- WLUG - wlug.mailman3.com

REMINDER!! Meeting TONIGHT! March 12th, 2015!

by Tim Keller

Hey Everybody, This is a reminder that tonight is WLUG! We'll be talking about the Raspberry Pi like devices that are now on the market and the amazing stuff we can do with them. Chuck is going to bring along a Pi like device to show off how open hardware helps speed along the innovation curve! We'll be meeting in the usual spot, the Mid-Century Room (rm-331) at 7pm. I'll bring along snacks and drinks and afterwards we'll go out for pizza! See ya there! Later, Tim. -- I am leery of the allegiances of any politician who refers to their constituents as "consumers".

March 12, 2015

March Meeting Reminder!!!! Thursday March 12th 2015 at 7pm in the Mid Century Room (rm 331)

by Tim Keller

Hey Everybody! This Thursday (March 12th) we've got our monthly WLUG meeting! Same bat time, same bat channel! This month we're going to be talking about the Raspberry Pi. It's come along way since the "A" model has come out! Also because the Pi is open lots of compatible Pi like devices have come on the market as well. Chuck has offered to show off his ODROID-C1 <http://www.hardkernel.com/main/products/prdt_info.php> I'll bring along my Pi and the GPIO stuff. If you've got a Pi, bring it along and we can talk shop and swap ideas! Per our standard convention I'll bring along the soda and chips and afterwards we'll continue to conversation while stuffing ourselves with Tech Pizza. Later, Tim. -- I am leery of the allegiances of any politician who refers to their constituents as "consumers".

March 10, 2015

Re: [Wlug] Meeting reminder! Next Meeting Thursday March 12th 2015!!!

by Tim Keller

That would be awesome! I can bring along my pi and my automatic Christmas waterer as well, so people can see what the gpio stuff looks like. Sent from my iPad > On Mar 2, 2015, at 7:30 PM, Chuck Anderson <cra(a)WPI.EDU> wrote: > > I could bring my ODROID-C1 in, which is similar to Raspberry Pi 2, but > with some extra features. We might even have a Raspberry Pi 2 to > bring in to compare with. > > I just upgraded my FreeNAS and loaded the newest Logitech Media Server > onto it. I've been reading about how you can run LMS, SqueezeBox > emulator clients, and AirPlay-compatible servers on RPi, ODROID, etc. > Perhaps I could demo something along those lines. LMS + SqueezeLite > allows you to create a whole-house synchronized audio system with > multiple listening points over Wi-Fi or ethernet (or each client can > stream different things). > >> On Mon, Mar 02, 2015 at 05:36:40PM -0500, Tim Keller wrote: >> Hey Everybody! >> >> The next WLUG meeting is Thursday March 12th at 7pm in the mid century room >> (rm 331)! As of right now, I don't have a speaker lined up! >> >> If anybody has an ache to present something, have at it. Otherwise, we >> could do an open discussion meeting since we haven't had one of those in a >> while. >> >> I know in the past there's been some serious interest in what can be done >> with a raspberry pi. >> >> Like always they'll be refreshments and snacks followed by an egregious >> consumption of pizza. >> >> Thanks, >> Tim. > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug

March 3, 2015

Re: [Wlug] Meeting reminder! Next Meeting Thursday March 12th 2015!!!

by JeffA Maillists

I just got a Raspberry Pi 2 in a few days ago... I haven't had time to tinker with it yet. ;-) Jeff On Mon, Mar 2, 2015 at 7:30 PM, Chuck Anderson <cra(a)wpi.edu> wrote: > I could bring my ODROID-C1 in, which is similar to Raspberry Pi 2, but > with some extra features. We might even have a Raspberry Pi 2 to > bring in to compare with. > > I just upgraded my FreeNAS and loaded the newest Logitech Media Server > onto it. I've been reading about how you can run LMS, SqueezeBox > emulator clients, and AirPlay-compatible servers on RPi, ODROID, etc. > Perhaps I could demo something along those lines. LMS + SqueezeLite > allows you to create a whole-house synchronized audio system with > multiple listening points over Wi-Fi or ethernet (or each client can > stream different things). > > On Mon, Mar 02, 2015 at 05:36:40PM -0500, Tim Keller wrote: > > Hey Everybody! > > > > The next WLUG meeting is Thursday March 12th at 7pm in the mid century > room > > (rm 331)! As of right now, I don't have a speaker lined up! > > > > If anybody has an ache to present something, have at it. Otherwise, we > > could do an open discussion meeting since we haven't had one of those in > a > > while. > > > > I know in the past there's been some serious interest in what can be done > > with a raspberry pi. > > > > Like always they'll be refreshments and snacks followed by an egregious > > consumption of pizza. > > > > Thanks, > > Tim. > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug >

