• networking

networking

• IEEE Standards

Subpages

Trouble Shooting

In non-deterministic cases you may resort to
IETF RFC 2321 - RITA -- The Reliable Internetwork Troubleshooting Agent

Equipment

Serial adapter RS232

US232R-10-BULK

• https://ftdichip.com/products/us232r-10-bulk/

• US232R-10-BULK datasheet

I really like this device, with its little leds, that signal transmission.

• Die RS232-/V.24-Schnittstelle

Management cable for RS232

A light blue Cisco "management cable" RJ-45 to DB-9/D-Sub

RS232 voltage is different from UART

• high +15V
• low -15

UART to USB adapter

Wiki En - Universal asynchronous receiver-transmitter

Use cases

• Unbrick devices via booting over UART.
• Configure bootloaders.
• Flash routers with OpenWRT to get free open source devices (access points, …).
• Connect to IoT devices (log and shell).

Possible chipsets

• WCH (in full WinChipHead) CH350G (Nanjing Qinheng Microelectronics Co., Ltd)

  • http://www.wch-ic.com/products/category/1.html

  • CH340DS1.PDF

  • 50bps to 2Mbps
  • 12MHz clock
  • compatible to 3.3V and 5V
• FTDI FT232 RL (Future Technology Devices International Limited)

  • FT232RL

  • DS_FT232R.pdf

  • 300baud to 3Mbaud
  • 48MHz clock (multiplied from 12MHz)
  • compatible to 1.8V up to 5.25V
  • FTDIgate?!
• Silicon Labs CP2102

  • USB to UART Bridge

  • CP2102.pdf

  • 300bps to 1Mbps
  • 48 MHz clock
  • compatible to 3.3V (5V devices will probably still recognize 3.3V)
• Prolific PL2303

  • Prolific USB to Serial/UART/RS232/Printer

  • Prolific PL2303GS USB to Serial Bridge Controller

  • PL2303GS product brochure 20190125.pdf

  • 1bps to 12Mbps
  • compatible to 3.3V and 5V
  • 96 MHz clock

SPI/I2C/JTAG adapter

USB 2.0 Hi-Speed to MPSSE cable (Multi-Protocol Synchronous Serial Engine)

• DS_C232HM_MPSSE_CABLE.pdf

• C232HM-EDHSL-0

  • 5V

• C232HM-DDHSL-0

  • 3.3V

RJ-45 repair clips

Give a cable a second life! :-D

Network Byte Order

• Wiki EN Endianess

• The GNU C Library Reference Manual - 16.6.5 Byte Order Conversion

The network byte order is Big Endian (most Network Protocols, Motorola, IBM Mainframes like System/360|370 and ESA/390 and z/Architecture). The most significant BYTE (MSB) is stored at the lowes address or sent first (Big Startian).

Examples:

• ISO long date YYYY-MM-DD or

• ordinary english numbers 1234 "one thousand two hundred and thiry four".

In opposite Little Endian (most Processor architectures, Intel, RS-232). The least significant BYTE (MSB) is stored at the lowes address or sent first (Little Startian).

Examples:

• German long date DD.MM.YYYY or

• German number lower than 100 like 21 "einundzwanzig"

0x12345678 on a big endian 32bit machine is
0x78563412 on a little endian 32bit machine and vice versa.

Linux device names

The length of device names, aliases and alternative interface names is defined in
github torvalds/linux master include/uapi/linux/if.h

   1 #if __UAPI_DEF_IF_IFNAMSIZ
   2 #define IFNAMSIZ        16
   3 #endif /* __UAPI_DEF_IF_IFNAMSIZ */
   4 #define IFALIASZ        256
   5 #define ALTIFNAMSIZ     128
   6 #include <linux/hdlc/ioctl.h>
   7 

Predictable device names

• www.freedesktop.org: PredictableNetworkInterfaceNames

• access.redhat.com: Understanding the predictable network interface device names

Let's predict some names.

Bus:Device.Function (BDF)

lspci |grep -i eth

   1 00:1f.6 Ethernet controller: Intel Corporation Ethernet Connection (2) I219-LM

PCI-address 00:1f.6

BUS: 0
Device/Slot: 31 = 1*16¹ + 15*16⁰
Function: 6

So the interface name is:
enp0s31f6 = "en" + "p" + "0" + s + "31" + "f" + "6"

lspci |grep -i eth

   1 07:00.0 Ethernet controller: Intel Corporation I210 Gigabit Network Connection (rev 03)

PCI-address 07:00.0

BUS: 7
Device/Slot: 0 = 0*16⁰
Function: 0

So the interface name is:
enp0s31f6 = "en" + "p" + "7" + s + "0" + "f" + "0"

Models OSI and TCP/IP

Physical Layer

Definitions and abbreviations

SFD

Start Frame Delimiter

10101011 LSB 213 0xD5

Occurs after 7 octets of preamble

provide byte-level synchronization

Immeadiately followed by the Ethernet Frame specifically the destination MAC

Wiki EN Preamble and start frame delimiter

Preamble

56-bit (seven-bytes/octets) pattern of alternating 1 and 0 bits

provides bit-level synchronization

10101010 LSB 85 0x55

Full preamble with Start Frame Delimiter
10101010 10101010 10101010 10101010 10101010 10101010 10101011

Wiki EN Preamble and start frame delimiter

MII

media independent interface

more specifically MII, GMII, RGMII, SGMII, XGMII

Interface between MAC (chip) and PHY (chip)

Wiki EN Media-independent interface

PHY

PHYsical (layer) transceiver (circuitry)

Wiki EN Ethernet physical transceiver

Provides analog signal physical access to the link

Data Link

Logical Link Control (LLC)

• Wiki EN Logical Link Control

• L2 sublayer
• provides flow control and multiplexing for the logical link

Medium Access Control (MAC)

• Medium access control

• L2 sublayer
• provides flow control and multiplexing for the transmission medium

Address Resolution Protocol (ARP)

• Wiki EN Address Resolution Protocol

• IETF RFC826 An Ethernet Address Resolution Protocol

• IETF RFC5227 IPv4 Address Conflict Detection

• IETF RFC5494 IANA Allocation Guidelines for the Address Resolution Protocol (ARP)

The Address Resolution Protocol (ARP) is a communication protocol used for discovering the link layer address, such as a MAC address, associated with a given internet layer address, typically an IPv4 address. This mapping is a critical function in the Internet protocol suite. ARP was defined in 1982 by RFC 826, which is Internet Standard STD 37.

Show ARP

Display ARP table sorted (especially useful on BSD machines)

   1 LANG=C arp -a \
   2         |sed -r -e 's/^([[:alnum:].?-]+) +\(([0-9.]+)\)/\2 \1/' \
   3                 -e 's/ at / /' \
   4                 -e 's/ on / /' \
   5                 -e 's/ (expires in|permanent ).*//' \
   6         |sort -V \
   7         |column -t

Alternatively

   1 arp -a |sort -k 2V|column -t

MAC addresses

• IANA Ethernet Numbers

• IETF RFC7042 IANA Considerations and IETF Protocol and Documentation Usage for IEEE 802 Parameters #EUI-48 Assignments under the IANA OUI

• IETF RFC5798 Virtual Router Redundancy Protocol (VRRP) Version 3 for IPv4 and IPv6 #Virtual Router MAC Address

• IANA IEEE 802 Numbers

  • IANA ETHER TYPES

  • IANA ORGANIZATIONALLY UNIQUE IDENTIFIERS

  • Logical Link Control (LLC) Numbers

  • IANA Link Layer Discovery Protocol (LLDP) TLV Subtypes

48bit MAC addresses, now called EUI-48 (Extended Unique Identifier 48), consist of 6 octets. The first 3 octets are called Organizationally Unique Identifier (OUI) and the second 3 octets are called the (Network Interface Controller (NIC) specific) manufacturer-selected extension identifier. The least significant bits of the first octet of the OUI, signal Unicast (0) / Multicast(1) and globally unique (OUI enforced) (0) / locally administered (1).

