Re: Packet loss with latest snapshot

On Mon, 4 Mar 2019, 13:29 David Gwynne, wrote: > On Mon, Mar 04, 2019 at 10:36:23AM +0100, Tony Sarendal wrote: > > On Mon, 4 Mar 2019, 09:43 Tony Sarendal, wrote: > > > > > > > > > > > Den m??n 4 mars 2019 kl 09:26 skrev Tony Sarendal : > > >

Re: Packet loss with latest snapshot

On Mon, 4 Mar 2019, 09:43 Tony Sarendal, wrote: > > > Den mån 4 mars 2019 kl 09:26 skrev Tony Sarendal : > >> Den sön 3 mars 2019 kl 21:35 skrev Theo de Raadt : >> >>> Tony, >>> >>> Are you out of your mind? You didn't provide even a rough hi

Re: Packet loss with latest snapshot

Den mån 4 mars 2019 kl 09:26 skrev Tony Sarendal : > Den sön 3 mars 2019 kl 21:35 skrev Theo de Raadt : > >> Tony, >> >> Are you out of your mind? You didn't provide even a rough hint about >> what your firewall configuration looks like. You recognize that's >&

Re: Packet loss with latest snapshot

Den sön 3 mars 2019 kl 21:35 skrev Theo de Raadt : > Tony, > > Are you out of your mind? You didn't provide even a rough hint about > what your firewall configuration looks like. You recognize that's > pathetic, right? > > > Earlier in the week I could run parallel ping-pong tests through my

Packet loss with latest snapshot

Earlier in the week I could run parallel ping-pong tests through my test firewalls at 300kpps without any packet loss. I updated to the latest snapshot today and start to see packet loss at around 80kpps. /T OpenBSD 6.5-beta (GENERIC.MP) #764: Sun Mar 3 10:24:08 MST 2019

40G ixl nics

Good evening, We inserted a 2x40G NIC into one of our old franken-pc's, and got this: ixl0 at pci2 dev 0 function 0 "Intel XL710 QSFP+" rev 0x02: port 0, FW 5.0.40043 API 1.5, msi, address 0c:c4:7a:5e:f9:c8 ixl0: unable to query phy types ixl1 at pci2 dev 0 function 1 "Intel XL710 QSFP+" rev

Re: OpenBSD & OpenBGPD router replacement

You will likely run out of CPU before bandwidth. Even on nice hardware I have yet to exceed 1Mpps with OpenBSD. /T Den ons 19 dec. 2018 kl 03:12 skrev Max Clark : > Tom, > > The presentation was very interesting and it's given me a lot of food for > thought for another project. Fortunately for

Re: Reduced network performance since installing 6.4

Hola, Unrelated to wifi, I have seen a dramatic drop in forwarding performance in 6.4 and later. I run some basic performance tests to verify the releases before we deploy them. For the same test on the same hardware I have this: Release, pps snapshot, 340k 6.4, 340k 6.3, 450k 6.2, 430k 6.1,

Re: Integration between CARP and BGPD ?

Or re-write next-hop to the carp address, so carp actually decides the master firewall. /T Den tors 13 sep. 2018 kl 00:20 skrev Tim Jones < b631093f-779b-4d67-9ffe-5f6d5b1d3...@protonmail.ch>: > > On Wednesday, 12 September 2018 20:49, Stuart Henderson < > s...@spacehopper.org> wrote: > > > On

Re: testing cabling and NIC hardware with one machine

Configure the interfaces into separate rdomains. /T 2017-10-25 21:17 GMT+02:00 Christopher Paul : > Hi Misc, > > I have been tasked with setting up a benchmark platform to test NICs and > network cables. I'd like to do this on one PC. So I want to send packets of >

ftp.eu.openbsd.org

Not looking so good. tonsar@jump0.swe1$ ftp ftp.eu.openbsd.org Trying 193.156.26.18... Connected to ftp.eu.openbsd.org (193.156.26.18). 220 jj-prod-obsdmirror.inet6.se FTP server ready. Name (ftp.eu.openbsd.org:tonsar): ftp 331 Guest login ok, send your email address as password. Password: 230

Re: maximum number of interfaces

Back in 2007 I tested with 4k VLAN interfaces, it wasn't fast, but it worked. /T 2017-04-03 5:46 GMT+02:00 Nick Holland : > On 04/02/17 22:08, Edgar Pettijohn wrote: > > Is there a maximum number of network interfaces that can be configured? > > I looked around in