March 3, 2015

Re: [Wlug] Meeting reminder! Next Meeting Thursday March 12th 2015!!!

by Chuck Anderson

I could bring my ODROID-C1 in, which is similar to Raspberry Pi 2, but with some extra features. We might even have a Raspberry Pi 2 to bring in to compare with. I just upgraded my FreeNAS and loaded the newest Logitech Media Server onto it. I've been reading about how you can run LMS, SqueezeBox emulator clients, and AirPlay-compatible servers on RPi, ODROID, etc. Perhaps I could demo something along those lines. LMS + SqueezeLite allows you to create a whole-house synchronized audio system with multiple listening points over Wi-Fi or ethernet (or each client can stream different things). On Mon, Mar 02, 2015 at 05:36:40PM -0500, Tim Keller wrote: > Hey Everybody! > > The next WLUG meeting is Thursday March 12th at 7pm in the mid century room > (rm 331)! As of right now, I don't have a speaker lined up! > > If anybody has an ache to present something, have at it. Otherwise, we > could do an open discussion meeting since we haven't had one of those in a > while. > > I know in the past there's been some serious interest in what can be done > with a raspberry pi. > > Like always they'll be refreshments and snacks followed by an egregious > consumption of pizza. > > Thanks, > Tim.

March 3, 2015

Meeting reminder! Next Meeting Thursday March 12th 2015!!!

by Tim Keller

Hey Everybody! The next WLUG meeting is Thursday March 12th at 7pm in the mid century room (rm 331)! As of right now, I don't have a speaker lined up! If anybody has an ache to present something, have at it. Otherwise, we could do an open discussion meeting since we haven't had one of those in a while. I know in the past there's been some serious interest in what can be done with a raspberry pi. Like always they'll be refreshments and snacks followed by an egregious consumption of pizza. Thanks, Tim. -- I am leery of the allegiances of any politician who refers to their constituents as "consumers".

March 2, 2015

Linux kernel/driver contract in RI

by John Spencer

We have a client with a 6+ month contract opening for a Linux expert in RI, south of Providence. Linux internals Device Driver Development Extensive experience with Linux Kernel Architecture development and configuration including Linux OS System Kernel Programming Board Support Package experience Ability to configure, build and release cross platform Linux tool chains. Please contact me directly via email or phone (below) for more details. Regards, John Spencer Connected Systems Partners Office: (978) 455-5550 x208 Cell: (978) 621-9743 jspencer(a)connectedsp.com<mailto:jspencer@connectedsp.com> www.connectedsp.com<http://www.connectedsp.com/> GET CONNECTED! All information in this email, unless indicated otherwise in the body of the email, is considered confidential and intended for the view and use of the recipient(s) only.

Feb. 26, 2015

Re: [Wlug] Speech recognition software

by Randall Mason

Sphinx is the gold standard open source part that people plug into other systems. You can read about Firefox integrating it here: https://hacks.mozilla.org/2014/09/enabling-voice-input-into-the-open-web-an… And a module that is compiled to JavaScript: http://syl22-00.github.io/pocketsphinx.js/live-demo.html They work best with a limited vocabulary, but both are offline. If you are willing to send your days to Google, chromium can be set up with an API key that will send everything to your nearest Google server. Somebody has a not so bad library here: https://www.talater.com/annyang/ It actually uses the same web standard API as the one that should land in Firefox soon, when that above bug is resolved. On Feb 21, 2015 3:06 PM, "Andy Stewart" <andystewart(a)comcast.net> wrote: > > HI everybody, > > Do any of you have experience or recommendations with any Free Software > that does speech recognition? > > Thanks, > > Andy > > -- > Andy Stewart (KB1OIQ) > Founder: Worcester Linux Users' Group > Founder: Chelmsford Linux Meetup Group > President: PART of Westford, MA (WB1GOF) > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug >

Feb. 21, 2015

Re: [Wlug] Speech recognition software

by Andy Stewart

On 02/21/2015 09:40 AM, David Glaser wrote: > Hi Andy, > > What sort of requirements do you have. > > Does the voice recognition system need to be locally resident or can the > "recognition" part be sent off to a server. This determines the local > resource requirements. For local processing you need lots of memory and > a ghz processor. Remote recognition leaves you at the whim of the > service - think samsung tv or google's data collection. > > What sort of response times do you need? That is, how many seconds > between uttering the voice and receiving a response. > > Do you need single word recognition, phrase recognition or whole > sentence recognition? > > -David > > On 02/21/2015 08:05 AM, Andy Stewart wrote: >> HI everybody, >> >> Do any of you have experience or recommendations with any Free Software >> that does speech recognition? >> >> Thanks, >> >> Andy Hi David, I'm asking for my sister, who is asking for a friend. I'm going to guess (until I get more information), that this is a speech-to-text application that is needed. Andy -- Andy Stewart (KB1OIQ) Founder: Worcester Linux Users' Group Founder: Chelmsford Linux Meetup Group President: PART of Westford, MA (WB1GOF)

Feb. 21, 2015

Re: [Wlug] Speech recognition software

by David Glaser

Hi Andy, What sort of requirements do you have. Does the voice recognition system need to be locally resident or can the "recognition" part be sent off to a server. This determines the local resource requirements. For local processing you need lots of memory and a ghz processor. Remote recognition leaves you at the whim of the service - think samsung tv or google's data collection. What sort of response times do you need? That is, how many seconds between uttering the voice and receiving a response. Do you need single word recognition, phrase recognition or whole sentence recognition? -David On 02/21/2015 08:05 AM, Andy Stewart wrote: > HI everybody, > > Do any of you have experience or recommendations with any Free Software > that does speech recognition? > > Thanks, > > Andy >

Feb. 21, 2015

Speech recognition software

by Andy Stewart

HI everybody, Do any of you have experience or recommendations with any Free Software that does speech recognition? Thanks, Andy -- Andy Stewart (KB1OIQ) Founder: Worcester Linux Users' Group Founder: Chelmsford Linux Meetup Group President: PART of Westford, MA (WB1GOF)

Feb. 21, 2015

Pile o Hardware for sale (some free)

by Pete Wason

Hi, I have a pile of Dell desktops and servers for sale. And a bunch of other stuff. Some for free as it is either very old or misbehaving in some way. (6) Precision 690 workstations, some missing memory and/or drives, all functional. multi-RAID, multi-monitor. Giant 90lb. boxes, all metal. (4) PowerEdge R300 1U rackmount servers, some missing memory and/or (SAS) drives, all functional. (3) PowerEdge SC1420 tower servers, one has a RAID5 SCSI array, all functional. (2) XPS GEN 4/5 workstations (gaming boxes from early '00s), w/ RAID1. Working. A few Optiplex 740s, some working, some not. 2.9Ghz Athlon II 64 CPUs. Most need memory. PowerEdge SC600, needs new fan and PS. Pentiam 2.4Ghz. PowerEdge 2400, monster of a case, 8? SCSI drives in 2 arrays, dual PIII CPUs, makes an excellent bench+space heater. A few older Dell desktops like a Dim 4550, Dim 5100, Opti 280GX, etc. Working. Miscellaneous used HDs, D-Dock docking stations w/ removable HD modules, video cables, video cards, et al. Broken 6-tape DDS4 autochanger, some new 20/40GB tapes 4-5 monitors which may be fixable; Samsung 20" 4/3 Cavalier 2-bay external RAID box, working w/ (2) 500GB drives G-RAID 5-bay hot-swap enclosure, gutted, (was thinking about turning it into a mini-PC or a SCSI-tower for my Amiga :) Other stuff.. No warranties, obviously. Caveat emptor, blah blah blah blah, yada yada.. If interested I can send you specs directly. Nothing individually priced higher than $375. Volume (or tonnage) discounts are available. Please reply to: pwason(a)clarku.edu -- Pete Wason * Hy Noom Publications * 5088655414 * codevark(a)aim.com * codevark "Aborigine left speechless by steady disappearance of native dialects." -- The Onion

