Re: Bandwidth consumed by computer on the network

2010-10-02 Thread Hermes Ojeda Ruiz

Thanks Eugene Yunak,

I'm sorry if I don't explain correctly by language problems.

I need to know how Mb or Kb have received or sent every IP address, or 
Consumed/Available bandwidth ratio. The client only need a way to 
measure the IP that download/upload more packets.


I hope that help to explain the problem.

On 02/10/10 01:25, Eugene Yunak wrote:
On 2 October 2010 04:57, Hermes Ojeda Ruiz hermes@gmail.com 
mailto:hermes@gmail.com wrote:


Hi,

I'm working with a OpenBSD firewall on embedded hardware, and the
client
want to know the bandwidth consume by IP address.

I don't know if this is possible using PF, another tool or making
scripts to
get the information.

I'm worried about the performance, because, some weeks ago I make
a question
in the list How distribute bandwidth by IP's, and I solved it,
using a lot
of cbq's by ip address (~150 ip address) like was recommended on the
replies, of course, using an script to generate it. That's work,
perfect,
but generate some delays on the packets, and if I log everything
it can make
the connection useless. The firewall is running in a Soekris net5501.

Sorry, if this is a fool question, and my bad english.

--
Hermes Ojeda Ruiz



Hi Hermes,

This is probably due to the native-language problem, but your question 
is a bit incorrect.
The bandwidth consumed by IP address is 4x2=8 bytes per each packet 
(unless we are speaking of IPv6).
But this is not what you want to know. So what do you need? 
Consumed/Available bandwidth ratio? (my best guess)


Hope the clarification of your question will help others answer you.


Cheers,
Eugene

--
The best the little guy can do is what
the little guy does right




Re: Bandwidth consume by IP address

2010-10-02 Thread Peter N. M. Hansteen
Hermes Ojeda Ruiz hermes@gmail.com writes:

 I'm working with a OpenBSD firewall on embedded hardware, and the client
 want to know the bandwidth consume by IP address.

 I don't know if this is possible using PF, another tool or making scripts to
 get the information.

There are a few options available. One is to write the rule set with
labels to collect statistics, making sure the labels are one per IP
address.  The other main option is to use pflow(4), with 'set
state-defaults pflow' or 'keep state (pflow)' for individual rules in
your rule set, set up a collector somewhere and extract the data you
need per IP address.  If you go for pflow, the pflow man page will get
you started.  I'd recommend taking a look at Michael W. Lucas' recent
book for the Netflow analysis part, while the upcoming second edition
of the Book of PF contains a bit of material about both approaches too
(the first edition has only the labels part).

- Peter
-- 
Peter N. M. Hansteen, member of the first RFC 1149 implementation team
http://bsdly.blogspot.com/ http://www.bsdly.net/ http://www.nuug.no/
Remember to set the evil bit on all malicious network traffic
delilah spamd[29949]: 85.152.224.147: disconnected after 42673 seconds.



Re: Is GeForce 8200 supported ?

2010-10-02 Thread Jean-Francois
Le Thursday 30 September 2010 22:45:02, Chris Cappuccio a icrit :
 Not supported

 Jean-Francois [jfsimon1...@gmail.com] wrote:
  Hello,
 
  I have a problem starting X and in Xorg.0.log there is the following
  lines. Is it a driver error ? It's an integrated graphic card on the MB
  providing both vesa/hdmi outputs. Could you please help ?
 
  (II) VESA: driver for VESA chipsets: vesa
  (II) Primary Device is: PCI 0...@00:00.0
  (WW) NV: Ignoring unsupported device 0x10de0849 (GeForce 8200) at
  0...@00:00.0 (WW) Falling back to old probe method for vesa
  (EE) No devices detected.
 
  Fatal server error:
  no screens found

Is there noway to solve this with existing software, such as a compatible but
limited driver ?

