DOCSLIB.ORG

Guide to IP Layer Network Administration with Linux Version 0.4.5 Martin A

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Guide to IP Layer Network Administration with Linux Version 0.4.5 Martin A Guide to IP Layer Network Administration with Linux Version 0.4.5 Martin A. Brown Guide to IP Layer Network Administration with Linux: Version 0.4.5 Martin A. Brown Publication date 2007-Mar-14 Copyright © 2002, 2003 Martin A. Brown Abstract This guide provides an overview of many of the tools available for IP network administration of the linux operating system, kernels in the 2.2 and 2.4 series. It covers Ethernet, ARP, IP routing, NAT, and other topics central to the management of IP networks. Table of Contents Introduction ..................................................................................................................... xiv 1. Target Audience, Assumptions, and Recommendations ................................................ xiv 2. Conventions ......................................................................................................... xiv 3. Bugs and Roadmap ................................................................................................ xv 4. Technical Note and Summary of Approach ................................................................ xv 5. Acknowledgements and Request for Remarks ............................................................. xv I. Concepts ......................................................................................................................... 1 1. Basic IP Connectivity ............................................................................................... 4 1. IP Networking Control Files .............................................................................. 4 2. Reading Routes and IP Information .................................................................... 5 2.1. Sending Packets to the Local Network ...................................................... 7 2.2. Sending Packets to Unknown Networks Through the Default Gateway ............ 8 2.3. Static Routes to Networks ...................................................................... 9 3. Changing IP Addresses and Routes ..................................................................... 9 3.1. Changing the IP on a machine ............................................................... 10 3.2. Setting the Default Route ...................................................................... 11 3.3. Adding and removing a static route ........................................................ 12 4. Conclusion .................................................................................................... 13 2. Ethernet ............................................................................................................... 15 1. Address Resolution Protocol (ARP) .................................................................. 15 1.1. Overview of Address Resolution Protocol ................................................ 15 1.2. The ARP cache ................................................................................... 18 1.3. ARP Suppression ................................................................................ 20 1.4. The ARP Flux Problem ........................................................................ 20 2. Proxy ARP ................................................................................................... 23 3. ARP filtering ................................................................................................ 24 4. Connecting to an Ethernet 802.1q VLAN ........................................................... 25 5. Link Aggregation and High Availability with Bonding ......................................... 25 5.1. Link Aggregation ................................................................................ 26 5.2. High Availability ................................................................................. 27 3. Bridging ............................................................................................................... 28 1. Concepts of Bridging ...................................................................................... 28 2. Bridging and Spanning Tree Protocol ................................................................ 28 3. Bridging and Packet Filtering ........................................................................... 28 4. Traffic Control with a Bridge ........................................................................... 28 5. ebtables ....................................................................................................... 28 4. IP Routing ............................................................................................................ 29 1. Introduction to Linux Routing .......................................................................... 29 2. Routing to Locally Connected Networks ............................................................ 31 3. Sending Packets Through a Gateway ................................................................. 32 4. Operating as a Router ..................................................................................... 33 5. Route Selection ............................................................................................. 33 5.1. The Common Case .............................................................................. 34 5.2. The Whole Story ................................................................................. 34 5.3. Summary ........................................................................................... 36 6. Source Address Selection ................................................................................ 