Potential Spam: Re: IPv6 calculator

[Olivier Mehani]

On Thu, Aug 26, 2010 at 09:41:59PM +0200, Martin PelikC!n wrote:
> I just updated my IPv6 address calculator and thought it might find
> its use in OpenBSD. It shouldn't contain any security risk, is small
> enough not to bloat the tree and handy enough to help admins visualize
> and plan their network's addressing or set those crazy PTRs properly.
> You can get it here: http://cap.potazmo.cz/software/ipv6calc/ipv6calc.c

Did you make sure the bCompact formb complies with [RFC5952]?

I haven't, and I am surely not saying it doesn't, but I thought it would
be good to mention that RFC if you did not already know about it.

[RFC5952] S. Kawamura and M. Kawashima, "A recommendation for IPv6
address text representation," RFC 5952 (Standards Track). [Online].
Available: http://tools.ietf.org/rfc/rfc5952.txt

--
Olivier Mehani 
PGP fingerprint: 4435 CF6A 7C8D DD9B E2DE  F5F9 F012 A6E2 98C6 6655

[demime 1.01d removed an attachment of type application/pgp-signature]

Seminario, Licitaciones Públicas para la Ley de Pemex, Agosto 30 México DF.

[Lic. Karla Quintero]

[IMAGE]

Promociones Especiales para Grupos!

Mayores informes responda este correo electrsnico con los siguientes
datos.

Empresa:

Nombre:

Telifono:

Ciudad y Estado:

Email:

Nzmero de Interesados:

Y en breve le haremos llegar la informacisn completa del evento.

O bien comunmquense a nuestros telifonos un ejecutivo con gusto le
atendera

Tels. (33) 8851-2365, (33)8851-2741.

Copyright (C) 2010, PMS Capacitacisn Efectiva de Mixico S.C. Derechos
Reservados. PMS de Mixico, El logo de PMS de Mixico son marcas
registradas.
ADVERTENCIA PMS de Mixico no cuenta con alianzas estratigicas de ningzn
tipo
dentro de la Republica Mexicana. NO SE DEJE ENGAQAR - DIGA NO A LA
PIRATERIA. Todos los logotipos, marcas comerciales e imagenes son
propiedad
de sus respectivas corporaciones y se utilizan con fines informativos
solamente.

Este Mensaje ha sido enviado a misc@openbsd.org como usuario de Pms de
Mixico o bien un usuario le refiris para recibir este boletmn.
Como usuario de Pms de Mixico, en este acto autoriza de manera expresa
que Pms de Mixico le puede contactar vma correo electrsnico u otros
medios.
Si usted ha recibido este mensaje por error, haga caso omiso de el y
reporte su cuenta respondiendo este correo con el subject BAJApemex
Unsubscribe to this mailing list, reply a blank message with the subject
UNSUBSCRIBEpemex
Tenga en cuenta que la gestisn de nuestras bases de datos es de suma
importancia y no es intencisn de la empresa la inconformidad del receptor

[demime 1.01d removed an attachment of type image/jpeg which had a name of 
pemex.jpg]

Re: IPv6 calculator

[Tomas Bodzar]

Hi,

did you try net/sipcalc ? It's quite fine I think.

2010/8/26 Martin PelikC!n :
> Hello list,
> I just updated my IPv6 address calculator and thought it might find
> its use in OpenBSD. It shouldn't contain any security risk, is small
> enough not to bloat the tree and handy enough to help admins visualize
> and plan their network's addressing or set those crazy PTRs properly.
>
> As there is already net/ipv6calc port, which I don't really think is
> much of use (uncomfortable operation, missing useful information and
> containing lots of the irrelevant/unnecessary), there might be some
> confusion.
>
> Even if it would be rejected, I hope it can reach more people through
> the misc archives and helps to save them some time. Feel free to write
> comments and suggestions.
>
> You can get it here: http://cap.potazmo.cz/software/ipv6calc/ipv6calc.c
>
> --
> Martin Pelikan
>
>



--
bIf youbre good at something, never do it for free.bB bThe Joker

Seminario para Asistentes Ejecutivas en Puerto Vallarta, 3 de Septiembre

[Lic Cristal Dominguez]

[IMAGE]

B!Promociones Especiales para Grupos!

