Wireshark 'in' operator

The thing I'm working on has gotten to the point of looking at pcaps. I love a good ol' hexdump (shout out to FreeBSD's in kernel hexdump and honourable mention to printf(9) offering bitfield and byte dump function.

More than a hexdump I love a packet capture. When asked I'll say -xx is my favourite tcpdump flag narrowly beating out -ttttt .

Wireshark expressions can get a bit cumbersome if you are trying to look at many things. Luckily you can use the membership ( in ) operator as a filter . As an example this will give you ieee80211 probe requests, probe responses, assoc requests and responses only requiring you find the types somewhere (like a header file /usr/include/net80211/ieee80211.h ): 

#define IEEE80211_FC0_SUBTYPE_MASK              0xf0
#define IEEE80211_FC0_SUBTYPE_SHIFT             4
/* 802.11-2020 Table 9-1-Valid type and subtype combinations */
/* For type 00 Management (IEEE80211_FC0_TYPE_MGT) */
#define IEEE80211_FC0_SUBTYPE_ASSOC_REQ         0x00    /* Association Request */
#define IEEE80211_FC0_SUBTYPE_ASSOC_RESP        0x10    /* Association Response */
#define IEEE80211_FC0_SUBTYPE_REASSOC_REQ       0x20    /* Reassociation Request */
#define IEEE80211_FC0_SUBTYPE_REASSOC_RESP      0x30    /* Reassociation Response */
#define IEEE80211_FC0_SUBTYPE_PROBE_REQ         0x40    /* Probe Request */
#define IEEE80211_FC0_SUBTYPE_PROBE_RESP        0x50    /* Probe Response */
#define IEEE80211_FC0_SUBTYPE_TIMING_ADV        0x60    /* Timing Advertisement */
/* 0111 Reserved                                0x70 */
#define IEEE80211_FC0_SUBTYPE_BEACON            0x80    /* Beacon */
#define IEEE80211_FC0_SUBTYPE_ATIM              0x90    /* ATIM */
#define IEEE80211_FC0_SUBTYPE_DISASSOC          0xa0    /* Disassociation */
#define IEEE80211_FC0_SUBTYPE_AUTH              0xb0    /* Authentication */
#define IEEE80211_FC0_SUBTYPE_DEAUTH            0xc0    /* Deauthentication */
#define IEEE80211_FC0_SUBTYPE_ACTION            0xd0    /* Action */
#define IEEE80211_FC0_SUBTYPE_ACTION_NOACK      0xe0    /* Action No Ack */

The wireshark values are shifted for a 4 bit field already, that gives us a filter like this: 

wlan.fc.type_subtype in {0x0000, 0x0001, 0x0004, 0x0005}

If you are trying to figure out a filter in wireshark you can always right click and pick Apply as Filter->Selected .

My work on FreeBSD is supported by the FreeBSD Foundation , you can contribute to improving FreeBSD with code, documentation or financially by donating to the Foundation .

FreeBSD Network Status Week 45 2024

No stream this week, doing the streams in the morning means that if there is any pressure from elsewhere in my life that makes me later they become quite stressful. They also take a big exertion, running a stream and writing at the same time is hard work, even when no one speaks to me.

I am torn about scheduling, things put off tend to get squeezed out, this was a motivator for doing them at the start of the day. As my mornings are proving busy I'm thinking about moving the writing and stream out to 1400 UK time. This has the benefit of being 9am for the East Coast US for most of the year.

Goings on

This is a lighter week for network stack goings on, I'm still a few reports away from being able to pick out a trend. From the reports I have written this week has the fewest taken commits, but it is within 10% of other light weeks. It is 50% the volume of the busiest weeks.

These numbers are very noisy, I have a habit of taking interesting stuff along with the networking stuff.