36 7. Routing Cache ............................................................................................... 37 8. Routing Tables .............................................................................................. 38 8.1. Routing Table Entries (Routes) .............................................................. 40 8.2. The Local Routing Table ...................................................................... 42 8.3. The Main Routing Table ....................................................................... 43 iii Guide to IP Layer Network Administration with Linux 9. Routing Policy Database (RPDB) ..................................................................... 43 10. ICMP and Routing ....................................................................................... 45 10.1. MTU, MSS, and ICMP ....................................................................... 45 10.2. ICMP Redirects and Routing ............................................................... 45 5. Network Address Translation (NAT) ......................................................................... 47 1. Rationale for and Introduction to NAT .............................................................. 47 2. Application Layer Protocols with Embedded Network Information .......................... 49 3. Stateless NAT with iproute2 ........................................................................... 49 3.1. Stateless NAT Packet Capture and Introduction ........................................ 50 3.2. Stateless NAT Practicum ...................................................................... 51 3.3. Conditional Stateless NAT .................................................................... 51 4. Stateless NAT and Packet Filtering ................................................................... 52 5. Destination NAT with netfilter (DNAT) ............................................................. 54 5.1. Port Address Translation with DNAT ..................................................... 55 6. Port Address Translation (PAT) from Userspace .................................................. 55 7. Transparent PAT from Userspace ..................................................................... 55 6. Masquerading and Source Network Address Translation ............................................... 56 1. Concepts of Source NAT ................................................................................ 56 1.1. Differences Between SNAT and Masquerading ......................................... 56 1.2. Double SNAT/Masquerading ................................................................. 56 2. Issues with SNAT/Masquerading and Inbound Traffic .......................................... 56 3. Where Masquerading and SNAT Break ............................................................. 56 7. Packet Filtering ..................................................................................................... 57 1. Rationale for and Introduction to Packet Filtering ................................................ 57 1.1. History of Linux Packet Filter Support .................................................... 58 2. Limits and Weaknesses of Packet Filtering ......................................................... 58 2.1. Limits of the Usefulness of Packet Filtering ............................................. 58 2.2. Weaknesses of Packet Filtering .............................................................. 59 2.3. Complex Network Layer Stateless Packet Filters ....................................... 59 3. General Packet Filter Requirements ................................................................... 60 4. The Netfilter Architecture ................................................................................ 60 4.1. Packet Filtering with iptables ................................................................ 60 5. Packet Filtering with ipchains ........................................................................
Load more

Recommended publications
  • Chapter 3. Booting Operating Systems
    Chapter 3. Booting Operating Systems Abstract: Chapter 3 provides a complete coverage on operating systems booting. It explains the booting principle and the booting sequence of various kinds of bootable devices. These include booting from floppy disk, hard disk, CDROM and USB drives. Instead of writing a customized booter to boot up only MTX, it shows how to develop booter programs to boot up real operating systems, such as Linux, from a variety of bootable devices. In particular, it shows how to boot up generic Linux bzImage kernels with initial ramdisk support. It is shown that the hard disk and CDROM booters developed in this book are comparable to GRUB and isolinux in performance. In addition, it demonstrates the booter programs by sample systems. 3.1. Booting Booting, which is short for bootstrap, refers to the process of loading an operating system image into computer memory and starting up the operating system. As such, it is the first step to run an operating system. Despite its importance and widespread interests among computer users, the subject of booting is rarely discussed in operating system books. Information on booting are usually scattered and, in most cases, incomplete. A systematic treatment of the booting process has been lacking. The purpose of this chapter is to try to fill this void. In this chapter, we shall discuss the booting principle and show how to write booter programs to boot up real operating systems. As one might expect, the booting process is highly machine dependent. To be more specific, we shall only consider the booting process of Intel x86 based PCs.
