gmane.os.solaris.opensolaris.networking

ipf increase NAT table

skeletor — 2013-02-22T09:26:16

Hello all.
How to increase a NAT table, for example for 300000 sessions? I have tried

#ipf -D -T ipf_nattable_sz=10009,ipf_nattable_max=300000 -E

but after this NAT hangup and doesn't work.

$ uname -a
SunOS router 5.11 11.1 sun4v sparc SUNW,Sun-Fire-T1000

On FreeBSD i recompile kernel with bigger values and it works fine, but 
in Solaris - i doesn't want to recompile kernel/ipf.

Thanks.

Re: IPMP - Programmatic interface

Peter Memishian — 2012-07-25T19:28:34

 >  > I want to perform following operations in C/C++ -
 >  > - given a set of interfaces, configure IPMP group containing those interfaces
 > 
 > That definitely will need to be done through ifconfig/ipadm.
 > 
 >  > - monitor IPMP group for failure - take some action on failure 
 > 
 > This can be done through routing sockets by monitoring the IFF_FAILED flag
 > on IFF_IPMP interfaces.

One note: due to limitations in the routing socket message format, the
IFF_FAILED and IFF_IPMP flags will not be visible in rtm_flags.  As such,
you'll need to use the RTM_IFINFO message as hint that you should call
SIOCGLIFFLAGS and check to see if the flags have changed.

 >  > - if possible, move one virtual IP address from one active interface to
 >  > another one the same IPMP group
 > 
 > The kernel has control over which IP addresses are bound to which active
 > interfaces.  Thus, if you have more than one active interface, you cannot
 > explicitly control this.  Further, note that in the future the kernel may
 > el

Re: IPMP - Programmatic interface

Peter Memishian — 2012-07-25T19:23:27

 > I want to perform following operations in C/C++ -
 > - given a set of interfaces, configure IPMP group containing those interfaces

That definitely will need to be done through ifconfig/ipadm.

 > - monitor IPMP group for failure - take some action on failure 

This can be done through routing sockets by monitoring the IFF_FAILED flag
on IFF_IPMP interfaces.

 > - if possible, move one virtual IP address from one active interface to
 > another one the same IPMP group

The kernel has control over which IP addresses are bound to which active
interfaces.  Thus, if you have more than one active interface, you cannot
explicitly control this.  Further, note that in the future the kernel may
elect to rebind at any time -- e.g., based on monitoring the load across
the active interfaces.

 > Thanks and Regards,
 > Paresh Bafna
 > 
 > 
 > -----Original Message-----
 > From: Peter Memishian [mailto:Peter.Memishian-veTT2BtV2gBXrIkS9f7CXA< at >public.gmane.org] 
 > Sent: Tuesday, July 24, 2012 10:58 PM
 > To: Paresh Bafna

Re: IPMP - Programmatic interface

Paresh Bafna — 2012-07-25T05:17:41

Hi,

I want to perform following operations in C/C++ -
- given a set of interfaces, configure IPMP group containing those interfaces
- monitor IPMP group for failure - take some action on failure 
- if possible, move one virtual IP address from one active interface to another one the same IPMP group

Thanks and Regards,
Paresh Bafna


-----Original Message-----
From: Peter Memishian [mailto:Peter.Memishian-veTT2BtV2gBXrIkS9f7CXA< at >public.gmane.org] 
Sent: Tuesday, July 24, 2012 10:58 PM
To: Paresh Bafna
Cc: Peter.Memishian-veTT2BtV2gBXrIkS9f7CXA< at >public.gmane.org; networking-discuss-xZgeD5Kw2fzokhkdeNNY6A< at >public.gmane.org
Subject: RE: [networking-discuss] IPMP - Programmatic interface


 > I am looking for stable/supported interface for configuring and
 > monitoring IPMP groups from C/C++ program. 

If you could be more specific I may be able to suggest a stable/supported
way to do what you want in C/C++.

 > Looks like I will have to move towards CLI interface.
 > 
 > Thanks all for help.
 > 
 > Thanks and Reg

Re: IPMP - Programmatic interface

Peter Memishian — 2012-07-24T17:27:37

 > I am looking for stable/supported interface for configuring and
 > monitoring IPMP groups from C/C++ program. 

If you could be more specific I may be able to suggest a stable/supported
way to do what you want in C/C++.