Fall 2024 FreeBSD Summit

The summit started yesterday and there are live streams on YouTube, Day One is here , there isn't a link for Day Two right now you can find it on the FreeBSDProject YouTube channel .

update: Day Two

I caught Ian Evans Talk yesterday while I was making supper, it was great to watch and see how they have built out rural internet infrastructure. It was on a project like this that I first got paid to do cool things with the Internet.

BSD Devroom at FOSDEM 2024 

Welcome to the BSD Devroom Call For Participation. The BSD Devroom aims
to provide a dedicated space for presentations covering BSD operating
system family.

Key dates

Proposals can be submitted by October the 30th, 2024
Submission deadline : 1st December 2024 Brussels time
Announcement of selected talks : 15th of December 2024
Conference dates : 1 & 2 February 2025
BSD devroom date : Saturday February 1st, 2025 afternoon (second half)

CFP info is here

Transport

TCP is very complex, this change fixes setting the congestion window when a SYN is lost. I don't remember talking about what the cwnd was being set to before this change. cwnd goes to 1 if a SYN has to be retransmitted, packet loss during establishment can make your connection very painful.

More tidy ups in the SCTP code, I know that is the only comment I manage most weeks. I think the continued work on SCTP is incredible considering how difficult it is to point at a use case.

Netdev

Improvements to the gve(4) driver which is used in GCE. The live lock commit comes with a wonderful diagram: 

gve: Fix TX livelock

Before this change the transmit taskqueue would enqueue itself when it
cannot find space on the NIC ring with the hope that eventually space
would be made. This results in the following livelock that only occurs
after passing ~200Gbps of TCP traffic for many hours:

                            100% CPU
┌───────────┐wait on  ┌──────────┐         ┌───────────┐
│user thread│  cpu    │gve xmit  │wait on  │gve cleanup│
│with mbuf  ├────────►│taskqueue ├────────►│taskqueue  │
│uma lock   │         │          │ NIC ring│           │
└───────────┘         └──────────┘  space  └─────┬─────┘
     ▲                                           │
     │      wait on mbuf uma lock                │
     └───────────────────────────────────────────┘

kbowling@ has made igb(4) work better with misreporting SFP receivers.

Fix build of ice with options RSS.

Bluetooth fixes! I'm not sure if I should be surprised, but I am very surprised.

Firewalls

Tests are steadily improving.

Fixes in the build for pf, including making it work when IPv4 is disabled (we would have IPv6 in that case, no need for pf with no ip stack).

Plumbing to allow ipfilter options to be settable during put from rc.conf.

User Tooling

Ping tests improved, this is good because ping is a core tool which needs attention. There was a lot of churn trying to get the recent 'large ping' change in, more tests more better.

Improvements to tftpd tests, tftpd is an old program that was written to be launched by inetd and this complicated testing. Should we have a tftpd is another question.

Other stuff

Some excellent other commits rolling by, first a change to the vmm interface which enables creation and destruction via a file interface rather than the old sysctl interface. As the commit explains this is a step towards narrowing the privileges required to manage virtual machines.

A previous fix to the bell frequency (yes the pc speaker) was accidentally reverted and has been reinstated. The original commit message is a great read:

Please Send Feedback

I would love to know if this summary was any help, if it was, or if you think I should cover other thing please let me know (thj@freebsd.org).

If you find a typo or have a correct let me know and I'll thank you at the end here.

You can see all prior posts here. ( rss )

My work on FreeBSD is supported by the FreeBSD Foundation , you can contribute to improving FreeBSD with code, documentation or financially by donating to the FreeBSD Foundation .

FreeBSD Network Status Week 44 2024

The report was streamed again this week, I have tried to advertise streaming in all the expected places (discord, irc, BSDNow Telegram). If I missed somewhere let me know.

Goings on

We seem to be back to a much more normal events calendar post-2020. There is a return of a BSD Devroom at FOSDEM and I am hearing about people attending many more events.

It looks like the bugzilla tidy up is calming down, I have it on my todo list to find interesting bugs, but I have gotten bogged down doing other things the last few weeks.