USB and Intel Bay Trail

Hola, I got a pair of mini-pc's to play with for the summer vacation, small fanless thingies with 4xGE and wifi. http://www.qotom.net/goods-129-QOTOM-Q190G4+4+LAN+Mini+PC.html When testing with the latest snapshot USB wont play. Any ideas ? Regards Tony # dmesg OpenBSD 6.0-beta (GENERIC.MP)

lots of states (5.8)

Hola amigos, I'm doing some testing in the lab at the moment and just though I'd share. pf0.swe69# pfctl -si | grep current current entries 50239413 pf0.swe69# vmstat -m | tail -n 1 In use 22035659K, total allocated 5678936K; utilization 388.0% pf0.swe69# 4 tcpbench sessions

Re: bgpd network connected

2016-03-08 15:38 GMT+01:00 Matt Schwartz <matt.schwart...@gmail.com>: > I did not even know it was broken? > > On Mar 8, 2016 1:26 AM, "Tony Sarendal" wrote: > > > > Is there any chance of getting "network inet connected" fixed to 5.9 ? > > >

bgpd network connected

Is there any chance of getting "network inet connected" fixed to 5.9 ? Regards Tony

Re: openbgpd puts wrong nexthop in FIB

2016-01-21 11:16 GMT+01:00 Stuart Henderson <s...@spacehopper.org>: > On 2016-01-20, Tony Sarendal <t...@polarcap.org> wrote: > > network inet connected is broken in 5.6, 5.8 and -current. > > Restarting bgpd is required when making interface changes. > > Ah,

Re: openbgpd puts wrong nexthop in FIB

network inet connected is broken in 5.6, 5.8 and -current. Restarting bgpd is required when making interface changes. /T 2016-01-20 20:36 GMT+01:00 Denis Fondras : > Hello, > > I'm using -current as a BGP router and "sometimes" it won't put the right > nexthop in FIB. The

5.8 bgpd, network connected behaves like 5.6

"network inet connected" does not pick up new vlan interfaces, same problem as 5.6. bmr0.esp1# ifconfig vlan69 create bmr0.esp1# ifconfig vlan69 vlandev trunk0 vlan 69 up bmr0.esp1# ifconfig vlan69 1.1.1.1/30 bmr0.esp1# bgpctl show rib 1.1.1.1 flags: * = Valid, > = Selected, I = via IBGP, A =

Re: 5.8 bgpd, network connected behaves like 5.6

2015-12-17 10:29 GMT+01:00 Peter Hessler : > 1) does "bgpctl reload" detect it? > > 2) does -current work as you expect? > > > 1. bgpctl reload does not make any difference. 2. A quick test on my -current workstation (not the same hardware, no trunk) also fails to work.

Re: Donation request for Network SMP development

How is this going ? /T On Fri, Mar 20, 2015 at 8:57 PM, Martin Pieuchot m...@openbsd.org wrote: If you've been following my contributions to OpenBSD's kernel, you already know that in the past years I've been working on the Network Stack [1] to make it more SMP friendly [2]. All the

bgpd.conf macros on 5.5 and up

From 5.5 and up it looks like bgpd macros are broken. ton...@obc2.rad$ cat bgpd.conf good={ 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 } AS 65001 deny from any prefix { $good } ton...@obc2.rad$ On 5.4: ton...@obc2.rad$ bgpd -f bgpd.conf -n configuration OK ton...@obc2.rad$ On 5.5:

4k graphics and openbsd

Good afternoon, Friday question: Does anyone have recommendation on graphics hardware to use for 4k screens and OpenBSD ? I'm thinking about improving my workstation. I run lots of terminal windows, a web browser, and the default window manager. As I like eye candy I may even do xsetroot -solid

Re: 4k graphics and openbsd

On Fri, Sep 19, 2014 at 6:07 PM, Jonathan Gray j...@jsg.id.au wrote: On Fri, Sep 19, 2014 at 02:22:49PM +0200, Tony Sarendal wrote: Good afternoon, Friday question: Does anyone have recommendation on graphics hardware to use for 4k screens and OpenBSD ? I'm thinking about

Re: packets logged by pf without log rule

On Tue, Sep 16, 2014 at 12:20 AM, Alexander Salmin alexan...@salmin.biz wrote: Did you see it in previous versions? I would compare the same ruleset with a fresh 5.5 and see if you experience the same and in that case continue compare the relevant sourcecode. The behaviour is the same as

packets logged by pf without log rule

I'm currently looking into some logging strangeness in we are seeing. Does anyone know why this is logged ? obc3.rad# cat /etc/pf.conf pass quick all obc3.rad# pfctl -sr pass quick all flags S/SA obc3.rad# tcpdump -n -e -ttt -i pflog0 tcpdump: WARNING: snaplen raised from 116 to 160 tcpdump:

Re: bgpctl show advertisements?

bgpctl show rib nei neighbor out On Mon, Sep 15, 2014 at 3:55 AM, Adam Thompson athom...@athompso.net wrote: Is there any functionality in bgpctl(8) that will show me precisely what I'm advertising to a neighbor? If not, is there any easier way - assuming I don't have access to my

Re: pfsync and trunk

On Sat, Sep 13, 2014 at 10:17 AM, Henning Brauer hb-open...@ml.bsws.de wrote: * Tony Sarendal t...@polarcap.org [2014-09-03 06:48]: The initial request disappearing and the firewalls staying demoted forever are independent issues. sure about that? the demotion counter for the interface

Re: pfsync and trunk

he's clearly indicating currently supported OpenBSD versions 5.4 and 5.5 near the bottom...) On 30 Aug 2014 at 14:22, Chuck Burns wrote: On Saturday, August 30, 2014 8:27:24 AM Tony Sarendal wrote: Good morning, I'm having issues with pfsync on trunk interfaces, although I suspect

Re: pfsync and trunk

, Tony Sarendal t...@polarcap.org wrote: As Chuck pointed out this has nothing to do with pfsense or freebsd. While I dig deeper I'm running with the following config to get around the problem: pf1.swe1# cat /etc/hostname.pfsync0 ! sleep 10 ! ifconfig $1 syncdev vlan44 syncpeer 10.240.252.77

pfsync and trunk

Good morning, I'm having issues with pfsync on trunk interfaces, although I suspect it to be any interface that is slow to start. When I run pfsync on a vlan interface on a trunk(4), the pfsync bulk transfer never completes. Running pfsync on an interface that starts quickly I see:

Re: Does OpenBGPd suffer collateral damage with this?

What a horrible article. I thought the kebab I just had for lunch ruined my day, reading that was worse. On Mon, Aug 18, 2014 at 2:27 AM, Rod Whitworth glis...@witworx.com wrote: http://www.smh.com.au/technology/technology-news/how-flakey-is-the-inter net-20140816-104t8p.html I would love

Re: Does OpenBGPd suffer collateral damage with this?

wrote: -Ursprüngliche Nachricht- Von: owner-m...@openbsd.org [mailto:owner-m...@openbsd.org] Im Auftrag von Tony Sarendal Gesendet: Montag, 18. August 2014 12:55 An: misc Betreff: Re: Does OpenBGPd suffer collateral damage with this? What a horrible article. I thought

routes stuck in bgpd after ifconfig destroy

Tested on 5.2 and current. routes get stuck in bgpd after ifconfig destroy. titan# cat /etc/bgpd.conf AS 65001 router-id 10.1.1.1 network inet connected network inet static titan# bgpctl show rib flags: * = Valid, = Selected, I = via IBGP, A = Announced, S = Stale origin: i = IGP, e = EGP, ?

Re: Intel E3-1270 and AES-NI

On Tue, Apr 3, 2012 at 10:49 PM, mxb m...@alumni.chalmers.se wrote: On Apr 3, 2012, at 4:31 PM, Tony Sarendal wrote: On Tue, Apr 3, 2012 at 3:41 PM, Jonathan Gray j...@jsg.id.au wrote: On Tue, Apr 03, 2012 at 03:09:37PM +0200, Tony Sarendal wrote: When testing new boxes with Intel E3

Intel E3-1270 and AES-NI

When testing new boxes with Intel E3-1270 cpu I don't see AES on the cpu's in dmesg. Does this mean that the aes-ni stuff isn't used on these ? I was a bit curious to see if it had any effect on ipsec performance. Regards Tony test3.pio# dmesg OpenBSD 5.1-current (GENERIC.MP) #258: Mon Apr 2

Re: Intel E3-1270 and AES-NI

On Tue, Apr 3, 2012 at 3:41 PM, Jonathan Gray j...@jsg.id.au wrote: On Tue, Apr 03, 2012 at 03:09:37PM +0200, Tony Sarendal wrote: When testing new boxes with Intel E3-1270 cpu I don't see AES on the cpu's in dmesg. Does this mean that the aes-ni stuff isn't used on these ? I was a bit

4.9, set reassemble no + block log + fragments = panic

Good evening, the last two days we have experienced panics sequentially across all of our peering boxes. After one day of coffee, thinking and reading, I found this in 4.9. (5.0+ looks good): target49# ifconfig vlan69 vlan69: flags=8843UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST mtu 1500