 > Looks like I will have to move towards CLI interface.
 > 
 > Thanks all for help.
 > 
 > Thanks and Regards,
 > Paresh Bafna
 > 
 > 
 > -----Original Message-----
 > From: Peter Memishian [mailto:Peter.Memishian-veTT2BtV2gBXrIkS9f7CXA< at >public.gmane.org] 
 > Sent: Friday, July 20, 2012 10:06 PM
 > To: Paresh Bafna
 > Cc: networking-discuss-xZgeD5Kw2fzokhkdeNNY6A< at >public.gmane.org
 > Subject: re: [networking-discuss] IPMP - Programmatic interface
 > 
 > 
 >  > I read about libipmp library which provides programmatic (ioctl/system
 >  > calls) interface to configure and monitor IPMP groups.
 >  > 
 >  > However I am not able to find any documentation or library itself for use.
 >  > 
 >  > Please provide more info on libipmp.
 > 
 > As Jim said, this is a private/unstable library.  If you

Re: IPMP - Programmatic interface

Paresh Bafna — 2012-07-24T06:41:26

Thanks for your reply.

I am looking for stable/supported interface for configuring and monitoring IPMP groups from C/C++ program.
Looks like I will have to move towards CLI interface.

Thanks all for help.

Thanks and Regards,
Paresh Bafna


-----Original Message-----
From: Peter Memishian [mailto:Peter.Memishian-veTT2BtV2gBXrIkS9f7CXA< at >public.gmane.org] 
Sent: Friday, July 20, 2012 10:06 PM
To: Paresh Bafna
Cc: networking-discuss-xZgeD5Kw2fzokhkdeNNY6A< at >public.gmane.org
Subject: re: [networking-discuss] IPMP - Programmatic interface


 > I read about libipmp library which provides programmatic (ioctl/system
 > calls) interface to configure and monitor IPMP groups.
 > 
 > However I am not able to find any documentation or library itself for use.
 > 
 > Please provide more info on libipmp.

As Jim said, this is a private/unstable library.  If you write code that
uses it, the only guarantee is that your code will break in the future :-)

As an aside: libipmp does not configure IPMP.  For S11 FCS, that
functiona

Re: IPMP - Programmatic interface

Peter Memishian — 2012-07-20T16:35:38

 > I read about libipmp library which provides programmatic (ioctl/system
 > calls) interface to configure and monitor IPMP groups.
 > 
 > However I am not able to find any documentation or library itself for use.
 > 
 > Please provide more info on libipmp.

As Jim said, this is a private/unstable library.  If you write code that
uses it, the only guarantee is that your code will break in the future :-)

As an aside: libipmp does not configure IPMP.  For S11 FCS, that
functionality lives mostly in another private/unstable library (libipadm).
Further, the programmatic mechanism used to configure IPMP is also subject
to change at any time.  The only stable configuration mechanisms are the
command-line utilities.  For monitoring, tracking the IFF_* flags is
stable and will cover the basics; beyond that you'd need to use ipmpstat's
parsable mode.

Hope this helps,
--
meem

Re: IPMP - Programmatic interface

James Carlson — 2012-07-20T11:49:02

Some (actually, many) libraries have no interface designed for use by
anyone outside of the project team that implemented them.  They're not
necessarily "secret," but the team that wrote them either does not
believe that they represent useful interfaces for other projects or that
the team does not (or cannot) commit to a sufficient level of stability
to make the interfaces safe enough to use in any other project.

So, the answer really depends on what you're trying to do.  However, if
you're bound and determined to use it anyway, Google is your friend.
Here's the first hit when I plug "libipmp" into the search box:

http://arc.opensolaris.org/caselog/PSARC/2007/272/commitment.materials/libipmp.txt

IPMP - Programmatic interface

Paresh Bafna — 2012-07-20T06:54:25

Hi,

I read about libipmp library which provides programmatic (ioctl/system calls) interface to configure and monitor IPMP groups.

However I am not able to find any documentation or library itself for use.

Please provide more info on libipmp.

Thanks and Regards,
Paresh Bafna

Re: Increasing buffer size onsockets/socketpairs?

Peter Memishian — 2012-06-01T22:46:03

 > Does Solaris/Illumos have an API to increase the buffer size for
 > sockets or socketpairs?

You mean other than the standard SO_SNDBUF socket option?

Re: scalability and memory consumption of the DCE cache

Kacheong Poon — 2012-02-07T09:54:37



I think your analysis is correct.  And I have opened a bug to track
this issue.  Thanks for your info.

workaround: scalability and memory consumption of the DCE cache

Nils Goroll — 2012-02-06T18:29:02

Hi,

I was looking for a way to purge the cache and have come up with this to trigger
the reclamation code:

#!/bin/bash
ndd -set /dev/ip ip_dce_reclaim_fraction 1
{
echo '%/l/lotsfree >oldlotsfree'
echo 'lotsfree/Z ((%/l/freemem)*4)'
sleep 2
echo 'lotsfree/Z <oldlotsfree'
} | exec mdb -kw

any better ideas?

