Sampsa Laine wrote:
Gentlemen, anyone happen to have softcopy documentation for the above?
Just got one off Ebay, will wire it up sooner or later.
Sampsa
If you'll take a reply from a non-gentleman ... I found this :
http://vt100.net/mirror/antonio/d200cin1.pdf
;-)
Chrissie
On Wed, May 13, 2009 at 11:57:01AM +0100, Sampsa Laine wrote:
I agree, reliability could definitely be an issue. Of course the SSH
tunnel has the advantage of not really requiring any additional
software to be installed or configured.
While that's certainly a valid point, it's not like it's hard to install.
Setting it up on the other hand, well, if you've never done that before, it
can be a bit daunting.
-brian
--
"Coding in C is like sending a 3 year old to do groceries. You gotta
tell them exactly what you want or you'll end up with a cupboard full of
pop tarts and pancake mix." -- IRC User (http://www.bash.org/?841435)
On Fri, May 15, 2009 at 01:27:25PM +0200, Johnny Billquist wrote:
But in addition, for this to work, you need to allow the remote users to
get ssh access to your local machine, otherwise ssh can't set up tunneling.
And for me, that's not something I'll do for all you guys... :-)
After we get moved and get settled in, the two VAX 4000 boxes are going to
bet setup again. I'll also setup a cisco router or two to go along with them.
At that point I'd be willing to do GRE/OpenVPN/SSH/etc for people.
Also, within the next two to three weeks I'll be upgrading my colocated box.
It's got great bandwidth (100MB+) and I'd be more than willing to setup OpenVPN
for HECnet. I think for our purposes OpenVPN in bridging mode would work best.
Hmmm, I wonder how hard it would be to get DECnet support rolled into something
like OpenVPN?
-brian
--
"Coding in C is like sending a 3 year old to do groceries. You gotta
tell them exactly what you want or you'll end up with a cupboard full of
pop tarts and pancake mix." -- IRC User (http://www.bash.org/?841435)
Sampsa Laine wrote:
Came across this whilst looking for some SSH stuff and realized this could be used to either securely transmit HECnet data between two hosts or enable a host with a dynamic IP to run the bridge/MULTINET UDP thing:
http://24.97.150.195/nstwiki/index.php/Tunnelling_UDP_Traffic_Through_An_SS… Basically, they use a combination of SSH port forwarding (which is TCP only) and nc to create a secure UDP tunnel between two sites. Setting this up would be trivial on a standard Unix box and if we use public key authentication we don't even need to store passwords anywhere. Also, we would of course benefit from the authentication and cryptographic features that SSH brings to the table.
The main disadvantage I can see is that SSH runs over TCP so any dropped packets might cause more delays than using straight UDP.
Yes, tunneling through something would always work. It will cost a lot in overhead, but for some that may be okay.
Also, as you note, it might cause retransmits at several levels, which also cost some.
And of course, you also risk additional delays.
But in addition, for this to work, you need to allow the remote users to get ssh access to your local machine, otherwise ssh can't set up tunneling.
And for me, that's not something I'll do for all you guys... :-)
There are other aspects to this as well, but I'll leave it at this. I've also read the other comments. :-)
Johnny
--
Johnny Billquist || "I'm on a bus
|| on a psychedelic trip
email: bqt at softjar.se || Reading murder books
pdp is alive! || tryin' to stay hip" - B. Idol
What I was referring to is the cascading time-out problems you can sometimes get tunnelling one TCP connection over another, e.g. HTTP over a PPP over SSH connection:
3. HTTP (TCP)
2. IP
1. PPP
0. SSH (TCP)
Sometimes if a time-out occurs and layers 0 and 3 have different retransmission timers, the retransmissions kill the whole shebang.
More details can be found at: http://sites.inka.de/~W1011/devel/tcp-tcp.html
Not sure if this will be a problem with NSP over TCP however, but I can imagine it might be (if the NSP retransmission timer is faster than the underlying TCP timers).
Sampsa
On 13 May 2009, at 15:25, Paul Koning wrote:
"Sampsa" == Sampsa Laine <sampsa at mac.com> writes:
Sampsa> The main disadvantage I can see is that SSH runs over TCP so
Sampsa> any dropped packets might cause more delays than using
Sampsa> straight UDP.