Local database

   1 aptitude install ieee-data

   1 /usr/share/ieee-data/iab.csv
   2 /usr/share/ieee-data/iab.txt
   3 /usr/share/ieee-data/mam.csv
   4 /usr/share/ieee-data/mam.txt
   5 /usr/share/ieee-data/oui.csv
   6 /usr/share/ieee-data/oui.txt ### <-- MAC-ADRESSESS
   7 /usr/share/ieee-data/oui36.csv
   8 /usr/share/ieee-data/oui36.txt
   9 
  10 /usr/share/nmap/nmap-mac-prefixes

Neighbor Discovery Protocol (NDP)

• Wiki EN Neighbor Discovery Protocol

• IETF RFC4861 Neighbor Discovery for IP version 6 (IPv6)

Spanning Tree Protocol

Algorhyme

Radia Perlman penned this poem while she developed Spanning Tree.

I think that I shall never see
A graph more lovely than a tree.
A tree whose crucial property
Is loop-free connectivity.
A tree that must be sure to span
So packets can reach every LAN.
First, the root must be selected.
By ID, it is elected.
Least-cost paths from root are traced.
In the tree, these paths are placed.
A mesh is made by folks like me,
Then bridges find a spanning tree.

--
Radia Perlman 

STP

• Wiki EN Spanning Tree Protocol

• IEEE 802.1D-2004 - IEEE Standard for Local and metropolitan area networks: Media Access Control (MAC) Bridges

Standards

• IEEE 802.1d-1990 - STP
• IEEE 802.1w-2003 - RSTP
  • later IEEE 802.1D-2004
• IEEE 802.1s-2003 - MSTP
  • later IEEE 802.1Q-2014

Bridge-ID (BID) is 8 Byte long (2 Byte bridge priority, 6 Byte MAC address).

Bridge Priority

is basically a 4bit number and locally assigned system ID extension (12 bits)

has only 16 values,

p * 2¹², where 0 ≤ p ≤ 2⁴

Root Bridge

of the spanning tree is the bridge with the smallest (lowest) bridge ID.

There can only be one root bridge in a spanning tree.

When initializing the protocol all bridges send out BPDUs, with themselves as root bridge.

After convergence only the root bridge generates BPDUs. Other devices only forward BPDUs.

Has no root port.

All the ports on the root bridge are designated ports

Designated Bridge

Has exactly one root port

Device responsible to forwards frames to a LAN segment

Bridge Protocol Data Units (BPDUs)

• are sent
  • from the unique source MAC-address of a switch port

  • to STP destination multicast MAC-address 01:80:C2:00:00:00 or 01:00:0C:CC:CC:CD in case of Cisco Per VLAN Spanning Tree (PVST)

• 2 types
  • Configuration BPDU
  • Topology Change Notification (TCN) BPDU

Port states (4)

Blocking

BPDUs are received and processed

Frames are not forwarded

This port would cause a topology loop

May transit to forwarding state on failure of another link

Listening

BPDUs are received and processed

Frames are not forwarded

MAC table is not populated

May return to blocking

Learning

BPDUs are received and processed

Frames are not forwarded

MAC table is populated

May return to blocking

Forwarding

BPDUs are received and processed

Frames are forwarded

May return to blocking

Disabled

Not strictly part of STP

Manually disabled switch port

Blocking -> Listening -> Learning -> Forwarding

Port roles (2)

Root

A forwarding port that is the best port from non-root bridge to root bridge

Port on which a device received the optimum configuration BPDU.

Designated

A forwarding port for every LAN segment

Disabled

Not strictly part of STP, a network administrator can manually disable a port

Timers

• Hello-Timer Default: 2s
• Forward-Delay Default: 15s (1x Listening, 1x Learning)
• Maximum Age Default: 20s

The root bridge sets the timer values and distributes these in Configuration BPDUs.

When a new device is attached it takes 2x Forward-Delay timers (default: 30s) to transit to the state Forwarding.

Path cost

• calculated on bandwidth
  • The lower bandwidth, the higher cost
    • with STP originally 1Gbit/s devided by bandwidth
    • with RSTP 20Tbit/s devided by bandwidth
• admin can influence the path cost
• path cost to the root bridge add up along the path (across the switches)
• if there are multiple upstream/designated bridges with equal cost to the root bridge, the lower sender bridge-id wins
• if there are multiple designated ports (no lag) to an upstream/designated bridges with equal cost to the root bridge, the lower designated port-id wins
  • Port ID = priority (4 bits) + ID (Interface number) (12 bits)
    • the default port priority is 128.
    • may be influenced by the admin
• if this still has equal costs finally the local lowest Port ID wins

Rapid STP

• Standard IEEE 802.1D-2004 incorporates RSTP and obsoletes the original STP standard
• Backwards-compatible with standard STP
• Significantly faster convergence by introduction of new behaviours and new port roles
  • usually responds to changes within 3 Hello times
• Handshake between switches to determine if a rapid transition to the forwarding state is possible
  1. RTSP bridges propagate their superior root bridge information to their designated ports
  2. Receiving bridges
     1. sets all other ports to discarding.
     2. responds to this BPDUs with an BPDU with the agreement flag set.
  3. Sending Bridge now knows, that it can transition directly to forwarding state, bypassing listening state.
• Allows configuration and autodetection of edge ports, which directly transition to forwarding. Edge-ports transition to non-edge ports, when BPDUs are detected.

Port roles

Root

A forwarding port that is the best port from non-root bridge to root bridge

Designated

A forwarding port for every LAN segment

Alternate

An alternate path to the root bridge.

This path is different from using the root port.

Backup

A backup/redundant path to a segment where another bridge port already connects

Disabled

Not strictly part of STP, a network administrator can manually disable a port

port states (3)

Discarding

BPDUs are received and processed

Frames are not forwarded

This port would cause a topology loop

May transit to forwarding state on failure of another link

Learning

BPDUs are received and processed

Frames are not forwarded

MAC table is populated

May return to blocking

Forwarding

BPDUs are received and processed

Frames are forwarded

May return to blocking

Disabled

Not strictly part of STP

manually disabled switch port

Timers

• Hello-Timer Default: 2s
• Forward-Delay Default: 15s (1x Listening, 1x Learning)
• Maximum Age Default: 3x Hello-Timer (6s)

Per-VLAN-Spanning Tree

• Cisco proprietary
  • Limited support across switch vendors
  • Compatibility issues between
    • PVSTP(+) vendor implementations
    • compatible protocols like VLAN Spanning Tree Protocol (VSTP)
• bridge system ID extension carries VLAN ID
• Based on simple STP
• One Spanning Tree instance per VLAN
  • Adds significat overhead
  • Consumes CPU-time on the networking device
• VLAN encapsulation
  • PVSTP uses Inter-Switch Link (ISL)
  • PVSTP+ uses IEEE 802.1q
• PVST+ can tunnel across an MSTP region.
• Rapid PVSTP(+) (RPVSTP(+)) is based on RSTP instead.

Multiple STP

• Compatible to RSTP and thus to STP.
• Bridge system ID extension carries the MSTP instance number
• Allows usage of multiple Multiple spanning tree instances (MSTI)
• Allows mapping multiple VLANs to a MSTI (based on mapping-tables)
  • Allow load-sharing across links that otherwise would be blocked
  • Reduces number of instances in comparision to PVSTP+
• A switched network may be devided into multiple regions, with independant spanning trees.
Common Spanning Tree (CST)

connects all MST regions in a switched network

Internal Spanning Tree (IST)

runs in an MST region

also named MSTI 0, a special MSTI to which all VLANs are mapped by default

Common and Internal Spanning Tree (CIST)

connects all devices in a switched network

consists of the ISTs in all MST regions and the CST

Regional root

of the IST or a and MSTI within an MST region

different MSTIs in a MST region may have different regional root bridges

Common root bridge

root bridge of the CIST

Port roles (6)

Root port

forwards data to the root bridge

Designated port

forwards data to the designated bridge for a downstream network segment or device

Boundary port

port that connects a MST region to

another MST region or

a network-segment running STP, or RSTP

Master port

root port (of a region) on the CIST to the common root bridge

Alternate port

Backup port for a root port and master port

Does not forward frames

Takes over when the root port or master port has failed

Starts forwarding without delay

Backup port

Backup port of a designated port

Starts forwarding without delay

Disabled port

admin down in every MSTI

A port may have different roles in different MSTIs.

Port states (3)

• Discarding
• Learning
• Forwarding

A port may have different states in different MSTIs.

Notes

Never use simple old STP.

Hold-down time (50s) is not reconcilable with high-availability.

If STP is in default configuration (with bridge-priority 32768) the election is based on the mac address. The root bridge bridge may be located in a inefficient position, e.g. far away from the router. If a STP-protocol is used in a network, it must be planned and configured carefully!

Different implementations of a standard are not guaranteed to work, due for example to differences in default timer settings.