Mayores informes responda este correo electrC3nico con los siguientes
datos.

Empresa:

Nombre:

TelC)fono:

Email:

NC:mero de Interesados:

Y en breve le haremos llegar la informaciC3n completa del evento.

O bien comunCquense a nuestros telC)fonos un ejecutivo con gusto le
atenderC!
Tels. (33) 8851-2365, (33)8851-2741.

Copyright (C) 2010, PMS CapacitaciC3n Efectiva de MC)xico S.C. Derechos
Reservados. PMS de MC)xico, El logo de PMS de MC)xico son marcas
registradas.

ADVERTENCIA PMS de MC)xico no cuenta con alianzas estratC)gicas de
ningC:n tipo dentro de la Republica Mexicana. NO SE DEJE ENGACAR - DIGA
NO A LA PIRATERIA. Todos los logotipos, marcas comerciales e imC!genes
son propiedad de sus respectivas corporaciones y se utilizan con fines
informativos solamente.

Este Mensaje ha sido enviado a misc@openbsd.org como usuario de Pms de
MC)xico o bien un usuario le refiriC3 para recibir este boletCn.

Como usuario de Pms de MC)xico, en este acto autoriza de manera expresa
que Pms de MC)xico le puede contactar vCa correo electrC3nico u otros
medios.

Si usted ha recibido este mensaje por error, haga caso omiso de el y
reporte su cuenta respondiendo este correo con el subject BAJAasistentes

Unsubscribe to this mailing list, reply a blank message with the subject
UNSUBSCRIBEasistentes Tenga en cuenta que la gestiC3n de nuestras bases
de datos es de suma importancia y no es intenciC3n de la empresa la
inconformidad del receptor.

[demime 1.01d removed an attachment of type image/jpeg which had a name of 
secres.jpg]

Re: Checking Routes/Gateways For Good Connection

[dontek]

On  August 26, 2010 4:14 Pete Vickers wrote:
>On 26. aug. 2010, at 00.18, Don Tek wrote:

>> I've recently implemented a firewall with two internet connections using
multipath routing and round-robin outbound load balancing.
>>
>>I am looking for a solution from the shell to detect failure of these two
internet gateways so I can force routing and pf changes from a script.
>> 
>> I need something more robust than simply checking to see if the interface
is up or down.
>> 
>> I have managed a solution using traceroute that allows me to accomplish
half of my goal.  I can detect a failure and "down" that route, however,
once I delete the default route from the routing table for the failed
connection, I can no longer test it with traceroute.  This is because it
doesn't appear to me that OpenBSD's traceroute allows forcing an interface
to work on.
>> 
>> I am looking for better solutions from some of you more experienced
users.  Any suggestions are welcome.
>> 
>> don..
>> 


>Taking a look at the bigger picture, the 'correct' way to do this is to
have redundancy at the firewall level as well at ISP link level. This gives
higher availability, and makes your problem much easier. If you have a
single ISP link per firewall then link testing is simple. Redundancy/LB is
then managed by CARP between the two firewalls' _inside_ interfaces.

>/Pete

I wish I could do this, but this particular client is as stingy as it gets
with IT spending.  They also aren't very concerned about redundancy.  The
only reason they even have two ISP's is because they don't employ any
internal IT personnel and we try and do almost everything remotely, and,
they insist on hosting file sharing for their road warriors internally and
it was the cheapest route to more speed.  Of course, the two ISP's are
nothing more than DSL and DOCIS from two different companies which seem to
flake out fairly often.  At least if I can test on the one firewall, I can
send notification and adjust routes when one of them goes down.

Re: Checking Routes/Gateways For Good Connection

[dontek]

On August 25, 2010 8:20 PM, Stuart Henderson wrote:
>On 2010-08-26, David Gwynne  wrote:
>> relayd can do this i think.
>
>afaik, it just uses the normal routing table, you can't force a specific
interface/nexthop. if that's correct, to have relayd check connectivity
beyond the gateways, you'll need static routes (e.g. host 8.8.8.8 via
connection A, 208.67.222.222 via connection B) and use those hosts as an
indicator.

