[01:08] mercutio: from sort(1): "*** WARNING *** The locale specified by the environment affects sort order. Set LC_ALL=C to get the traditional sort order that uses native byte values." [01:11] hmm mine doesn't show that [01:12] mercutio: got that from a debian wheezy machine [01:14] yeah i can't find a way to repeat [01:14] it does say that in the man page though [01:14] oh i thought you meant it outputted that [01:14] try "A" and ".a" with en_US.UTF-8 and de_DE.UTF-8 [01:15] no it just said so in the man page [01:15] yeah [01:15] i only use sort to do uniq :/ [01:16] so as long as it sorts i don't worry too much [01:16] and it's usually on numbers anyway [08:20] the order wasn't case sensitiv elike it ususually is [08:21] mkb: what is your locale normally? [08:22] LANG=en_US.UTF-8 on these machines [08:22] patrick.georgi-clan.de/2015/02/17/intel-boot-guard/ [08:22] err, wrong channel [08:23] I can't reproduce, but I've heard of grep matching the wrong case too [08:23] Huh, peculiar. [08:24] locales are a UI thing and sort is used for a lot more than that so it doesn't seem to make sense to have sort change behavior on different locales [08:24] I mean there's a lot of scripts that didn't expect sort to do anything more than by byte number [08:24] Yeah it's well-known and documented that if you want consistent and cross-platform results in your programs/scripts, you set LC_*=C before calling out to anything. [08:25] I've had LC_ALL=C LC_CTYPE=en_US.UTF-8 on my desktop for a while since that's all that OpenBSD supports anyway [08:25] I guess I'll have to make sure I put that in .profile everywhere else [08:27] fwiw i can reproduce it on my Linux desktop. Normally, only variable set is LANG=en_CA.UTF-8 and sort does not function case-sensitive. If I unset that, or set LC_ALL=C, it's case-sensitive. [10:43] *** dwarren has quit IRC (Remote host closed the connection) [10:45] *** dj_goku has quit IRC (Ping timeout: 244 seconds) [11:10] *** dj_goku has joined #arpnetworks [11:10] *** dj_goku has quit IRC (Changing host) [11:10] *** dj_goku has joined #arpnetworks [13:19] *** _Zodiac has joined #arpnetworks [13:19] *** _Zodiac has left [15:32] *** djkrikke-2 has joined #arpnetworks [15:32] Hi, I'm looking for some common practices on datacenter ip subnetting [15:44] RFC 3531 comes to mind (it also works for IPv4, despite its title). It's how we allocate blocks to customers. [15:45] up_the_irons: I'm more interested in the technical aspect, like vlans and inter-vlan routing [15:46] like, is it common practice to VLAN customers? [15:48] djkrikke-2: no [15:48] djkrikke-2: arp does though [15:48] it's common practice to just stick everyone in a huge bridge domain [15:52] not that common practice is a good thing [15:52] mercutio: I see [15:53] mercutio: doesn't that generate a huge amount of broadcast traffic on switches? [15:53] djkrikke-2: most don't have mac address limits or ip restrictions or reverse path filtering. [15:53] djkrikke-2: yes [15:53] djkrikke-2: find a random cheap vps like vultr adn do tcpdump -p -l -n -i eth0 ! port 22 [15:54] the cable network here got so bad that routers started failing under the heavy arp load [15:56] mercutio: do you know a good solution? [15:56] djkrikke-2: well you can do what arp does, you can also do pppoe, and i am struggling to figure out what the best way is [15:57] with virtual machines, i've been experiementing with just having ip route default dev eth0 src [15:57] and having a single /32 routed to it. [15:57] mercutio: I was thinking of keeping a big subnet, but creating vlans, combined with proxy arp on the gateway [15:58] then those routes are picked up by routing domain on the host and propogated. [15:59] *** _Zodiac has joined #arpnetworks [16:00] *** _Zodiac has left [16:00] mercutio: what exactly does that ip route command do? [16:00] for physical machines i kind of like the idea of just having routed /29 tbh [16:00] djkrikke-2: it means you don't have a gateway, and it relies on proxy arp to get out [16:00] so you can have a netmask of 255.255.255.255 on the ip [16:00] oh, so you don't configure a gateway, but tell everything to go through eth0, and proxy arp answers on this? [16:01] yeh [16:01] well you have a gateway of the ethernet interface [16:01] is this for physical machines or virtual machines? [16:01] well physical, but I'm interested in your