Regards



Re: Mobile VPN

2010-10-02 Thread Evgeniy Sudyr
I was able to get it working with 4.6/4.7 and E60/E65/E52 it works as
expected :)

Nokia VPN config tool will save hours instead trial by error.

On Fri, Oct 1, 2010 at 10:29 PM, Claudiu Pruna clau...@net-go.net wrote:

 On Fri, 2010-10-01 at 21:19 +0200, David Coppa wrote:
  On Fri, Oct 1, 2010 at 9:11 PM, Claudiu Pruna clau...@net-go.net
 wrote:
  I was wondering has anyone got an S60 mobile phone to connect to
   OpenBSD Ipsec ?
  
  I did some tryies, but no luck.
 
  Maybe this is of some use:
 
  http://betabug.ch/wiki/VPNNotes
 
  I'm sorry, but I have no personal experiences with mobile vpns...
 
  cheers,
  david

 thanks a lot, sounds very interesting, I will test it and see what
 happens ;)

 --
 Claudiu Pruna clau...@net-go.net




-- 
--
With regards,
Eugene Sudyr



Re: Bandwidth consume by IP address

2010-10-02 Thread Bret S. Lambert
man pflow

On Fri, Oct 01, 2010 at 08:57:07PM -0500, Hermes Ojeda Ruiz wrote:
 Hi,
 
 I'm working with a OpenBSD firewall on embedded hardware, and the client
 want to know the bandwidth consume by IP address.
 
 I don't know if this is possible using PF, another tool or making scripts to
 get the information.
 
 I'm worried about the performance, because, some weeks ago I make a question
 in the list How distribute bandwidth by IP's, and I solved it, using a lot
 of cbq's by ip address (~150 ip address) like was recommended on the
 replies, of course, using an script to generate it. That's work, perfect,
 but generate some delays on the packets, and if I log everything it can make
 the connection useless. The firewall is running in a Soekris net5501.
 
 Sorry, if this is a fool question, and my bad english.
 
 -- 
 Hermes Ojeda Ruiz



Re: Is GeForce 8200 supported ?

2010-10-02 Thread Marco Peereboom
nivida really isn't supported at all.  Not their video boards, not the
chipsets etc.  just don't buy nvidia it is crap hardware to boot.

On Sat, Oct 02, 2010 at 10:55:19AM +0200, Jean-Francois wrote:
 Le Thursday 30 September 2010 22:45:02, Chris Cappuccio a icrit :
  Not supported
 
  Jean-Francois [jfsimon1...@gmail.com] wrote:
   Hello,
  
   I have a problem starting X and in Xorg.0.log there is the following
   lines. Is it a driver error ? It's an integrated graphic card on the MB
   providing both vesa/hdmi outputs. Could you please help ?
  
   (II) VESA: driver for VESA chipsets: vesa
   (II) Primary Device is: PCI 0...@00:00.0
   (WW) NV: Ignoring unsupported device 0x10de0849 (GeForce 8200) at
   0...@00:00.0 (WW) Falling back to old probe method for vesa
   (EE) No devices detected.
  
   Fatal server error:
   no screens found
 
 Is there noway to solve this with existing software, such as a compatible but
 limited driver ?
 
 Regards



Re: Bandwidth consume by IP address

2010-10-02 Thread Stuart Henderson
On 2010-10-02, Peter N. M. Hansteen pe...@bsdly.net wrote:
 Hermes Ojeda Ruiz hermes@gmail.com writes:

 I'm working with a OpenBSD firewall on embedded hardware, and the client
 want to know the bandwidth consume by IP address.

 I don't know if this is possible using PF, another tool or making scripts to
 get the information.

 There are a few options available. One is to write the rule set with
 labels to collect statistics, making sure the labels are one per IP
 address.  The other main option is to use pflow(4), with 'set
 state-defaults pflow' or 'keep state (pflow)' for individual rules in
 your rule set, set up a collector somewhere and extract the data you
 need per IP address.  If you go for pflow, the pflow man page will get
 you started.

pflow needs software to collect data; you might want to look at nfsen/nfdump,
pmacct or flow-tools - all are in ports. (Note that pflow is compatible
with Netflow).



