- WLUG - wlug.mailman3.com

Re: [Wlug] iptables use of --mac-source

by John Stoffel

Frank> On Fri, Sep 01, 2006 at 10:40:25AM -0400, John Stoffel wrote: >> This will only work if you have a bridged network, once you have a >> switch in the way, the MAC address will change. This is because Frank> Nope - a switch is logically identical to a bridge with more Frank> than two ports. A packet forwarded by a router will have the Frank> routers MAC address because the router has to generate a new Frank> ethernet frame with the same ethernet payload as the original Frank> packet, while a switch will blindly forward the packet to Frank> wherever it's FDB tells it to. Details details... don't confuse me with facts! *grin* You're right of course. >> For network switches, each port has it's own MAC address. Basically, Frank> Only if the switch supports spanning tree, and only for Frank> spanning tree - those per-port MACs aren't used for anything Frank> else. Yup, that's the details I mis-remembered. Then again, who pays attention to this stuff any more? *grin* John

Sept. 2, 2006

Re: [Wlug] iptables use of --mac-source

by Frank Sweetser

On Fri, Sep 01, 2006 at 10:40:25AM -0400, John Stoffel wrote: > This will only work if you have a bridged network, once you have a > switch in the way, the MAC address will change. This is because Nope - a switch is logically identical to a bridge with more than two ports. A packet forwarded by a router will have the routers MAC address because the router has to generate a new ethernet frame with the same ethernet payload as the original packet, while a switch will blindly forward the packet to wherever it's FDB tells it to. > For network switches, each port has it's own MAC address. Basically, Only if the switch supports spanning tree, and only for spanning tree - those per-port MACs aren't used for anything else. -- Frank Sweetser fs at wpi.edu | For every problem, there is a solution that WPI Network Engineer | is simple, elegant, and wrong. - HL Mencken GPG fingerprint = 6174 1257 129E 0D21 D8D4 E8A3 8E39 29E3 E2E8 8CEC

Sept. 1, 2006

Re: [Wlug] iptables use of --mac-source

by John Stoffel

Andy> I'm playing with my firewall rules, trying to setup a rule that Andy> will recognize my laptop's mac address on an incoming Andy> connection. Andy> iptables -I INPUT -m mac --mac-source uu:vv:ww:xx:yy:zz -j LOG Andy> - --log-prefix "Laptop Detected: " This will only work if you have a bridged network, once you have a switch in the way, the MAC address will change. This is because you're looking at the low level packets, where the MAC addresses gets re-written to reflect the next hop device that the packet needs to goto to get off the local network segment. Note, this is purely a low level ethernet issue, not an IP issue. Andy> That worked fine. I saw the appropriate log entry when my Andy> laptop ping'd the firewall. The log entry showed the expected Andy> mac address of my laptop. At that time, my laptop was plugged Andy> into my home network, which is connected to the "internal" Andy> interface of my firewall. Andy> I then setup iptables to log all incoming packets from the Andy> firewall's external interface, and I noticed that in the log all Andy> incoming mac source addresses are the same. I didn't expect Andy> this. The address is 00:0b:bf:xx:xx:xx, which I think is a Andy> piece of Cisco hardware, and I don't have any Cisco hardware at Andy> home. Is this some hardware from my ISP ? Yup, it's the MAC address of the upstream ethernet device. Basically, all packets are sent to that MAC address when they go off your network. Basically, what happens is that when you try to goto a new IP address (or when a new IP address attempts to contact you), the low level ethernet stack sends out an ARP (Address Resolution Protocol) request, saying "Who has this IP?" and waiting for a response from some other device. Be-it a bridge, a switch, an actual host, or whatever. This is how the low level ethernet knows where to forward packets within it's network segment. Each hub has just a single MAC address for all it's ports. A computer should have a unique MAC address for each ethernet port, though Suns didn't do this for a long time. The idea was that you couldn't put two seperate interfaces on the same network, since it caused problems. Obviously this was also on bridged networks, not swiched ones, which are the standard today. For network switches, each port has it's own MAC address. Basically, every device on a network (low level, physical medium) has to have a unique MAC address, otherwise you run into problems. This is layer 2 stuff. Layer 1 is the physical media. TCP/IP are layers 3 and 4 respectively. Hopefully this helps. I know I've skipped some details here. John