approach :) [16:02] so you have netmask 255.255.255.255 and a gateway ip [16:02] do you really need proxy arp then? [16:02] you just use the gateway for everything? [16:02] proxy arp was because i have stuff in bridge mode still [16:02] the gateway is just the ethernet interface [16:02] i don't know if need proxy arp or not [16:03] but it's enabled [16:03] if it's physical i would say that a /29 per user is better [16:04] the other thing you can do is you can have a /30 in rfc1913 space and route a /29 to /32 to them [16:04] depending on how much space they want [16:04] and use a normal gateway but you have like ip route add default via 192.168.32.77 src 4.2.2.2 [16:04] or wehatever ip you give them [16:05] i prefer /30 to /31 as it means you can always have low ip for gateway [16:05] which is the first ip of the block too [16:05] the way arp is doing it uses up a lot of ip addresses. [16:06] it's not necessarily bad - and if there were lots of ip addresses available then other hackish solutions wouldn't be so advantageous [16:06] but it's getting harder and more expensive to buy ip addresses. [16:06] like people are buying old companies to get ip address space! [16:06] actually i'm in apnic zone, and arin is apparently not so bad. [16:08] mercutio: yes that's the reason why I'm thinking about this subject, I'm looking into ways to optimize the ip usage [16:08] if you need a public ip for every subnet, wel.. [16:08] what kind of customers are you servicing? [16:08] as much as i hate the huge bridge domain, most people don't seem to care :/ [16:08] mercutio: it's for a local computer science club [16:09] with hundreds of users? [16:09] not hundreds :) [16:09] like 30? [16:09] but I'm a computer science student myself, so I'm always thinking about optimal solutions [16:09] something like that yes [16:10] with 30 it's probably fine to just have a /28 and two broadcast and gateway [16:10] or /27 if it's acutally 30, rather than nearly 30 [16:10] oh god [16:10] make that /27 and /26 [16:10] i went off by one :/ [16:11] mercutio: or... we could keep a big subnet, put them in 3 vlans and proxy arp? [16:11] there are pros and cons. one of the reasons peopel are doing it that way is that some people are doing two router solutions, with 3 ip addresses used for routers. [16:11] so each router has an ip on the subnet, then there's one that bounces between them [16:12] traffic can be forwarded from either to the host, and out the bouncing one [16:12] well the thing is vlans complicate things. [16:12] if you have a small setup then suddenly it means you're the only one who understands how it works. [16:13] mercutio: the reason why we want to isolate several "groups" is because it's for testing purposes [16:13] so usually i'd vote in favour of not increasing complexity too much, unless it's necessary. [16:13] ok [16:13] it's necessary then [16:13] so we want the traffic to be forced through the firewall [16:13] and that works with proxy arp and vlans [16:13] yeah [16:14] but I was thinking, can't large hosting providers save on ip's by using this strategy [16:14] large hosting providers usually have heaps of ip addresses they got earlier. [16:14] instead of subnetting, just use vlans per user and filter broadcast traffic [16:14] it's small and medium providers that hav higher requirements for ip's [16:14] and use a large block [16:14] small providers don't usually have expertise, and medium providers .. [16:15] well that's where innovation can happen i suppose [16:15] i actually have been thinking about pppoe per user more and more recently [16:15] now there's in kernel etc for ppp [16:15] it's not really that high overhead [16:16] mercutio: I'm not that familiar with pppoe, but it's some kind of tunnel right? [16:16] yeah kind of [16:16] 8 byte overhead [16:16] well it can be 6 i think [16:16] but yeah 8 is normal overhead spoken of [16:17] basically it means you have a radius server, a ppp server. [16:17] the ppp server deals with terminating the connections, the radius server deals with authentication and accounting [16:17] bringing easy talleys of data done, making it easy to disconnect users, add ip addresses etc. [16:18] and not wasting ip's [16:18] that said i'm familiar with ppp/radius so it doesn't seem such a big complexity to me [16:18] http://sourceforge.net/projects/accel-ppp/ [16:18] so you can use