[Music]
okay welcome back to the system in min
conf um next up we have paul warren
talking about some slightly more
advanced networking with linux a
reminder if you have questions during
this talk just put them into the
questions tab in venulis okay take away
paul
all right good day folks
my name's paul here to talk about some
stuff i've learned over the last little
while
networking with linux
first of all a bit of a warning that i'm
not a network engineer there are bits i
don't know and there's probably gaps
that will
you know potentially cause issues so
don't blame me if your network
stops working
and maybe don't go try building an isp
based off this talk
and as another sort of
aside my uh
i've just moved house and that was an
experience that i was woefully
unprepared for
so please keep that in mind
so i thought we'd start like what what
even is a network i mean
is it ethernet
maybe token ring
ipx
ax25
or is it something more like ipv4 or six
or tcp
i like to think of it as something that
allows connections between computers
uh in in this uh talk i'm mostly going
to talk about ethernet and ipv6 although
it sort of
doesn't really matter that part of it
and the the stuff we'll talk about will
be mostly based on
ethernet and ip
most of us probably work in a managed
network
where
the idea is to control connections
between computers rather than just allow
they also scale much more
managed networks also scale connections
between computers
and you've probably seen this this
diagram of the three tier in your core
distribution access
network they're
um which is not likely to be something
we have at home we have a pretty flat
edge network at home
and this diagram while it's nice it does
hide a lot of complexities at each layer
and is not something i know a great deal
about and
i invite you to research further about
this methodology
networking and as you probably have
already
understood is about layers
like an onion or a parfait if you like
that better
there's that seven layer thing from the
osi which i can't remember what it
stands for
which we can
mostly ignore because it doesn't you
know because what we generally use in
the real world doesn't sort of conform
to it very well but is a good um
framework for assisting in in
understanding
so you know the general networks we use
are basically ethernet with ip on top of
that and then various flavors of other
you know layer 3 networks of icmp tcp
and udp
it can also be administrative overlays
things like
firewalls web proxies ssl man in the
middle um things for enterprise but also
things like access rights and
bandwidth shaping and things like that
there no that's the wrong button
sorry about that
oh yes and the last one there was for
vpns and tunnels which allow you to put
networks through other networks and have
them appear in strange places
and that's sort of so that
means that the physical layers don't
have to match the logical connections
and
you know you can distribute your network
across multiple physical networks
and it all should just work
they're also a bit fractal in nature so
you know large-scale networks
are sort of self-similar the more you
delve into the details
but we can ignore a lot of this
complexity for the stuff that i'm going
to talk about today because that's
really advanced networking not slightly
advanced networking
so i sort of start off with
an easy one on linux which is vlans or
virtual local area networks
it's an ethernet layer protocol
designed to limit broadcast storms and
you can use it to separate ip networks
on the same ethernet
there is a concept of a tag in this
in vlans which is a
4096
up goes up to 4096 so some bit number
that i can't remember
and that is used to separate these
uh
vlans at the ethernet layer it's part of
the ethernet frame
the untagged network is the default one
that your nic will respond to
if nothing else is set and then
most nics
need to have some
magic done to them so they can respond
to tagged
packets from the ethernet
it's defined in the ieee
802.1q standard and zooms pretty
interesting read
in linux it's pretty easy to get one
going and with the ip command
you just run something like that you add
a link
and give it a name and tell it that it's
for vlan id and then your number then
you can as normal add addresses routes
and whatever on top of that and then set
it up to make it all go
distributions
do this in various different ways
in debian it's
the in etsy network interfaces
you tell it to
you know in create the the interface and
then
set it up with the hcp in this
particular case and it takes care of all
the ipsec and iplink link
commands for you
now open w
open wrt has a nice gui to do all this
sort of stuff
and can also use the hardware present on
most
cpu endpoint routers and switches to
do it at a hardware level so you can set
one particular port to have
a tagged vlan everywhere else be
untagged on that port
so here's sort of what i've done
with uh with vlans in my
my home network so i've got my normal
router on the edge there
which has three main vlans the
production network or untagged
which is you know production in the
sense that it's the netflix and youtube
that my kids watch
along with
my web host the work computers and
desktops for my wife and all of that
then i have another one or an actual
tagged vlan for the wi-fi guest network
um so all the traffic there is
segregated out and firewalled off
completely from
all the other vlans
and i'll also put this what i call an
access vlan or that's probably not the
right terminology it should be i think a
distribution vlan
but that's where all the other routers
that i'm
mucking about with
sit so they can talk to each other so
i've got a um
yeah open sense test network same with
open wit
and the uh the
internet for the
knorry
tutorials which i'll link later it's a
really interesting tutorial on where i
learned most of the stuff i'm talking
about today
okay so the next one is