Sept. 1, 2006

Re: [Wlug] iptables use of --mac-source

by Justin Odom

Andy, MAC Addresses work at layer 2. When a router receives a packet, it strips off the mac addresses, looks at its destination, appends its own mac addresses, and forwards out the appropriate interface. The MAC your seeing is probably your ISP's router. On 8/31/06, Andy Stewart <andystewart(a)comcast.net> wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > > HI everybody, > > I'm playing with my firewall rules, trying to setup a rule that will > recognize my laptop's mac address on an incoming connection. > > I tried this: > > iptables -I INPUT -m mac --mac-source uu:vv:ww:xx:yy:zz -j LOG > - --log-prefix "Laptop Detected: " > > That worked fine. I saw the appropriate log entry when my laptop ping'd > the firewall. The log entry showed the expected mac address of my > laptop. At that time, my laptop was plugged into my home network, which > is connected to the "internal" interface of my firewall. > > I then setup iptables to log all incoming packets from the firewall's > external interface, and I noticed that in the log all incoming mac > source addresses are the same. I didn't expect this. The address is > 00:0b:bf:xx:xx:xx, which I think is a piece of Cisco hardware, and I > don't have any Cisco hardware at home. Is this some hardware from my ISP ? > > I'm guessing somebody is rewriting the packets to replace the source mac > address, but clearly my knowledge of this is lacking, and thus I'm > confused. Any helpers? > > Thanks, > > Andy > > - -- > Andy Stewart, Founder > Worcester Linux Users' Group > Worcester, MA, USA > http://www.wlug.org > > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.2 (GNU/Linux) > Comment: Using GnuPG with SUSE - http://enigmail.mozdev.org > > iD8DBQFE95kJHl0iXDssISsRAmcUAJ4zD1PDX+TmZca7gzdmtvf7DwWgxACfUH4B > 3awkKwfmcBN7nmu/WXjsre4= > =6u9G > -----END PGP SIGNATURE----- > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug >

Sept. 1, 2006

iptables use of --mac-source

by Andy Stewart

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 HI everybody, I'm playing with my firewall rules, trying to setup a rule that will recognize my laptop's mac address on an incoming connection. I tried this: iptables -I INPUT -m mac --mac-source uu:vv:ww:xx:yy:zz -j LOG - --log-prefix "Laptop Detected: " That worked fine. I saw the appropriate log entry when my laptop ping'd the firewall. The log entry showed the expected mac address of my laptop. At that time, my laptop was plugged into my home network, which is connected to the "internal" interface of my firewall. I then setup iptables to log all incoming packets from the firewall's external interface, and I noticed that in the log all incoming mac source addresses are the same. I didn't expect this. The address is 00:0b:bf:xx:xx:xx, which I think is a piece of Cisco hardware, and I don't have any Cisco hardware at home. Is this some hardware from my ISP ? I'm guessing somebody is rewriting the packets to replace the source mac address, but clearly my knowledge of this is lacking, and thus I'm confused. Any helpers? Thanks, Andy - -- Andy Stewart, Founder Worcester Linux Users' Group Worcester, MA, USA http://www.wlug.org -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (GNU/Linux) Comment: Using GnuPG with SUSE - http://enigmail.mozdev.org iD8DBQFE95kJHl0iXDssISsRAmcUAJ4zD1PDX+TmZca7gzdmtvf7DwWgxACfUH4B 3awkKwfmcBN7nmu/WXjsre4= =6u9G -----END PGP SIGNATURE-----

Aug. 31, 2006

My memory leak problem from last week.

by ken jones

I have moved from mozilla mail and mozilla browser to thunderbird mail and firefox browser. The memory leak problem seems to have either gone away completely or greatly been reduced. Interesting... thanks for the suggestions and help. Ken Jones