Try to use (multi-chassis) link-aggregations ((MC)-LAGs) where possible, to avoid blocking redundant ports and enhance bandwidth.

Make sure to configure BPDU-guard to protect your network from malicious bridges.

Edge-ports should be used

• to allow fast transition of terminal devices.
• in conjunction with BPDU-guard.

You may use a BPDU-filter to discard BPDUs from adjacent switching infrastructures, when it's clear that a loop can never be established.

Use loop detection on the edge to the network.

VLANs

• IEEE 802.1Q

• IEEE 802.1ad

  • stacked VLANs, QinQ or double tagging

  • Double tagging

Native VLAN

Native VLAN

Frames of the native VLAN are not tagged on a trunk.

Frames that arrive untagged on a trunk are put into the native VLAN.

Native VLAN is usually by default VLAN 1, but can be changed on a trunk-base.

On access ports the native VLAN loses its meaning.

Some vendors these also refer to native VLANs as primary VLANs. This maybe the case, when native VLAN is never mentioned. This term unfortunately is ambibuous. So please do not mix ut up with the primary VLAN of a private VLAN infrastructure (with secondary isolated, community VLANs and promiscuous, isolated and community ports like on Cisco devices). That's a different concept.

Network

First-hop redundancy protocols (FHRP)

• Wikipedia EN - First-hop redundancy protocol

Protocols: CARP, VRRP, HSRP, GLBP, ESRP, R-SMLT, NSRP

FHRP pitfalls

Many switches (like D-Link DGS-series switches (e.g. DGS-1210-16 Rev. A1, Netgear MS510TXM and probably this list is exhausting) seam to fail ARP in combination with CARP/VRRP gateways in default configuration.

In such cases the default gateway cannot be resolved to a MAC-address and routing fails generally. ARP resolution within the same network may still work and can be used to connect to and manage the device. This may be diagnosed using telnet and the command debug info (D-Link). The MAC of the CARP/VRRP address is only in the MAC-forwarding table, but missing in the host arp-table (mgmtVlan).

# WIP - exact feature has to be determined

Requirements to switches for using FHRP
https://docs.netgate.com/pfsense/en/latest/highavailability/index.html#switch-layer-2-concernsSwitch/docs.netgate.com - High Availability Layer 2 Concerns

Trouble Shooting

One hack that worked for IPMI interfaces. IPMI#LAN

Common Address Redundancy Protocol (CARP)

CARP is a secure, free alternative to the Virtual Router Redundancy Protocol (VRRP) and the Hot Standby Router Protocol (HSRP).

CARP allows multiple hosts on the same local network to share a set of IP addresses. Its primary purpose is to ensure that these addresses are always available, but in some configurations carp can also provide load balancing functionality.

Alternatives: CARP, VRRP, HSRP, GLBP, ESRP, R-SMLT, NSRP

• Wiki EN Common Address Redundancy Protocol

• docs.netgate.com - High Availability

• docs.opnsense.org - High Availability

• openbsd.org - PF - Firewall Redundancy (CARP and pfsync)

Please also see ARP as it is closely related
#Address Resolution Protocol (ARP)

CARP numbers

VRRP and CARP use the same IANA number assignments.

Please see
#VRRP numbers

CARP sniffing

CARP Sniffing

   1 tcpdump -nepi igb0 -T carp carp
   2 16:05:05.024541 00:00:5e:00:01:01 > 01:00:5e:00:00:12, ethertype IPv4 (0x0800), length 70: 192.168.255.21 > 224.0.0.18: CARPv2-advertise 36: vhid=1 advbase=1 advskew=0 authlen=7 counter=14868393346680216794
   3 16:05:06.041066 00:00:5e:00:01:01 > 01:00:5e:00:00:12, ethertype IPv4 (0x0800), length 70: 192.168.255.21 > 224.0.0.18: CARPv2-advertise 36: vhid=1 advbase=1 advskew=0 authlen=7 counter=14868393346680216795
   4 16:05:07.056317 00:00:5e:00:01:01 > 01:00:5e:00:00:12, ethertype IPv4 (0x0800), length 70: 192.168.255.21 > 224.0.0.18: CARPv2-advertise 36: vhid=1 advbase=1 advskew=0 authlen=7 counter=14868393346680216796
   5 16:05:08.056781 00:00:5e:00:01:01 > 01:00:5e:00:00:12, ethertype IPv4 (0x0800), length 70: 192.168.255.21 > 224.0.0.18: CARPv2-advertise 36: vhid=1 advbase=1 advskew=0 authlen=7 counter=14868393346680216797

This is a typical ARP resolution for CARP addresses. You can see VRID = 0x01 (hex) in the last byte of the source MAC address. tcpdump -nepi igb0 arp

   1 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
   2 listening on igb0, link-type EN10MB (Ethernet), capture size 262144 bytes
   3 18:37:10.376202 bc:2e:48:02:bf:bc > 00:00:5e:00:01:01, ethertype ARP (0x0806), length 60: Request who-has 192.168.255.20 tell 192.168.255.1, length 46
   4 18:37:10.376214 3c:ec:ef:ce:22:32 > bc:2e:48:02:bf:bc, ethertype ARP (0x0806), length 42: Reply 192.168.255.20 is-at 00:00:5e:00:01:01, length 28
   5 18:37:42.118744 bc:2e:48:02:bf:bc > 00:00:5e:00:01:01, ethertype ARP (0x0806), length 60: Request who-has 192.168.255.20 tell 192.168.255.1, length 46
   6 18:37:42.118751 3c:ec:ef:ce:22:32 > bc:2e:48:02:bf:bc, ethertype ARP (0x0806), length 42: Reply 192.168.255.20 is-at 00:00:5e:00:01:01, length 28

In the end the MAC address is never changed. But the frames may come in on another port of a switch, which may yield some trouble. The switch may filter it.

Virtual Router Redundancy Protocol (VRRP)

• Wikipedia EN - First-hop redundancy protocol

• Wikipedia EN - Virtual Router Redundancy Protocol

• IETF RFC2338 Virtual Router Redundancy Protocol

• IETF RFC3768 Virtual Router Redundancy Protocol (VRRP)

• IETF RFC5798 Virtual Router Redundancy Protocol (VRRP) Version 3 for IPv4 and IPv6

• github.com topic vrrp

Alternatives: CARP, VRRP, HSRP, GLBP, ESRP, R-SMLT, NSRP

VRRP is using Cisco patents. All patents have expired in the mean time.

Implementation levels:

• frrouting.org implements VRRP3 RFC5798 (recommended)

• keepalived.org implements VRRP2 RFC2338

• sourceforge.net vrrpd implements VRRP2 RFC2338

VRRP numbers

VRRP and CARP use the same IANA number assignments.

VRRP was assigned IPv4 multicast address 224.0.0.18 and IPv6 multicast address ff02::12.

• IANA - IPv4 Multicast Address Space Registry

The OUI 00-00-5E has been assigned to IANA.
This includes 2**24 EUI-48 multicast identifiers 01-00-5E.

• IETF RFC7042 - IANA Considerations and IETF Protocol and Documentation Usage for IEEE 802 Parameters Section 2.1.1. EUI-48 Assignments under the IANA OUI

• IANA Ethernet Numbers

IANA Unicast 48-bit MAC Addresses

…

IANA Multicast 48-bit MAC Addresses

…

The 23 lower order bits of a multicast ip address are mapped to the respective bits of the MAC-multicast-address.

• IETF RFC1112 - Host Extensions for IP Multicasting - Section 6.4 Extensions to an Ethernet Local Network Module

So the VRRP
IPv4 Multicast MAC address is 01:00:5e:00:00:12
IPv6 Multicast MAC address is 33:33:00:00:00:12.

So the VRRP Unicast MAC address is

• IETF RFC5798 - Virtual Router Redundancy Protocol (VRRP) Version 3 for IPv4 and IPv6 - Virtual Router MAC Address

  • IPv4 case: 00-00-5E-00-01-{VRID}  (in hex, in Internet-standard bit- order) The first three octets are derived from the IANA's Organizational Unique Identifier (OUI). The next two octets (00-01) indicate the address block assigned to the VRRP for IPv4 protocol. {VRID} is the VRRP Virtual Router Identifier. This mapping provides for up to 255 IPv4 VRRP routers on a network.