Re: Is GeForce 8200 supported ?

2010-10-02 Thread Ted Unangst
On Sat, Oct 2, 2010 at 4:55 AM, Jean-Francois jfsimon1...@gmail.com wrote:
 Is there noway to solve this with existing software, such as a compatible but
 limited driver ?

Have you called up nvidia?  You have a support contract, right?



Vende lo que quieras a todo Mexico desde $1,499 MXN

2010-10-02 Thread Contrata Publicidad via Email y SMS
Please see the web version:
http://email.enviomasivoempresarial.com/f/rnl.aspx/?y3r=0c78hodzus0=9jjq3v=d6
ne2iiw=l...@s/evmrhm8zuEOCS



Si tiene problemas para leer este mensaje, por
favor haga clic aquC- para verlo en su navegador



POLITICA ANTI-SPAM
Estamos en contra de mandar mensajes no solicitados. Si piensas que recibiste
este mensaje por error o si usted quisiera dejar de recibir estos tipos de
notificaciones a su correo electrC3nico misc@openbsd.org, simplemente haga
clic aquC-.



Re: [OpenCV] Compilation error

2010-10-02 Thread Ted Unangst
There is no dl library.  Remove references to it.

On Fri, Oct 1, 2010 at 6:31 PM, Benjamin GUILLER
orion.64.loves@gmail.com wrote:
 Hello world,

 I am trying to install OpenCV library onto my laptop for making
 a robot running on OpenBSD.

 I need to install OpenCV library, so I've read the OpenCV's manual,
 I've downloaded sources using svn, and I've prepared compilation
 with cmake.

 The compilation stops when it tries to link .o files using the dl library.

 Here is the error :

 Linking CXX shared library ../../lib/libcxcore.so
 /usr/bin/ld: cannot find -ldl
 collect2: ld returned 1 exit status
 gmake[2]: *** [lib/libcxcore.so.2.1] Error 1
 gmake[1]: *** [src/cxcore/CMakeFiles/cxcore.dir/all] Error 2
 gmake: *** [all] Error 2


 Regards



Re: How to use /dev/srandom

2010-10-02 Thread Kevin Chadwick
On Wed, 29 Sep 2010 13:02:41 -0400
Ted Unangst ted.unan...@gmail.com wrote:

 On Wed, Sep 29, 2010 at 12:49 PM, Kevin Chadwick ma1l1i...@yahoo.co.uk
wrote:
   And isn't srandom sometimes (very rarely!) appropriate? E.g. for
   generating encryption keys?

 If arandom is somehow not appropriate for generating keys, it should
 be fixed.  I'd be interested to hear more.

  I notice arandom doesn't pause. Is arandom always better or only when
  there's enough entropy?

 It is more efficient.  There is almost always enough entropy for
 arandom, and if there isn't, you would have a hard time detecting
 that.

I love it when you get something that's more secure and more functional.

It strikes in the face of sweeping and simplistic statements about
security. :C



Which Video to use: AGP ATI or Onboard Intel

2010-10-02 Thread Kevin Chadwick
Just added a system to the network with a rage agp card and onboard
intel.

I've never liked the idea of a video card using system memory but am
under the impression that the intel driver support is better at the
moment in OpenBSD.

Which would you choose?



Re: Is GeForce 8200 supported ?

2010-10-02 Thread Kevin Chadwick
On Sat, 2 Oct 2010 11:37:59 -0400
Ted Unangst ted.unan...@gmail.com wrote:

 On Sat, Oct 2, 2010 at 4:55 AM, Jean-Francois jfsimon1...@gmail.com wrote:
  Is there noway to solve this with existing software, such as a compatible 
  but
  limited driver ?
 
 Have you called up nvidia?  You have a support contract, right?
 