Thanks, Nils

scalability and memory consumption of the DCEcache

Nils Goroll — 2012-02-06T17:36:47

Hi,

I am analyzing issues on some s11 (151.0.1.12) production systems used as
Varnish web caches with a high number of concurrent connections from a high
number of tcp clients where client-side statistics/benchmarks would show long
connect times at times, e.g. 2.7 seconds connect maximum reported in ApacheBench
compared to normal .6 seconds (which already was far too bad, see below)

I would very much appreciate if I could discuss my current understanding with
someone.

* The issue is related to the DCE cache

  Using

  dtrace -n 'profile-1001 { < at >s[stack(),ustack()] = count();} END {trunc(< at >s,5)}'

  i noticed that the top stacks were

CPU     ID                    FUNCTION:NAME
  2      2                             :END


              ip`ip_snmp_get_mib2_ip_dce+0xbe
              ip`ip_snmp_get+0x267
              ip`snmpcom_req+0x293
              ip`ip_wput_nondata+0xd5
              unix`putnext+0x21e
              unix`putnext+0x21e
              unix`putnext+0x21e
              unix`putnext+0x21e

Re: ioctl(sock, FIONBIO, 0) returns ECONNREFUSED after non-blocking connect() or accept()

Nils Goroll — 2012-02-06T16:03:32

Just a very late follow-up: I have finally got around closing the varnish
ticket, this turned out not to be ralated to Solaris.

Re: etherstub - backup interface?

Krishna Yenduri — 2011-10-26T22:26:32

  etherstub is really a stub and you can not create it
  with any datalinks. So, the above is not possible.

  One option here is to create vnic1 on top
  of aggr0 and vnic2 on top of aggr1 and assign both of them
  to Zone A. You can then use IPMP on top of the VNICs
  in Zone A. You can repeat this for all the zones by
  creating more VNICs on top of aggr0 and aggr1.

Regards,
-Krishna

etherstub - backup interface?

Jens Elkner — 2011-10-26T14:11:45

Hi,

is it possible to tell etherstub, that one link is the backup for
another?

What I have in mind is simplifying/uniform zone setup/connectivity ->
zone management:


  CampusA ||       || CampusB
      +------------------+       2x10G       +--------------------+
      | Cisco 6509/3560X |<=================>|   Cisco Nexus 5010 |
      +------------------+                   +--------------------+
Uplinks:     ^ ^                                 ^ ^
  _________  | | 2x1G _________________________  | | 2x10G ______________
 /           \V/                                 \V/                    /
/             T                                   T                    /
\             | aggr0                             | aggr1              \
 \            v                                   v                     \
  \       +---------------------------------------------+                \
  /       |             etherstub es0                   |                /
 /        +-------------------------------------

Re: Can't find package SUNWyp in ISO image

alan pae — 2011-09-30T21:39:43

http://dlc.sun.com/osol/docs/content/2009.06/IMGPACKAGESYS/giifx.html

Re: Can't find package SUNWyp in ISO image

alan pae — 2011-09-29T20:51:17

It looks like you're missing several packages.

system/network/nis
service/network/nis

should be installed.  Are they?

alan

Re: Can't find package SUNWyp in ISO image

alan pae — 2011-09-28T20:43:52

try pkg search or pkg search -r

alan

Re: igb becomes sender only on Intel 82576 [kawela] (X8DTH-6F motherboard)

2011-09-15T09:13:34

John,

Many thanks for your reply!

I've added the line to /etc/system but I haven't rebooted yet. According to http://wesunsolve.net/bugid/id/6958068 another workaround is to add

cpu_deep_idle           disable

to /etc/power.conf and to then run pmconfig. The workaround doesn't mention having to reboot after running pmconfig, and the man page for pmconfig indicates that changes are made effective immediately. Is this sufficient to change the cpu_deep_idle setting or do I actually need to reboot? (This system is sensitive to downtime from rebooting, so I'm hoping to avoid the reboot if it's not necessary.)

Also, before I made the above change, I created a new dtrace script that trace the processing of the open(/dev/arp) system call in the arp process and had this run from cron every 5 minutes. The issue occurred again after I made this change (but before I changed the above power setting) where it was offline for a couple of minutes. I've attached the resulting dtrace output, as well as the dtrace scripts

Re: igb becomes sender only on Intel 82576 [kawela] (X8DTH-6F motherboard)

John Cui — 2011-09-14T07:54:43

Hi Kevin,
This symptom looks similar with a known Intel CPU issue.
Erratum AAK76
EOI Transaction May Not be Sent if Software Enters Core C6 During An Interrupt Service Routine
==================================================================
Problem: If core C6 is entered after the start of an interrupt service routine but before a write to the APIC EOI(End of Interrupt) register, and the core is woken up by an event other than a fixed interrupt source the core may drop the EOI transaction the next time APIC EOI register is written and further interrupts from the same or lower priority level will be blocked.

Please try the workaround:
Add the line

set idle_cpu_no_deep_c = 1

to /etc/system and reboot.

Cheers,