Stupid Stupid 11.00 "Feature".

3r1c_3$7r4d4_at_salmahayeksknockers.edu
Date: 07/10/03 

Date: Thu, 10 Jul 2003 18:22:39 GMT

For days, we've been having networking problems with a server just being put
into production. It had been tested thoroughly, but it seems that as soon
as we shifted it to the prod subnet, it lost connectivity. Everything at
the OS level appeared to be configured correctly.

Second day of this, I notice that after the server boots, I get ~minutes in
which the networking DOES work, after which point, my session is killed, and
I am unable to initiate more.

Third day, network guy who is scrutinizing firewall/router logs notices that
our server is pinging its gateway every 3 minutes and 3 seconds.

After some research, we find the following:

11.00 pings it's gateway every 183 seconds, and it it doesn't get a
response, it drops the route. Actually, it doesn't even drop it from the
routing table, it stops using it. This is a "feature" to allow failing over
to a secondary gateway in case of the failure of the primary. In our case,
our gateway is also a firewall that drops ICMP. Once discovered, we were
able to turn off this "feature" using ndd.

1) Cute feature, but why is it enabled by default?

2) Many gateways have their own protocols to ensure failover. Why does
this need to be done at the OS level?

3) If it's going to drop the route, why doesn't it do so VISIBLY, and
remote it from the routing table?

AFAICT, someone needs their peepee slapped, and hard. 

-- 
.............................................................................
"The human rights group [Amnesty International] said Israel has arrested
 more than 1,500 Palestinians in the past year, and that many of the
 detainees were tortured"
                              -Laurie Copans, Associated Press, (28/08/2001)
.............................................................................
dswan@m3m3t1ccand1ru.com                        http://www.memeticcandiru.com

Relevant Pages

  • Re: IP Change
    ... For the gateway, from the command line as root: ... you can also configure the networking from /stand/sysinstall ... > I'm somewhat new to FreeBSD, so today when we had to deploy a new server ... > to the colo running FreeBSD, ...
    (freebsd-questions)
  • Re: Help NT 4.0 Problem
    ... > the life of me get the networking to work!! ... I can ping 127 and the IP ... > address of the server but not the gateway or anyother IP any ideas? ...
    (microsoft.public.win2000.networking)
  • RE: IPNAT / IPF / rdr issue
    ... All your clients are on the LAN behind the gateway correct. ... > request has to go to your ISP DNS server to get your public ip ... > block out log first quick on dc0 all ...
    (freebsd-questions)
  • Re: Help w/ Not-booting Problem
    ... >No - setting the hostname is one element in the boot process. ... I have had a working system of RedHat Linux 7.2 for several months. ... >external DNS server on an adsl router! ... >You appear to have a networking problem. ...
    (comp.os.linux.misc)
  • Re: Default Gateway on VPN subnets
    ... Now I understand that you are using the TZ170 VPN routers to establish the ... Once the default gateway of the remote 2003 server was automatically ... to access the internet or the SBS network? ...
    (microsoft.public.windows.server.sbs)