    [Show full text]
  • Openswitch OPX Configuration Guide Release 3.0.0 2018 - 9
    OpenSwitch OPX Configuration Guide Release 3.0.0 2018 - 9 Rev. A02 Contents 1 Network configuration....................................................................................................................................4 2 Interfaces...................................................................................................................................................... 5 Physical ports..................................................................................................................................................................... 5 Fan-out interfaces..............................................................................................................................................................6 Port-channel and bond interfaces....................................................................................................................................7 VLAN interfaces................................................................................................................................................................. 7 Port profiles.........................................................................................................................................................................8 3 Layer 2 bridging............................................................................................................................................10 VLAN bridging...................................................................................................................................................................10
    [Show full text]
  • Devt: Let the Device Talk
    Iowa State University Capstones, Theses and Creative Components Dissertations Summer 2020 DevT: Let the Device Talk Chander Bhushan Gupta Follow this and additional works at: https://lib.dr.iastate.edu/creativecomponents Part of the Data Storage Systems Commons Recommended Citation Gupta, Chander Bhushan, "DevT: Let the Device Talk" (2020). Creative Components. 585. https://lib.dr.iastate.edu/creativecomponents/585 This Creative Component is brought to you for free and open access by the Iowa State University Capstones, Theses and Dissertations at Iowa State University Digital Repository. It has been accepted for inclusion in Creative Components by an authorized administrator of Iowa State University Digital Repository. For more information, please contact [email protected]. DevT: Let the Device Talk by Chander Bhushan Gupta A Creative Component submitted to the graduate faculty in partial fulfillment of the requirements for the degree of MASTER OF SCIENCE Major: Computer Engineering Program of Study Committee: Mai Zheng, Major Professor The student author, whose presentation of the scholarship herein was approved by the program of study committee, is solely responsible for the content of this creative component. The Graduate College will ensure this creative component is globally accessible and will not permit alterations after a degree is conferred. Iowa State University Ames, Iowa 2020 Copyright c Chander Bhushan Gupta, 2020. All rights reserved. ii TABLE OF CONTENTS Page LIST OF TABLES . iv LIST OF FIGURES . .v ACKNOWLEDGMENTS . vii ABSTRACT . viii CHAPTER 1. INTRODUCTION . .1 1.1 Motivation . .3 1.2 Related Work . .5 1.3 Outline . .6 CHAPTER 2. REVIEW OF LITERATURE . .7 2.1 Why FEMU? .
    [Show full text]
  • User Space TCP - Getting LKL Ready for the Prime Time
    User Space TCP - Getting LKL Ready for the Prime Time H.K. Jerry Chu, Yuan Liu Google Inc. 1600 Amphitheatre Pkwy, Mountain View, CA 94043, USA [email protected], [email protected] Abstract ets destined for Google services may be initiated from a for- eign stack installed by a cloud customer running directly in- Running the networking stack in the user space is not new. The side Google’s data center. If these “guest” packets created by conventional wisdom is that the network stack must bypass the untrusted stacks are allowed into our internal networks un- kernel in order to meet the performance requirements of a class of applications that demand super-low latency. changed, and terminated directly by the Linux kernel TCP stack running on our internal servers, it poses a very high se- This paper describes an experiment we’ve undertaken to pro- vide a production- strength user space TCP stack for a different curity risk. On the other hand, forcing all the guest packets use case inside Googles internal production network. to route through GFEs in order to subject them to the rigor- We choose a Linux based open source project called Linux ous checks and filtering is undesirable, both from the cost and Kernel Library (LKL) as a base for our effort, and have made performance stand points. significant contribution to it since late last year, improving both Running a TCP stack in the user space to terminate guest its quality and performance. During the time, we discovered a connections provides a solution that much reduces our expo- number of architectural constraints inherited in the LKL’s cur- sure to the security risk, from the whole OS kernel down to rent design and implementation, and gained valuable insights a single user process.