>> On 26/08/2010, at 9:10 AM, dontek wrote:
> I have managed a solution using traceroute that allows me to 
> accomplish half of my goal.  I can detect a failure and "down" that 
> route, however, once I delete the default route from the routing 
> table for the failed connection, I can no longer test it with
traceroute.
> This is because it doesn't appear to me that OpenBSD's traceroute 
> allows forcing an interface to work on.

>it may work to set the source address (ping -I, traceroute -s) and use a
route-to pf rule to make sure packets with a specific source address are
directed out of the relevant interface...though if you only have one address
to play with for each connection you might be unable to distinguish "check"
packets from normal packets.

I tried out Stuart's suggestion with a couple of vether interfaces and it
seems to have accomplished what I was looking for.  Details:

$ cat /etc/hostname.vether0
inet 172.16.0.1 255.255.255.0 NONE

$ cat /etc/hostname.vether1
inet 172.16.1.1 255.255.255.0 NONE

$ cat /etc/pf.conf  (additions only)

match out on $ext_if_1 from (vether0:network) nat-to ($ext_if_1)
match out on $ext_if_2 from (vether1:network) nat-to ($ext_if_2)

pass out on $ext_if_1 from (vether0) route-to ($ext_if_1 $ext_gate_1)
pass out on $ext_if_2 from (vether1) route-to ($ext_if_2 $ext_gate_2)

Tests:

$ traceroute -s 172.16.0.1 -n google.com
$ traceroute -s 172.16.1.1 -n google.com

Once the above was done I could apply my traceroute scheme of testing to a
script and/or integrate into ifstated.

Thanks Stuart.

>otherwise maybe you can do something with multiple routing tables...

installation improvements

[Chris Smith]

Just installed a snapshot on a Supermicro SYS-5015A-EHF and wanted to
say how much I liked the installation improvements - the little things
really do add up. Used the pxeboot for the first time as well - faster
and easier than dealing with a usb drive and cheaper than buying an
external CD drive.

Chris

Re: which kernel/OS ?

[Ted Unangst]

On Thu, Aug 26, 2010 at 4:16 PM, Chris Smith  wrote:
> I'm building up an OpenBSD box on an Atom D510 (dual core) platform
> running -current . Use will be strictly as a firewall running PF. I've
> read that SMP doesn't really help PF, but it may assist in speeding up
> compiling when keeping up with -current. What are the tradeoffs here?
> Will the mp kernel harm PF performance? As x86 and amd64 are both
> supported are there any strong arguments for running either one?

You're not going to push enough traffic through an atom based system
to notice any difference.  (If you do notice a difference, it's a sign
to get a real computer.)  i386 and amd64 are pretty similar, except
amd64 has a larger address space (rarely needed) and less shit works.

which kernel/OS ?

[Chris Smith]

Hello,

I'm building up an OpenBSD box on an Atom D510 (dual core) platform
running -current . Use will be strictly as a firewall running PF. I've
read that SMP doesn't really help PF, but it may assist in speeding up
compiling when keeping up with -current. What are the tradeoffs here?
Will the mp kernel harm PF performance? As x86 and amd64 are both
supported are there any strong arguments for running either one?

Thanks,

Chris

IPv6 calculator

[Martin Pelikán]

Hello list,
I just updated my IPv6 address calculator and thought it might find
its use in OpenBSD. It shouldn't contain any security risk, is small
enough not to bloat the tree and handy enough to help admins visualize
and plan their network's addressing or set those crazy PTRs properly.

As there is already net/ipv6calc port, which I don't really think is
much of use (uncomfortable operation, missing useful information and
containing lots of the irrelevant/unnecessary), there might be some
confusion.

Even if it would be rejected, I hope it can reach more people through
the misc archives and helps to save them some time. Feel free to write
comments and suggestions.

You can get it here: http://cap.potazmo.cz/software/ipv6calc/ipv6calc.c

-- 
Martin Pelikan

Gran Inaguracion Compucity Minerva

[Info-Compucity]

Newsletter COMPUCITY MINERVA

Expertos en tecnologia

Suscriptor: misc@openbsd.org



Cambiar la suscripcisn (
http://infocomputerland.com/index.php?option=com_acajoom&Itemid=1&act=change&subscriber=1385&cle=c7d9c7344f641c6f217a5e76a292e29b&listid=3
 )
De-suscribirse (
http://infocomputerland.com/index.php?option=com_acajoom&Itemid=1&act=unsubscribe&subscriber=1385&cle=c7d9c7344f641c6f217a5e76a292e29b&listid=3
 )