we talk about routing and what is a
router
i think it's a
computer that has two or more interfaces
and it does some sort of computation to
determine where a packet goes
which interface the packet goes to
in linux it's reasonably simple to turn
a linux machine into a router you add to
the siskit or config and this set of
stanzas tell it to
forward for ipv4 and ipv6
and we're done
yeah no not really
that's that sets up the ability to do
routing but you also have to do things
like actually add routes
so static routes is the the normal one
usually manually added or by scripts
including things like scripts from dhcp
which is as you probably know a
mechanism to dynamically assign ips
within a network they will also send out
information like the
the default route for the network and
dns ntp servers whatever else there's a
whole bunch of stuff you can do with
dhcp which i should probably have talked
about but i didn't think of it
so this one here is just adding a route
via
a particular router on an interface with
wireguard interface in this case
uh you can also
you know
do ipv6 and i never did get this to work
right so you can see it all
but you know this is
you know a few more
but manually adding these you can
imagine
it comes quickly it quickly becomes
unwieldy with expanding networks
it's like this one so this is sort of my
home network with the k nori side
expanded on a little bit
you can imagine for a
machine you know say in the wi-fi sorry
in the
open wrt test network there to try and
talk out to something
in the k9 network
it would have to have a lot of static
routes
to know where to go properly
so this is where dynamic routes come in
so a dynamic routing
thing is where you
advertise the lands on your router
discover routes to
lands on other routers
if you need to do some logic and then
add them to the kernel space routing
table
on linux we don't have this built into
the kernel but we have some user space
domains and talking to the kernel
networking stack
so the main
protocol is this open shortest path
first
protocol it uses the you know digits
graph minimization cost a graph
traversal cost minimization algorithm
and it's defined in in the rfcs 2328 and
5340
and it's four
uh
dynamically assigning routes within
within your network
um
the other dynamic routing protocol is a
border gateway protocol
oops that didn't work well
but that's uh for
talking outside you know sharing your
dynamic routes outside your network
and
as part of an autonomous system
and this is sort of something i don't
really know a lot about and is what i
would consider even more advanced than
slightly
for
uh the user space diamonds the main one
i've used is the berkeley internet
routing daemon there's also quagga
open bgpd
from the open bsd project
there's significant overlap but they are
different and support slightly different
things
and yeah i've not used quagga there are
probably others
[Music]
and i think there are
specific ones within things like the
cisco ios and microtic operating systems
but i'm not at all familiar with them
so
the berkeley internet routing diamond or
bird is a very powerful and complex to
configure although it's not quite turing
complete
um
i would recommend you use version
control on
i use git on slash etc bird
and wherever your distro stores that's
what i recommend because
you've got tracking changes which can
undo
your last change which made nothing work
so the bird config file is
built up of these protocol blocks
and the most important part i suppose is
the
the router id
um
that's
excuse me
that's usually one of the routers ipv4
address
addresses and the default that
bird chooses the lowest one that's not
on the loopback
interface it needs to be unique
across your network not necessarily
globally
yeah
there are lots of protocol block types
including ospf bgp there's rip
a whole bunch of them
the documentation for bird is really
good
and and tells you a lot about what each
of these blocks needs it's really
relatively straightforward to follow
so the protocol blocks a how bird knows
who or what to talk to and how so
in the next slide yeah we've got an ospf
protocol block which uh talks it has an
area and an interface
oh that's what i was going to mention so
back here we've got this device
protocol so in there you can specify
to ignore particular network interfaces
or
give certain others higher priority or
higher costs that sort of thing
oh yes and yeah that's all good
so this
is a bit of a more advanced diagram with
a reasonably complex set of
things but it shows you sort of so each
circle there is a protocol
there's a the rspf you can see at the
top and then the kernel
and so you know it's importing
routes from the wider ospf protocol that
it gets stuffing it all into the master
table and then
exporting that to the linux kernel
now on the other side you've got some
strange bg penis
which
goes into this temporary table tr-10
then through a pipe
and pipes uh
where the logic can happen so you can
start aggregating or ignoring or
doing things as needed
for
to the routes that are discovered and
you can put them in between any other
protocol and any other
table
all right so
what inspired me to do this talk is this
funky thing i found you can do
with ospf
so say you have some necessary service
within your network
that can be
where you know where the data is more
efficiently
obtained across local links but can
still get
the same data across a more expensive
link
if the local version goes down
so all you need is an ip on a host or
many hosts that provide that services it
that service
and you can use that same ip in two
different places in the network
one might think that this is going to
lead to confused routes
but ospf
helps us out
so there's a little bit of a diagram of
you know two offices one in perth and
one in hobart
um
you know both
having you know computers on the bottom
talking to their own network with a
router in the middle
and an expensive link