Re: bgpctl shiw rib out displaying incorrect information

On Fri, Sep 16, 2011 at 2:34 PM, Claudio Jeker cje...@diehard.n-r-g.comwrote: On Wed, Aug 31, 2011 at 04:37:49PM +0200, Tony Sarendal wrote: On Wed, Aug 31, 2011 at 4:24 PM, Josh Hoppes josh.hop...@gmail.com wrote: Why are you using set nexthop self and then trying to change

Re: bgpctl shiw rib out displaying incorrect information

On Wed, Aug 31, 2011 at 9:51 AM, Patrick Lamaiziere patf...@davenulle.orgwrote: Le Wed, 31 Aug 2011 07:19:15 +0200, Tony Sarendal t...@polarcap.org a icrit : Hi, current1# cat /etc/bgpd.conf AS 65001 network 10.0.1.0/24 current1# bgpctl show rib nei 172.29.1.52 out flags

Re: bgpctl shiw rib out displaying incorrect information

On Wed, Aug 31, 2011 at 11:01 AM, Andre Keller a...@list.ak.cx wrote: Hi Am 31.08.2011 10:23, schrieb Tony Sarendal: Sender says next hop = 172.29.1.100, receiver says .51. show rib out in this case shows incorrect nexthop. Well thats kind of the point of having set nexthop self

Re: bgpctl shiw rib out displaying incorrect information

On Wed, Aug 31, 2011 at 4:24 PM, Josh Hoppes josh.hop...@gmail.com wrote: Why are you using set nexthop self and then trying to change that with the filter allow quick to 172.29.1.52 set nexthop 172.29.1.200. If you don't want your nexthop to be yourself don't tell bgpd to do that. To show

bgpctl shiw rib out displaying incorrect information

current1# cat /etc/bgpd.conf AS 65001 network 10.0.1.0/24 neighbor 172.29.1.52 { remote-as 65001 set nexthop self descr current2 local-address 172.29.1.51 } allow quick to 172.29.1.52 set nexthop 172.29.1.200 allow to any allow from any current1# bgpctl show rib

Re: isakmpd and INVALID_COOKIE

On Mon, Jul 4, 2011 at 4:12 PM, rancor theran...@gmail.com wrote: Ah =) Thanks! // rancor 2011/7/4 Stuart Henderson s...@spacehopper.org: On 2011-07-02, rancor theran...@gmail.com wrote: Hi. I have two separate ipsec tunnels from 4.9 boxes and both are generating this message i

Re: isakmpd and INVALID_COOKIE

On Fri, Jul 8, 2011 at 4:09 PM, Stuart Henderson s...@spacehopper.orgwrote: On 2011-07-08, Tony Sarendal t...@polarcap.org wrote: If you're running isakmpd from 4.8 or 4.9 with IKE you want to pull up src/sbin/isakmpd/dh.c to r1.14 otherwise you will certainly see problems from time

redistributing routes

Is there a way to redistribute routes from BGP to OSPF using bgpd and ospfd ? I have a network where the core concists of openbsd devices using bgpd to distribute routing information. At present we need to use static routing if we connect devices that do not support BGP. Regards Tony

Re: redistributing routes

On Sat, Oct 23, 2010 at 2:05 PM, Insan Praja SW insan.pr...@gmail.comwrote: Hi Tony, On Sat, 23 Oct 2010 18:44:46 +0700, Tony Sarendal t...@polarcap.org wrote: Is there a way to redistribute routes from BGP to OSPF using bgpd and ospfd ? on bgpd.conf you might want to do this: match

Re: redistributing routes

On Sat, Oct 23, 2010 at 3:07 PM, Henning Brauer lists-open...@bsws.dewrote: * Tony Sarendal t...@polarcap.org [2010-10-23 14:29]: rtlabel label Add the prefix with the specified label to the kernel routing table. Is this an error in the page or me

Re: redistributing routes

On Sat, Oct 23, 2010 at 6:16 PM, Stuart Henderson s...@spacehopper.orgwrote: On 2010-10-23, Tony Sarendal t...@polarcap.org wrote: rtlabel label Add the prefix with the specified label to the kernel routing table. I think this should be: Add the prefix

Re: redistributing routes

On Sat, Oct 23, 2010 at 8:02 PM, Henning Brauer lists-open...@bsws.dewrote: * Tony Sarendal t...@polarcap.org [2010-10-23 19:03]: How does OpenBSD handle the same prefix being in both bgpd and ospfd ? in general? OSPF routes have priority over BGP routes. that's implemented kernel routing

Re: redistributing routes

On Sat, Oct 23, 2010 at 8:45 PM, Tony Sarendal t...@polarcap.org wrote: On Sat, Oct 23, 2010 at 8:02 PM, Henning Brauer lists-open...@bsws.dewrote: * Tony Sarendal t...@polarcap.org [2010-10-23 19:03]: How does OpenBSD handle the same prefix being in both bgpd and ospfd ? in general