I believe vesa though limited in capability, should work as a
standard on all cards, atleast in theory. It'll be better and a lot
easier just to use a different card though.

If nvidia get enough requests maybe they'll followsuit of AMD and Intel
and opensource they're drivers, but I think they're happy with they're
status on Windows and Linux at the mo.



Re: Is GeForce 8200 supported ?

2010-10-02 Thread Theo de Raadt
 If nvidia get enough requests maybe they'll followsuit of AMD and Intel
 and opensource they're drivers, but I think they're happy with they're
 status on Windows and Linux at the mo.

They never will.



Re: Is GeForce 8200 supported ?

2010-10-02 Thread Jean-Francois
Le Saturday 02 October 2010 17:37:59, Ted Unangst a icrit :
 On Sat, Oct 2, 2010 at 4:55 AM, Jean-Francois jfsimon1...@gmail.com
wrote:
  Is there noway to solve this with existing software, such as a compatible
  but limited driver ?

 Have you called up nvidia?  You have a support contract, right?

Not yet, I decided to do something else to solve my problem actually. However
it's more interesting, but there's not so much details to say here at the
moment.

I dive into OpenBSD and find out how much work there was done on it.

Thanks to all developpers.



Re: Which Video to use: AGP ATI or Onboard Intel

2010-10-02 Thread Marco Peereboom
Either ATI or intel work pretty well.  ATI is a bit faster but I'd guess
Intel is marginally better supported.  There are of course Intel and ATI
boards that aren't very well supported (yet).

On Sat, Oct 02, 2010 at 06:00:10PM +0100, Kevin Chadwick wrote:
 Just added a system to the network with a rage agp card and onboard
 intel.
 
 I've never liked the idea of a video card using system memory but am
 under the impression that the intel driver support is better at the
 moment in OpenBSD.
 
 Which would you choose?



NFS file list incomplete

2010-10-02 Thread Alexander Polakov
Hi misc,

 I experience a strange issue here with NFS. I am running a dragonflybsd
 NFS server and an OpenBSD client. DragonFly client works just fine, so
 I am asking on this list.

 When I try to get directory listing it appears incomplete:
 # client
 [~]% ls /mnt/net/music/|wc -l
  180
 # server
  ls /var/data/music/|wc -l
  260
 
 but:

 [~]% ls /mnt/net/music/|grep 3nd
 [~]% ls /mnt/net/music/3nd
 2003 - 1st demo/2003 - 9gatsu 29nichi (demo)/   2007 -
 View From Here/  2009 - World Tour/  Band.jpg

 I tried tracing ls and got this:
 
 25213 ls   CALL  open(0x824e8800,0x4,0x)
 25213 ls   NAMI  /mnt/net/music/
 25213 ls   RET   open 5
 25213 ls   CALL  fstat(0x5,0xcfbe62e0)
 25213 ls   RET   fstat 0
 25213 ls   CALL  fcntl(0x5,0x2,0x1)
 25213 ls   RET   fcntl 0
 25213 ls   CALL  mmap(0,0x2000,0x3,0x1002,0x,0,0,0)
 25213 ls   RET   mmap -1962889216/0x8b00b000
 25213 ls   CALL  mmap(0,0x1000,0x3,0x1002,0x,0,0,0)
 25213 ls   RET   mmap -1967628288/0x8ab86000
 25213 ls   CALL  getdirentries(0x5,0x8b00b000,0x2000,0x7fd62394)
 25213 ls   RET   getdirentries 4696/0x1258
 25213 ls   CALL  mmap(0,0x1000,0x3,0x1002,0x,0,0,0)
 25213 ls   RET   mmap -1980260352/0x89f7a000
 25213 ls   CALL  mmap(0,0x1000,0x3,0x1002,0x,0,0,0)
 25213 ls   RET   mmap -2120105984/0x81a1c000
 25213 ls   CALL  mmap(0,0x1000,0x3,0x1002,0x,0,0,0)
 25213 ls   RET   mmap -2130837504/0x80fe
 25213 ls   CALL  mmap(0,0x1000,0x3,0x1002,0x,0,0,0)
 25213 ls   RET   mmap -2094350336/0x832ac000
 25213 ls   CALL  mmap(0,0x1000,0x3,0x1002,0x,0,0,0)
 25213 ls   RET   mmap -2067316736/0x84c74000
 25213 ls   CALL  getdirentries(0x5,0x8b00b000,0x2000,0x7fd62394)
 25213 ls   RET   getdirentries -1 errno 22 Invalid argument
 25213 ls   CALL  close(0x5)