Fall 2024 FreeBSD Summit

This is happening next week on the 7-8th of November. If you still want to go and haven't made any plans time is running out. 

@NetApp San Jose

Program includes:
    - Pawel Dawidek, Fudo Security on "FreeBSD Security Improvements"
    - Dorr Clark, NetScaler on “Using FreeBSD in Products"
    - George Neville-Neil on "OSDB: Turning the Tables on Kernel Data"
    - Dr. Marshall Kirk McKusick on “History of the BSD Daemon”
    - And more!

The summit is open to the public, with a registration fee of US $150.

BSD Devroom at FOSDEM 2024

After a year off there will be a BSD Devroom at FOSDEM 2024, the Devroom needs your talks to be successful. The Devroom talks are shorter than conferences than EuroBSDCon so this is a great opportunity to share work in progress with a diverse BSD crowd. 

Welcome to the BSD Devroom Call For Participation. The BSD Devroom aims
to provide a dedicated space for presentations covering BSD operating
system family.

Key dates

Proposals can be submitted by October the 30th, 2024
Submission deadline : 1st December 2024 Brussels time
Announcement of selected talks : 15th of December 2024
Conference dates : 1 & 2 February 2025
BSD devroom date : Saturday February 1st, 2025 afternoon (second half)

CFP is here

Transport

I think changes in the transport stack go through phases. We have a regular call every two weeks to discuss things, but it shows mostly as tidy ups and commits landing for extremely long running projects. This SACK change is part of an exceedingly long project by rscheff@ to fix SACK functionality and performance.

Network Stack

Improvements to handling of external data on mbufs. Adding external pages to mbufs is an important way to improve performance when interacting with other subsystems. Everything mbufs is a bit of a minefield.

kTLS is supported in GNUtls.

Netdev

ice(4) has been updated to 1.43.2-k through some other updates. ice(4) is a good NIC for high performance interfaces.

if_ffec got some tidy ups.

It is great to see multiple families of Intel network drivers getting consistent attention. Tidy ups in man pages are really important for debugging.

bz@ did a series of commits to update wireless drivers using the LinuxKPI for v6.11 which required disabling the drivers from the build. Feedback on the freebsd-src suggested that this can be skipped over in git-bisect and might not be needed.

Firewalls

User Tooling

More updates following on the recent changes to ndp. More and more stuff is getting netlink support.

Other Interesting Change

I might have gotten carried away taking other commits, there is a lot of cool stuff going on.

br@ landed support for bhyve on riscv, this was developed over the summer (incredibly quickly) on the SPICE simulator and QEMU. Hardware with support for the riscv 'h' (hypervisor) hasn't shipped yet, but there might be a small run of ASICs (200 boards) later this year.

Amazing to have support for a hypervisor that doesn't really exist yet.

emaste@ fixed an IPv4 address in resolver to be valid (8.8.4.4 vs 4.4.4.4) and it started a conversation about example addresses in our documentation and including IPv6. It is a good to acknowledge that we should use documentation addresses as specified by IANA, it does help if examples are directly usable.

nuageinit got support for OpenStack network configuration. As more cloud init support lands FreeBSD cloud images are going to get easier and easier to build.

virtio p9fs implements 9pfs (plan 9 file system) for bhyve making it significantly better to provide file systems to guest in bhyve virtual machines.

Please Send Feedback

I would love to know if this summary was any help, if it was, or if you think I should cover other thing please let me know (thj@freebsd.org).

If you find a typo or have a correct let me know and I'll thank you at the end here.

You can see all prior posts here. ( rss )

My work on FreeBSD is supported by the FreeBSD Foundation , you can contribute to improving FreeBSD with code, documentation or financially by donating to the FreeBSD Foundation .

FreeBSD Network Status Week 43 2024

No stream this week, it would be an odd audio mixture of my keyboard, me coughing and blowing my nose, wondering what the cats are up to (we have a guest doubling the number of cats) and talking about compiler flags. I'll be back on next week if I can match the audio standard. Roughly 1000 UK time on Friday the 1st of November (whichever timezone that is next week).