Feb. 17, 2015

Re: [Wlug] Wireless mesh network question

by Randall Mason

Every access point on the same channel (as well as every client) shares bandwidth. If all of the networking is happening on channel one, with two clients, you would end up with 1/6 the bandwidth. The problem isn't interference, it's making a 6 lane highway a two lane road. If you use distinct, but overlapping channels, you end up with radio level interference, so not shared bandwidth, but lots of retransmits when both are active. The best case is using the non overlapping channels which allows you full bandwidth and very low interference. So I would have your backbone on some far channel from your clients, or your chatty mesh protocol will slow the normal clients to a crawl. You could even use the three distinct channels so that one is backbone and the other two are not overlapping where the two circles fall in the same territory. On Feb 16, 2015 7:00 PM, "Andy Stewart" <andystewart(a)comcast.net> wrote: > > HI gang, > > I setup an experiment with all of the wifi access on one channel. WiCD > saw both access points with the same SSID and wifi channel. Connecting > to either of them seems to have no ill effects. > > Andy > > -- > Andy Stewart (KB1OIQ) > Founder: Worcester Linux Users' Group > Founder: Chelmsford Linux Meetup Group > President: PART of Westford, MA (WB1GOF) > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug >

Feb. 16, 2015

Re: [Wlug] Wireless mesh network question

by Michael Limanni

75 degrees! On 2/16/2015 11:59 AM, Andy Stewart wrote: > HI gang, > > I setup an experiment with all of the wifi access on one channel. WiCD > saw both access points with the same SSID and wifi channel. Connecting > to either of them seems to have no ill effects. > > Andy >

Feb. 16, 2015

Re: [Wlug] Wireless mesh network question

by Frank Sweetser

As long as all of the APs are on either matching or non-overlapping channels, you should be fine. In practice, this means you'll get the best overall throughput by evenly distributing them across channels 1, 6, and 11. You *might* be able to get away with channel 14 (this is outside of the normal part 15 regs, but you can probably legally get away with it since you're licensed), but you may have strange results if you're trying to have standard wifi clients connecting to them, as some of them are set up only for US options and won't look at that channel at all. Frank Sweetser fs at wpi.edu | For every problem, there is a solution that Manager of Network Operations | is simple, elegant, and wrong. Worcester Polytechnic Institute | - HL Mencken On 02/16/2015 11:39 AM, Andy Stewart wrote: > > HI guys, > > I am planning to setup a wireless mesh network at a ham radio event in June. > > Each mesh node will consist of two Linksys WRT54GLs, much like the demo > I showed at a recent WLUG meeting. > > One of the WRT54GLs will be on channel 6 and carry mesh network traffic. > The other one will be on channel 1 and allow generic wifi devices > access to the mesh network. > > It seems like there would be an interference problem if every node > allowed wifi access on channel 1. Should this be 4 different wifi > channels? It is possible for a user to be within radio range of > multiple of them simultaneously. > > Thoughts? I've never setup a wireless network before and could use your > advice. These mesh nodes will be placed outside in weatherproof > enclosures with battery power. > > Thanks! > > Andy >

Feb. 16, 2015

Re: [Wlug] Wireless mesh network question

by Andy Stewart

HI gang, I setup an experiment with all of the wifi access on one channel. WiCD saw both access points with the same SSID and wifi channel. Connecting to either of them seems to have no ill effects. Andy -- Andy Stewart (KB1OIQ) Founder: Worcester Linux Users' Group Founder: Chelmsford Linux Meetup Group President: PART of Westford, MA (WB1GOF)