 [~]% mount -v|grep net
 192.168.0.101:/var/data on /mnt/net type nfs (rw, nodev, nosuid,
 ctime=Sun Oct  3 00:20:53 2010, v3, tcp, hard, wsize=8192, rsize=8192,
 rdirsize=8192, timeo=100, retrans=101, maxgrouplist=16, readahead=1,
 acregmin=5, acregmax=60, acdirmin=5, acdirmax=60)

 [~]% dmesg|head -2
 OpenBSD 4.8-current (GENERIC) #407: Sat Oct  2 05:47:52 MDT 2010
 dera...@i386.openbsd.org:/usr/src/sys/arch/i386/compile/GENERIC

--
Alexander Polakov | plhk.ru



Re: project : openbsd as nas

2010-10-02 Thread Jean-Francois
Hi,

I understood that this list is not meant for me to show off what I did with
this nas stuff.
I'll just post once the work is done so it may be of interest to some.
At the moment I'm doing a custom install cd, not sure how long it will take if
I ever outcome all difficulties but I'll bet.

Here's the first hack, I am working on the install.sh  install.sub files.

In the install process /src/distrib/miniroot/install.{sh,sub}, replaced

Available disks are: wd0 wd1 wd2.
Which one do you wish to initialize? (or 'done') [done]

by

disk : wd0
label: Veritech SSD 200
total sectors: 63078400 #  total bytes: 30.1G

disk : wd1
label: SAMSUNG HD103UJ
total sectors: 1953525168 #  total bytes: 931.5G

disk : wd2
label: MAXTOR STM316021
total sectors: 312581808 #  total bytes: 149.1G

Available disks are: wd0 wd1 wd2.
Which one will the operating system be installed on? (or 'done') [done]

e.g.

# Force the user to think and type in a disk name by
# making 'done' the default choice.
# Jean-Francois Simon, ADD start
echo
for _n in $(get_dkdevs); do
echo disk : $_n
disklabel -h $_n | grep label;
disklabel -h $_n | grep total;
echo
done
# Jean-Francois Simon, ADD end
ask_which disk will the operating system be installed on \
'$(l=$(get_dkdevs); for a in $DISKS_DONE; do
l=$(rmel $a $l); done; bsort $l)' \
done

Le Monday 30 August 2010 14:51:56, IC1igo Ortiz de Urbina a C)crit :
 I have been following misc long enough to say, without any fear, that
 OpenBSD community likes hacking rather than talking. Work on it and
 then show some results for feedback, if it is interesting enough.

 Also, misc is for openbsd, strictly, not related projects. Sometimes
 marco's scrotwm bugs appear on the list and are discussed, till its
 sure its a scrotwm, and not an openbsd, bug. Of course, marco is marco

 :-)

 On 8/30/10, Jean-Francois jfsimon1...@gmail.com wrote:
  Hello,
 
  I was thinking about how to help openbsd project, and since I am not able
  to help in programming, I'm thinking about starting something aroung
  openbsd such
  as a layer making it an easy enough to manage home nas server of good
  quality.
 
  I have not yet the whole picture of how to do it but maybe a project that
  will
  take quite sometime and whose goal is to transform a standard install
  into a ready to run nas server with few efforts.
 
