Markus A.'s questions

I'm working on an embedded platform with very limited resources where I need to build my own Ethernet frames.

If I need to answer a UDP request with a UDP reply, is it ever not OK to just send the reply back to the Ethernet source MAC address of the request packet instead of doing a full ARP lookup of the source IP address?

If so, a list of concrete examples where a reply would need to be sent to a different MAC address than the request came from would be very useful.

Clearly, if the request originator changed their own MAC address right after sending the request, that would be a trivial example, but let's ignore that case.

I need to add a wildcard address record to dnsmasq running on OpenWRT.

If I were to call dnsmasq from the command line, it would look like this:

dnsmasq --address=/#/123.123.123.123 ...

I would like to use UCI to configure dnsmasq, but I am having trouble figuring out how to add this option.

One complication is that I have two instances of dnsmasq configured for my different interfaces. So, I have two config dnsmasq <some name> sections in /etc/config/dhcp. Unfortunately, I need to add this wildcard to only one of the sections, so I don't think I can use /etc/dnsmasq.conf to specify this option as it would then apply to both instances (if I understand correctly). And, unfortunately, there doesn't seem to be an option that allows me to specify an additional dnsmasq.conf for just one of the interfaces.

My first thought was to add an option addnhosts ... to specify another hosts file just for one of the instances, but it seems like hosts files don't support wildcards.

Is this possible somehow? If so, how?

To deal with the Android captive portal detection for my specific setup, I need to return an HTTP status code 204 whenever I get a GET request for /generate_204. I currently use uhttpd as my webserver, so I'm wondering whether this is possible to do with this server.

My current understanding: I need to write myself a CGI (or PHP or Lua) script that returns something like
Status: 204 No Result

The question I have is how I can configure uhttpd to forward requests to /generate_204 to CGI or PHP or Lua, since that neither has a prefix nor a file-extension that I can match for this purpose.

If, across the same building, I have two physically separate networks to connect devices together via simple switches, my understanding is that I could save myself some hardware-complexity if I were to instead use smart-switches, connect them to each other via trunk-ports, and have them assign their different ports which connect to the devices to one of two VLANs depending on which "physical" network the device should belong to.

In the scenario of the two independent physical networks, if I wanted to combine them into one physical network, all I would need to do on the hardware side is to connect a switch between the two. If I understand correctly, I could equivalently plug a linux router between the two and bridge the two ports that two networks are connected to.

To do the same thing in the scenario of the VLANs, I could connect a router to the switch via a trunk port, create the virtual interfaces eth0.10 and eth0.20 (for example) and bridge those two together. Would this work as expected?

Reason I am asking is because I was just thinking about how traffic would be forwarded by the switches. In the case of a physical network, each switch builds an ARP table that tells it which MAC addresses can be reached by which port. And if one port is connected to another switch, that port should eventually get sent all traffic for all MAC addresses that are connected to that other switch.

Let's say I have the following physical network layout:

 ____________     ___________     __________     ___________     ____________
|            |   |           |   |          |   |           |   |            |
| Device 1   |___| Network 1 |___| "Bridge" |___| Network 2 |___| Device 2   |
| MAC ...:01 |   | Switch    |   | Switch   |   | Switch    |   | MAC ...:02 |
|____________|   |___________|   |__________|   |___________|   |____________|

Now, if Device 1 wants to send a packet to Device 2, Switch 1 knows that MAC ...:02 is connected somewhere to its right port, so it passes the packet to the bridge-switch, etc.

If I were to change the network to the following layout instead:

 ____________               ________               ____________
|            |             |        |             |            |
| Device 1   |_____________| Smart  |_____________| Device 2   |
| MAC ...:01 |  VLAN ID 1  | Switch |  VLAN ID 2  | MAC ...:02 |
|____________|             |________|             |____________|
                               ||
                               || Trunk
                           ____||____
                          |          |
                          | "Bridge" |
                          | Router   |
                          |__________|

Then, if Device 1 wanted to send a packet to Device 2, the smart switch should not just send the packet out of its right port, simply because that's where the destination MAC address matches. Instead it needs to forward the packet out the bottom port to the bridge-router, which should then send it back out of its top port, but tagged for VLAN 2 now, rather than VLAN 1.

This would imply that both, the smart switch and the bridge-router would need to maintain two (or more) independent ARP tables, one for each VLAN, and, in the case of the smart switch, MAC ...:02 should be linked to the right port iff the traffic belongs to VLAN 2 and it should be linked to the bottom port iff the traffic belongs to VLAN 1.