something like that [16:18] oh which can do rate limits too [16:20] djkrikke-2: it is not common to VLAN customers, but I do it because it makes sense and customers like it [16:20] djkrikke-2: you're right in that the way most providers do things, it makes arp storms a problem [16:20] up_the_irons: just for internal isolation? So that they can have internal traffic? [16:21] or with filtering in between? [16:21] mercutio: rate limiting is pretty interesting too ;) [16:21] djkrikke-2: well it simply makes sense that each customer have a private network; it segregates things nicely [16:21] djkrikke-2: i have isp background so radius/ppp is more familiar to me too [16:22] djkrikke-2: also, it allows mixing of services easily; some customers have VMs and also dedicated servers, or VMs and colo [16:24] up_the_irons: That makes sense, but you combine it with subnetting right? [16:24] so that for outer-vlan traffic, the gateway is always used? [16:24] i'm not sure what exactly you're referring to when you say subnetting; that's a very general term [16:25] yes gateway is always used for outside traffic [16:25] I mean that every customer has a separate subnet, like for example a /29 [16:25] yes [16:26] up_the_irons: allright [16:26] don't you think that's a waste of public ip's, when you need a gateway for every subnet? [16:27] go rfc1918 :) [16:28] oh djkrikke-2 another way people in more commercial environments do things is sometimes direct to direct nat [16:28] like one to one mapping... so they'll have internal subnets everywhere, and just remap from an external ip to an internal ip [16:28] mercutio: yes, I was thinking about that too. But...NAT [16:29] djkrikke-2: it's not like normal nat evilness [16:29] you can do it stateless [16:29] so 1-to-1 mappiung [16:29] mercutio: true, but you can't for example configure a cpanel with an internal ip, then it will create dns records with internal ip's etc [16:29] or sip sessions [16:31] djkrikke-2: it does tend to use IPs, yes [16:33] (And steak does tend to use cows. The world is imperfect, but you do what you gotta do.) [16:33] djkrikke-2: i don't use cpanel [16:33] brycec: maybe we can solve that cow problem too :) [16:33] No I'm just wondering if there are better solutions, that's all [16:34] it's more common with people using load balancers etc. [16:34] which cpanel isn't really aimed towards. [16:34] ipv6 makes everything less painful. [16:38] so i registered localdomain.nz does that mean that people with search paths are going to hit my domain? [16:38] djkrikke-2: i'm not aware of better solutions, but i haven't investigated it in a long time; do tell if you find something promising :) [16:39] up_the_irons: well my idea is to have a router that knows about all the ips and vlans [16:39] then you can create a vlan per customer, take a big subnet, and let the router handle the arp proxying [16:40] djkrikke-2: he's terminating on cisco, which makes these more complicated setups a bit more troublesome. [16:40] linux makes it easier to shoot yourself in the foot [16:40] djkrikke-2: so you would have a large subnet, but separate VLANs. how would you prevent one node from taking another's IP? [16:41] and yeah, i only do hardware packet forwarding for main traffic [16:41] up_the_irons: if the router knows about the IP's in a specific vlan, it can take that into account? [16:41] so that when the same IP is in another VLAN, nothing happens? [16:41] That's what she said!! [16:42] So, MAC pinning [16:42] (or static MAC) [16:42] Which isn't very flexible for the customer [16:42] i hate mac pinning [16:42] well, the customer is always in his VLAN? [16:42] more IP pinning [16:43] tbh, pppoe is the easiest solution :/ [16:43] but it does add a little of complexity to each userr. [16:49] hmm, ok, it's 2 am over here so I'm going to get some sleep. Thanks for the discussion brycec, up_the_irons and mercutio :) [16:49] djkrikke-2: it's a complicated topic [16:49] 'night [16:49] Thank you [16:50] djkrikke-2: on cisco, you can't have the same subnet be in two separate VLANs [16:50] djkrikke-2: 'nite! [18:16] sophos sent me fancy unicorn socks [18:24] *** _Zodiac has joined #arpnetworks [18:24] *** _Zodiac has left [21:16] *** jlgaddis has quit IRC (Ping timeout: 250 seconds) [21:21] *** jlgaddis has joined #arpnetworks [22:11] *** DaCa has quit IRC (Remote host closed the connection)