED] 20:51 3-Mar-2007) /etc/rc.conf

Re: mpd 4.1 on 5.5-STABLE

2007-03-04 Thread Ian Smith
On Sat, 3 Mar 2007, Alexander Motin wrote: Ian Smith wrote: When started the first time, before there's any ng0 interface, mpd logs the following two lines then immediately exits without further ado: paqi# /usr/local/etc/rc.d/mpd4.sh start Try to run mpd from console just

Re: mpd 4.1 on 5.5-STABLE

2007-03-05 Thread Ian Smith
On Sun, 4 Mar 2007, Alexander Motin wrote: Ian Smith wrote: mpd4 -b syslogs the intro line, then sometimes another one, maybe two: Mar 4 20:03:16 paqi mpd: process 39879 started, version 4.1 ([EMAIL PROTECTED] 20:51 3-Mar-2007) Mar 4 20:03:16 paqi mpd: CONSOLE: listening

Re: Troubleshooting aliases.

2007-03-17 Thread Ian Smith
On Sat, 17 Mar 2007, Colin Waring wrote: Hi folks, Been running into brick walls since last night on this one. Situation is that our server has 6.1-RELEASE on it with four IP addresses. The section of rc.conf is this: ifconfig_em0=inet a.a.a.a netmask 255.255.255.0

Re: Troubleshooting aliases.

2007-03-17 Thread Ian Smith
On Sat, 17 Mar 2007, Colin Waring wrote: Basically, .a and .d respond to pings and pass all traffic .b and .c respond to pings but don't appear to pass any other traffic. IPF is compiled but I've completely turned it off for testing If you run one tcpdump on lo0 and another on em0 and

Re: Call for testers: olsrd and IP_ONESBCAST

2007-04-15 Thread Ian Smith
On Mon, 9 Apr 2007, Bruce M Simpson wrote: For a while now I have had a patch available to teach olsrd to use IP_ONESBCAST instead of using libnet/bpf just to send broadcast datagrams in FreeBSD, which has had IP_ONESBCAST for a few years now. Would 'a few years' likely include

Re: ipfw, keep-state and limit

2007-04-16 Thread Ian Smith
On Sun, 15 Apr 2007, Luigi Rizzo wrote: On Sun, Apr 15, 2007 at 11:53:15PM +0200, Ivan Voras wrote: Luigi Rizzo wrote: if i remember well (the implementation dates back to 2001 or so) you just need to use limit, as it implicitly installs a dynamic state entry (same as

Re: ppp/peers/* files

2007-06-26 Thread Ian Smith
On Tue, 26 Jun 2007, Artyom Viklenko wrote: On Tue, 26 Jun 2007, Jim Stapleton wrote: What man/handbook pages/sections should I look at to get a clue. I'm so far from having one, I don't even know the direction... see handbook section about networking. simply speaking enter

RE: Mpd daemon stop when rotating mpd.log file with newsyslog.conf

2007-07-08 Thread Ian Smith
On Sun, 8 Jul 2007, Gloomy Group wrote: Thanks to all of you. Keeping N option solved.Thanks again. (trying to recover the format, more or less) Alexander Motin wrote: Julian Elischer wrote: Hello all, I have installed mpd4.2.2 in freebsd 6.2. Everything is working fine except when

Re: A and AAAA DNS query process in getaddrinfo()?

2007-08-10 Thread Ian Smith
On Fri, 10 Aug 2007, blue wrote: JINMEI Tatuya / wrote: At Fri, 10 Aug 2007 13:45:46 +0800, blue [EMAIL PROTECTED] wrote: Although DNS resolver may lead to some delay or misbehavior of the upper application, I think that would be caller's resposibility to decide

how to use iic(4)

2007-09-21 Thread Ian Smith
This drew a blank in -questions. I don't know where else to post it, so I'm hoping someone here might be able to spare me a clue. We're building a small board with two AVR Tiny MCUs chatting to each other over an opto-isolated I2C-compatible bus, hopefully at 400kbps. Hoping to use the

Re: ifconfig: BRDGADD vr1: Invalid argument

2007-12-11 Thread Ian Smith
On Wed, 12 Dec 2007, Randy Bush wrote: the symptom # ifconfig bridge0 192.168.0.1 addm vr1 addm vr2 addm vr3 addm ath0 up ifconfig: BRDGADD vr1: Invalid argument the conditions # kldstat Id Refs AddressSize Name 13 0xc040 39ad48 kernel 21 0xc27c8000

Re: ifconfig: BRDGADD vr1: Invalid argument

2007-12-11 Thread Ian Smith
On Wed, 12 Dec 2007, Randy Bush wrote: Ah. Well the only other thing i noticed (after posting) was that each of vr1 to vr3 showed as UP, but: media: Ethernet autoselect (none) status: no carrier but I don't know whether that should matter? man page says not.

  1   2   >