Sunday, March 04, 2018

Re: OSPF over gif on top of IPsec transport -current

On 2018-03-04 13:31, Stefan Sperling wrote:
> On Sun, Mar 04, 2018 at 01:08:21PM +0200, Atanas Vladimirov wrote:
>> Please, let me know if I'm doing something wrong/stupid or this is bug
>> somewhere in the stack.
>
> I can't spot anything wrong in what you've shown but it seems you're
> not looking at all the data you could be looking at.
>
> What might help with diagnosing the issue is monitoring the output of:
>
> netstat -I gif0
> netstat -I enc0
>
> and:
> netstat -s
>
> Look closely at how the counters change, and find the ones which
> could relate to an OSPF packet being dropped.
>
> Also, check if pf is dropping related packets by logging any blocking
> rules and checking pflog0 with tcpdump as well.

Hi Stefan,

I forgot to mention that both gif0 and enc0 are disable in pf.conf (set
skip on {...}).
Also I have a `pass quick log proto ospf` rule.

With `netstat` I observe the same behavior, packets going out on gif0 -
no packets in.

ns]~$ netstat -I gif0
Name Mtu Network Address Ipkts Ierrs Opkts
Oerrs Colls
gif0 1400 <Link> 0 0 8142
0 0
gif0 1400 10.255.255. 10.255.255.2 0 0 8142
0 0
[ns]~$ netstat -I enc0
Name Mtu Network Address Ipkts Ierrs Opkts
Oerrs Colls
enc0* 0 <Link> 8820 0 8870
0 0

I'll try to take a deeper look on this.
Thanks for your time and effort,
Atanas

No comments:

Post a Comment