That isn't actually a disadvantage when you travel all the way to the
top of the stack. Yes, the DECnet network layer (just like IP) uses,
and provides, a datagram service. But it also uses retransmit
internally for stuff that has to get through, and of course the
transport layer (NSP) makes a reliable service through timeout and
retry.
So a tunnel over TCP is just fine. It means you have a lossless
network (ignoring congestion in the DECnet nodes). So instead of
having delays due to timeout and retransmit in NSP, you have the same
delay (or, quite possibly, a shorter delay) due to timeout and
retransmit in TCP. The overall application performance should come
out essentially the same.
paul
"Sampsa" == Sampsa Laine <sampsa at mac.com> writes:
Sampsa> The main disadvantage I can see is that SSH runs over TCP so
Sampsa> any dropped packets might cause more delays than using
Sampsa> straight UDP.
That isn't actually a disadvantage when you travel all the way to the
top of the stack. Yes, the DECnet network layer (just like IP) uses,
and provides, a datagram service. But it also uses retransmit
internally for stuff that has to get through, and of course the
transport layer (NSP) makes a reliable service through timeout and
retry.
So a tunnel over TCP is just fine. It means you have a lossless
network (ignoring congestion in the DECnet nodes). So instead of
having delays due to timeout and retransmit in NSP, you have the same
delay (or, quite possibly, a shorter delay) due to timeout and
retransmit in TCP. The overall application performance should come
out essentially the same.
paul
I agree, reliability could definitely be an issue. Of course the SSH tunnel has the advantage of not really requiring any additional software to be installed or configured.
Sampsa
On 13 May 2009, at 11:52, Brian Hechinger wrote:
On Wed, May 13, 2009 at 11:39:19AM +0100, Sampsa Laine wrote:
The main disadvantage I can see is that SSH runs over TCP so any
dropped packets might cause more delays than using straight UDP.
Having done various SSH tunnels over the years another disadvantage is
that they are a complete pain to deal with. Honestly, I would find it
considerably easier to setup something like OpenVPN which would solve
both the UDP and the dynamic IP problems and give you everything you
wanted ssh to do for you except with less pain and suffering attached.
Don't get me wrong, ssh tunnels are a FANTASTIC tool, but they've only
ever caused me grief when I expected them to be a "permenent" tunneling
solution.
Just my $0.02
-brian
--
"Coding in C is like sending a 3 year old to do groceries. You gotta
tell them exactly what you want or you'll end up with a cupboard full of
pop tarts and pancake mix." -- IRC User (http://www.bash.org/?841435)
On Wed, May 13, 2009 at 11:39:19AM +0100, Sampsa Laine wrote:
The main disadvantage I can see is that SSH runs over TCP so any
dropped packets might cause more delays than using straight UDP.
Having done various SSH tunnels over the years another disadvantage is
that they are a complete pain to deal with. Honestly, I would find it
considerably easier to setup something like OpenVPN which would solve
both the UDP and the dynamic IP problems and give you everything you
wanted ssh to do for you except with less pain and suffering attached.
Don't get me wrong, ssh tunnels are a FANTASTIC tool, but they've only
ever caused me grief when I expected them to be a "permenent" tunneling
solution.
Just my $0.02
-brian
--
"Coding in C is like sending a 3 year old to do groceries. You gotta
tell them exactly what you want or you'll end up with a cupboard full of
pop tarts and pancake mix." -- IRC User (http://www.bash.org/?841435)
Came across this whilst looking for some SSH stuff and realized this could be used to either securely transmit HECnet data between two hosts or enable a host with a dynamic IP to run the bridge/MULTINET UDP thing:
http://24.97.150.195/nstwiki/index.php/Tunnelling_UDP_Traffic_Through_An_SS…
Basically, they use a combination of SSH port forwarding (which is TCP only) and nc to create a secure UDP tunnel between two sites. Setting this up would be trivial on a standard Unix box and if we use public key authentication we don't even need to store passwords anywhere. Also, we would of course benefit from the authentication and cryptographic features that SSH brings to the table.