    IPv6 case: 00-00-5E-00-02-{VRID}  (in hex, in Internet-standard bit- order)

VRRPD

• sourceforge.net vrrpd implements RFC2338

  • Development has moved to

    github.com fredbcode/Vrrpd

    • This repository has been archived by the owner on Apr 14, 2023. It is now read-only.

So, the project is probably dead, the latest version in Debian is old as the hills and fails communicating with netlink.

IMHO: Don't use it.

However …

Install

   1 apt install vrrpd

This installed version 1.0-2+b2 of the package on Debian 11 (Bookworm).

vrrpd is a very minimal package with just the binary, some docs and the man-page.

Run it (as root)

   1 vrrpd -i bridge -v 11 -p 1 -d 1 -f /run -a "pw/0x12345678" 192.168.182.31
   2 RTNETLINK answers: Network is unreachable
   3 Can not talk with netlink interface...

Same without bridge and bond (active-backup) on the bare interface.

vrrpd was not working, because it was unable to set the IP-address when also propagating a virtual MAC (default behaviour without -n), whereas with -n set the IP-address correctly, undesireably was propagating the permanent hardware address.

tcpdump -nepi bridge 'vrrp'

   1 tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
   2 listening on bridge, link-type EN10MB (Ethernet), snapshot length 262144 bytes
   3 10:11:44.951089 00:00:5e:00:01:0b > 01:00:5e:00:00:12, ethertype IPv4 (0x0800), length 54: 192.168.182.16 > 224.0.0.18: VRRPv2, Advertisement, vrid 11, prio 1, authtype simple, intvl 1s, length 20
   4 10:11:45.952245 00:00:5e:00:01:0b > 01:00:5e:00:00:12, ethertype IPv4 (0x0800), length 54: 192.168.182.16 > 224.0.0.18: VRRPv2, Advertisement, vrid 11, prio 1, authtype simple, intvl 1s, length 20
   5 10:11:46.985574 00:00:5e:00:01:0b > 01:00:5e:00:00:12, ethertype IPv4 (0x0800), length 54: 192.168.182.16 > 224.0.0.18: VRRPv2, Advertisement, vrid 11, prio 1, authtype simple, intvl 1s, length 20
   6 10:11:48.001304 00:00:5e:00:01:0b > 01:00:5e:00:00:12, ethertype IPv4 (0x0800), length 54: 192.168.182.16 > 224.0.0.18: VRRPv2, Advertisement, vrid 11, prio 1, authtype simple, intvl 1s, length 20

Keepalived

• keepalived.org

• github.com acassen/keepalived

Free Range Routing (FRR)

FRRouting (FRR) is a free and open source Internet routing protocol suite for Linux and Unix platforms. It implements BGP, OSPF, RIP, IS-IS, PIM, LDP, BFD, Babel, PBR, OpenFabric and VRRP, with alpha support for EIGRP and NHRP.

• https://www.frrouting.org/

• github.com FRRouting/FRR

• FRRouting User Guide

• FRRouting Developer’s Guide

Install

   1 apt install frr frr-pythontools frr-doc

The frr.service should have come up.

A basic setup should be performed
https://frrouting.readthedocs.io/en/latest/setup.html

FRR Crashlogs and Logbuffers

Paths are not affected by configurtration options:

• Crashlogs in plaintext

  /var/tmp/frr/<daemon>[-<instance>].<pid>/crashlog

• Log-Buffers may contain unwritten logs which are null-byte terminated

  /var/tmp/frr/<daemon>[-<instance>].<pid>/logbuf.<tid> and may be read with
  tr '\0' '\n' < /var/tmp/frr/zebra.577515/logbuf.577519|less

FRR - Summoning daemons

• The watchfrr, zebra and staticd daemons are always started.

vrrp is still disabled

   1 vtysh -c "show vrrp"
   2 vrrpd is not running

To enable the service set vrrpd=yes and reload the daemon.

/etc/frr/daemons

   1 # This file tells the frr package which daemons to start.
   2 #
   3 # Sample configurations for these daemons can be found in
   4 # /usr/share/doc/frr/examples/.
   5 #
   6 # ATTENTION:
   7 #
   8 # When activating a daemon for the first time, a config file, even if it is
   9 # empty, has to be present *and* be owned by the user and group "frr", else
  10 # the daemon will not be started by /etc/init.d/frr. The permissions should
  11 # be u=rw,g=r,o=.
  12 # When using "vtysh" such a config file is also needed. It should be owned by
  13 # group "frrvty" and set to ug=rw,o= though. Check /etc/pam.d/frr, too.
  14 #
  15 # The watchfrr, zebra and staticd daemons are always started.
  16 #
  17 bgpd=no
  18 ospfd=no
  19 ospf6d=no
  20 ripd=no
  21 ripngd=no
  22 isisd=no
  23 pimd=no
  24 pim6d=no
  25 ldpd=no
  26 nhrpd=no
  27 eigrpd=no
  28 babeld=no
  29 sharpd=no
  30 pbrd=no
  31 bfdd=no
  32 fabricd=no
  33 vrrpd=yes
  34 pathd=no
  35 
  36 #
  37 # If this option is set the /etc/init.d/frr script automatically loads
  38 # the config via "vtysh -b" when the servers are started.
  39 # Check /etc/pam.d/frr if you intend to use "vtysh"!
  40 #
  41 vtysh_enable=yes
  42 zebra_options="  -A 127.0.0.1 -s 90000000"
  43 bgpd_options="   -A 127.0.0.1"
  44 ospfd_options="  -A 127.0.0.1"
  45 ospf6d_options=" -A ::1"
  46 ripd_options="   -A 127.0.0.1"
  47 ripngd_options=" -A ::1"
  48 isisd_options="  -A 127.0.0.1"
  49 pimd_options="   -A 127.0.0.1"
  50 pim6d_options="  -A ::1"
  51 ldpd_options="   -A 127.0.0.1"
  52 nhrpd_options="  -A 127.0.0.1"
  53 eigrpd_options=" -A 127.0.0.1"
  54 babeld_options=" -A 127.0.0.1"
  55 sharpd_options=" -A 127.0.0.1"
  56 pbrd_options="   -A 127.0.0.1"
  57 staticd_options="-A 127.0.0.1"
  58 bfdd_options="   -A 127.0.0.1"
  59 fabricd_options="-A 127.0.0.1"
  60 vrrpd_options="  -A 127.0.0.1"
  61 pathd_options="  -A 127.0.0.1"
  62 
  63 
  64 # If you want to pass a common option to all daemons, you can use the
  65 # "frr_global_options" variable.
  66 #
  67 #frr_global_options=""
  68 
  69 
  70 # The list of daemons to watch is automatically generated by the init script.
  71 # This variable can be used to pass options to watchfrr that will be passed
  72 # prior to the daemon list.
  73 #
  74 # To make watchfrr create/join the specified netns, add the the "--netns"
  75 # option here. It will only have an effect in /etc/frr/<somename>/daemons, and
  76 # you need to start FRR with "/usr/lib/frr/frrinit.sh start <somename>".
  77 #
  78 #watchfrr_options=""
  79 
  80 
  81 # configuration profile
  82 #
  83 #frr_profile="traditional"
  84 #frr_profile="datacenter"
  85 
  86 
  87 # This is the maximum number of FD's that will be available.  Upon startup this
  88 # is read by the control files and ulimit is called.  Uncomment and use a
  89 # reasonable value for your setup if you are expecting a large number of peers
  90 # in say BGP.
  91 #
  92 #MAX_FDS=1024
  93 
  94 
  95 # For any daemon, you can specify a "wrap" command to start instead of starting
  96 # the daemon directly. This will simply be prepended to the daemon invocation.
  97 # These variables have the form daemon_wrap, where 'daemon' is the name of the
  98 # daemon (the same pattern as the daemon_options variables).
  99 #
 100 # Note that when daemons are started, they are told to daemonize with the `-d`
 101 # option. This has several implications. For one, the init script expects that
 102 # when it invokes a daemon, the invocation returns immediately. If you add a
 103 # wrap command here, it must comply with this expectation and daemonize as
 104 # well, or the init script will never return. Furthermore, because daemons are
 105 # themselves daemonized with -d, you must ensure that your wrapper command is
 106 # capable of following child processes after a fork() if you need it to do so.
 107 #
 108 # If your desired wrapper does not support daemonization, you can wrap it with
 109 # a utility program that daemonizes programs, such as 'daemonize'. An example
 110 # of this might look like:
 111 #
 112 # bgpd_wrap="/usr/bin/daemonize /usr/bin/mywrapper"
 113 #
 114 # This is particularly useful for programs which record processes but lack
 115 # daemonization options, such as perf and rr.
 116 #
 117 # If you wish to wrap all daemons in the same way, you may set the "all_wrap"
 118 # variable.
 119 #
 120 #all_wrap=""
 121 

FRR - reload the daemon

Reloading FRR depends on frr-pythontools whjich provides /usr/lib/frr/frr-reload.py

   1 systemctl reload frr.service

vrrpd should now be started (shows no error any more).