Feb. 16, 2015

Wireless mesh network question

by Andy Stewart

HI guys, I am planning to setup a wireless mesh network at a ham radio event in June. Each mesh node will consist of two Linksys WRT54GLs, much like the demo I showed at a recent WLUG meeting. One of the WRT54GLs will be on channel 6 and carry mesh network traffic. The other one will be on channel 1 and allow generic wifi devices access to the mesh network. It seems like there would be an interference problem if every node allowed wifi access on channel 1. Should this be 4 different wifi channels? It is possible for a user to be within radio range of multiple of them simultaneously. Thoughts? I've never setup a wireless network before and could use your advice. These mesh nodes will be placed outside in weatherproof enclosures with battery power. Thanks! Andy -- Andy Stewart (KB1OIQ) Founder: Worcester Linux Users' Group Founder: Chelmsford Linux Meetup Group President: PART of Westford, MA (WB1GOF)

Feb. 16, 2015

Reminder! Meeting tomorrow! Feb. 12th 2015 at 7pm (Mid-Century Room) rm 331!

by Tim Keller

Hey Everybody, This is just a quick reminder that we're having a meeting tomorrow at 7pm in the Mid-Century Room (rm 331) in the student center. Andy is going to be giving a talk about mesh networking! Afterwards we'll do pizza at Tech! Refreshments will be provided at the meeting as well. Later, Tim. -- I am leery of the allegiances of any politician who refers to their constituents as "consumers".

Feb. 11, 2015

Re: [Wlug] sshd_config MaxStartups

by Randall Mason

Maybe it's from a time when servers had fewer resources. If your server would run out of memory with 20 concurrent attempted logins, you may want to have that set to 20, else you should end up with a bigger DOS than if you were just able to prevent ssh logins. The same would be true with bandwidth. If you were on dialup, for example, you may want to make sure that you aren't overwhelming your connection, such that if you can only support 20 concurrent real time logins, you wouldn't end up with a terrible degradation in service. Not that it's too popular to run services on your bandwidth capped 2G internet connection... Sitting at a login prompt on my ARM NAS gives me this: sshd: Virt: 11672 Res: 5280 Shared: 4584 So it seems that I'm wasting 5MB of my 256MB of memory on my NAS when somebody just hangs at the login prompt. I could fairly easily DOS my little NAS by just running `while [ 1 ]; do ssh <box> & done`, couldn't I? Are you really using more than 10 connections sitting at a login prompt? What are they being used for? Is the system powerful enough to handle many concurrent logins? I think that today you should probably have this set up with a combination of dynamic blacklists (BlockHosts or sshguard) and this option, if your server is truly needing more resources. That way all of the failed logins don't eat up your cap for too long. The nice thing about the percent number is that it gives you, as an administrator, at least some chance of logging in before the system is so overloaded that you could never get in and start killing things. It could be that because ssh is becoming more of a transport layer than just a remote tty, this option is less useful. At Github for example, most of the unauthenticated connections that github has should just be dropped quickly because nobody uses password authentication. Randall Mason clashthebunny(a)gmail.com On Wed, Feb 11, 2015 at 9:46 AM, Jamie Guinan <guinan(a)bluebutton.com> wrote: > > Hi Group! > > I'm seeking opinions about an sshd feature. > > I was doing some work on a remote system (I did not set it up) that > seemed to be refusing ssh and scp connections randomly. > > I looked into it, and finally stumbled across this from sshd_config(5), > > MaxStartups > Specifies the maximum number of concurrent unauthenticated > connections to the SSH daemon. > Additional connections will be dropped until authentication > succeeds or the LoginGraceTime > expires for a connection. The default is 10. > > Alternatively, random early drop can be enabled by specifying > the three colon separated val‐ > ues “start:rate:full” (e.g. "10:30:60"). sshd(8) will refuse > connection attempts with a > probability of “rate/100” (30%) if there are currently > “start” (10) unauthenticated connec‐ > tions. The probability increases linearly and all connection > attempts are refused if the > number of unauthenticated connections reaches “full” (60). > > Indeed, the server had this setting, > > MaxStartups 10:50:20 > > This just seems like a terrible option. You can DOS their server just > by making 20 connections and leaving them hanging. And it breaks any > automated scripts relying on ssh or scp (unless you wrap them in a > loop until they succeed, ugh). > > My guess is that the reasoning behind this feature that it will filter > out a number of automated attacks. That seems no better than > security-by-obscurity, and I know how some of you feel about that. :) > > Can you think of any sane reason to enable this feature, or for it to > even exist at all? > > Best regards, > -Jamie > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug > >

Feb. 11, 2015

sshd_config MaxStartups

by Jamie Guinan

Hi Group! I'm seeking opinions about an sshd feature. I was doing some work on a remote system (I did not set it up) that seemed to be refusing ssh and scp connections randomly. I looked into it, and finally stumbled across this from sshd_config(5), MaxStartups Specifies the maximum number of concurrent unauthenticated connections to the SSH daemon. Additional connections will be dropped until authentication succeeds or the LoginGraceTime expires for a connection. The default is 10. Alternatively, random early drop can be enabled by specifying the three colon separated val‐ ues “start:rate:full” (e.g. "10:30:60"). sshd(8) will refuse connection attempts with a probability of “rate/100” (30%) if there are currently “start” (10) unauthenticated connec‐ tions. The probability increases linearly and all connection attempts are refused if the number of unauthenticated connections reaches “full” (60). Indeed, the server had this setting, MaxStartups 10:50:20 This just seems like a terrible option. You can DOS their server just by making 20 connections and leaving them hanging. And it breaks any automated scripts relying on ssh or scp (unless you wrap them in a loop until they succeed, ugh). My guess is that the reasoning behind this feature that it will filter out a number of automated attacks. That seems no better than security-by-obscurity, and I know how some of you feel about that. :) Can you think of any sane reason to enable this feature, or for it to even exist at all? Best regards, -Jamie

Feb. 11, 2015

Re: [Wlug] linux networking question (reformatted for readability)

by Frank Sweetser

On 2/7/2015 5:14 PM, Brad wrote: > On Sat, Feb 07, 2015 at 04:40:36PM -0500, Frank Sweetser wrote: >> This is just a rough guess, but did you ever check on the state tables >> in your openbsd firewall? >> > I did not check the state tables in the OpenBSD firewall. I figured > since it had just been forcefully reboot the state tables were > coherent. It's not just a simple question of the firewall state table being internally consistent, it also has to be consistent with both the NAT gateway and what the clients are expecting. When one of your internal clients makes an outgoing connection, both the firewall and NAT tables have to have entries added to accommodate the return traffic - a translation rule in the NAT table, and an allow rule in the firewall. If either of those aren't correct, the return traffic won't make it back to the client. >> In your setup you have state distributed >> amongst your clients, your firewall, and you NAT gateway, and unless >> all three are in sync you can easily get the kind of possessed network >> behavior you describe. >> > To properly exorcize should i pour holy-water over the routers? I always > figured some king of black magic was involved in routing. Simple routing, not so much - it's just packet go in, packet go out. It's when you throw state tables in that things start to get fragile. When you have strings of disconnected state tables that require consistency like this, it's not uncommon that you end up having to always reboot them together. > Is a bridged-firewall not a good idea in practice because it adds > another layer between the internat and the intranet, and could get out > of sync? The bridged portion itself isn't inherently much worse than doing a traditional layer 3 visible firewall, so long as you have your rules set up correctly to account for things like passing ARP traffic. Your typical all-in-one box is a little less likely to display this kind of weirdness only because they're combined on a single box, so a reboot will clear both out simultaneously. I would seriously suggest you check out pfSense. It's a FreeBSD based distribution designed to operate as a SOHO class firewall, with all of the usual NAT, DHCP, and other expected goodies. I think it's a pretty safe bet that it'll be a better router and firewall than OSX... -- Frank Sweetser fs at wpi.edu | For every problem, there is a solution that Manager of Network Operations | is simple, elegant, and wrong. Worcester Polytechnic Institute | - HL Mencken