The main disadvantage I can see is that SSH runs over TCP so any dropped packets might cause more delays than using straight UDP.
Sampsa
Yes, Urho Kekkonen ;) It's a joke from the past.
You got some extra letters, pretty close.
"Mielest ni teill on s p presidentti."
I'm not sure if I want to know more about your fetishes.. ;)
--Saku
On Thu, May 7, 2009 at 1:53 AM, Tore Sinding Bekkedal
<toresbe at ifi.uio.no> wrote:
Kekkonen? As in Urho Kekkonen? Am I missing something here? :)
Mielest ni teill onn s p presidenttin. (did I get that right?)
-Tore :)
http://www.facebook.com/album.php?aid=7441&id=1456476365&l=393493bbf6
Didn't even know these links are not permanent..
On Wed, May 6, 2009 at 5:47 PM, Tore Sinding Bekkedal
<toresbe at ifi.uio.no> wrote:
Saku Set l wrote:
Just wanted to share the photos.
I was at The Alternate Party with 20 VaxStations/Microvaxen.
Young people were more interested about playing Tetris but some
old-timers also had interest for the cluster.
http://www.facebook.com/album.php?aid=7441&l=39349&id=1456476365
Catching up on old list mail, and:
This public photo link has expired. To see these photos, please ask the
owner to generate a new public link.
Temporary links don't work very well with mailing lists...
-Tore :)
Saku Set l wrote:
Just wanted to share the photos.
I was at The Alternate Party with 20 VaxStations/Microvaxen.
Young people were more interested about playing Tetris but some
old-timers also had interest for the cluster.
http://www.facebook.com/album.php?aid=7441&l=39349&id=1456476365
Catching up on old list mail, and:
This public photo link has expired. To see these photos, please ask the owner to generate a new public link.
Temporary links don't work very well with mailing lists...
-Tore :)
Maybe I should clarify. I can talk with ZAPHOD (for instance), but it's not through my bridge program. I have connection through GORVAX (next hop).
But maybe Chrissie just isn't running the bridge?
Johnny
Steve Davidson wrote:
I can see you from the US. If you are running LATD on Linux I can not
see that however.
-Steve
Hollis, NH USA -----Original Message-----
From: owner-hecnet at Update.UU.SE [mailto:owner-hecnet at Update.UU.SE] On
Behalf Of Chrissie Caulfield
Sent: Monday, April 20, 2009 10:22
To: hecnet at Update.UU.SE
Subject: Re: [HECnet] Zaphod, new IP Address
Chrissie Caulfield wrote:
Hi,
Well, I'm all switched over and my new IP address (as of last week,
sorry for the delay in sending this email) is
86.10.38.192
I've updated chrissie.homelinux.net. No-one seems to be connected to
me
yet ...
Chrissie
Hmm, very strange. I'll investigate....
--
Johnny Billquist || "I'm on a bus
|| on a psychedelic trip
email: bqt at softjar.se || Reading murder books
pdp is alive! || tryin' to stay hip" - B. Idol
I can see you from the US. If you are running LATD on Linux I can not
see that however.
-Steve
Hollis, NH USA
-----Original Message-----
From: owner-hecnet at Update.UU.SE [mailto:owner-hecnet at Update.UU.SE] On
Behalf Of Chrissie Caulfield
Sent: Monday, April 20, 2009 10:22
To: hecnet at Update.UU.SE
Subject: Re: [HECnet] Zaphod, new IP Address
Chrissie Caulfield wrote:
Hi,
Well, I'm all switched over and my new IP address (as of last week,
sorry for the delay in sending this email) is
86.10.38.192
I've updated chrissie.homelinux.net. No-one seems to be connected to
me
yet ...
Chrissie
Hmm, very strange. I'll investigate....
--
Chrissie
Chrissie Caulfield wrote:
Hi,
Well, I'm all switched over and my new IP address (as of last week,
sorry for the delay in sending this email) is
86.10.38.192
I've updated chrissie.homelinux.net. No-one seems to be connected to me
yet ...
Chrissie
Hmm, very strange. I'll investigate....
--
Chrissie
Bob Armstrong wrote:
No-one seems to be connected to me yet ...