  I don't know yet what it will be like, probably it needs to be package or
  something else, I need to study it more in details so far.
 
  I hope that you will receive well this idea I have and maybe if you do
  wish, support if it is needed.
 
  I will then open something on my own wiki to prepare and work on the
  complete
  project, describe it in detail and start to implement things.
 
  Again thanks for the quality of that os and its documentation which makes
  it very interesting to work on.
 
  Regards
  JF



Incorrect FAQ entry about ksh(1) does not appear to read my .profile

2010-10-02 Thread Amit Kulkarni
http://www.openbsd.org/faq/faq8.html#ksh

echo XTerm*loginShell: true  ~/.Xdefaults

My .Xdefaults has XTerm*loginShell:true

Notice the missing space before true. I upgraded from a August 16,2010
snapshot to -current

Thanks



Re: Incorrect FAQ entry about ksh(1) does not appear to read my .profile

2010-10-02 Thread Ted Unangst
On Sat, Oct 2, 2010 at 5:33 PM, Amit Kulkarni amitk...@gmail.com wrote:
 http://www.openbsd.org/faq/faq8.html#ksh

 echo XTerm*loginShell: true  ~/.Xdefaults

 My .Xdefaults has XTerm*loginShell:true

 Notice the missing space before true. I upgraded from a August 16,2010
 snapshot to -current

Yeah?  What's your point?



Re: Incorrect FAQ entry about ksh(1) does not appear to read my .profile

2010-10-02 Thread Amit Kulkarni
I thought that the space makes a difference as .profile is still not being
read.

On Sat, Oct 2, 2010 at 5:45 PM, Ted Unangst ted.unan...@gmail.com wrote:

 On Sat, Oct 2, 2010 at 5:33 PM, Amit Kulkarni amitk...@gmail.com wrote:
  http://www.openbsd.org/faq/faq8.html#ksh
 
  echo XTerm*loginShell: true  ~/.Xdefaults
 
  My .Xdefaults has XTerm*loginShell:true
 
  Notice the missing space before true. I upgraded from a August 16,2010
  snapshot to -current

 Yeah?  What's your point?



Re: Incorrect FAQ entry about ksh(1) does not appear to read my .profile

2010-10-02 Thread Abel Abraham Camarillo Ojeda
Amit Kulkarni amitk...@gmail.com wrote:

 I thought that the space makes a difference as .profile is still not being
 read.

 On Sat, Oct 2, 2010 at 5:45 PM, Ted Unangst ted.unan...@gmail.com wrote:

  On Sat, Oct 2, 2010 at 5:33 PM, Amit Kulkarni amitk...@gmail.com wrote:
   http://www.openbsd.org/faq/faq8.html#ksh
  
   echo XTerm*loginShell: true  ~/.Xdefaults
  
   My .Xdefaults has XTerm*loginShell:true
  
   Notice the missing space before true. I upgraded from a August 16,2010
   snapshot to -current
 
  Yeah?  What's your point?

.Xdefaults has nothing to do with .profile ...

--
DISCLAIMER: http://goldmark.org/jeff/stupid-disclaimers/ 
This message will self-destruct in 3 seconds.



Re: Incorrect FAQ entry about ksh(1) does not appear to read my .profile

2010-10-02 Thread Edho P Arief
On Sun, Oct 3, 2010 at 5:59 AM, Amit Kulkarni amitk...@gmail.com wrote:
 I thought that the space makes a difference as .profile is still not being
 read.


It seems to still read my .profile fine with space (using 4.7-release)

-- 
O ascii ribbon campaign - stop html mail - www.asciiribbon.org



carp + client avahi-daemon = OpenBSD kernel hang

2010-10-02 Thread Devin Reade
I've got a problem where I have a couple of OpenBSD firewalls 
running in a redundant configuration using carp, and have found 
that CentOS 5.5 (Linux) boxes running on a protected network, if
they have avahi-daemon running, will cause the OpenBSD kernels to lock
up hard.  This is very reproducable.

