Re: Problem with new source address selection

2008-11-27 Thread Frank Behrens
Bjoern A. Zeeb <[EMAIL PROTECTED]> wrote on 27 Nov 2008 16:47: > > Now I want to tunnel between my 192.168.90.0/24 and a foreign > > 192.168.200.0/24. So I assigned 192.168.90.254/32 to lo2 and created > > a static route. > > So if you don't mind to go out with a source address of 192.168.90.1 > i

Re: if_bridge + pf rdr (bridged inline proxy)

2008-11-27 Thread Kevin Foo
Thank Eygene for the reply. It might be but I'm not sure. Anyone is having the same setting or any info on this? -- Regards Kevin Foo On Thu, Nov 27, 2008 at 10:00 PM, Eygene Ryabinkin <[EMAIL PROTECTED]> wrote: > Kevin, good day. > > Thu, Nov 27, 2008 at 08:26:55PM +0800, Kevin Foo wrote: >> I

Re: IFCAP_LRO on FreeBSD 7

2008-11-27 Thread Jack Vogel
On Thu, Nov 27, 2008 at 4:51 AM, Robert Watson <[EMAIL PROTECTED]> wrote: > > On Thu, 27 Nov 2008, Yony Yossef wrote: > > Is there a native interface for LRO in FreeBSD 7? I can't find any use for >> IFCAP_LRO but notifying the driver if to use or not to use this offload. >> >> If not, is it plan

Re: Problem with new source address selection

2008-11-27 Thread Frank Behrens
Bjoern A. Zeeb <[EMAIL PROTECTED]> wrote on 27 Nov 2008 16:47: > I am running out the door but ... will check again tonight. Thanks! > So if you don't mind to go out with a source address of 192.168.90.1 > instead of .254, what about this hack. What happens if you change the > route to > ro

Re: Problem with new source address selection

2008-11-27 Thread Bjoern A. Zeeb
On Thu, 27 Nov 2008, Frank Behrens wrote: Hi, I am running out the door but ... will check again tonight. Bjoern A. Zeeb <[EMAIL PROTECTED]> wrote on 27 Nov 2008 14:53: [gif-like ipsec and routes] routes are not alternatives for fixing applications;) Often it's easier to apply a hack inste

Re: Problem with new source address selection

2008-11-27 Thread Frank Behrens
Bjoern, thanks for your fast answer. Bjoern A. Zeeb <[EMAIL PROTECTED]> wrote on 27 Nov 2008 14:53: > Yes I know that hack though I never actually used it with a loopback > as the loopback case is *uhm* gross. You know you are telling the > kernel to actually send the packets to yourself which so

Re: Problem with new source address selection (was Anyone interested in jail patches?)

2008-11-27 Thread Bjoern A. Zeeb
On Thu, 27 Nov 2008, Frank Behrens wrote: 2b) for RELENG_7: http://people.freebsd.org/~bz/bz_jail7-20081126-02-at153644.diff With this patch I received a new source selection implementation, I believe the same as announced for HEAD. Here I found a problem. HEAD has had it since beginning

Problem with new source address selection (was Anyone interested in jail patches?)

2008-11-27 Thread Frank Behrens
Bjoern A. Zeeb <[EMAIL PROTECTED]> wrote on 26 Nov 2008 23:56: > If you are interested in a new set of jail patches... anyone?;-) Yes, but about jail specific things I'll write later, in another mail and on another list. > 2b) for RELENG_7: > http://people.freebsd.org/~bz/bz_jail7-20081126-0

FreeBSD Window updates

2008-11-27 Thread David Malone
I was looking at some tcpdumps from a FreeBSD box receiving a TCP stream with someone yesterday and noticed that it seemed to be generating quite a lot of dupliacte acks. Looking more carefully, we noticed that the duplicates were actually window updates. The code for sending window updates can be

Re: if_bridge + pf rdr (bridged inline proxy)

2008-11-27 Thread Eygene Ryabinkin
Kevin, good day. Thu, Nov 27, 2008 at 08:26:55PM +0800, Kevin Foo wrote: > I recently setup a bridge box with inline cache proxy. if_bridge with > pf filtering was working perfectly. However, squid-cache listening on > loopback device did not get any packets from pf rdr. I have seen > successful s