connecting the two
but then we have these two
services running on this 172-17055
ip address and the way ospf works is you
can add a cost
you know it's just a number to scale
uh within ospf you can add a cost to
each link on a router so you know up you
know on the hobart office router you'd
say the
link up to that top network is say 10
and then the expensive link off to perth
is 100 and what will happen then is that
that hobart router will think the
172170 network is local
and everything on that side of the link
will then talk to that service on that
side
if the
local link goes down
the will then go across the expensive
link to perth and you know hopefully
with your
synchronization the data's the same
and it all still hangs together
so that's right that was this was what
was causing so um late last year there
was a big outage with facebook
this is what they were doing with their
dns services
and they added a
line in which turned off the uh
part of the way bg ospf works turned it
off so no one could talk to the dns
which meant nothing worked
so you do have to be careful with these
things but they are they're pretty
powerful
all right so i sort of thought why would
you want to use
a real router and then the main reason
is probably going to be performance and
scaling
the on a
linux based router you have a packet
come in through the nik hardware which
then has to copy the whole thing to
driver memory
then off
again to various kernel subsystems
which can make the routing decision or
you know potentially going out to some
user space
application if needed
and then back out the same path through
the kernel subsystems into the driver
memory and then out the neck hardware
in comparison a
enterprise level router
has
the packet come in and just enough of
the packet to get the address is copied
to the routing silicon where the routing
decision is made and then the silicon is
switched to forward the packet out the
correct nick
nick hardware
at wire speed so it's a switched
physical connection usually although i'm
sure that's all
done in asics and fpgas these days
so yeah yeah performance
i mentioned that so there's a lot of
work being done currently on links with
zero copy networking so we can do sort
of the same sorts of things pass
pointers around i suppose i'm not
sure how it all goes together and then
the i o urine
part of linux also has some smarts and
other bits and pieces that tie into this
pretty well
some other considerations uh so network
engineers are generally not familiar
with linux networking they're much more
familiar with things like cisco eyes or
ios or a micro ticks operating system
and
excuse me
yeah they have much more significant
skills in those networking stacks than
they will with
with linux
there's also the the
availability of hardware for you know in
terms of ruggedness and suitability for
working in a data center
a lot of stuff that linux supports
is not
great at that
and you know power consumption is
another problem
um
not so much in the data center though
it's becoming more and more important i
suppose um then you can also sort of
have both
so open wrt
is my favorite thing for doing
networking with
it does work on a lot of enterprise
level you know routers and switches and
stuff and does support a lot of the
hardware
on a lot of those
[Music]
so yeah i didn't get to explore bgp
as much as i'd like i'm not yeah not uh
too confident in my understanding of it
as yet but it is how the internet's put
together
and can do some even more funky tricks
like our service example
uh things like
uh the um
the netflix data centers and netflix
caches
yeah you can do all sorts of fun tricks
all right
so
i put in some some bonus homework if you
want to
learn a bit more you can try asking
yourself
those few questions there
idea very highly recommend going through
k nori's
ospf and bgp tutorial
it's really worthwhile
i didn't cover ospf areas much and
so the idea is that ospf is done in
areas and you can split that up within
birds so it talks
in areas
so you usually have the area zero which
is where all routes are shared and you
can then you know fractalize that out to
other areas
with smaller networks
and then there's also the problem of
authentication and authorization so ospf
by default will just accept routes from
anywhere
you may want to
hash that or password protected or other
things all certainly possible
and you know
the stuff i have done with bgp was a bit
minimal and requires internal bgp
to be set up sort of manually i'm
assuming there'll be a automatic
transfer of internal aggregate networks
but i haven't looked into it
all that much
so
the resources for this um maybe these
slides the bird website's great so is
open wrt the irc channel for opened up
wit has been really helpful to me over
the last couple of years
and if you want to know more about why
facebook was down for five hours there's
a really good youtube video
uh from ben eater
to look at
and there's the 802.1 q link which i
couldn't get to work in the other slide
i think but yeah that's the the protocol
design uh documents there
huh and that's my talk i'm a little bit
early i think so
feel free to ask some questions
yeah we don't have any questions yet um
now we are on a delay so if you got any
questions please type them in really
fast
yes so we're talking about 30 seconds in
the future
so i'll give it a couple of i'll give it
a give it a few seconds and then um
it might be it there is some
some discussion in the chat chat room
people talking about general networking
stuff and that and
recommending their favorite little
things and crazy stuff so excellent
yeah
so
we've got a networking theme at least
okay uh
i think we don't have any questions all
right
okay so um yeah thank you
sorry my brain's gone
so yeah thank you very much paul
um all right obviously but stressful
week moving for you but
thanks thanks for joining us and giving
us a talk
no trouble thank you