Aug. 27, 2006

Re: [Wlug] ALSA - mic trouble

by Eric Stein

Jamie Guinan wrote: > Hi, > > What kind of Mic is it? Some of mine have a small battery, and an > on/off switch, which I tend to forget "on". > > Have you tried other mics? > Non-USB - the kind that just plugs into the sound card like headphones. It never had batteries or a switch. My roommate's mic doesn't work either - it's part of a headset, but doesn't require power either. >> Info: Ubuntu Breezy 5.10 >> Linux pippin 2.6.12-10-386 #1 Tue Jul 18 22:08:27 UTC 2006 i686 GNU/Linux >> >> I'm prepared to spend a good deal of time on this, but I don't know what >> I need to do. If you need more information, let me know how to get it >> and I'll be happy to share it. >> Send output of "amixer". eastein@pippin:~$ amixer Simple mixer control 'Master',0 Capabilities: pvolume pswitch pswitch-joined Playback channels: Front Left - Front Right Limits: Playback 0 - 31 Front Left: Playback 27 [87%] [on] Front Right: Playback 27 [87%] [on] Simple mixer control 'Master Mono',0 Capabilities: pvolume pvolume-joined pswitch pswitch-joined Playback channels: Mono Limits: Playback 0 - 31 Mono: Playback 0 [0%] [on] Simple mixer control 'PCM',0 Capabilities: pvolume pswitch pswitch-joined Playback channels: Front Left - Front Right Limits: Playback 0 - 31 Front Left: Playback 28 [90%] [on] Front Right: Playback 28 [90%] [on] Simple mixer control 'Surround',0 Capabilities: pvolume pswitch Playback channels: Front Left - Front Right Limits: Playback 0 - 31 Front Left: Playback 0 [0%] [on] Front Right: Playback 0 [0%] [on] Simple mixer control 'Surround Jack Mode',0 Capabilities: Mono: Simple mixer control 'Center',0 Capabilities: pvolume pvolume-joined pswitch pswitch-joined Playback channels: Mono Limits: Playback 0 - 31 Mono: Playback 27 [87%] [on] Simple mixer control 'LFE',0 Capabilities: pvolume pvolume-joined pswitch pswitch-joined Playback channels: Mono Limits: Playback 0 - 31 Mono: Playback 0 [0%] [on] Simple mixer control 'Line',0 Capabilities: pvolume pswitch pswitch-joined cswitch cswitch-joined cswitch-exclusive Capture exclusive group: 0 Playback channels: Front Left - Front Right Capture channels: Front Left - Front Right Limits: Playback 0 - 31 Front Left: Playback 27 [87%] [off] Capture [off] Front Right: Playback 27 [87%] [off] Capture [off] Simple mixer control 'CD',0 Capabilities: pvolume pswitch pswitch-joined cswitch cswitch-joined cswitch-exclusive Capture exclusive group: 0 Playback channels: Front Left - Front Right Capture channels: Front Left - Front Right Limits: Playback 0 - 31 Front Left: Playback 27 [87%] [on] Capture [off] Front Right: Playback 27 [87%] [on] Capture [off] Simple mixer control 'Mic',0 Capabilities: pvolume pvolume-joined pswitch pswitch-joined cswitch cswitch-joined cswitch-exclusive Capture exclusive group: 0 Playback channels: Mono Capture channels: Front Left - Front Right Limits: Playback 0 - 31 Mono: Playback 27 [87%] [off] Front Left: Capture [on] Front Right: Capture [on] Simple mixer control 'Mic Boost (+20dB)',0 Capabilities: pswitch pswitch-joined Playback channels: Mono Mono: Playback [on] Simple mixer control 'Mic Select',0 Capabilities: Mono: Simple mixer control 'Video',0 Capabilities: cswitch cswitch-joined cswitch-exclusive Capture exclusive group: 0 Capture channels: Front Left - Front Right Front Left: Capture [off] Front Right: Capture [off] Simple mixer control 'Phone',0 Capabilities: pvolume pvolume-joined pswitch pswitch-joined cswitch cswitch-joined cswitch-exclusive Capture exclusive group: 0 Playback channels: Mono Capture channels: Front Left - Front Right Limits: Playback 0 - 31 Mono: Playback 27 [87%] [off] Front Left: Capture [off] Front Right: Capture [off] Simple mixer control 'IEC958',0 Capabilities: pswitch pswitch-joined cswitch cswitch-joined Playback channels: Mono Capture channels: Mono Mono: Playback [on] Capture [on] Simple mixer control 'IEC958 Playback AC97-SPSA',0 Capabilities: volume volume-joined Playback channels: Mono Limits: 0 - 3 Mono: 3 [100%] Simple mixer control 'PC Speaker',0 Capabilities: pvolume pvolume-joined pswitch pswitch-joined Playback channels: Mono Limits: Playback 0 - 15 Mono: Playback 15 [100%] [on] Simple mixer control 'Aux',0 Capabilities: pvolume pswitch pswitch-joined cswitch cswitch-joined cswitch-exclusive Capture exclusive group: 0 Playback channels: Front Left - Front Right Capture channels: Front Left - Front Right Limits: Playback 0 - 31 Front Left: Playback 27 [87%] [off] Capture [off] Front Right: Playback 27 [87%] [off] Capture [off] Simple mixer control 'Mono Output Select',0 Capabilities: Mono: Simple mixer control 'Capture',0 Capabilities: cvolume cswitch cswitch-joined Capture channels: Front Left - Front Right Limits: Capture 0 - 15 Front Left: Capture 13 [87%] [off] Front Right: Capture 13 [87%] [off] Simple mixer control 'Mix',0 Capabilities: cswitch cswitch-joined cswitch-exclusive Capture exclusive group: 0 Capture channels: Front Left - Front Right Front Left: Capture [off] Front Right: Capture [off] Simple mixer control 'Mix Mono',0 Capabilities: cswitch cswitch-joined cswitch-exclusive Capture exclusive group: 0 Capture channels: Front Left - Front Right Front Left: Capture [off] Front Right: Capture [off] Simple mixer control 'Channel Mode',0 Capabilities: Mono: Simple mixer control 'Duplicate Front',0 Capabilities: pswitch pswitch-joined Playback channels: Mono Mono: Playback [off] Simple mixer control 'External Amplifier',0 Capabilities: pswitch pswitch-joined Playback channels: Mono Mono: Playback [off] eastein@pippin:~$ > Also, what kind of sound chip/card? Onboard? Add-in PCI? eastein@pippin:~$ lspci|grep audio 0000:00:06.0 Multimedia audio controller: nVidia Corporation nForce2 AC97 Audio Controler (MCP) (rev a1) eastein@pippin:~$ I hope this is enough to tip you off as to what's wrong... Eric