    [Show full text]
  • Block Devices and Volume Management in Linux
    Block devices and volume management in Linux Krzysztof Lichota [email protected] L i n u x b l o c k d e v i c e s l a y e r ● Linux block devices layer is pretty flexible and allows for some interesting features: – Pluggable I/O schedulers – I/O prioritizing (needs support from I/O scheduler) – Remapping of disk requests (Device Mapper) – RAID – Various tricks (multipath, fault injection) – I/O tracing (blktrace) s t r u c t b i o ● Basic block of I/O submission and completion ● Can represent large contiguous memory regions for I/O but also scattered regions ● Scattered regions can be passed directly to disks capable of scatter/gather ● bios can be split, merged with other requests by various levels of block layer (e.g. split by RAID, merged in disk driver with other disk requests) s t r u c t b i o f i e l d s ● bi_sector – start sector of I/O ● bi_size – size of I/O ● bi_bdev – device to which I/O is sent ● bi_flags – I/O flags ● bi_rw – read/write flags and priority ● bi_io_vec – memory scatter/gather vector ● bi_end_io - function called when I/O is completed ● bi_destructor – function called when bio is to be destroyed s t r u c t b i o u s a g e ● Allocate bio using bio_alloc() or similar function ● Fill in necessary fields (start, device, ...) ● Initialize bio vector ● Fill in end I/O function to be notified when bio completes ● Call submit_bio()/generic_make_request() ● Example: process_read() in dm-crypt O t h e r I / O s u b m i s s i o n f u n c t i o n s ● Older interfaces for submitting I/O are supported (but deprecated),
    [Show full text]
  • SPDK Performance in a Nutshell
    Karol Latecki John Kariuki SPDK, PMDK, Intel® Performance Analyzers Virtual Forum Agenda I/O Performance Performance and Efficiency 1 Workloads Local Storage Performance Test case and objectives 2 Performance Test tools, environment and optimizations Storage over Ethernet Performance Test case and objectives 3 Performance Test tools, environment and optimizations Virtualized Storage Performance Test case and objectives 4 Performance Test tools, environment and optimizations SPDK, PMDK, Intel® Performance Analyzers Virtual Forum 2 SPDK I/O Performance Efficiency & Scalability Latency I/O per sec from 1 thread Average I/O core scalability Tail(P90, P99, P99.99) 3 SPDK, PMDK, Intel® Performance Analyzers Virtual Forum 4 KiB 128 KiB Local Storage Performance 100% Random Read 100% Seq Read Storage over Ethernet Performance 100% Random Write 100% Seq Write Virtualized Storage Performance 70%/30% Random Read/Write 70%/30% Seq Read/Write 4 SPDK, PMDK, Intel® Performance Analyzers Virtual Forum https://spdk.io/doc/performance_reports.html The Performance Reports 5 SPDK, PMDK, Intel® Performance Analyzers Virtual Forum SPDK, PMDK, Intel® Performance Analyzers Virtual Forum Local Block Storage Objectives: • Measure SPDK NVMe BDEV performance • Compare SPDK vs. Linux Kernel (libaio, io_uring) block layers SPDK Perf/FIO Test Cases: 1. I/O per second from one thread SPDK 2. I/O core scalability SPDK NVMe 3. SPDK vs. Kernel Latency BDEV 4. IOPS vs. Latency SPDK NVMe Driver Intel® TLC Test case execution automated with test/nvme/perf/run_perf.sh 3D NAND SSD 7 SPDK, PMDK, Intel® Performance Analyzers Virtual Forum SPDK NVMe SPDK NVMe BDEV IOPS 1 CPU Core BDEV I/O 4 KB Rand Read @ QD=128 Efficiency.
    [Show full text]
  • Red Hat Enterprise Linux 7 Performance Tuning Guide
    Red Hat Enterprise Linux 7 Performance Tuning Guide Monitoring and optimizing subsystem throughput in RHEL 7 Last Updated: 2021-08-31 Red Hat Enterprise Linux 7 Performance Tuning Guide Monitoring and optimizing subsystem throughput in RHEL 7 Milan Navrátil Red Hat Customer Content Services Laura Bailey Red Hat Customer Content Services Charlie Boyle Red Hat Customer Content Services Edited by Marek Suchánek Red Hat Customer Content Services [email protected] Legal Notice Copyright © 2018 Red Hat, Inc. This document is licensed by Red Hat under the Creative Commons Attribution-ShareAlike 3.0 Unported License. If you distribute this document, or a modified version of it, you must provide attribution to Red Hat, Inc. and provide a link to the original. If the document is modified, all Red Hat trademarks must be removed. Red Hat, as the licensor of this document, waives the right to enforce, and agrees not to assert, Section 4d of CC-BY-SA to the fullest extent permitted by applicable law. Red Hat, Red Hat Enterprise Linux, the Shadowman logo, the Red Hat logo, JBoss, OpenShift, Fedora, the Infinity logo, and RHCE are trademarks of Red Hat, Inc., registered in the United States and other countries. Linux ® is the registered trademark of Linus Torvalds in the United States and other countries. Java ® is a registered trademark of Oracle and/or its affiliates. XFS ® is a trademark of Silicon Graphics International Corp. or its subsidiaries in the United States and/or other countries. MySQL ® is a registered trademark of MySQL AB in the United States, the European Union and other countries.