Re: nmap on FreeBSD 7.0-RELEASE

2008-11-27 Thread Eygene Ryabinkin
Dave, good day. Thu, Nov 27, 2008 at 10:28:10PM +1030, Dave Edwards wrote: > I've tried creating a host route for the nmap target instead of relying > on the default route and I've tried three other versions of nmap. As an > aside (or maybe a hint) when compiling nmap from source, there are a > n

if_bridge + pf rdr (bridged inline proxy)

2008-11-27 Thread Kevin Foo
Hi list, I recently setup a bridge box with inline cache proxy. if_bridge with pf filtering was working perfectly. However, squid-cache listening on loopback device did not get any packets from pf rdr. I have seen successful setups with OpenBSD's bridge spamd which rather a similar setup. Is somet

Re: IFCAP_LRO on FreeBSD 7

2008-11-27 Thread Robert Watson
On Thu, 27 Nov 2008, Yony Yossef wrote: Is there a native interface for LRO in FreeBSD 7? I can't find any use for IFCAP_LRO but notifying the driver if to use or not to use this offload. If not, is it planned for FreeBSD 8? IFCAP_LRO is a capability/policy flag allowing drivers to declare

IFCAP_LRO on FreeBSD 7

2008-11-27 Thread Yony Yossef
Hi All, Is there a native interface for LRO in FreeBSD 7? I can't find any use for IFCAP_LRO but notifying the driver if to use or not to use this offload. If not, is it planned for FreeBSD 8? Thanks Yony ___ freebsd-net@freebsd.org mailing list http:

nmap on FreeBSD 7.0-RELEASE

2008-11-27 Thread Dave Edwards
Hi, I'm having some problems with nmap over the tun device. I connect to the net using ppp and pppoe (adsl) which creates the "tun0" device. My default route goes out that way. Using nmap to try to map an external host: - # nmap -vvv -e tun0 -sS -p80,443 1.2.3.4 Startin

Re: TSO on VLAN interface, FreeBSD 7

2008-11-27 Thread Gergely CZUCZY
And an other question. For now, if these options are manually set for the derived interfaces, will that work? On Thu, 27 Nov 2008 11:28:05 +0100 Ivan Voras <[EMAIL PROTECTED]> wrote: > Gergely CZUCZY wrote: > > Hello, > > > > I'd be also pretty interested in this one. And also, the question > >

Re: TSO on VLAN interface, FreeBSD 7

2008-11-27 Thread Ivan Voras
Gergely CZUCZY wrote: > Hello, > > I'd be also pretty interested in this one. And also, the question > arises me for the very same issue, for LACP interfaces, and > VLAN-over-LACP interfaces (lagg(4) as LACP). > Having a gateway requires performances, and it often also means having > VLANs, and LA

Re: bin/129218: [ipsec]: freebsd6.2 kernel cannot support ipsec "-E null -A hmac-sha1", FreeBSD7.0 kernel cannot support -A aes-xcbc-mac

2008-11-27 Thread remko
Synopsis: [ipsec]: freebsd6.2 kernel cannot support ipsec "-E null -A hmac-sha1", FreeBSD7.0 kernel cannot support -A aes-xcbc-mac State-Changed-From-To: open->closed State-Changed-By: remko State-Changed-When: Thu Nov 27 09:55:17 UTC 2008 State-Changed-Why: Close per request of the submitter. t

Re: i386/129218: freebsd6.2 kernel cannot support ipsec "-E null -A hmac-sha1", FreeBSD7.0 kernel cannot support -A aes-xcbc-mac

2008-11-27 Thread wang_jiabo
The following reply was made to PR bin/129218; it has been noted by GNATS. From: wang_jiabo <[EMAIL PROTECTED]> To: [EMAIL PROTECTED], [EMAIL PROTECTED] Cc: Subject: Re: i386/129218: freebsd6.2 kernel cannot support ipsec "-E null -A hmac-sha1", FreeBSD7.0 kernel cannot support -A aes-xcbc-mac

Re: TSO on VLAN interface, FreeBSD 7

2008-11-27 Thread Gergely CZUCZY
Hello, I'd be also pretty interested in this one. And also, the question arises me for the very same issue, for LACP interfaces, and VLAN-over-LACP interfaces (lagg(4) as LACP). Having a gateway requires performances, and it often also means having VLANs, and LACP for failure tolerance. So I think