Powered by Joobi ( http://www.joobisoft.com )

Notebook 3GB RAM HP apenas 1.799,00

[Colombo.com.br]

Se nco estiver visualizando, clique no link abaixo ou cole este endereco
no navegador:
http://www.colombo.com.br/promo/email_msg_012/email_msg_012.htm

Colombo

Notebook Pavilion DV5-2112BR Atlhon II Dual-Core P320(2,1GHz) 3GB RAM
320GB - HP
  Celular Nokia 5233 Desbloqueado Gsm Quadriband

Fogco Gas 4 Bocas Utop  Atlas
   Forno Elitrico
44 Litros Grill 16  Fischer

Mixer Ultra Mixer  Britbnia
  Aspirador de Ps Neo
1200W - Electrolux

Confira a linha de Livros.

Amor E Para Os Fortes, O
   7 Chaves Da Imaginacao


Confira cartuchos Originais HP a partir de 24,90
  Multifuncional HP a
partir de 249,00

Colombo.com.br


Livros

Som e Vmdeo
   Eletrodomisticos
 Cine e Foto
 Telefonia




Informatica
   Esporte e Lazer
   Portateis

Troubles suspending IBM laptop

[Ido Admon]

Hello misc@,
I'm recently having trouble suspending/hibernating an IBM X31 laptop.
It used to work flawlessly with either the Fn+F4/F12 keys or with 'apm
-z', but after a recent update (Aug. 24th snapshot) it won't anymore.

The behavior I'm experiencing is that the suspend LED flashes, as it
should, but the display remains active and then freezes (keyboard/mouse
don't work at all) and I have to power down. If I'm in X then the
display first switches to the console before freezing.

It may be this commit that has changed things for me:
http://marc.info/?l=openbsd-cvs&m=128207276025618&w=2

Here's my dmesg:

OpenBSD 4.8-current (GENERIC) #142: Tue Aug 24 19:46:33 MDT 2010
dera...@i386.openbsd.org:/usr/src/sys/arch/i386/compile/GENERIC
cpu0: Intel(R) Pentium(R) M processor 1400MHz ("GenuineIntel" 686-class) 1.40 
GHz
cpu0: 
FPU,V86,DE,PSE,TSC,MSR,MCE,CX8,SEP,MTRR,PGE,MCA,CMOV,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,TM,SBF,EST,TM2
real mem  = 804220928 (766MB)
avail mem = 781107200 (744MB)
mainbus0 at root
bios0 at mainbus0: AT/286+ BIOS, date 09/22/05, BIOS32 rev. 0 @ 0xfd750, SMBIOS 
rev. 2.33 @ 0xe0010 (57 entries)
bios0: vendor IBM version "1QET97WW (3.02 )" date 09/22/2005
bios0: IBM 2672C1U
apm0 at bios0: Power Management spec V1.2
apm0: battery life expectancy 9%
apm0: AC on, battery charge high, charging
acpi at bios0 function 0x0 not configured
pcibios0 at bios0: rev 2.1 @ 0xfd6e0/0x920
pcibios0: PCI IRQ Routing Table rev 1.0 @ 0xfdea0/272 (15 entries)
pcibios0: PCI Interrupt Router at 000:31:0 ("Intel 82371FB ISA" rev 0x00)
pcibios0: PCI bus #6 is the last bus
bios0: ROM list: 0xc/0x1 0xd/0x1000 0xd1000/0x1000 0xdc000/0x4000! 
0xe/0x1
cpu0 at mainbus0: (uniprocessor)
cpu0: Enhanced SpeedStep 1427 MHz: speeds: 1400, 1200, 1000, 800, 600 MHz
pci0 at mainbus0 bus 0: configuration mode 1 (bios)
io address conflict 0x5800/0x8
io address conflict 0x5808/0x4
io address conflict 0x5810/0x8
io address conflict 0x580c/0x4
pchb0 at pci0 dev 0 function 0 "Intel 82855PM Host" rev 0x03
intelagp0 at pchb0
agp0 at intelagp0: aperture at 0xd000, size 0x1000
ppb0 at pci0 dev 1 function 0 "Intel 82855PM AGP" rev 0x03
pci1 at ppb0 bus 1
vga1 at pci1 dev 0 function 0 "ATI Radeon Mobility M6" rev 0x00
wsdisplay0 at vga1 mux 1: console (80x25, vt100 emulation)
wsdisplay0: screen 1-5 added (80x25, vt100 emulation)
radeondrm0 at vga1: irq 11
drm0 at radeondrm0
uhci0 at pci0 dev 29 function 0 "Intel 82801DB USB" rev 0x01: irq 11
uhci1 at pci0 dev 29 function 1 "Intel 82801DB USB" rev 0x01: irq 11
uhci2 at pci0 dev 29 function 2 "Intel 82801DB USB" rev 0x01: irq 11
ehci0 at pci0 dev 29 function 7 "Intel 82801DB USB" rev 0x01: irq 11
usb0 at ehci0: USB revision 2.0
uhub0 at usb0 "Intel EHCI root hub" rev 2.00/1.00 addr 1
ppb1 at pci0 dev 30 function 0 "Intel 82801BAM Hub-to-PCI" rev 0x81
pci2 at ppb1 bus 2
mem address conflict 0xb000/0x1000
mem address conflict 0xb100/0x1000
cbb0 at pci2 dev 0 function 0 "Ricoh 5C476 CardBus" rev 0xaa: irq 11
cbb1 at pci2 dev 0 function 1 "Ricoh 5C476 CardBus" rev 0xaa: irq 11
"Ricoh 5C552 Firewire" rev 0x02 at pci2 dev 0 function 2 not configured
iwi0 at pci2 dev 2 function 0 "Intel PRO/Wireless 2200BG" rev 0x05: irq 11, 
address 00:0e:35:70:5b:95
fxp0 at pci2 dev 8 function 0 "Intel PRO/100 VE" rev 0x81, i82562: irq 11, 
address 00:09:6b:bf:c6:63
inphy0 at fxp0 phy 1: i82562ET 10/100 PHY, rev. 0
cardslot0 at cbb0 slot 0 flags 0
cardbus0 at cardslot0: bus 3 device 0 cacheline 0x0, lattimer 0xb0
pcmcia0 at cardslot0
cardslot1 at cbb1 slot 1 flags 0
cardbus1 at cardslot1: bus 6 device 0 cacheline 0x0, lattimer 0xb0
pcmcia1 at cardslot1
ichpcib0 at pci0 dev 31 function 0 "Intel 82801DBM LPC" rev 0x01: 24-bit timer 
at 3579545Hz
pciide0 at pci0 dev 31 function 1 "Intel 82801DBM IDE" rev 0x01: DMA, channel 0 
configured to compatibility, channel 1 configured to compatibility
wd0 at pciide0 channel 0 drive 0: 
wd0: 16-sector PIO, LBA48, 76319MB, 156301488 sectors
wd0(pciide0:0:0): using PIO mode 4, Ultra-DMA mode 5
pciide0: channel 1 disabled (no drives)
ichiic0 at pci0 dev 31 function 3 "Intel 82801DB SMBus" rev 0x01: irq 11
iic0 at ichiic0
spdmem0 at iic0 addr 0x50: 256MB DDR SDRAM non-parity PC2700CL2.5
spdmem1 at iic0 addr 0x51: 512MB DDR SDRAM non-parity PC2700CL2.5
auich0 at pci0 dev 31 function 5 "Intel 82801DB AC97" rev 0x01: irq 11, ICH4 
AC97
ac97: codec id 0x41445374 (Analog Devices AD1981B)
ac97: codec features headphone, 20 bit DAC, No 3D Stereo
audio0 at auich0
"Intel 82801DB Modem" rev 0x01 at pci0 dev 31 function 6 not configured
usb1 at uhci0: USB revision 1.0
uhub1 at usb1 "Intel UHCI root hub" rev 1.00/1.00 addr 1
usb2 at uhci1: USB revision 1.0
uhub2 at usb2 "Intel UHCI root hub" rev 1.00/1.00 addr 1
usb3 at uhci2: USB revision 1.0
uhub3 at usb3 "Intel UHCI root hub" rev 1.00/1.00 addr 1
isa0 at ichpcib0
isadma0 at isa0
pckbc0 at isa0 port 0x60/5
pckbd0 at pckbc0 (kbd slot)
pckbc0: using irq 1 for kbd slot
wskbd0 at pckbd0: console keyboard, usin

Re: pf support

[Johan Linnér]

Joachim Schipper skrev 2010-08-26 14:00:

On Thu, Aug 26, 2010 at 01:26:25PM +0200, Johan Linnir wrote:

We need help/support with setting up a couple of pf firewalls with
carp etc. and are of course willing to pay for it if we find the
right resource. Please reply off list if you're interested or can
recommend a company/person whom you think can help us.