Re: problems with carp based firewall - all connections are suspended after falling back from failover

On Sat, Apr 10, 2010 at 9:44 AM, tom baecker tb4...@googlemail.com wrote: Hello, I've setup a openbsd-ha firewall, based on the http://www.openbsd.org/faq/pf/carp.html. If the master goes down - the backup system become the Master rule. All established connections are in sync and stay

Re: unidentified system load

On Sun, Mar 28, 2010 at 1:18 PM, Tony Sarendal t...@polarcap.org wrote: On Sun, Mar 28, 2010 at 10:41 AM, Mark Kettenis mark.kette...@xs4all.nlwrote: It's worth trying to disable ichiic(4). Cheers, giving it a go on a few of them. Over a week running with i386 4.6 and -current

Re: unidentified system load

Is there a way to see where the cpu time is spent when it isn't in userland ? I took one of our affected systems and killed everything on it as well as disabling pf. bmr1.brh# ps aux USER PID %CPU %MEM VSZ RSS TT STAT STARTED TIME COMMAND root 1 0.0 0.0 324 296 ??

Re: unidentified system load

On Sun, Mar 28, 2010 at 10:41 AM, Mark Kettenis mark.kette...@xs4all.nlwrote: It's worth trying to disable ichiic(4). Cheers, giving it a go on a few of them. /Tony

unidentified system load

I'm using supermicro boxes (dmesg below) as vpn routers. IPsec+gre+bgp. After a few days uptime the boxes start reporting 8% system cpu, and at the same time they become unresponsive on the network approx every 10 seconds. Any idea on how to find the reason for this is appreciated. I have around

Re: unidentified system load

I'd be looking at the state of your mbufs as well. man netstat Thanks Aaron, these systems are currently running with load very low. From one of the boxes with the problem: bmr1.mlt# uptime 11:33AM up 13 days, 1:04, 1 user, load averages: 0.15, 0.17, 0.11 bmr1.mlt# netstat -m 102 mbufs in

IPsec 4.6 to snapshot failing

Good morning misc, I upgraded two devices from i386-4.6 to i386-snapshot-feb28. After the upgrade snapshot boxes are unable to communicate with the 4.6 devices when going through ipsec. snapshot-snapshot works fine. Everything looks ok except that nothing shows up on enc0 when doing

Re: IPsec 4.6 to snapshot failing

On Mon, Mar 1, 2010 at 12:54 PM, Stuart Henderson s...@spacehopper.orgwrote: On 2010-03-01, Tony Sarendal t...@polarcap.org wrote: Good morning misc, I upgraded two devices from i386-4.6 to i386-snapshot-feb28. After the upgrade snapshot boxes are unable to communicate with the 4.6

Re: Routing between spokes - recent best practices?

On 12/4/07, John Rodenbiker [EMAIL PROTECTED] wrote: On Dec 4, 2007, at 12:14 AM, visc wrote: So, my question is this - what are the current best practices for setting up a hub and spoke topology using OpenBSD, allowing for traffic to securely flow from Branch to Branch on occasion without

Re: Routing between spokes - recent best practices?

On 12/4/07, Tony Sarendal [EMAIL PROTECTED] wrote: On 12/4/07, John Rodenbiker [EMAIL PROTECTED] wrote: On Dec 4, 2007, at 12:14 AM, visc wrote: So, my question is this - what are the current best practices for setting up a hub and spoke topology using OpenBSD, allowing

Re: bgpd patch, WAS: bgpd causing black-holes with bgp-only setup

On 11/12/07, Claudio Jeker [EMAIL PROTECTED] wrote: On Tue, Nov 06, 2007 at 06:26:47PM +0100, Tony Sarendal wrote: New version. Less duplication and a nice feature as bonus. With softreconfig in enabled the looped prefixes are accepted into the Adj-RIB-In. This means that I can tell

Re: Mysterious transfer speed differences

On 11/7/07, Martin Toft [EMAIL PROTECTED] wrote: Hi, I'm experiencing some mysterious transfer speed differences. I have a virtual Linux-server at HostEurope, Germany, and it appears that machines running OpenBSD can only download from the Linux-server with approx 300 kB/s, whereas machines

Re: bgpd patch, WAS: bgpd causing black-holes with bgp-only setup

diff -u version. /Tony Index: rde.c === RCS file: /cvs/src/usr.sbin/bgpd/rde.c,v retrieving revision 1.228 diff -u -r1.228 rde.c --- rde.c 16 Sep 2007 15:20:50 - 1.228 +++ rde.c 6 Nov 2007 10:38:23 - @@

