Hot answers tagged

31

wireshark - powerfull sniffer which can decode lots of protocols, lots of filters. tshark - command line version of wireshark dumpcap (part of wireshark) - can only capture traffic and can be used by wireshark / tshark tcpdump - limited protocol decoding but available on most *NIX platforms ettercap - used for injecting traffic not sniffing All tools use ...


22

So needless to say, nobody on the planet knows how many nodes there are between here and there. I know how many nodes. There are exactly 16. The reason you get different responses is because different operating systems use different starting values for TTL. Some devices use 255, while others use 63. So, one of the devices you are pinging sends the ...


19

Is it correct in assuming that ASICs for router or switch interfaces will outperform the use of an x86 CPU for all packet processing which will greatly suffer from CPU interrupts? It's hard to say specifically whether interrupts are a limitation, since we aren't naming specific CPU, operating system or router models in this part of your question. Overall, ...


11

In 802.11 wireless (which I assume is your case), typically broadcast/multicast frames (as well as many management frames) are transmitted at the lowest base/basic/required (term varies by vendor) data rate. This is separate from the supported data rates. Typically, for best range and maximum compatibility, this defaults to the 1Mbps data rate, although in ...


11

Open vSwitch has a section on that in their FAQ: Q: Why would I use Open vSwitch instead of the Linux bridge? A: Open vSwitch is specially designed to make it easier to manage VM network configuration and monitor state spread across many physical hosts in dynamic virtualized environments. Refer to Why Open vSwitch? for a more detailed description of ...


10

Disclaimer: I work at Cumulus Networks To address a few of the high level points/concerns raised: 1.) Is ONIE getting traction? ONIE is the de facto method for getting software onto whitebox switches. It's been embraced by Dell, HP, Supermicro, Penguin, Facebook and a few others. It's run out of the Open Compute Project (http://www.opencompute.org/) an ...


9

I think your issue is coming from a simple misconception of how SNMP data (OIDs) is structured, and how snmpwalk, snmpget, and snmpgetnext interact with it. SNMP organizes the OIDs into related nested trees (or tables), the MIBs define those trees and the OIDs in them. It's important to understand how snmpget and snmpgetnext works before getting into ...


8

Running "ping -M do -s 1490 example.com" says that the ICMP data size is 1490 bytes and fragmentation is not allowed. For this size of ICMP data, ICMP size (i.e., header + data) is 1498 bytes. Adding IP header, frame size becomes 1518 bytes. Frame size can't exceed MTU size of the interface. As from the error message, MTU for the interface is 1500 bytes. So, ...


7

Multicast rate has to be the lowest common denominator so that all devices can receive it successfully. Multicast frames cannot be acknowledged[1], so if a peer fails to receive it, the sender will not know, and will not retransmit the frame. Having loss rates of more than 1% per receiver is common. Much higher loss rates can be expected if there is heavy ...


6

So first of all show fabric utilization all shows fabric utilization, not CPU utilization. Fabric doesn't have CPU component per se, and you can go all up to 100% of fabric utilization without any adverse effects similar to what CPU causes when nearing to the full load. Next, the WS-X6548-GE-TX is 8Gbit/s card, so "old" fabric attached LC with 8Gbit/s ...


6

Make sure there's a notable performance difference between jumbos and standard frames - without it, there's little reason to dive in. Hardware offloading tends to make jumbos obsolete unless you need the final 4% throughput. You should consider your latency and QoS requirements. Jumbos increase latency and may hurt QoS. Check your equipment for the jumbo ...


5

My thoughts on this are that firstly if you capture the traffic in one place (if you are able to, if you have one capture machine/device joint to both mcast groups) you don't have the complexity of having to replay two different captures files in time with each other. Secondly you can edit packet captures so that when you "play" them back the packets are ...


5

When a router should fragment but it receives the IP datagram with DF flag set, it sends ICMP (type should fragment but DF is set) to the source. Then the source adjust the MTU and it send again the datagram. This is how PMTUD works. What happens here is that after you receives the ICMP from the router adjust the MTU to 500 for the path so the following ...


5

is it reasonable to suggest that the relatively low mind share and vendor presence is a potential operational risk? There is the potential for both risks and rewards with choosing such a solution. Will the company disappear leaving the product abandoned? Possibly. Are there greater chances of bugs/problems with the code that aren't resolved in a timely ...


5

Step one, enable IP Forwarding on node2 and node3 (or the nodes will be "hosts" not "routers") All the nodes need to know what isn't directly attached: Node1 ip route add 10.1.1.0/24 via 10.1.3.3 ip route add 10.1.2.0/24 via 10.1.3.3 Node2 ip route add 10.1.2.0/24 via 10.1.1.3 Node3 ip route add 10.1.3.0/24 via 10.1.1.2 Node4 ip route add 10.1.3.0/...