Goings on

Quiet week on the Network side of things, I've not done this long enough to know if there is a pattern here or not. The big change this week was the import of LLVM 19, newer compilers are stricter which tends to break things. Makes us better through fixing bugs in weird code.

The Fall 2024 FreeBSD Summit is in just over two weeks, John made a call for people to register so the correct amount of food could be bought.

Fall 2024 FreeBSD Summit 

@NetApp San Jose

Program includes:
    - Pawel Dawidek, Fudo Security on "FreeBSD Security Improvements"
    - Dorr Clark, NetScaler on “Using FreeBSD in Products"
    - George Neville-Neil on "OSDB: Turning the Tables on Kernel Data"
    - Dr. Marshall Kirk McKusick on “History of the BSD Daemon”
    - And more!

The summit is open to the public, with a registration fee of US $150.

Performance issues with vnet jails + epair + bridge

Mailing list thread

I mentioned this discussion last week and got some feedback on performance of zones on Illumnos, sounds like there is some ground we can tread to catch up.

FreeBSD 14.2 Code Slush in Effet

The 14.2-RELEASE code slush continues. The schedule looks like a start of December release, but it depends a lot on testing. You can help by testing 14/stable for the next week and branches after. I'm not sure if the schdule is posted publicly so I won't include it here until I know if I should.

Known issues are on this wiki page

Stab week

This was the October Stab Week( announcement ). It doesn't look like there was fallout and the test period was ended on Wednesday ( email ).

Transport

Tidy ups in SCTP and TCP. The FreeBSD SCTP stack is used in a lot of places, on small platforms like Chrome for WebRTC data channel.

Network stack

Locking and VNET improvements in the network stack. Locking around VNETs is quite complex, for a while you could do a lot of damage by running a for loop creating VNETs, but we are improving all the time and crashes like that are less common. That means the remaining issues are harder to find, but overall better.

A small change to export route statistics via a sysctl, a lot of netstat involves looking at live kernel memory and it has all the problems you can imagine.

This was integrated into netstat a little later on:

Netdev

Small improvement in e1000 which should be a no-op.

On server restart with kTLS a long start up pause could be observed under high load. The process for allocating TLS memory was running single threaded and blocking the process start up.

Firewalls

Test with style.

Other stuff

LLVM 19 was imported just after stab week ended. Compiler imports break a ton of things, the second commit here is a good example of the compiler getting stricter and call us on our nonesense.

zlei@ did a run tidying up surplus semicolons (here is one, but there were many):

Updates via vendor imports for unbound (to 1.22.0), libarchive and googletest (to 1.15.2):

Please Send Feedback

I would love to know if this summary was any help, if it was, or if you think I should cover other thing please let me know (thj@freebsd.org).

If you find a typo or have a correct let me know and I'll thank you at the end here.

You can see all prior posts here. ( rss )

My work on FreeBSD is supported by the FreeBSD Foundation , you can contribute to improving FreeBSD with code, documentation or financially by donating to the FreeBSD Foundation .

FreeBSD Network Status Week 42 2024

Hey Folks,

Here we are for the fourth Weekly Network Status Update. The big changes last week in the report were streaming of the writing process and sharing the reports on the freebsd-net and freebsd-current mailing lists.

Thanks to everyone that sent me emails with positive feedback or corrections. All feedback is appreciated, it helps me know if anyone is reading these and it keeps me honest.

Next week there will hopefully be some supporting figures giving a summary of over all changes. I have written the svg and gotten awk making stuff up for me, I just need to get awk generating svg.

Goings on

The bugzilla storm continues, from my reading of my inbox it looks like others have gotten involved tidying up old bugs too. It is great to tidy up the bug tracker, but I'm going to continue waiting a bit before I write the tooling to cover new and changed bugs here. Maybe in a week or two.