Re: bgpd patch, WAS: bgpd causing black-holes with bgp-only setup

*/ if (fasp != asp) -- --- Tony Sarendal - [EMAIL PROTECTED] IP/Unix -= The scorpion replied, I couldn't help it, it's my nature =-

bgpd patch, WAS: bgpd causing black-holes with bgp-only setup

I have not yet checked how other implementations handle the situation where an update with a as-path loop hides the fact that the neighbor just lost a path. But I made a quick patch if anyone feel like testing. The black-hole condition does not appear anymore when I test. Be gentle, I only

bgpd causing black-holes with bgp-only setup

bgpd does not re-route correctly when I shut down a transit when I use a bgp-only design, causing black-holes for some prefixes. router-01 and router-02 are in the same AS and peer with the same transit provider. router-01 and router-02 have two ibgp peerings, primary and standby path. router-01

Re: bgpd causing black-holes with bgp-only setup

On 11/4/07, Tony Sarendal [EMAIL PROTECTED] wrote: bgpd does not re-route correctly when I shut down a transit when I use a bgp-only design, causing black-holes for some prefixes. router-01 and router-02 are in the same AS and peer with the same transit provider. router-01 and router-02

Re: bgpd causing black-holes with bgp-only setup

On 11/4/07, Tony Sarendal [EMAIL PROTECTED] wrote: On 11/4/07, Tony Sarendal [EMAIL PROTECTED] wrote: bgpd does not re-route correctly when I shut down a transit when I use a bgp-only design, causing black-holes for some prefixes. router-01 and router-02 are in the same AS and peer

Re: bgpd causing black-holes with bgp-only setup

On 11/4/07, Tony Sarendal [EMAIL PROTECTED] wrote: On 11/4/07, Tony Sarendal [EMAIL PROTECTED] wrote: On 11/4/07, Tony Sarendal [EMAIL PROTECTED] wrote: bgpd does not re-route correctly when I shut down a transit when I use a bgp-only design, causing black-holes for some

Re: bgpd causing black-holes with bgp-only setup

On 11/5/07, Claudio Jeker [EMAIL PROTECTED] wrote: On Sun, Nov 04, 2007 at 11:30:20PM +, Tony Sarendal wrote: On 11/4/07, Tony Sarendal [EMAIL PROTECTED] wrote: Thanks for all the info. I will have a look at this as well. Currently I think it is possible that route-reflector

Re: multipath routing with OpenBGPD

On 11/3/07, Florian Fuessl [EMAIL PROTECTED] wrote: Hi Gregory, we have multiple redundant FE upstream peerings to the same AS. So I guess the best solution would be in our case to let the upstream provider assign different community flags for packets passing each FE line which we can use

Re: using bgpd and ospfd

On 10/30/07, Henning Brauer [EMAIL PROTECTED] wrote: * Tony Sarendal [EMAIL PROTECTED] [2007-10-30 02:28]: bgp rib and fib look out of sync. Any ideas why it behaves this way ? It seems like the networks that only exist in bgp fail to re-route when I take down a core router

Re: using bgpd and ospfd

On 10/30/07, Henning Brauer [EMAIL PROTECTED] wrote: * Tony Sarendal [EMAIL PROTECTED] [2007-10-30 11:25]: On 10/30/07, Henning Brauer [EMAIL PROTECTED] wrote: * Tony Sarendal [EMAIL PROTECTED] [2007-10-30 02:28]: bgp rib and fib look out of sync. Any ideas why it behaves

using bgpd and ospfd

I set up a test network with bgpd/ospfd, a standard service provider design where ospf carries the network links and loopbacks and bgp carries everything, bgp routers doing nexthop self, core full mesh and access routers rr-clients of the two nearest core routers. I'm seeing some pretty odd

Re: Moved OpenBSD router from Network A to Network B and Internet no longer works

On 10/27/07, Jake Conk [EMAIL PROTECTED] wrote: Hello, I have my OpenBSD machine setup as a router and when I moved my network from my office to my new datacenter I was no longer able to connect to the internet from machines behind the obsd router. When I try to ping a domain such as

Re: Moved OpenBSD router from Network A to Network B and Internet no longer works

On 10/27/07, Tony Sarendal [EMAIL PROTECTED] wrote: On 10/27/07, Jake Conk [EMAIL PROTECTED] wrote: Hello, I have my OpenBSD machine setup as a router and when I moved my network from my office to my new datacenter I was no longer able to connect to the internet from machines behind

openbsd routing and link down

I'm testing openbsd and routing in a basic setup. router-01 and router-02 are access routers with dynamic routing, both connect to a lan where firewall-01 resides. Both router-01 and router-02 have a static route for the network behind firewall-01. router-01# cat /etc/hostname.em1 inet

Re: em(4) - IFCAP_VLAN_MTU IFCAP_VLAN_HWTAGGING ?