   1 systemctl status frr.service
   2 ● frr.service - FRRouting
   3      Loaded: loaded (/lib/systemd/system/frr.service; enabled; preset: enabled)
   4      Active: active (running) since Wed 2023-04-26 14:37:26 CEST; 12s ago
   5        Docs: https://frrouting.readthedocs.io/en/latest/setup.html
   6     Process: 589952 ExecStart=/usr/lib/frr/frrinit.sh start (code=exited, status=0/SUCCESS)
   7    Main PID: 589962 (watchfrr)
   8      Status: "FRR Operational"
   9       Tasks: 9 (limit: 76893)
  10      Memory: 14.3M
  11         CPU: 184ms
  12      CGroup: /system.slice/frr.service
  13              ├─589962 /usr/lib/frr/watchfrr -d -F traditional zebra staticd vrrpd
  14              ├─589975 /usr/lib/frr/zebra -d -F traditional -A 127.0.0.1 -s 90000000
  15              ├─589980 /usr/lib/frr/staticd -d -F traditional -A 127.0.0.1
  16              └─589983 /usr/lib/frr/vrrpd -d -F traditional -A 127.0.0.1
  17 
  18 Apr 26 14:37:26 libertas watchfrr[589962]: [YFT0P-5Q5YX] Forked background command [pid 589963]: /usr/lib/frr/watchfrr.sh restart all
  19 Apr 26 14:37:26 libertas zebra[589975]: [VTVCM-Y2NW3] Configuration Read in Took: 00:00:00

The query for vrrp also shows no error any more

   1 vtysh -c "show vrrp"

FRR - PAM authentication

/etc/pam.d/frr

   1 # Any user may call vtysh but only those belonging to the group frrvty can
   2 # actually connect to the socket and use the program.
   3 auth    sufficient      pam_permit.so

FRR - vtysh

vtysh

   1 Hello, this is FRRouting (version 8.4.2).
   2 Copyright 1996-2005 Kunihiro Ishiguro, et al.
   3 
   4 libertas# 
   5 libertas# 
   6   add               Add registration
   7   clear             Reset functions
   8   configure         Configuration from vty interface
   9   copy              Copy from one file to another
  10   debug             Debugging functions
  11   disable           Turn off privileged mode command
  12   enable            Turn on privileged mode command
  13   end               End current mode and change to enable mode
  14   exit              Exit current mode and down to previous mode
  15   find              Find CLI command matching a regular expression
  16   graceful-restart  Graceful Restart commands
  17   list              Print command list
  18   mtrace            Multicast trace route to multicast source
  19   no                Negate a command or set its defaults
  20   output            Direct vtysh output to file
  21   ping              Send echo messages
  22   quit              Exit current mode and down to previous mode
  23   rpki              Control rpki specific settings
  24   show              Show running system information
  25   terminal          Set terminal line parameters
  26   traceroute        Trace route to destination
  27   watchfrr          Watchfrr Specific sub-command
  28   write             Write running configuration to memory, network, or terminal

Here we go!

FRR vrrpd

• docs.frrouting.org VRRP

FRR uses MACVLAN interfaces to realize the virtual MAC requirement of the VRRP specification. Unfortunately FRR cannot yet create these interfaces itself. Create a MACVLAN device attached to enp8s0 using iproute2 utilities.

   1 ip link add vrrp4-2-1 link enp8s0 addrgenmode random type macvlan mode bridge
   2 ip link set dev vrrp4-2-1 address 00:00:5e:00:01:05
   3 ip addr add 10.0.2.16/24 dev vrrp4-2-1
   4 ip link set dev vrrp4-2-1 up
   5 
   6 ip link add vrrp6-2-1 link enp8s0 addrgenmode random type macvlan mode bridge
   7 ip link set dev vrrp6-2-1 address 00:00:5e:00:02:05
   8 ip addr add 2001:db8::370:7334/64 dev vrrp6-2-1
   9 ip link set dev vrrp6-2-1 up

You may also delete the interface with the following commands

   1 ip link del vrrp4-2-1 link enp8s0
   2 ip link del vrrp6-2-1 link enp8s0

You may also choose a more permanent solutioi in
/etc/network/interfaces

   1 auto vrrp4-2-1
   2 iface vrrp4-2-1 inet static
   3         pre-up ip link add vrrp4-2-1 link enp8s0 addrgenmode random type macvlan mode bridge
   4         hwaddress 00:00:5e:00:01:05
   5         address 192.168.182.31/24
   6         post-down ip link del vrrp4-2-1 link enp8s0
   7 
   8 iface vrrp6-2-1 inet6 static
   9         pre-up ip link add vrrp6-2-1 link enp8s0 addrgenmode random type macvlan mode bridge
  10         hwaddress 00:00:5e:00:02:05
  11         address 2001:db8::370:7334/64
  12         post-down ip link del vrrp6-2-1 link enp8s0

Now bring up/down the interfaces

   1 ifup vrrp4-2-1
   2 ifup vrrp6-2-1

Configure the virtual IP in vtysh

   1 vtysh 
   2                                                                                                                                                                                                                                                                                    
   3 Hello, this is FRRouting (version 8.4.2).
   4 Copyright 1996-2005 Kunihiro Ishiguro, et al.
   5                                                                                                                                                                                                                                                                                    
   6 libertas# 
   7 libertas# configure 
   8 libertas(config)# interface enp8s0 
   9 libertas(config-if)# vrrp 5 version 3
  10 libertas(config-if)# vrrp 5 priority 100
  11 libertas(config-if)# vrrp 5 advertisement-interval 1000
  12 libertas(config-if)# vrrp 5 shutdown
  13 libertas(config-if)# vrrp 5 ip 192.168.182.31
  14 libertas(config-if)# exit
  15 libertas(config)# exit
  16 libertas# show vrrp 
  17 
  18  Virtual Router ID                       5                   
  19  Protocol Version                        3                   
  20  Autoconfigured                          No                  
  21  Shutdown                                Yes                 
  22  Interface                               enp8s0              
  23  VRRP interface (v4)                     vrrp4-2-1           
  24  VRRP interface (v6)                     None                
  25  Primary IP (v4)                                             
  26  Primary IP (v6)                         ::                  
  27  Virtual MAC (v4)                        00:00:5e:00:01:05   
  28  Virtual MAC (v6)                        00:00:5e:00:02:05   
  29  Status (v4)                             Initialize          
  30  Status (v6)                             Initialize          
  31  Priority                                100                 
  32  Effective Priority (v4)                 100                 
  33  Effective Priority (v6)                 100                 
  34  Preempt Mode                            Yes                 
  35  Accept Mode                             Yes                 
  36  Advertisement Interval                  1000 ms             
  37  Master Advertisement Interval (v4) Rx   0 ms (stale)        
  38  Master Advertisement Interval (v6) Rx   0 ms (stale)        
  39  Advertisements Tx (v4)                  0                   
  40  Advertisements Tx (v6)                  0                   
  41  Advertisements Rx (v4)                  0                   
  42  Advertisements Rx (v6)                  0                   
  43  Gratuitous ARP Tx (v4)                  0                   
  44  Neigh. Adverts Tx (v6)                  0                   
  45  State transitions (v4)                  0                   
  46  State transitions (v6)                  0                   
  47  Skew Time (v4)                          0 ms                
  48  Skew Time (v6)                          0 ms                
  49  Master Down Interval (v4)               0 ms                
  50  Master Down Interval (v6)               0 ms                
  51  IPv4 Addresses                          1                   
  52  ..................................      192.168.182.31      
  53  IPv6 Addresses                          0                   
  54 
  55 libertas# 
  56 libertas# write terminal                                
  57 Building configuration...                      
  58                                                                     
  59 Current configuration:                                         
  60 !                                                 
  61 frr version 8.4.2                                  
  62 frr defaults traditional                        
  63 hostname libertas                             
  64 log syslog informational                         
  65 service integrated-vtysh-config                                                                                                          
  66 !                   
  67 interface enp8s0
  68  vrrp 5                                                      
  69  vrrp 5 ip 192.168.182.31                                    
  70 exit                                                         
  71 !                                                            
  72 end                                                          
  73 libertas# write file                                         
  74 Note: this version of vtysh never writes vtysh.conf          
  75 Building Configuration...                                    
  76 Integrated configuration saved to /etc/frr/frr.conf          
  77 [OK]                                                         
  78 libertas#

When issuing the command write file the following config was stored to
/etc/frr/frr.conf

   1 frr version 8.4.2
   2 frr defaults traditional
   3 hostname libertas
   4 log syslog informational
   5 service integrated-vtysh-config
   6 !
   7 interface enp8s0
   8  vrrp 5
   9  vrrp 5 ip 192.168.182.31
  10 exit
  11 !