Feb. 8, 2015

Re: [Wlug] linux networking question (reformatted for readability)

by Brad

On Sat, Feb 07, 2015 at 04:40:36PM -0500, Frank Sweetser wrote: > This is just a rough guess, but did you ever check on the state tables > in your openbsd firewall? > I did not check the state tables in the OpenBSD firewall. I figured since it had just been forcefully reboot the state tables were coherent. > In your setup you have state distributed > amongst your clients, your firewall, and you NAT gateway, and unless > all three are in sync you can easily get the kind of possessed network > behavior you describe. > To properly exorcize should i pour holy-water over the routers? I always figured some king of black magic was involved in routing. Is a bridged-firewall not a good idea in practice because it adds another layer between the internat and the intranet, and could get out of sync? Thanks for the ideas, - brad > On February 7, 2015 3:20:15 PM EST, Brad <bkn(a)ithryn.net> wrote: > >(i appologize for the previous message that i completely unreadable.) > > > >Dear W-LUGgers, > > > >I had some strange network related behavior that left me baffled and i > >wanted > >to hear some theories from more experienced network admins. > > > >The network layout is the following. The network is pretty simple, > >external > >traffic passes through a bridged-firewall (OpenBSD, my choice) into an > >OS X > >server (not my choice) which handles NAT/DHCP/DNS et al., and all the > >office > >computers are dhcp clients to the OS X server. The trouble machines are > >linux > >(ubuntu) desktop clients. > > > >The scenario is the following. I was doing work on the bridged firewall > >(OpenBSD) and somehow caused it to kernel panic, oopsie! So the > >bridged-firewall went down thus no-one had internet access, Dou! i > >quickly > >bounced the machine. It came back on-line and clients were able to > >access the > >internet, huzzah! But, the strange behavior was in two linux machines > >within > >the network that were not able to access some external IPs. My linux > >desktop > >could not access 8.8.8.8, when pinging, i could see an arp who-has > >request > >originating from my machine, i could see the packet come into the OS X > >server. > >But the request always went unanswered. The same behavior happened to > >another > >linux desktop but with 192.48.178.134 (sgi.com) My desktop could ping > >sgi.com. > >So each linux desktop had *different* unreachable IPs. The rest of the > >internet > >was reachable. I tried clearing the arp-cache on the OS X server, then > >clearing > >the NAT state tables, then I rebooted the OS X server, none solved the > >problem. > >I finally renewed the dhcp lease on my linux desktop machine and that > >allowed > >the ping to complete. > > > >What would case this behavior? Could it be stale arp-cache on the linux > >machine? ( I *should* have tried to clear the arp-cache on the linux > >machine > >before i renewed the dhcp lease, but i didn’t think of that until after > >the > >fact.) The linux machine was sending out arp who-has requests so would > >a stale > >cache even matter? Why would no one answer the arp requests? I am not > >an expert > >network admin (its just a side job since the company is only 15 > >people). I > >don’t expect to get a resolution but i’m interested to hear any > >theories. > > > >Thanks and cheers, — brad > > > >PS. As a worcester transplant to boston, i am really jealous i don’t > >live > >closer to attend meetings. The topics of late sound outstanding. > > > >_______________________________________________ > >Wlug mailing list > >Wlug(a)mail.wlug.org > >http://mail.wlug.org/mailman/listinfo/wlug > > -- > Sent from my Android device with K-9 Mail. Please excuse my brevity.

Feb. 7, 2015

Re: [Wlug] linux networking question (reformatted for readability)