    [Show full text]
  • Remote-Serial-Console-HOWTO.Pdf
    Remote Serial Console HOWTO Glen Turner Australian Academic and Research Network <[email protected]> Mark F. Komarinski <mkomarinskiATwayga.org> v2.6 2003−03−31 Revision History Revision 2.6 2003−03−31 Revised by: gdt Correct opposing CTS/RTS explanations. Use <quote> in markup. TLDP PDF is now good, so remove instructions for rendering PostScript to PDF. Typo in GRUB configuration. Revision 2.5 2003−01−20 Revised by: gdt Only one console per technology type. Setting timezone. Use off parameter rather than comments in inittab. Cable lengths. Revision 2.4 2002−10−03 Revised by: gdt Kernel flow control bug, more cabling, Debian, Livingston Portmaster, typos (especially those found during translation to Japanese). Revision 2.3 2002−07−11 Revised by: gdt Updates for Red Hat Linux 7.3, corrections to serial port speeds and UARTs, ioctlsave. Revision 2.2 2002−05−22 Revised by: gdt Minor changes Revision 2.1 2002−05−16 Revised by: gdt Corrections to kernel console syntax. Addition of USB and devfs. Revision 2.0 2002−02−02 Revised by: gdt Second edition. Revision d1.0 2001−03−20 Revised by: mfk First edition. An RS−232 serial console allows Linux to be controlled from a terminal or modem attached to an asynchronous serial port. The monitor, mouse and keyboard are no longer required for system administration. Serial consoles are useful where Linux systems are deployed at remote sites or are deployed in high−density racks. This HOWTO describes how to configure Linux to attach a serial console. Dedication Glen Turner would like to thank his family for allowing him to work on this project for the surprisingly large number of evenings which it took to write this HOWTO.
    [Show full text]
  • HP Smart Update Firmware DVD User Guide
    HP Smart Update Firmware DVD User Guide Abstract This guide is intended for individuals who are familiar with the configuration and operation of Microsoft Windows, Windows Server, Windows XP, Windows Vista, smart components, and deployment of firmware and software to systems and options. Part Number: 447788-404 March 2011 Edition: 13 © Copyright 2007, 2011 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. The only warranties for HP products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. HP shall not be liable for technical or editorial errors or omissions contained herein. Confidential computer software. Valid license from HP required for possession, use or copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor’s standard commercial license. Microsoft, Windows, Windows Server, Windows XP, and Windows Vista are U.S. registered trademarks of Microsoft Corporation. Contents Introduction .................................................................................................................................. 5 HP Smart Update Firmware DVD overview ................................................................................................... 5 Minimum requirements ..............................................................................................................................
    [Show full text]
  • 31 Network Security, Threats, Authentication, Authorization, and Securing Devices
    31 network Security, threats, authentication, authorization, and Securing devices WenbIn Luo IntroductIon by intercepting the network traffic, keyboard logging, or simply guessing, then the attacker can get into all their other Nowadays, almost all the information is stored electroni- accounts that share the same password. Also, if an insider in cally in computers, network servers, mobile devices, or one system compromises their password, their accounts in other storage media. We cannot protect electronic infor- other systems are also compromised. mation in a cabinet in the same way we protected physical In this chapter, first, we will review private key encryp- documents in the past. We have to come up with new tech- tion and public key encryption techniques. Then, we will give niques to protect the information from unauthorized access, examples of how to perform private key encryption, public use, or manipulation. The easiest way to protect electronic key encryption, and digital signing using GPG. Second, we data is to encrypt it so that people cannot figure out what will discuss some of the threats, which a computer system it contains without knowing the secret keys. Over the last or user may face, and how they work. Third, we will exam- several decades, two major types of encryption techniques ine some existing authentication techniques and take a look have been invented: private key encryption and public key at various authorization methods, especially those used on a encryption. Linux system. Finally, the last topic will be on how to secure Private key encryption, which is also called symmetric devices. encryption, scrambles the original data with a secret key.