I presume you are aware of http://www.openbsd.org/support.html? There
are two listings in Sweden, some developers, etc.

Joachim



Yep. The Swedish listing seems a little outdated.
And references are always nice.

/Johan

Re: cdce0: too many errors, disabling

[Alvaro Mantilla Gimenez]

Also, I forgot to tell:

 The laptop is running OpenBSD 4.7

 Regards,

  Alvaro

Alvaro Mantilla Gimenez wrote:
> Hi,
> 
>  I have a laptop connected to the Internet trough a cable modem plugged
> in to a usb port (cdce). For some unknown reason I receive in the logs
> this message:
> 
>cdce0: usb error on rx: IOERROR
>cdce0: usb error on tx: IOERROR
>cdce0: too many errors, disabling
> 
>  After that the internet connection goes down and the only way to go
> back to normal is rebooting the laptop (not the cable modem).
> 
>  I tried to down the device with ifconfig and then go back to up. Does
> not work.
> 
>  Is there any way to enable the cdce device again from ksh? Why is this
> happening?
> 
>  Regards,
> 
>  Alvaro

cdce0: too many errors, disabling

[Alvaro Mantilla Gimenez]

Hi,

 I have a laptop connected to the Internet trough a cable modem plugged
in to a usb port (cdce). For some unknown reason I receive in the logs
this message:

   cdce0: usb error on rx: IOERROR
   cdce0: usb error on tx: IOERROR
   cdce0: too many errors, disabling

 After that the internet connection goes down and the only way to go
back to normal is rebooting the laptop (not the cable modem).

 I tried to down the device with ifconfig and then go back to up. Does
not work.

 Is there any way to enable the cdce device again from ksh? Why is this
happening?

 Regards,

 Alvaro

Re: pf support

[Joachim Schipper]

On Thu, Aug 26, 2010 at 01:26:25PM +0200, Johan Linnir wrote:
> We need help/support with setting up a couple of pf firewalls with
> carp etc. and are of course willing to pay for it if we find the
> right resource. Please reply off list if you're interested or can
> recommend a company/person whom you think can help us.

I presume you are aware of http://www.openbsd.org/support.html? There
are two listings in Sweden, some developers, etc.

Joachim

-- 
TFMotD: genassym.sh (8) - emit an assym.h file

Re: pf support

[Johan Linnér]

alastair.john...@trinity.ox.ac.uk skrev 2010-08-26 13:38:

You might get further if you said where you are in the world..




-Original Message-
From: owner-m...@openbsd.org [mailto:owner-m...@openbsd.org] On Behalf Of Johan 
Linnir
Sent: 26 August 2010 12:26
To: misc@openbsd.org
Subject: pf support

Hi,

We need help/support with setting up a couple of pf firewalls with carp etc. 
and are of course willing to pay for it if we find the right
resource. Please reply off list if you're interested or can recommend a 
company/person whom you think can help us.

Thanks

Johan Linnir




Man, I am not that alert today.
We're located in Sweden and can install and set up the servers for 
remote admin...


/Johan

Re: pf support

[Johan Linnér]

Johan Linnir skrev 2010-08-26 13:26:

Hi,

We need help/support with setting up a couple of pf firewalls with carp
etc. and are of course willing to pay for it if we find the right
resource. Please reply off list if you're interested or can recommend a
company/person whom you think can help us.

Thanks

Johan Linnir



Sorry about the line length.
Thunderbird 3.1.2 seems to ignore the 72 chars setting.

pf support

[Johan Linnér]

Hi,

We need help/support with setting up a couple of pf firewalls with carp 
etc. and are of course willing to pay for it if we find the right 
resource. Please reply off list if you're interested or can recommend a 
company/person whom you think can help us.