On 10/23/07, Henning Brauer [EMAIL PROTECTED] wrote: * Tony Sarendal [EMAIL PROTECTED] [2007-10-22 18:33]: I didn't get that opinion from marketing. No matter, we disagree, lets leave it at that. well, yeah, nontheless, I wanna point out the essence why stateful is better (the way we do

Re: em(4) - IFCAP_VLAN_MTU IFCAP_VLAN_HWTAGGING ?

On 10/23/07, ropers [EMAIL PROTECTED] wrote: On 23/10/2007, Tony Sarendal [EMAIL PROTECTED] wrote: On 10/23/07, Henning Brauer [EMAIL PROTECTED] wrote: * Tony Sarendal [EMAIL PROTECTED] [2007-10-22 18:33]: I didn't get that opinion from marketing. No matter, we disagree, lets

Re: em(4) - IFCAP_VLAN_MTU IFCAP_VLAN_HWTAGGING ?

On 10/22/07, Henning Brauer [EMAIL PROTECTED] wrote: * Tony Sarendal [EMAIL PROTECTED] [2007-10-22 01:19]: On 10/21/07, Henning Brauer [EMAIL PROTECTED] wrote: well, you can go stateful up to a certain point and handle stuff above stateless (better than dropping), like pass out

Re: em(4) - IFCAP_VLAN_MTU IFCAP_VLAN_HWTAGGING ?

On 10/22/07, Henning Brauer [EMAIL PROTECTED] wrote: * Tony Sarendal [EMAIL PROTECTED] [2007-10-22 14:59]: On 10/22/07, Henning Brauer [EMAIL PROTECTED] wrote: * Tony Sarendal [EMAIL PROTECTED] [2007-10-22 01:19]: On 10/21/07, Henning Brauer [EMAIL PROTECTED] wrote: well, you can

Re: em(4) - IFCAP_VLAN_MTU IFCAP_VLAN_HWTAGGING ?

On 10/21/07, Henning Brauer [EMAIL PROTECTED] wrote: * Tony Sarendal [EMAIL PROTECTED] [2007-10-20 18:06]: On 10/20/07, Henning Brauer [EMAIL PROTECTED] wrote: * Tony Sarendal [EMAIL PROTECTED] [2007-10-20 13:24]: Once I have a few moments free I'll check the impact of pf with urpf

Re: em(4) - IFCAP_VLAN_MTU IFCAP_VLAN_HWTAGGING ?

On 10/21/07, Henning Brauer [EMAIL PROTECTED] wrote: * Tony Sarendal [EMAIL PROTECTED] [2007-10-21 14:50]: stateless is poop. What will happen when the limit of maximum concurrent states is reached ? Will it stop forwarding new flows ? depends on the way you write your ruleset. if you

Re: em(4) - IFCAP_VLAN_MTU IFCAP_VLAN_HWTAGGING ?

On 10/21/07, Can Erkin Acar [EMAIL PROTECTED] wrote: Tony Sarendal [EMAIL PROTECTED] wrote: On 10/21/07, Henning Brauer [EMAIL PROTECTED] wrote: * Tony Sarendal [EMAIL PROTECTED] [2007-10-21 14:50]: stateless is poop. What will happen when the limit of maximum concurrent states

Re: em(4) - IFCAP_VLAN_MTU IFCAP_VLAN_HWTAGGING ?

On 10/21/07, Henning Brauer [EMAIL PROTECTED] wrote: * Tony Sarendal [EMAIL PROTECTED] [2007-10-21 17:22]: On 10/21/07, Henning Brauer [EMAIL PROTECTED] wrote: * Tony Sarendal [EMAIL PROTECTED] [2007-10-21 14:50]: stateless is poop. What will happen when the limit of maximum

Re: em(4) - IFCAP_VLAN_MTU IFCAP_VLAN_HWTAGGING ?

I performed some quick additional tests with OpenBSD and vlan's just for the fun of it, although I belive these tests were more about OpenBSD's performance with lots of interfaces. If you want a openbsd router/firewall with 4000 interfaces don't go for a low-end CPU =)

Re: em(4) - IFCAP_VLAN_MTU IFCAP_VLAN_HWTAGGING ?