You do know that in neither Multinet nor Johnny's bridge program there's
nothing to automatically re-connect when an IP address changes?? It takes
manual intervention on the part of the operator of the other end of your
link.
hence this email .... ;-)
--
Chrissie
I've updated, but I see to traffic from you.
Johnny
Chrissie Caulfield wrote:
Hi,
Well, I'm all switched over and my new IP address (as of last week,
sorry for the delay in sending this email) is
86.10.38.192
I've updated chrissie.homelinux.net. No-one seems to be connected to me
yet ...
Chrissie
Chrissie Caulfield wrote:
Hi All,
Virgin have been mucking me about a bit. I will be upgraded to a new
cable modem next week which will mean I'll get a new IP address for ZAPHOD.
However, in the mean time they've mistakenly disconnected me and
reconnected me to a different IP!
Zaphod's current IP address is 82.8.17.191, but that WILL change next
Wednesday afternoon (GMT) so it's up to you if you change the multinet
connection in the meantime ... I won't be offended if I'm off HECnet for
a week, I'm far too busy doing other things anyway :S
I'll post the new IP address next week,
Sorry for the outage ... but it's not my fault :-(
Chrissie
--
Johnny Billquist || "I'm on a bus
|| on a psychedelic trip
email: bqt at softjar.se || Reading murder books
pdp is alive! || tryin' to stay hip" - B. Idol
No-one seems to be connected to me yet ...
You do know that in neither Multinet nor Johnny's bridge program there's
nothing to automatically re-connect when an IP address changes?? It takes
manual intervention on the part of the operator of the other end of your
link.
Bob
Hi,
Well, I'm all switched over and my new IP address (as of last week,
sorry for the delay in sending this email) is
86.10.38.192
I've updated chrissie.homelinux.net. No-one seems to be connected to me
yet ...
Chrissie
Chrissie Caulfield wrote:
Hi All,
Virgin have been mucking me about a bit. I will be upgraded to a new
cable modem next week which will mean I'll get a new IP address for ZAPHOD.
However, in the mean time they've mistakenly disconnected me and
reconnected me to a different IP!
Zaphod's current IP address is 82.8.17.191, but that WILL change next
Wednesday afternoon (GMT) so it's up to you if you change the multinet
connection in the meantime ... I won't be offended if I'm off HECnet for
a week, I'm far too busy doing other things anyway :S
I'll post the new IP address next week,
Sorry for the outage ... but it's not my fault :-(
Chrissie
--
Chrissie
On Thu, Apr 09, 2009 at 08:54:55AM -0400, Sridhar Ayengar wrote:
It was a poor attempt at humor.
HAHAHAHA, that's funny. It was so poor, I didn't even get it. ;)
-brian
--
"Coding in C is like sending a 3 year old to do groceries. You gotta
tell them exactly what you want or you'll end up with a cupboard full of
pop tarts and pancake mix." -- IRC User (http://www.bash.org/?841435)
On 9 Apr 2009, at 13:54, Sridhar Ayengar wrote:
Brian Hechinger wrote:
On Wed, Apr 08, 2009 at 11:18:14PM -0400, Sridhar Ayengar wrote:
Sampsa Laine wrote:
So if I have two dual port PCI cards, one in machine 1, one in machine 2, I wire them:
1.A. -> 2.B
2.A -> 1.B
No,
1. A -> B
2. B -> A
Which is exactly what Sampsa said in the first place.
Ignore him, Sampsa, you have the right idea.
It was a poor attempt at humor.
Yeah I looked at that at went like "hold on, that'll connect each machine to itself."
Very secure from the confidentiality and intergrity point of view I suppose, leaves something to be desired on the availability front.
Brian Hechinger wrote:
On Wed, Apr 08, 2009 at 11:18:14PM -0400, Sridhar Ayengar wrote:
Sampsa Laine wrote:
So if I have two dual port PCI cards, one in machine 1, one in machine 2, I wire them:
1.A. -> 2.B
2.A -> 1.B
No,
1. A -> B
2. B -> A
Which is exactly what Sampsa said in the first place.
Ignore him, Sampsa, you have the right idea.
It was a poor attempt at humor.
Peace... Sridhar