Test

tcpdump -nepi enp8s0 'vrrp'

   1 15:24:51.666841 00:00:5e:00:01:05 > 01:00:5e:00:00:12, ethertype IPv4 (0x0800), length 46: 192.168.182.16 > 224.0.0.18: VRRPv3, Advertisement, vrid 5, prio 100, intvl 100cs, length 12
   2 15:24:52.667027 00:00:5e:00:01:05 > 01:00:5e:00:00:12, ethertype IPv4 (0x0800), length 46: 192.168.182.16 > 224.0.0.18: VRRPv3, Advertisement, vrid 5, prio 100, intvl 100cs, length 12
   3 15:24:53.667154 00:00:5e:00:01:05 > 01:00:5e:00:00:12, ethertype IPv4 (0x0800), length 46: 192.168.182.16 > 224.0.0.18: VRRPv3, Advertisement, vrid 5, prio 100, intvl 100cs, length 12
   4 15:24:54.667297 00:00:5e:00:01:05 > 01:00:5e:00:00:12, ethertype IPv4 (0x0800), length 46: 192.168.182.16 > 224.0.0.18: VRRPv3, Advertisement, vrid 5, prio 100, intvl 100cs, length 12
   5 15:24:55.667441 00:00:5e:00:01:05 > 01:00:5e:00:00:12, ethertype IPv4 (0x0800), length 46: 192.168.182.16 > 224.0.0.18: VRRPv3, Advertisement, vrid 5, prio 100, intvl 100cs, length 12

Router and the host itself can both ping the address.
ping 192.168.182.31

   1 PING 192.168.182.31 (192.168.182.31) 56(84) bytes of data.
   2 64 bytes from 192.168.182.31: icmp_seq=1 ttl=64 time=0.132 ms
   3 64 bytes from 192.168.182.31: icmp_seq=2 ttl=64 time=0.500 ms
   4 64 bytes from 192.168.182.31: icmp_seq=3 ttl=64 time=0.267 ms
   5 64 bytes from 192.168.182.31: icmp_seq=4 ttl=64 time=0.252 ms
   6 64 bytes from 192.168.182.31: icmp_seq=5 ttl=64 time=0.253 ms
   7 64 bytes from 192.168.182.31: icmp_seq=6 ttl=64 time=0.320 ms
   8 ^C
   9 --- 192.168.182.31 ping statistics ---
  10 6 packets transmitted, 6 received, 0% packet loss, time 5211ms
  11 rtt min/avg/max/mdev = 0.132/0.287/0.500/0.110 ms

It works.

Explicit Congestion Notification (ECN)

Please compare to

• Linux#Explicit Congestion Notification (ECN)

• https://www.kernel.org/doc/html/latest/networking/ip-sysctl.html

• Wiki EN Explicit Congestion Notification

• IETF RFC3168 The Addition of Explicit Congestion Notification (ECN) to IP

Explicit Congestion Notification (ECN) is an extension to the Internet Protocol and to the Transmission Control Protocol and is defined in RFC 3168 (2001). ECN allows end-to-end notification of network congestion without dropping packets. ECN is an optional feature that may be used between two ECN-enabled endpoints when the underlying network infrastructure also supports it.

Conventionally, TCP/IP networks signal congestion by dropping packets. When ECN is successfully negotiated, an ECN-aware router may set a mark in the IP header instead of dropping a packet in order to signal impending congestion. The receiver of the packet echoes the congestion indication to the sender, which reduces its transmission rate as if it detected a dropped packet.

Some OS defaults

• OpenWRT: 0 disabled
• Debian: 2 (on-demand)
• Windows:
  • Server 2012+: enabled (DCTCP)
  • previous Windows versions and non-server versions: disabled
• MacOS: enabled

ECN TCP initialization

Please see:

• https://datatracker.ietf.org/doc/html/rfc3168#section-6.1.1

• #ECN signalization in IP

Already the SYN and SYN/ACK TCP segments have the reserved flag bits 8 (ECE [explicit congestion notification - echo] ) and/or 9 (CWR [explicit congestion notification - congestion window reduced]) set to negotiate if all hosts are ECN capable transports (ECTs). If the negotiation is successful in the ip header the least significant flag bits (10+11) of the field traffic class are set to 1 or 2. If congestion happens, a router on the path may set Congestion Experienced (CE) code point, which means both flags set (3) and the sender must reduce the pressure to the network.

ECN TCP Initialization sniffs

Neither host or at least HostA does not support ECN

   1 11:04:19.947303 IP HostA.53776 > HostB.https: Flags [S], seq 2068578816, win 42340, options [mss 1460,sackOK,TS val 2403502370 ecr 0,nop,wscale 12], length 0
   2 11:04:19.947585 IP HostB.https > HostA.53776: Flags [S.], seq 1151792898, ack 2068578817, win 65535, options [mss 1460,sackOK,TS val 2773609087 ecr 2403502370,nop,wscale 7], length 0
   3 11:04:19.947667 IP HostA.53776 > HostB.https: Flags [.], ack 1, win 11, options [nop,nop,TS val 2403502370 ecr 2773609087], length 0

HostA supports ECN, HostB not

   1 11:03:46.840333 IP HostA.44144 > HostB.https: Flags [SEW], seq 2208499727, win 42340, options [mss 1460,sackOK,TS val 2403469263 ecr 0,nop,wscale 12], length 0
   2 11:03:46.840542 IP HostB.https > HostA.44144: Flags [S.], seq 3316106916, ack 2208499728, win 65535, options [mss 1460,sackOK,TS val 2773575982 ecr 2403469263,nop,wscale 7], length 0
   3 11:03:46.840608 IP HostA.44144 > HostB.https: Flags [.], ack 1, win 11, options [nop,nop,TS val 2403469263 ecr 2773575982], length 0

Both hosts support ECN

   1 11:56:11.326494 IP HostA.35024 > HostB.https: Flags [SEW], seq 1721541561, win 42340, options [mss 1460,sackOK,TS val 2406613749 ecr 0,nop,wscale 12], length 0
   2 11:56:11.326722 IP HostB.https > HostA.35024: Flags [S.E], seq 96984504, ack 1721541562, win 65535, options [mss 1460,sackOK,TS val 2776720270 ecr 2406613749,nop,wscale 7], length 0
   3 11:56:11.326777 IP HostA.35024 > HostB.https: Flags [.], ack 1, win 11, options [nop,nop,TS val 2406613749 ecr 2776720270], length 0

ECN signalization in IP

Please see:
IETF RFC3168 - Section 5 - Explicit Congestion Notification in IP

Least significant flag bits (10+11) of the field traffic class in IP header.

   1       +-----+-----+
   2       | ECN FIELD |
   3       +-----+-----+
   4         ECT   CE         [Obsolete] RFC 2481 names for the ECN bits.
   5          0     0         Not-ECT
   6          0     1         ECT(1)
   7          1     0         ECT(0)
   8          1     1         CE

IPAM Documentation

Please use a IP address management / infrastructure resource planning tool to document your environments, like

• https://netbox.dev/

• https://phpipam.net/

Geo-Blocking

# TODO: Translate into english

Links

• Rat der Europäischen Union - Geoblocking: Beseitigung der Hindernisse für den elektronischen Handel in der EU

• EUR-Lex - Geoblocking – neue Verordnung tritt in Kraft

• EU-Kommission: Fragen und Antworten zur Geoblocking-Verordnung

• BSI - Qualifizierte DDoS-Mitigation Dienstleister

• Bundesnetzagentur - Geo­blocking

• IHK Stuttgard - Die neue Geoblocking-Verordnung

• Wikipedia - Verordnung (EU) 2018/302 (Geoblocking)

• Wikipedia - Geoblocking

Betrachtungen

• Diskriminierung aufgrund der Herkunft
• Mittel der Internet Zensur
• VPNs, Anoymisierungen (wie z.B. TOR) und Proxies überwinden Geo-Blocking (spielend)
  • Technisch Versierte wissen wie diese Werkzeuge einzusetzen sind.
  • Ausgeschlossen werden einfache Nutzer ohne böswillige Motive.
• Einschränkungen durch Geoblocking-Verordnung der EU
  • Der EU-Binnenmarkt darf nicht geblockt werden.
  • Bei falscher Implementierung unter Strafe gestellt
  • Durchsetzung der Geoblocking-Verordnung durch Bundesnetzagentur
• Es gibt meiner Meinung nach keine staatlichen Empfehlungen, welche Quellen (Kontinente, Länder) geblockt werden sollten.

