 Take our Quick Survey and enter a drawing for a chance to win a $100 VISA Gift Card.Here we will cover some advanced features of the new bridge code.
Ok, let's leave that commercial and get back linux and the bridge.
Take a look on this small thread from the linux-bridge mailing list.
STP Thread from bridge at openrock.net (no more valid)- Could you give me some hints about multi-bridge scenarios.
- Does the STP "heartbeat" mechanism also work
with bridges with more than two cards?
- How fast does it get up, and what can I do about it?
Could you give me some hints about multi-bridge scenarios.
You can just set up two "mirrored" bridges.
You have two network interfaces in your bridge?
Set up the mirror bridge so that it has two network interfaces
as well, and connect each of the interfaces to one subnet.
This will work without the need of configuration.
Note: Be sure that you have the spanning tree protocol
enabled.
If you didn't use brctl, this should
be fine, because in Linux, it is on by default.
To check, you could check whether the bridge sends a
packet to 0180c2000000
every 2 seconds.
If it does, the STP is on.
The STP is needed so that only one bridge will be active
at any given time.
Note: To be able to see nicely formatted stp packages in your
network take a look at at the bridge homepage for the patches
to tcpdump.
The "master" bridge will send out STP packets every
2 seconds by default.
The "slave" bridge will receive these packets,
and will notice that the master is still up.
If the slave hasn't received a packet in 20 seconds (max.
message age parameter), it will start the takeover procedure.
From the moment the takeover procedure starts, it will take
about 30 seconds (twice the forward delay parameter) for the
bridge to become fully operational.
Does the STP "heartbeat" mechanism also work
with bridges with more than two cards?
Yes, it works with any number of interfaces.
You can invent bizarre topologies to your heart's desire.
You can use multiple (redundant) bridge-bridge connects,
you can insert loops, whatever.
The STP code will always find the minimal spanning tree.
The bridge code will even deal with the loss of any number
of interfaces.
If there are two redundant bridges with identical connections,
the loss of an interface on one of the bridges will cause the
other bridge to take over forwarding to that specific
interface.
Now isn't that great? :)
How fast does it get up, and what can I do about it?
If you think 50 seconds is too much -- and I guess you
should; alas, the IEEE specs gives us these default values
-- you can tweak these parameters.
If you set the hello time (the STP packet interval) from 2 to 1
second, you can safely set the message age parameter to 4
seconds.
Then you can set the forward delay to 4 seconds, and this will
in total give you a takeover time of ~12 seconds.
The great thing which is made possible by STP is
a redundant parallel bridging scenario, with automated take over
features.
Within a network basing on stp the bridges always try to send a
datagram the (by path cost) shortest path.
Only on that path the bridges are forwarding, all other paths between
this shortest way are blocked.
If there is a broken path, the bridges agree about the next shortest.
So doubled paths don't break the net, but are bringing more security...
For a example setup of a fail secured connection see
Section 8.
The normal idea about a bridge would not allow anything like
firewalling, but since several people have asked Lennert for ipchains
firewalling on bridge forwarding he implemented it.
Important: If you want to do this, you will need to apply the
special ip-chain-bridge-patch (also available at
the bridge homepage).
As soon you have everything up correctly, the bridging code will
check each to-be-forwarded packet against the ipchains chain which has
the same name as the bridge.
So.. if a packet on eth0 is to be forwarded to eth1, and those
interfaces are both part of the bridge group br0, the
bridging code will check the packet against the chain called 'br0'.
| Warning | If the chain does not exist, the packet will be forwarded.
So if you want to do firewalling, you'll have to create the chain
yourself.
|
| |
| |