Aug. 26, 2006

Re: [Wlug] ALSA - mic trouble

by Jamie Guinan

On Fri, 25 Aug 2006, Eric Stein wrote: > Hi, > > When I first set up my Ubuntu machine, everything worked fine. But for > the last few months (I don't remember exactly how long), my mic has > refused to work. Nothing I use can pick up any signal from it. I've > tried all the mixers (alsamixer, kmix, the built in GNOME mixer), and > none of them show the mic as muted. Is there a way to reset ALSA's > volumes and other mixer settings to defaults? I can't seem to find > information about this online, and this lack of a fully working sound > system has me on the end of my rope. Hi, What kind of Mic is it? Some of mine have a small battery, and an on/off switch, which I tend to forget "on". Have you tried other mics? > Info: Ubuntu Breezy 5.10 > Linux pippin 2.6.12-10-386 #1 Tue Jul 18 22:08:27 UTC 2006 i686 GNU/Linux > > I'm prepared to spend a good deal of time on this, but I don't know what > I need to do. If you need more information, let me know how to get it > and I'll be happy to share it. Send output of "amixer". Also, what kind of sound chip/card? Onboard? Add-in PCI? -Jamie > Eric

Aug. 26, 2006

ALSA - mic trouble

by Eric Stein

Hi, When I first set up my Ubuntu machine, everything worked fine. But for the last few months (I don't remember exactly how long), my mic has refused to work. Nothing I use can pick up any signal from it. I've tried all the mixers (alsamixer, kmix, the built in GNOME mixer), and none of them show the mic as muted. Is there a way to reset ALSA's volumes and other mixer settings to defaults? I can't seem to find information about this online, and this lack of a fully working sound system has me on the end of my rope. Info: Ubuntu Breezy 5.10 Linux pippin 2.6.12-10-386 #1 Tue Jul 18 22:08:27 UTC 2006 i686 GNU/Linux I'm prepared to spend a good deal of time on this, but I don't know what I need to do. If you need more information, let me know how to get it and I'll be happy to share it. Eric

Aug. 25, 2006

My memory leak problem.

by ken jones

Everyone: It is hard to believe that X is the problem. It came with Fedora 4 and no one else seems to be reporting it as a bug. I have another Fedora 4 machine that does not display this swap space problem. Karl's idea of looking carefully at my drivers is a good one. This machine has more than one special driver. It is late now. I am tired. I shall pursue this track tomorrow or Friday. If anyone else is interested in the cut and paste of ps auxw lspci uname -a lsmod vmstat dmesg tell me. I will send you a copy. Thank you all:-) Ken Jones Thank you.

Aug. 23, 2006