Modalitäten

• Kunde sollte durch den Dienstleister (wertungsfrei) auf die Implikationen hingewiesen werden.
• Kunde muss die Einrichtung von Geo-Blocking explizit in Auftrag geben.
• Kunde bestimmt die Inhalte der Allow- und Block-Listen.

Internet Protocol version 4 (IPv4)

• Wiki EN Reserved IP addresses

IANA

• IANA - IANA IPv4 Address Space Registry

• IANA - IPv4 Multicast Address Space Registry

• IANA - IANA IPv4 Special-Purpose Address Registry

• IANA - IPv4 Recovered Address Space

In DNS make sure your NS, MX and A records for a given domain don't share a single IP-address.

Internet Protocol version 6 (IPv6)

IETF

• IETF RFC8200 - Internet Protocol, Version 6 (IPv6) Specification

• IETF RFC4291 - IP Version 6 Addressing Architecture

• IETF RFC4293 - Unique Local IPv6 Unicast Addresses

• IETF RFC5952 - A Recommendation for IPv6 Address Text Representation

• IETF RFC7346 - IPv6 Multicast Address Scopes

• IETF RFC7136 - Significance of IPv6 Interface Identifiers

• IETF RFC8064 - Recommendation on Stable IPv6 Interface Identifiers

• IETF RFC8981 - Temporary Address Extensions for Stateless Address Autoconfiguration in IPv6

• IETF RFC2464 - Transmission of IPv6 Packets over Ethernet Networks

• IETF RFC3306 - Unicast-Prefix-based IPv6 Multicast Addresses

• IETF RFC3307 - Allocation Guidelines for IPv6 Multicast Addresses

IANA

• IANA - Internet Protocol Version 6 Address Space

• IANA - RIPE NCC IPv6 Allocations

• IANA - Internet Protocol Version 6 (IPv6) Parameters

• IANA - IPv6 Multicast Address Space Registry

• IANA - IPv6 Global Unicast Address Assignments

Blog

• Infoblox IPv6 Center of Excellence (COE) Blog

Reasons for using IPv6

• IPv4 address space is exhausted
• Price increases quickly
• New products, that need a IP-address, are possible
• On fusions no readdressing is necessary, because the addresses are unique
• Simplification

Abbreviations

CID

Company ID

DSCP

Differentiated Services Code Point

ECN

Explicit Congestion Notification

EUI

Extended Unique Identifier

IID

Modified EUI-64 interface identifiers

NAT64

Network Address Translation IPv6 to IPv4

NAT66

Network Address Translation IPv6 to IPv6

NPTv6

Network Prefix Translation IPv6-to-IPv6

ORCHIDv2

Overlay Routable Cryptographic Hash Identifiers Version 2

OUI

Organizationally Unique Identifier

RA

Route Advertisement

RS

Router Solicitation

SLAAC

Stateless Address Autoconfiguration

ULA

Unique Local Address

IPv6 Addresses

• IETF RFC3879 - Deprecating Site Local Addresses

• IETF RFC4291 - IP Version 6 Addressing Architecture

• IETF RFC4193 - Unique Local IPv6 Unicast Addresses

• IANA - IPv6 Multicast Address Space Registry

4bit are a nibble, which can be replaced by a hexadecimal digit -> 0-9a-f

Multicast scopes

IETF RFC4291 - Multicast Addresses scope

scop is a 4-bit multicast scope value used to limit the scope of the multicast group.

The values are as follows:

• 0 reserved
• 1 Interface-Local scope
• 2 Link-Local scope
• 3 reserved
• 4 Admin-Local scope
• 5 Site-Local scope
• 6 (unassigned)
• 7 (unassigned)
• 8 Organization-Local scope
• 9 (unassigned)
• A (unassigned)
• B (unassigned)
• C (unassigned)
• D (unassigned)
• E Global scope
• F reserved

Shortening

The following is an excerpt from
IETF RFC - A Recommendation for IPv6 Address Text Representation Section 4

4. A Recommendation for IPv6 Text Representation

• A recommendation for a canonical text representation format of IPv6 addresses is presented in this section. The recommendation in this document is one that complies fully with [RFC4291], is implemented by various operating systems, and is human friendly. The recommendation in this section SHOULD be followed by systems when generating an address to be represented as text, but all implementations MUST accept and be able to handle any legitimate [RFC4291] format. It is advised that humans also follow these recommendations when spelling an address.

4.1. Handling Leading Zeros in a 16-Bit Field

• Leading zeros MUST be suppressed. For example, 2001:0db8::0001 is not acceptable and must be represented as 2001:db8::1. A single 16- bit 0000 field MUST be represented as 0.

4.2. "::" Usage

4.2.1. Shorten as Much as Possible

• The use of the symbol "::" MUST be used to its maximum capability. For example, 2001:db8:0:0:0:0:2:1 must be shortened to 2001:db8::2:1. Likewise, 2001:db8::0:1 is not acceptable, because the symbol "::" could have been used to produce a shorter representation 2001:db8::1.

4.2.2. Handling One 16-Bit 0 Field

• The symbol "::" MUST NOT be used to shorten just one 16-bit 0 field. For example, the representation 2001:db8:0:1:1:1:1:1 is correct, but 2001:db8::1:1:1:1:1 is not correct.

4.2.3. Choice in Placement of "::"

• When there is an alternative choice in the placement of a "::", the longest run of consecutive 16-bit 0 fields MUST be shortened (i.e., the sequence with three consecutive zero fields is shortened in 2001: 0:0:1:0:0:0:1). When the length of the consecutive 16-bit 0 fields are equal (i.e., 2001:db8:0:0:1:0:0:1), the first sequence of zero bits MUST be shortened. For example, 2001:db8::1:0:0:1 is correct representation.

4.3. Lowercase

• The characters "a", "b", "c", "d", "e", and "f" in an IPv6 address MUST be represented in lowercase.

Examples:

• In IPv4 1.0.0.1
  00000001 00000000 00000000 00000001
  may be shortened to 1.1

• In IPv6 fe80:0000:0000:0000:0000:0000:0000:0001
  1111111010000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000001
  shortens to fe80::1

Interface Identifiers (IID)

• IETF RFC4291 - IPv6 Addressing Architecture - Appendix A: Creating Modified EUI-64 Format Interface Identifiers

• IEEE Guidelines for Use of Extended Unique Identifier (EUI), Organizationally Unique Identifier (OUI), and Company ID (CID)

  • Here's a local copy since I've seen many broken links before
    

For the structure of a MAC address
please see #MAC addresses

Deriving the IID

1. In IIDs the universal bit is inverted.
2. Furthermore between the vendor (OUI) and the NIC-ID

   ff:fe 11111111 11111110 is inserted.

   |0              1|1              3|3              4|4              6|
   |0              5|6              1|2              7|8              3|
   +----------------+----------------+----------------+----------------+
   |ccccccugcccccccc|cccccccc11111111|11111110mmmmmmmm|mmmmmmmmmmmmmmmm|
   +----------------+----------------+----------------+----------------+

6to4 addresses

Oneliner to generate a 6to4 address from an IPv4 address

   1 ipv4="1.2.3.4"; sla="5";
   2 printf "2002:%02x%02x:%02x%02x:%04x::1" \
   3         $(echo $ipv4 |tr "." " ") $sla

Unique Local Addresses (ULA)

IETF RFC4293 - Unique Local IPv6 Unicast Addresses

• Provider independent address space
  • Makes renumbering of the provider dependent addresses possible without disrupting the internal network.
• Usable like any other global IPv6 unicast addresses
• Well known prefix that can easily be filtered
• Randomly generated with a high probability to be unique
  • Merging site is possible without renumbering
  • Routeable within and between a limited number of sites
  • Not globally routable (actually filtered and rejected), because of their random bits their cannot be aggregated to shorter prefixes and would impair a great performance penalty in convergence of routing protocols.