Thanks

Johan Linnir

Re: Checking Routes/Gateways For Good Connection

[Pete Vickers]

On 26. aug. 2010, at 00.18, Don Tek wrote:

> I've recently implemented a firewall with two internet connections using
multipath routing and round-robin outbound load balancing.
>
> I am looking for a solution from the shell to detect failure of these two
internet gateways so I can force routing and pf changes from a script.
>
> I need something more robust than simply checking to see if the interface is
up or down.
>
> I have managed a solution using traceroute that allows me to accomplish half
of my goal.  I can detect a failure and "down" that route, however, once I
delete the default route from the routing table for the failed connection, I
can no longer test it with traceroute.  This is because it doesn't appear to
me that OpenBSD's traceroute allows forcing an interface to work on.
>
> I am looking for better solutions from some of you more experienced users.
Any suggestions are welcome.
>
> don..
>


Taking a look at the bigger picture, the 'correct' way to do this is to have
redundancy at the firewall level as well at ISP link level. This gives higher
availability, and makes your problem much easier. If you have a single ISP
link per firewall then link testing is simple. Redundancy/LB is then managed
by CARP between the two firewalls' _inside_ interfaces.

/Pete

Re: cardbus on sparc64

[Pete Vickers]

Ok, here you go ( hurra for machines with serial consoles :-)


ok boot -s
Boot device: /p...@1f,0/i...@d/d...@0,0  File and args: -s
OpenBSD IEEE 1275 Bootblock 1.3
..>> OpenBSD BOOT 1.3
Trying bsd...
Booting /p...@1f,0/i...@d/d...@0,0:a/bsd
6372...@0x100+616@0x1613d98+190...@0x180+4004176@0x182e6b0
symbols @ 0xfef5e2c0 81+390912+244649 start=0x100
[ using 636360 bytes of bsd ELF symbol table ]
console is /p...@1f,0/i...@7/ser...@0,3f8
Copyright (c) 1982, 1986, 1989, 1991, 1993
The Regents of the University of California.  All rights reserved.
Copyright (c) 1995-2010 OpenBSD. All rights reserved.  http://www.OpenBSD.org