    [Show full text]
  • FUZE: Towards Facilitating Exploit Generation for Kernel Use-After
    FUZE: Towards Facilitating Exploit Generation for Kernel Use-After-Free Vulnerabilities Wei Wu, University of Chinese Academy of Sciences; Pennsylvania State University; Institute of Information Engineering, Chinese Academy of Sciences; Yueqi Chen, Jun Xu, and Xinyu Xing, Pennsylvania State University; Xiaorui Gong and Wei Zou, University of Chinese Academy of Sciences; Institute of Information Engineering, Chinese Academy of Sciences https://www.usenix.org/conference/usenixsecurity18/presentation/wu-wei This paper is included in the Proceedings of the 27th USENIX Security Symposium. August 15–17, 2018 • Baltimore, MD, USA ISBN 978-1-939133-04-5 Open access to the Proceedings of the 27th USENIX Security Symposium is sponsored by USENIX. FUZE: Towards Facilitating Exploit Generation for Kernel Use-After-Free Vulnerabilities Wei Wu?1,2,3, Yueqi Chen2, Jun Xu2, Xinyu Xing2∗, Xiaorui Gong1,3∗, and Wei Zou1,3 1School of Cyber Security, University of Chinese Academy of Sciences 2College of Information Sciences and Technology, Pennsylvania State University 3{CAS-KLONAT,† BKLONSPT‡}, Institute of Information Engineering, Chinese Academy of Sciences {wuwei, gongxiaorui, zouwei}@iie.ac.cn, {yxc431, jxx13, xxing}@ist.psu.edu Abstract 1 Introduction Software vendors usually prioritize their bug remedia- It is very rare for a software team to ever have suf- tion based on ease of their exploitation. However, accu- ficient resources to address every single software bug. rately determining exploitability typically takes tremen- As a result, software vendors such as Microsoft [13] dous hours and requires significant manual efforts. To ad- and Ubuntu [28] design and develop various strategies dress this issue, automated exploit generation techniques for prioritizing their remediation work.
    [Show full text]
  • Security for Linux on System Z
    Front cover Security for Linux on System z Learn about the new cryptography functions in the CEX3C Deploy security-related technologies in Linux on System z Understand protected key cryptography Lydia Parziale Jonathan Barney Vic Cross William Johnston Eduardo Kienetz Eric Marins Nilesh Patel Sri Venkatesen ibm.com/redbooks International Technical Support Organization Security for Linux on System z January 2013 SG24-7728-01 Note: Before using this information and the product it supports, read the information in “Notices” on page ix. Second Edition (January 2013) This edition applies to Version 6, Release 2, RSU 1101 of z/VM, SUSE Linux Enterprise Server version 11 Service Pack 2 and Red Hat Enterprise Linux version 6.2. © Copyright International Business Machines Corporation 2010, 2013. All rights reserved. Note to U.S. Government Users Restricted Rights -- Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp. Contents Notices . ix Trademarks . .x Preface . xi The team who wrote this book . xii Now you can become a published author, too! . xiii Comments welcome. xiii Stay connected to IBM Redbooks . xiv Chapter 1. Introduction. 1 1.1 Hardware configuration . 2 1.2 z/VM configuration . 2 1.3 Other software used . 2 1.4 Disk storage configurations. 2 Chapter 2. The z/VM security management support utilities . 3 2.1 The need for security management in z/VM . 4 2.1.1 Scaling up the proof-of-concept . 4 2.2 External security management . 4 2.2.1 z/VM internal security . 4 2.2.2 Reasons to use an ESM . 5 2.2.3 Selective enablement of an ESM .
    [Show full text]