Some important notes

• 3.2.1. Locally Assigned Global IDs

  • Locally assigned Global IDs MUST be generated with a pseudo-random algorithm consistent with [RANDOM]. Section 3.2.2 describes a suggested algorithm. It is important that all sites generating Global IDs use a functionally similar algorithm to ensure there is a high probability of uniqueness. The use of a pseudo-random algorithm to generate Global IDs in the locally assigned prefix gives an assurance that any network numbered using such a prefix is highly unlikely to have that address space clash with any other network that has another locally assigned prefix allocated to it. This is a particularly useful property when considering a number of scenarios including networks that merge, overlapping VPN address space, or hosts mobile between such networks.

• 3.2.2. Sample Code for Pseudo-Random Global ID Algorithm

  • The algorithm described below is intended to be used for locally assigned Global IDs. In each case the resulting global ID will be used in the appropriate prefix as defined in Section 3.2.
    1. Obtain the current time of day in 64-bit NTP format [NTP].
    2. Obtain an EUI-64 identifier from the system running this algorithm. If an EUI-64 does not exist, one can be created from a 48-bit MAC address as specified in [ADDARCH]. If an EUI-64 cannot be obtained or created, a suitably unique identifier, local to the node, should be used (e.g., system serial number).
    3. Concatenate the time of day with the system-specific identifier in order to create a key.
    4. Compute an SHA-1 digest on the key as specified in [FIPS, SHA1]; the resulting value is 160 bits.
    5. Use the least significant 40 bits as the Global ID.

    6. Concatenate fc00::/7, the L bit set to 1, and the 40-bit Global ID to create a Local IPv6 address prefix.

    This algorithm will result in a Global ID that is reasonably unique and can be used to create a locally assigned Local IPv6 address prefix.

• 4.1 Routing

  • The default behavior of exterior routing protocol sessions between administrative routing regions must be to ignore receipt of and not

    advertise prefixes in the fc00::/7 block. A network operator may specifically configure prefixes longer than fc00::/7 for inter-site communication.

• 4.4. DNS Issues

  • At the present time, AAAA and PTR records for locally assigned local IPv6 addresses are not recommended to be installed in the global DNS. …

ULA generation

• github.com adeverteuil/bash-ula-generator

     1 sudo apt install ntp
     2 git clone https://github.com/adeverteuil/bash-ula-generator
     3 cd bash-ula-generator
     4 bash gen-ula.sh
  

  • Not recommended

    • Dependency ntp collides with systemd-timesyncd

    • ntpq command does not come back.

• github.com yoshi0808/ula-generator

     1 git clone https://github.com/yoshi0808/ula-generator.git
     2 cd ula-generator
     3 python3 ula_generator.py
     4 Input MAC address: 52:54:00:6c:69:60        
     5 
     6 ULA Prefix        -> fd30:6ab5:f9fa::/48
     7 First Subnet      -> fd30:6ab5:f9fa::/64
     8 Last Subnet       -> fd30:6ab5:f9fa:ffff::/64
     9 First IPv6 Address-> fd30:6ab5:f9fa::1/64
  

• github.com ekline/ulagen

     1 git clone https://github.com/ekline/ulagen.git
     2 cd ulagen
     3 make
     4 impl/c/ulagen
     5 fd35:f14e:b221::/48
     6 impl/cpp/ulagen
     7 fdc3:2ae1:4fe1::/48
  

Linux Kernel options

• There are numerous options supported by the Linux Kernel
  kernel.org/doc latest /proc/sys/net/ipv6/* Variables

Suppress learning default route from route advertisement (ra)

kernel.org/doc latest Search for accept_ra_defrtr - BOOLEAN

Learn default router in Router Advertisement.

Functional default:

• enabled if accept_ra is enabled.

• disabled if accept_ra is disabled.

It is possible that your host has learned a default route from an internal interface.
ip -6 r |grep -e default -e ovs-pub2

   1 fe80::/64 dev ovs-pub2 proto kernel metric 256 pref medium
   2 default via fe80::1 dev enp7s0 metric 1024 onlink pref medium
   3 default via fe80::5054:ff:fece:d9b7 dev ovs-pub2 proto ra metric 1024 expires 1751sec hoplimit 64 pref medium

You may suppress this behaviour with
sysctl net.ipv6.conf.ovs-pub2.accept_ra_defrtr=0

   1 net.ipv6.conf.ovs-pub2.accept_ra_defrtr = 0

Reload the interface and check again

   1 ifdown ovs-pub2; ifup ovs-pub2
   2 ip -6 r |grep -e default -e ovs-pub2
   3 fe80::/64 dev ovs-pub2 proto kernel metric 256 pref medium
   4 default via fe80::1 dev enp7s0 metric 1024 onlink pref medium

To make it persistent

   1 cat > /etc/sysctl.d/net.ipv6.conf <<-EOF
   2 net.ipv6.conf.ovs-pub1.accept_ra_defrtr = 0
   3 net.ipv6.conf.ovs-pub2.accept_ra_defrtr = 0
   4 net.ipv6.conf.ovs-1a.accept_ra_defrtr = 0
   5 EOF

router advertisement daemon (radvd)

• https://radvd.litech.org/

• Mailing Lists

  • radvd-announce-l@lists.litech.org

  • radvd-devel-l@lists.litech.org

• github.com radvd-project/radvd

• file:///usr/share/doc/radvd/INTRO.html

• Peter Bieringer - Linux IPv6 HOWTO (en)

• Peter Bieringer - Linux IPv6 HOWTO (de)

IETF Standards

• IETF RFC - Transmission of IPv6 Packets over Ethernet Networks

• IETF RFC - Neighbor Discovery for IP version 6 (IPv6)

• IETF RFC - IPv6 Stateless Address Autoconfiguration

Tools

• IPv6 Toolkit

• The ipv6calc Homepage

• The Hacker Choice's IPv6 Attack Toolkit thc-ipv6

ifmetric

0pointer.de ifmetric

• ifmetric is a Linux tool for setting the metrics of all IPv4 routes attached to a given network interface at once. This may be used to change the priority of routing IPv4 traffic over the interface. Lower metrics correlate with higher priorities.

You may use this to e.g.

• have a fallback interface in the same network or
• control the default route based on the metric

Just add the keyword metric in the interface section in
/etc/network/interfaces

   1 auto enp8s0
   2 iface enp8s0 inet dhcp
   3         metric 10
   4 
   5 auto enp9s0
   6 iface enp9s0 inet dhcp
   7         metric 100

Take a lot at the routes
ip r

   1 default via 192.168.182.1 dev enp8s0 proto dhcp metric 10
   2 default via 192.168.182.1 dev enp9s0 proto dhcp metric 100 
   3 169.254.0.0/16 dev lo scope link metric 1000 
   4 192.168.182.0/24 dev enp8s0 proto kernel scope link src 192.168.182.16 metric 10
   5 192.168.182.0/24 dev enp9s0 proto kernel scope link src 192.168.182.162 metric 100

NetBIOS

• is obsolete.
• is not strictly a network layer protocol, this depends on its implementation.
• may be implemented as

  • NetBEUI (NetBEUI -> MAC)

  • on top of IPX (NetBIOS -> IPX-address-> MAC)

  • on top of TCP/IP (NetBIOS -> IP-address-> MAC)

• is limited to a broadcast domain and is not routed.
• causes a high amount of broadcast traffic.

Links

* IETF RFC1002 PROTOCOL STANDARD FOR A NetBIOS SERVICE ON A TCP/UDP TRANSPORT: DETAILED SPECIFICATIONS

NetBIOS name

• reservations are broadcasted to the broadcast-address followed by a time the requestor listens for complains from the network (already registered). This procedure is repeated 4 times, until the name is considered reserved.
• are 16Byte long.

• may be unique (U) or a group (G).

  • Please avoid assigning the name as a workgroup to a node. This may lead to problems on the node.
• Microsoft's implementation of NetBIOS uses the 16th byte of the NetBIOS Name as a type field, which is also known as the NetBIOS-Suffix.

Patrick P. Yeung NetBIOS Suffix Code Table