4

Apologies, it took a while to figure out mininet and the OpenFlow ryu controller, but I finally got it... I tried to print haddr_to_str(src), haddr_to_str(dst) and got 00:00:00:00:00:03 and ff:ff:ff:ff:ff:ff which is not what I expected. I wanted to get 2 as source and 3 as dest. The short story is that you're decoding the destination mac address ...


4

Assuming the servers can ping each other: You need to check that the Optimization Service is enabled globally and for your inpath interface otherwise the Riverbed will not interact with network traffic at all. As soon as Optimization is enabled you can check under "Reports / Connected Appliances" if the Riverbeds can see each other.


4

I'm trying to understand how zeroconfig works in a situation where not all devices are on a single network, but they are all connected to a centralized PC. Zeroconf is not designed to work in this situation, so don't expect things to work out of the box. Zeroconf has three component: IPv4LL, mDNS and DNS-SD. IPv4LL allows a device to configure an address ...


4

I've done this sort of thing before using tcpreplay and mergecap (one of the tools that is distributed with Wireshark). The first step is to use tcprewrite (part of tcpreplay) to edit the destination IPs of foo.pcap to be first address you are looking to send as, and bar.pcap to be the second. Then use mergecap to merge the packets chronologically so you get ...


4

I was able to get it working with this command sudo screen /dev/ttyS0 38400,cs8,-ixon,ixoff Before running the command, I had to use dmesg to find which of the ttyS or ttyU devices was to be used. Also the parameters after the ttyS device are the exact ones specified in the the HP 1910 manuals. There are other programs such as cu and minicom. I chose GNU ...


4

The three major differences between a managed switch and using Linux bridge interfaces are performance, port density, and features. Most managed switches will embed some of their programmed functionality into specialized hardware. This is not true in all cases, but this specialized hardware will tend to outperform devices that are purely software based (at ...


4

is it reasonable to suggest that the relatively low mind share and vendor presence is a potential operational risk? This is always an issue. Products from a small vendor could (and more often than not, do) end up abandoned. As long as they continue to function, there's little to worry about. But when they break, there's nowhere to go but somewhere else. ...


4

The thing is that you are not using the official Global Protect client so you need and extra configuration step in the firewall. You need to define X-Auth support (on the firewall) and all related fields. After that, you can use any SSL VPN Standard client. I confirm it works for me in Linux and IOS (the iphone thing, not the Cisco :P). This link would be ...


4

What route -n (or netstat -rn) is showing you needs a bit of interpretation - a "gateway" of 0.0.0.0 means that the next hop for any packet sent to this subnet is the actual destination host, not a router. If the "gateway" is not 0.0.0.0, then all packets destined for this subnet will actually be sent to the MAC address of the gateway (which will then ...


4

The way switches (bridges) work is that a switch builds a MAC address table which relates MAC addresses to the port(s) where the MAC addresses are connected. When a frame comes into a switch port, the switch will update its MAC address table to show that the source MAC address in the frame is connected to that port. Each port can have multiple MAC addresses ...


4

You are confusing MTU and MSS. The MTU 1500 is related to ethernet, so it includes the IP and TCP headers. Both have a minimum size of 20, so the MSS (maximum segment size) for TCP is in this case 1500 - 20 - 20 = 1460. Note that both the IP header and the tcp header can have a size greater than 20, when using options, and so you may still encounter ...


4

JFL was correct it was a NIC checksum offloading error. My guess is that when my virtual router was behind my physical router it somehow made it so it didn't need to do checksumming. Recap of Problem: Scenario A: virtual behind physical resulted in 88mbps (pfsense 2.4.2 as a KVMguest on CentOS 7 with default settings on the pfsense install.) (...


4

You need to investigate low latency switches. Nexus 3000 is designed for financial applications where low latency is essential. Increasing bandwidth can also reduce latency, so look for 10Gbps or higher end-to-end (including PC connectivity). Also investigate a QOS feature called low latency queuing. The feature is designed for voice and video. ...


3

The linux bridge is a pure software switch -- the cpu is involved with every packet. With a "managed switched", there will be dedicated switching hardware.


3

If the port channel is DOWN, then the Cisco device doesn't see it bundled together. As your display shows, each port are Stand-Alone (as indicated by the "I" status), meaning they're seen as separate entities to the switch with regards to MAC table, etc. This point to something wrong in your channel config and/or capabilities (mismatch between the linux box ...


Only top voted, non community-wiki answers of a minimum length are eligible