I didn't get any feedback on writing tooling against phabricator, I think I'll pull interesting reviews into my notes. From a read this morning there wasn't anything particularly stand out to include. If you want to know whats going on you can look for reviews with #netdev and #transport groups.

Fall 2024 FreeBSD Summit

On the 7th and 8th of November 2024 there will be a FreeBSD Summit kindly hosted by NetApp in their San Jose campus.

So far the program includes: 

    - Pawel Dawidek, Fudo Security on "FreeBSD Security Improvements"
    - Dorr Clark, NetScaler on “Using FreeBSD in Products"
    - George Neville-Neil on "OSDB: Turning the Tables on Kernel Data"
    - Dr. Marshall Kirk McKusick on “History of the BSD Daemon”
    - And more!

The summit is open to the public, with a registration fee of US $150.

Registration and event information is available here:

Performance issues with vnet jails + epair + bridge

There has been some discussion on the freebsd-net mailing about performance issues with VNET jailed applications. The conversation started in September, cc@ has made some points about the performance methodology. I have encountered this problem, TCP single flow over bridge for me stops at 2.5Gbit/s (on a machine that will do localhost TCP single flow at ~40Gbit/s). The issue is real, but we lack comparisons to other platforms to really motivate improvements. 

https://lists.freebsd.org/archives/freebsd-net/2024-September/005510.html

FreeBSD 14.2 Code Slush in Effect

It used to be the case that FreeBSD frozen branches in advance of a release, the freeze was led into by a 'slush' phase where only 'safe' commits were wanted. The Slush phase has started for the 14.2 release. Time to get things MFC'd if you want them in 14.2.

Transport

Netdev

Lots of commits to update the EC2 Elastic Network Adapter by osamaabb@ updating the ena(4) driver to v2.8.0 (and through version v2.7.0 ). Here is one of them:

peterj@ has been working improving support for the Quartz64 SBC and as part of that is fixing things in eqos(4) .

More updates to Intel network drivers, with igc(4) getting improved AIM mode support (as igb(4) did last week.

The CFT closed on the axgbe(4) promisc mode change and landed in the tree.

Netmap buffer pools have been made NUMA-aware, this may help with performance on systems with multiple memory domains as the buffer locality should be much better.

Over in WiFi land rtw89 was turned on after 2 years of being in the tree thanks to improved testing from a group of users.

Updates in the LinuxKPI layer to support updates in iwlwifi

Minor man page changes, for users this rearranges the HARDWARE section which is an excellent source of truth when trying to buy things.

Firewalls

The divapp tool for testing divert sockets has been moved from pf specific into the more general netpfil tests area. And divert tests added for ipfw.

The Scapy port update broke some tests so those needed to be updated:

User Tooling

Ping continues to be an incredibly difficult piece of software to work on. Ping is going to get support for non-root users to control the size of the ICMP request (as it can on other platforms).

Libxo is a flexible way of generating machine readable output from Unix tools and subsystems, many more tools got complete libxo support this week, here are some to the network tools:

Other Interesting Changes

I added this section this week because there were quite a few interesting changes going by that weren't networking specific, but still might be of interest.

A new bsd release!

Back in July ISA device hints were changed, but the UPDATING message was missed. It is here now:

In advance of OCI support on FreeBSD, change the name of OCI to ORACLE. That first OCI is Open Container Initiative and the second one is Oracle Cloud Infrastrcuture - simple.

Please Send Feedback

This weeks report took much longer to write because I was speaking to/at the kind people that joined the stream. Thanks for kp@ and mgdm for keeping me company.

I would love to know if this summary was any help, if it was, or if you think I should cover other thing please let me know (thj@freebsd.org).

If you find a typo or have a correct let me know and I'll thank you at the end here.

You can see all prior posts here. ( rss )

My work on FreeBSD is supported by the FreeBSD Foundation , you can contribute to improving FreeBSD with code, documentation or financially by donating to the FreeBSD Foundation .

previous next