On 10/20/07, Henning Brauer [EMAIL PROTECTED] wrote: * Tony Sarendal [EMAIL PROTECTED] [2007-10-20 09:49]: I performed some quick additional tests with OpenBSD and vlan's just for the fun of it, although I belive these tests were more about OpenBSD's performance with lots of interfaces

Re: em(4) - IFCAP_VLAN_MTU IFCAP_VLAN_HWTAGGING ?

On 10/20/07, Henning Brauer [EMAIL PROTECTED] wrote: * Tony Sarendal [EMAIL PROTECTED] [2007-10-20 13:24]: Once I have a few moments free I'll check the impact of pf with urpf and basic stateless filters filters enabled. Time to go look for a light sabre for my son. stateless filters

Re: Idle sessions dying on crappy router: How to increase TCP keepalive?

On 10/20/07, Timo Schoeler [EMAIL PROTECTED] wrote: Hi list, on a customers' site I have a problem connecting from within their LAN (OpenBSD machine) crossing their router (Linksys BEFSX41, doing NAT) to a machine on the internet via SSH: Sessions die after some time due to 'timeouts'. If

Re: em(4) - IFCAP_VLAN_MTU IFCAP_VLAN_HWTAGGING ?

On 10/18/07, Brian A. Seklecki [EMAIL PROTECTED] wrote: On Wed, 17 Oct 2007 10:52:34 +0200 Henning Brauer [EMAIL PROTECTED] wrote: * Brian A. Seklecki [EMAIL PROTECTED] [2007-10-16 23:01]: All: I see that IFCAP_VLAN_MTU is available, but IFCAP_VLAN_HWTAGGING, as seen in ti(4),

Re: em(4) - IFCAP_VLAN_MTU IFCAP_VLAN_HWTAGGING ?

On 10/18/07, Brian A. Seklecki [EMAIL PROTECTED] wrote: On Thu, 18 Oct 2007 14:16:59 +0100 Tony Sarendal [EMAIL PROTECTED] wrote: Just a 5 minute quick test, nothing too scientific. Thanks! What was your IXIA platform? RHEL with gig interface or an appliance? I used an Optixia XM12

OpenBSD router performance tests

I made a new more detailed latency/throughput test with ifq.maxlen set to 2500. With AMD64 UP kernel we are now looking at around 500kpps without packet loss. From 400 to 500kpps with one command, pretty nice, I have to remember that one.

Re: Speed Problems

On 10/3/07, Claudio Jeker [EMAIL PROTECTED] wrote: On Tue, Oct 02, 2007 at 08:46:43PM +0100, Tony Sarendal wrote: On 9/27/07, Tony Sarendal [EMAIL PROTECTED] wrote: On 9/27/07, Claudio Jeker [EMAIL PROTECTED] wrote: ... I hooked up the X4100 to one of our testers and ran some

Re: Speed Problems

On 10/3/07, Daniel Ouellet [EMAIL PROTECTED] wrote: Claudio Jeker wrote: Could you add the dmesg of the test box to the website? Do you have any other network cards you could test? (I'm mostly interested in bnx but sk, msk, bge and nfe could be interesting as well). This box if the M2

Re: Speed Problems

New set of tests done with AMD64 UP kernel. http://www.layer17.net/openbsd-router-intro.html /Tony

Re: Speed Problems

On 9/27/07, Tony Sarendal [EMAIL PROTECTED] wrote: On 9/27/07, Claudio Jeker [EMAIL PROTECTED] wrote: On Thu, Sep 27, 2007 at 09:54:00AM +0100, Tony Sarendal wrote: On 9/27/07, Henning Brauer [EMAIL PROTECTED] wrote: * Tony Sarendal [EMAIL PROTECTED] [2007-09-27 10:36]: On 9

Re: Speed Problems

On 9/26/07, Tom Bombadil [EMAIL PROTECTED] wrote: net.inet.ip.ifq.maxlen defines how many packets can be queued in the IP input queue before further packets are dropped. Packets comming from the network card are first put into this queue and the actuall IP packet processing is done later.

Re: Speed Problems

On 9/27/07, Henning Brauer [EMAIL PROTECTED] wrote: * Tony Sarendal [EMAIL PROTECTED] [2007-09-27 10:36]: On 9/26/07, Tom Bombadil [EMAIL PROTECTED] wrote: net.inet.ip.ifq.maxlen defines how many packets can be queued in the IP input queue before further packets are dropped. Packets

Re: Speed Problems

On 9/27/07, Henning Brauer [EMAIL PROTECTED] wrote: * Tony Sarendal [EMAIL PROTECTED] [2007-09-27 10:59]: I meant if the input queue length was per physical or logical interface. neither. there is one per protocol. i. e. typically two (inet and inet6). Very good. My preconfigured

  1   2   3   >