OpenBSD 4.7 (GENERIC) #258: Wed Mar 17 23:40:34 MDT 2010
dera...@sparc64.openbsd.org:/usr/src/sys/arch/sparc64/compile/GENERIC
real mem = 805306368 (768MB)
avail mem = 768499712 (732MB)
mainbus0 at root: Sun Blade 100 (UltraSPARC-IIe)
cpu0 at mainbus0: SUNW,UltraSPARC-IIe (rev 1.4) @ 502 MHz
cpu0: physical 16K instruction (32 b/l), 16K data (32 b/l), 256K external (64
b/l)
psycho0 at mainbus0: pci108e,a001, impl 0, version 0, ign 7c0
psycho0: bus range 0-1, PCI bus 0
psycho0: dvma map c000-dfff
pci0 at psycho0
ebus0 at pci0 dev 12 function 0 "Sun RIO EBus" rev 0x01
"flashprom" at ebus0 addr 0-f not configured
clock1 at ebus0 addr 0-1fff: mk48t59
ebus1 at pci0 dev 7 function 0 "Acer Labs M1533 ISA" rev 0x00
"dma" at ebus1 addr 0- ivec 0x2a not configured
power0 at ebus1 addr 800-82f ivec 0x20
com0 at ebus1 addr 3f8-3ff ivec 0x2b: ns16550a, 16 byte fifo
com0: console
com1 at ebus1 addr 2e8-2ef ivec 0x2b: ns16550a, 16 byte fifo
gem0 at pci0 dev 12 function 1 "Sun ERI Ether" rev 0x01: ivec 0x7c6, address
00:03:ba:08:46:e8
ukphy0 at gem0 phy 1: Generic IEEE 802.3u media interface, rev. 1: OUI
0x0010dd, model 0x0002
"Sun FireWire" rev 0x01 at pci0 dev 12 function 2 not configured
ohci0 at pci0 dev 12 function 3 "Sun USB" rev 0x01: ivec 0x7e4, version 1.0,
legacy support
alipm0 at pci0 dev 3 function 0 "Acer Labs M7101 Power" rev 0x00: 223KHz
clock
iic0 at alipm0
"max1617" at alipm0 addr 0x18 skipped due to alipm0 bugs
"scm001" at alipm0 addr 0x20 skipped due to alipm0 bugs
spdmem0 at iic0 addr 0x50: 256MB SDRAM ECC PC133CL2
spdmem1 at iic0 addr 0x51: 256MB SDRAM ECC PC133CL2
spdmem2 at iic0 addr 0x52: 256MB SDRAM ECC PC133CL2
autri0 at pci0 dev 8 function 0 "Acer Labs M5451 Audio" rev 0x01: ivec 0x7e3
ac97: codec id 0x41445348 (Analog Devices AD1881A)
ac97: codec features headphone, Analog Devices Phat Stereo
audio0 at autri0
midi0 at autri0: <4DWAVE MIDI UART>
pciide0 at pci0 dev 13 function 0 "Acer Labs M5229 UDMA IDE" rev 0xc3: DMA,
channel 0 configured to native-PCI, channel 1 configured to native-PCI
pciide0: using ivec 0x7cc for native-PCI interrupt
wd0 at pciide0 channel 0 drive 0: 
wd0: 16-sector PIO, LBA, 9541MB, 19541088 sectors
atapiscsi0 at pciide0 channel 0 drive 1
scsibus0 at atapiscsi0: 2 targets
cd0 at scsibus0 targ 0 lun 0:  ATAPI 5/cdrom
removable
wd0(pciide0:0:0): using PIO mode 4, Ultra-DMA mode 2
cd0(pciide0:0:1): using PIO mode 4, Ultra-DMA mode 4
pciide0: channel 1 disabled (no drives)
ppb0 at pci0 dev 5 function 0 "DEC 21152 PCI-PCI" rev 0x03
pci1 at ppb0 bus 1
ral0 at pci1 dev 1 function 0 "Ralink RT2560" rev 0x01: ivec 0x7ca, address
00:11:50:a8:c8:a2
ral0: MAC/BBP RT2560 (rev 0x04), RF RT2525
cbb0 at pci1 dev 2 function 0 "Ricoh 5C475 CardBus" rev 0x80: ivec 0x7d5
cardslot0 at cbb0 slot 0 flags 0
cardbus0 at cardslot0: bus 2 device 0 cacheline 0x0, lattimer 0x20
pcmcia0 at cardslot0
machfb0 at pci0 dev 19 function 0 "ATI Rage XL" rev 0x27
machfb0: ATY,RageXL, 1280x1024
wsdisplay0 at machfb0 mux 1
wsdisplay0: screen 0 added (std, sun emulation)
usb0 at ohci0: USB revision 1.0
uhub0 at usb0 "Sun OHCI root hub" rev 1.00/1.00 addr 1
vscsi0 at root
scsibus1 at vscsi0: 256 targets
softraid0 at root
bootpath: /p...@1f,0/i...@d,0/d...@0,0
root on wd0a swap on wd0b dump on wd0b
WARNING: clock gained 2 days -- CHECK AND RESET THE DATE!
Enter pathname of shell or RETURN for sh:
#

# pcidump -v -xx 1:2:0
 1:2:0: Ricoh 5C475 CardBus
0x: Vendor ID: 1180 Product ID: 0475
0x0004: Command: 0047 Status ID: 0210
0x0008: Class: 06 Subclass: 07 Interface: 00 Revision: 80
0x000c: BIST: 00 Header Type: 02 Latency Timer: 40 Cache Line Size:
00
0x0010: Cardbus Control Registers Base Address: 03002000
0x0018: Primary Bus: 0 Cardbus Bus: 2 Subordinate Bus: 0
Cardbus Latency Timer: 20
0x001c: Memory Base 0: f000
0x0020: Memory Limit 0: 
0x0024: Memory Base 1: f000
0x0028: Memory Limit 1: 
0x002c: I/O Base 0: fffc
0x0030: I/O Limit 0: 
0x0034: I/O Base 1: fffc
0x0038: I/O Limit 1: 
0x003c: Interrupt Pin: 01 Line: 00 Bridge Control: 07c0
0x0040: Subsystem Vendor ID: 14ef Product ID: 0101
0x0044: 16-bit Legacy Mode Base Address: 0001
0x00dc: Capab