by Frank Sweetser

This is just a rough guess, but did you ever check on the state tables in your openbsd firewall? In your setup you have state distributed amongst your clients, your firewall, and you NAT gateway, and unless all three are in sync you can easily get the kind of possessed network behavior you describe. On February 7, 2015 3:20:15 PM EST, Brad <bkn(a)ithryn.net> wrote: >(i appologize for the previous message that i completely unreadable.) > >Dear W-LUGgers, > >I had some strange network related behavior that left me baffled and i >wanted >to hear some theories from more experienced network admins. > >The network layout is the following. The network is pretty simple, >external >traffic passes through a bridged-firewall (OpenBSD, my choice) into an >OS X >server (not my choice) which handles NAT/DHCP/DNS et al., and all the >office >computers are dhcp clients to the OS X server. The trouble machines are >linux >(ubuntu) desktop clients. > >The scenario is the following. I was doing work on the bridged firewall >(OpenBSD) and somehow caused it to kernel panic, oopsie! So the >bridged-firewall went down thus no-one had internet access, Dou! i >quickly >bounced the machine. It came back on-line and clients were able to >access the >internet, huzzah! But, the strange behavior was in two linux machines >within >the network that were not able to access some external IPs. My linux >desktop >could not access 8.8.8.8, when pinging, i could see an arp who-has >request >originating from my machine, i could see the packet come into the OS X >server. >But the request always went unanswered. The same behavior happened to >another >linux desktop but with 192.48.178.134 (sgi.com) My desktop could ping >sgi.com. >So each linux desktop had *different* unreachable IPs. The rest of the >internet >was reachable. I tried clearing the arp-cache on the OS X server, then >clearing >the NAT state tables, then I rebooted the OS X server, none solved the >problem. >I finally renewed the dhcp lease on my linux desktop machine and that >allowed >the ping to complete. > >What would case this behavior? Could it be stale arp-cache on the linux >machine? ( I *should* have tried to clear the arp-cache on the linux >machine >before i renewed the dhcp lease, but i didn’t think of that until after >the >fact.) The linux machine was sending out arp who-has requests so would >a stale >cache even matter? Why would no one answer the arp requests? I am not >an expert >network admin (its just a side job since the company is only 15 >people). I >don’t expect to get a resolution but i’m interested to hear any >theories. > >Thanks and cheers, — brad > >PS. As a worcester transplant to boston, i am really jealous i don’t >live >closer to attend meetings. The topics of late sound outstanding. > >_______________________________________________ >Wlug mailing list >Wlug(a)mail.wlug.org >http://mail.wlug.org/mailman/listinfo/wlug -- Sent from my Android device with K-9 Mail. Please excuse my brevity.

Feb. 7, 2015

linux networking question (reformatted for readability)

by Brad

(i appologize for the previous message that i completely unreadable.) Dear W-LUGgers, I had some strange network related behavior that left me baffled and i wanted to hear some theories from more experienced network admins. The network layout is the following. The network is pretty simple, external traffic passes through a bridged-firewall (OpenBSD, my choice) into an OS X server (not my choice) which handles NAT/DHCP/DNS et al., and all the office computers are dhcp clients to the OS X server. The trouble machines are linux (ubuntu) desktop clients. The scenario is the following. I was doing work on the bridged firewall (OpenBSD) and somehow caused it to kernel panic, oopsie! So the bridged-firewall went down thus no-one had internet access, Dou! i quickly bounced the machine. It came back on-line and clients were able to access the internet, huzzah! But, the strange behavior was in two linux machines within the network that were not able to access some external IPs. My linux desktop could not access 8.8.8.8, when pinging, i could see an arp who-has request originating from my machine, i could see the packet come into the OS X server. But the request always went unanswered. The same behavior happened to another linux desktop but with 192.48.178.134 (sgi.com) My desktop could ping sgi.com. So each linux desktop had *different* unreachable IPs. The rest of the internet was reachable. I tried clearing the arp-cache on the OS X server, then clearing the NAT state tables, then I rebooted the OS X server, none solved the problem. I finally renewed the dhcp lease on my linux desktop machine and that allowed the ping to complete. What would case this behavior? Could it be stale arp-cache on the linux machine? ( I *should* have tried to clear the arp-cache on the linux machine before i renewed the dhcp lease, but i didn’t think of that until after the fact.) The linux machine was sending out arp who-has requests so would a stale cache even matter? Why would no one answer the arp requests? I am not an expert network admin (its just a side job since the company is only 15 people). I don’t expect to get a resolution but i’m interested to hear any theories. Thanks and cheers, — brad PS. As a worcester transplant to boston, i am really jealous i don’t live closer to attend meetings. The topics of late sound outstanding.

Feb. 7, 2015

linux networking question.

by Brad

Feb. 7, 2015