Is that what's happening? Or can this setup not work as the smart switches would get confused?

Also, is my understanding as described above correct at all? :)

I have a network with several VLANs that each contain resources or clients with different access rights.

For simplicity, let's say I have 3 VLANs:

1. ID 10: Contains privileged clients and private resources only accessibly to these privileged clients
2. ID 20: Contains guest-clients that only have access to public resources
3. ID 30: Contains public resources that are accessible by both privileged and guest-clients

On this setup, I would like to make auto-discovery and access right management work so that clients in VLAN 10 can discover and access resources in VLANs 10 and 30, and clients in VLAN 20 can discover and access resources in VLANs 20 and 30. The resources I need to auto-discover are of different type (windows network shares, printers, security cameras, apple devices, etc.) so there are several different mechanisms at work, most of which I don't have any knowledge over.

Is it possible to make such a setup work generically, so that devices on VLAN 10 see a single network that consists of both VLANs 10 and 30 and behaves just like as if everyone were plugged into the same switch and devices on VLAN 20 see a network that consists of all devices on VLANs 20 and 30?

Would I need to create a bridge between VLANs 10 and 30 and a second bridge between VLANs 20 and 30? Would this also implicitly bridge VLANs 10 and 20 (not acceptable)? If so, can I just disallow this implicit bridging with firewall rules (like drop all packets from VLAN 10 to VLAN 20 and vice versa)?

What would be the best way to subnet such a layout and how would I go about setting up DHCP to accomplish it? My current thoughts are something like the following:

• 192.168.10.x for VLAN 10, 192.168.20.x for VLAN 20, and 192.168.30.x for VLAN 30
• Subnet 255.255.0.0 for everyone (so that devices send broadcasts across VLANs)

Is it possible to get such a setup working on a Vyatta-Linux-based router, especially the DHCP part? It seems to determine which interfaces to listen on based on the subnet I provide. So, to have it listen on eth0.10 (VLAN 10), I would need to give it subnet 192.168.10.0/24, but I would like for the DHCP clients to be told that the subnet is 255.255.0.0, not 255.255.255.0.

What other services/forwarding would I need to set up (e.g. ARP proxying) to be reasonably sure that all common auto-discovery-mechanisms should work?

Any help would be much appreciated.

I just installed Debian Wheezy 7.1.0 on an Intel vPro System (Intel Core i5-2520M, SuperMicro MBD-X9SCV-Q-O). Intel AMT's KVM works perfectly until Debian has completed booting and shows the login prompt. At this point, the screen in RealVNC goes blank and after a minute, it dies with the following error message:

Error 0x80862000: Unsupported or inactive display adapter

Before it dies, while the screen is already blank, I can type my login info, and if I then type reboot, the server restarts. So, Debian is actually running as expected, just the display isn't working.

The system does not have any additional video cards installed, only the CPU-integrated one.

Here is what I think is going on: Debian detects that there is no monitor connected to the video card and then decides to switch the video card off to save energy (maybe some sort of headless mode). This in turn makes it impossible for Intel AMT to provide the frame buffer.

Assuming my assessment is right (otherwise please correct me), I am trying to figure out the following:

Is there a way (preferably a boot-time kernel option) to tell Debian to keep the video card enabled even if there is no monitor connected?

Just a quick question about ext3:

Are inodes stored in the same area as file data, or are there separate regions on the disk reserved exclusively for meta-data and others reserved exclusively for file/directory-content?

Reason I'm asking: If fsck is clearing/deleting/rewriting something that it thinks is an "inode", could it actually be messing with file content, or would the worst case effect be that a certain file disappears from the directory tree and get's added to a lost-and-found location, like in FAT file systems?

I recently added a 7th 2TB drive to a linux md software RAID 6 setup. After md finished reshaping the array from 6 to 7 drives (from 8 to 10TB), I was still able to mount the file system without problems. In preparation for resize2fs, I then unmounted the partition and ran fsck -Cfyv and was greeted with an endless stream of millions of random errors. Here is a short excerpt:

Pass 1: Checking inodes, blocks, and sizes
Inode 4193823 is too big.  Truncate? yes
Block #1 (748971705) causes symlink to be too big.  CLEARED.
Block #2 (1076864997) causes symlink to be too big.  CLEARED.
Block #3 (172764063) causes symlink to be too big.  CLEARED.
...
Inode 4271831 has a extra size (39949) which is invalid Fix? yes
Inode 4271831 is in use, but has dtime set.  Fix? yes
Inode 4271831 has imagic flag set.  Clear? yes
Inode 4271831 has a extra size (8723) which is invalid Fix? yes
Inode 4271831 has EXTENTS_FL flag set on filesystem without extents support. Clear? yes
...
Inode 4427371 has compression flag set on filesystem without compression support. Clear? yes
Inode 4427371 has a bad extended attribute block 1242363527.  Clear? yes
Inode 4427371 has INDEX_FL flag set but is not a directory. Clear HTree index? yes
Inode 4427371, i_size is 7582975773853056983, should be 0.  Fix? yes
...
Inode 4556567, i_blocks is 5120, should be 5184.  Fix? yes
Inode 4566900, i_blocks is 5160, should be 5200.  Fix? yes
...
Inode 5628285 has illegal block(s).  Clear? yes
Illegal block #0 (4216391480) in inode 5628285.  CLEARED.
Illegal block #1 (2738385218) in inode 5628285.  CLEARED.
Illegal block #2 (2576491528) in inode 5628285.  CLEARED.
...
Illegal indirect block (2281966716) in inode 5628285.  CLEARED.
Illegal double indirect block (2578476333) in inode 5628285.  CLEARED.
Illegal block #477119515 (3531691799) in inode 5628285.  CLEARED.

Compression? Extents? I've never had ext4 anywhere near this machine!

Now, the problem is that fsck keeps dying with the following error message:

Error storing directory block information (inode=5628285, block=0, num=316775570): Memory allocation failed

At first I was able to simply re-run fsck and it would die at a different inode, but now it's settled on 5628285 and I can't get it to go beyond that.

I've spent the last days trying to search for fixes to this and found the following 3 "solutions":

• Use 64-bit linux. /proc/cpuinfo contains lm as one of the processor flags, getconf LONG_BIT returns 64 and uname -a has this to say: Linux <servername> 3.2.0-4-amd64 #1 SMP Debian 3.2.46-1 x86_64 GNU/Linux. Should be all good, no?
• Add [scratch_files] / directory = /var/cache/e2fsck to /etc/e2fsck.conf. Did that and every time I re-run fsck, it adds another 500K *-dirinfo-* and an 8M *-icount-* file to the /var/cache/e2fsck directory. So that seems to have its desired effect as well.
• Add more memory or swap space to the machine. 12GB of RAM and a 32GB swap partition should be sufficient, no?

Needless to say: Nothing helped, otherwise I wouldn't be writing here.

Naturally, now the drive is marked bad and I can't mount it any more. So, as of right now, I lost 8TB of data due to a disk-check?!?!?

This leaves me with 3 questions:

• Is there anything I can do to fix this drive (remember, everything was fine before I ran fsck!) other than spending a month to learn the ext3 disk format and then trying to fix it manually with a hex editor???
• How is it possible, that something as mission-critical as fsck for a file-system as popular as ext3 still has issues like this??? Especially since ext3 is over a decade old.
• Is there an alternative to ext3 that doesn't have these sorts of fundamental reliability issues? Maybe jfs?

(I'm using e2fsck 1.42.5 on 64-bit Debian Wheezy 7.1 now, but had the same issues with an earlier version on 32-bit Debian Squeeze)

Is there a way to create a single 2TB partition, which is 4096-byte-sector aligned, on a disk using the standard Linux fdisk (I have tried version 2.17.2)?

I've tried the following things and ran into the described error:

• If I simply use the -u flag, it sets the cluster size to one sector of 512 byte. Then, the partition would have to be 3,906,250,000 clusters long and fdisk truncates this number to 2,147,483,647 (2^31-1).
• If I use -b 4096, it allows me to create the partition just fine (with length 488,281,506 sectors), but if I check the size of the resulting partition using blockdev --getsize64, it shows that the partition is only 250GB big, i.e. it is still using a sector size of 512.
• If I try to set the sector and head count using -S 64 -H 32, for example, then it always sets the sector count back to 63, which doesn't divide evenly into 4096 (I know, 32 dividing evenly by 8 is technically enough, but - call me perfectionist - I'd really like to have the partition start at sector 2048 (1MB aligned), as I read is the recommended setting these days.

Is there some combination of parameters that I can pass to fdisk, that will allow me to create a partition that starts at 1MB (sector 2048 [256] for 512-[4096-]byte sectors) and is exactly 2TB long (3,906,250,000 [488,281,506] sectors for 512-[4096-]byte sectors)?

(I read that I can just use gparted and have it change the drive to GPT partitioning, but I'd really like to know if there is a way to do it with standard fdisk and an MBR partition. I don't see a reason why MBR partitions shouldn't allow for this...)