While I can avoid the problem by not running avahi-daemon on the
Linux machines, I'd really prefer to find the source of the problem
on the OpenBSD side and fix it.  From my perspective, there is nothing
that a remote host should be able to do that should lock up a
an OpenBSD kernel. (And lest anyone be offended by my calling it a
problem on the OpenBSD side, I'm quite willing to believe that there
is bad ju-ju in my config and am not necessarily blaming OpenBSD per se.)

If anyone has suggestions on how I can proceed to diagnose the problem,
I would appreciate it.

Details follow.

==

Okay, the short version is that I noticed the problem weeks back that
whenever I booted or shut down a new CentOS 5.5 box, it would cause one
of the two redundant firewalls to lock up.  The firewalls are Soekris
net5501-70 machines, with the hardware watchdog enabled. So eventually
the watchdog would kick the firewall and it would come back.

Over a period of time I worked on elimination of various potential 
problem areas, such as doing memory checks, checking for bad power, 
power overloads, etc.  Without going into the details, I was able to
narrow it down to the point that the lockup was reproducable *every*
time avahi-daemon on the Linux box was started or stopped, *and* both
firewalls in the carp cluster were running.  If avahi-daemon is 
disabled or if the secondary firewall is shut down, there is no problem.

There is no kernel panic on the OpenBSD side; it just locks up hard.
There are no interesting diagnostics in either the OpenBSD or Linux
logs.  Running tcpdump shows that the avahi multicast traffic is the
last thing that occurs on the DMZ before the kernel locks up.

Most of the time, shutting down the CentOS host will kill the firewall
that is normally the backup, and starting up the CentOS host will kill
the firewall that is normally the primary, however I've seen the shutdown
kill the primary on occasion although I cannot definitively say that
the nominal primary was in fact the current master on the carp devices
on these occasions.

I have verified that this occurs with a bare-bones 64 bit CentOS
installation; although the original machine that triggered this is
a xen server, I've verified that it can happen with a non-xen server.

Interestingly, though, not all CentOS boxes will trigger this behavior;
there are CentOS 5.5 machines on both the DMZ and the internal network
that can be rebooted without affecting the firewall, and I've verified
that they also have avahi-daemon running.

I provide more details on the topology and environment below.

I *could* simplify my topology to see if that eliminates the problem,
but wanted to see if anyone has any ideas first in case a config change
causes the problem to go away without knowing why; I'd rather fix the
problem than avoid it.

I've attached various config files below, sanitized by running them
through perl (so the substitutions are at least self-consistent).  If someone
is willing to look at this in depth and needs the raw configs, contact me
directly.

Description of Environment
==

The topology is too ugly for ascii art, so I'll just describe it.  Both
soekris boxes use the following config:

vr0:  switch to dmz
vr1:  switch to upstream 1 demarc
vr2:  switch to upstream 2 demarc
vr3:  switch to guest network
fxp0: switch to internal network

Until I get a two-port lan card, pfsync is occuring via vr0 (the dmz link).

All switches are consumer grade non-managed DLink DGS-1005G or DGS-1008G
10/100/1000 Mb switches.  I've tried other non-managed switches and the 
problem persists.

I have seen the problem with clean install CentOS 5.5 servers in
the DMZ, both 64 bit, with slightly different hardware.  One has a
Intel Pro/1000 NIC, the other uses an RTL8168b/8111b.  However, I also
have other CentOS 5.5 machines both in the DMZ and on the internal 
net which do *not* trigger the problem.  These others are mix of 32 and
64 bit machines.

Both upstreams use static IPs.  Upstream 1 has been in operation for
a few years with an older single-host non-Soekris OpenBSD firewall,
and everything including the DMZ used NAT (with RFC-1918 IPs).
With the introduction of upstream 2, the DMZ will be moved to routable
IPs.  Currently the DMZ is mixed, with most hosts being private IPs 
and one (not yet production) host having a routable address.  The CentOS
boxes that trigger the problem are both using routable addresses (I
don't know if that's relevant). The pf config is such that
traffic for the routable IPs will be via upstream 2 and traffic for the
NAT'd IPs will 

Re: NFS file list incomplete

2010-10-02 Thread Otto Moerbeek
On Sun, Oct 03, 2010 at 12:43:19AM +0400, Alexander Polakov wrote:

 Hi misc,
 
  I experience a strange issue here with NFS. I am running a dragonflybsd
  NFS server and an OpenBSD client. DragonFly client works just fine, so
  I am asking on this list.
 
  When I try to get directory listing it appears incomplete:
  # client
  [~]% ls /mnt/net/music/|wc -l
   180
  # server
   ls /var/data/music/|wc -l
   260
  
  but:
 
  [~]% ls /mnt/net/music/|grep 3nd
  [~]% ls /mnt/net/music/3nd
  2003 - 1st demo/2003 - 9gatsu 29nichi (demo)/   2007 -
  View From Here/  2009 - World Tour/  Band.jpg
 
  I tried tracing ls and got this:
  
  25213 ls   CALL  open(0x824e8800,0x4,0x)
  25213 ls   NAMI  /mnt/net/music/
  25213 ls   RET   open 5
  25213 ls   CALL  fstat(0x5,0xcfbe62e0)
  25213 ls   RET   fstat 0
  25213 ls   CALL  fcntl(0x5,0x2,0x1)
  25213 ls   RET   fcntl 0
  25213 ls   CALL  mmap(0,0x2000,0x3,0x1002,0x,0,0,0)
  25213 ls   RET   mmap -1962889216/0x8b00b000
  25213 ls   CALL  mmap(0,0x1000,0x3,0x1002,0x,0,0,0)
  25213 ls   RET   mmap -1967628288/0x8ab86000
  25213 ls   CALL  getdirentries(0x5,0x8b00b000,0x2000,0x7fd62394)
  25213 ls   RET   getdirentries 4696/0x1258
  25213 ls   CALL  mmap(0,0x1000,0x3,0x1002,0x,0,0,0)
  25213 ls   RET   mmap -1980260352/0x89f7a000
  25213 ls   CALL  mmap(0,0x1000,0x3,0x1002,0x,0,0,0)
  25213 ls   RET   mmap -2120105984/0x81a1c000
  25213 ls   CALL  mmap(0,0x1000,0x3,0x1002,0x,0,0,0)
  25213 ls   RET   mmap -2130837504/0x80fe
  25213 ls   CALL  mmap(0,0x1000,0x3,0x1002,0x,0,0,0)
  25213 ls   RET   mmap -2094350336/0x832ac000
  25213 ls   CALL  mmap(0,0x1000,0x3,0x1002,0x,0,0,0)
  25213 ls   RET   mmap -2067316736/0x84c74000
  25213 ls   CALL  getdirentries(0x5,0x8b00b000,0x2000,0x7fd62394)
  25213 ls   RET   getdirentries -1 errno 22 Invalid argument
  25213 ls   CALL  close(0x5)
 
  [~]% mount -v|grep net
  192.168.0.101:/var/data on /mnt/net type nfs (rw, nodev, nosuid,
  ctime=Sun Oct  3 00:20:53 2010, v3, tcp, hard, wsize=8192, rsize=8192,
  rdirsize=8192, timeo=100, retrans=101, maxgrouplist=16, readahead=1,
  acregmin=5, acregmax=60, acdirmin=5, acdirmax=60)

Does this also happen with udp mounts?

 
  [~]% dmesg|head -2
  OpenBSD 4.8-current (GENERIC) #407: Sat Oct  2 05:47:52 MDT 2010
  dera...@i386.openbsd.org:/usr/src/sys/arch/i386/compile/GENERIC
 
 --
 Alexander Polakov | plhk.ru