/dev/chat

@Gilles Not Free or one of those that provide their own inhouse router which is controlled over the internet right? If so, it could be anything from their end I guess.

Gilles

The MTU over the DSL connection is 1492, over the local ethernet link from the PC to the router is 1500. Perfectly normal home stuff.

terdon

Great idea that, the only way to control your internet is through their website, so as soon as you bork the router, you can't fix it anymore.

slm

similar issue

8

Q: Why does SCP hang on copying files larger than 1405 bytes?

I'm trying to copy a file from one of my local machines to a remote machine. Copying a file with size upto 1405 bytes works fine. When I try to scp a larger file, the file gets copied but the scp process hangs up and doesn't exit. I have to hit Ctrl-C to return back to the shell. I have observed...

Gilles

@slm no, SSH didn't make things work for him

slm

I know but the reference in the comment of the Accepted A

tools.ietf.org/html/rfc2516

See the Wikipedia page on MTU (look out for PPPoE) and maybe RFC 2516 wich suggests an MTU of 1492 when behind a home router. — Stephan B Mar 29 '11 at 13:40

Gilles

8:13 PM

Assume what I know about MTUs is exactly what's in this answer

Patrick

@Gilles I'd be curious to see the effects of a traceroute with and without ssh. The only possibilities are that the MTU along the path is changing, or the route is changing.

...although that the box didn't respond with a smaller packet still bugs me

Gilles

yeah, why didn't the receipt of ICMP (ICMP 590 Destination unreachable (Fragmentation needed), AFAIR) cause Linux to reemit a smaller TCP packet?

All I had time to see after opening the SSH connection is that there was no ICMP. I didn't capture a session and check the packet sizes.

Ramesh

I am able to give this command and it seems to work. ip link set ens3 mtu 4000

Patrick

@Ramesh that would be a jumbo frame

Jumbo frame

In computer networking, jumbo frames are Ethernet frames with more than 1500 bytes of payload. Conventionally, jumbo frames can carry up to 9000 bytes of payload, but variations exist and some care must be taken using the term. Many Gigabit Ethernet switches and Gigabit Ethernet network interface cards support jumbo frames. Some Fast Ethernet switches and Fast Ethernet network interface cards also support jumbo frames. Most national research and education networks (such as Internet2, National LambdaRail, ESnet, GÉANT and AARNet) support jumbo frames, but most commercial Internet service providers...

Ramesh

But the maximum size seems to be only 1500 for ethernet as suggested here.

Patrick

8:26 PM

If you have a switch capable of handling jumbo frames, that 1500 byte limit is bogus

slm

@Gilles - need more info

Ramesh

ok, so wireless interface can handle more than ethernet?

slm

Q's still too vague

Gilles

@slm I know, otherwise I'd have asked on the site

Patrick

@Ramesh dunno. I'd have to look at the 802.11 spec

Ramesh

8:29 PM

So what's wrong in setting a MTU size like 3000?

slm

what makes you think you should set this higher?

Ramesh

I am just curious.

Patrick

@Ramesh as long as your network supports it, nothing

Ramesh

I mean is there an added advantage if we set it to maximum size supported?

slm

linksys shows the same approach of using ping to determine it

kb.linksys.com/Linksys/…

Patrick

8:30 PM

In fact 9000 byte MTUs are relatively common in enterprise networks

Ramesh

So the drawback is, even for a smaller packet it uses the entire MTU size?

slm

I can see where it makes sense if you're all on a LAN

Patrick

@Ramesh no, Maximum Transmit Unit

slm

the issue is if you're putting undo work on the routers/ switches to break up big packets into several smaller ones and then having to reassimilate

Patrick

@slm Not true, the linux kernel handles that

slm

8:32 PM

how do you mean?

Patrick

Path MTU Discovery

Path MTU Discovery (PMTUD) is a standardized technique in computer networking for determining the maximum transmission unit (MTU) size on the network path between two Internet Protocol (IP) hosts, usually with the goal of avoiding IP fragmentation. PMTUD was originally intended for routers in Internet Protocol Version 4 (IPv4). However, all modern operating systems use it on endpoints. In IPv6, this function has been explicitly delegated to the end points of a communications session. For IPv4 packets, Path MTU Discovery works by setting the Don't Fragment (DF) option bit in the IP headers of outgoing...

slm

according to that article all OSes now implement this. Hmm hadn't heard of this.

How does this work when behind a NAT?

Patrick

nat is irrelevant

slm

you negotiate up to the NAT and then from there you're no longer in communication with the ultimate endpoint

Patrick

NAT simply substitutes a few bytes in the header of the packet, has no bearing on MTU

slm

8:37 PM

only that it masks you from negotiating w/ your actual endpoint

Patrick

only DNAT, but that doesn't matter either

it's all just hops along the path, doesn't matter if a hop is performing any kind of NAT

slm

so with resp. to Gilles Q, how would this play into that?

Patrick

His box should have received the ICMP can't fragment / fragmentation needed packet and resent a smaller packet

slm

W/ this the the local endpoint should be getting some notifications from the remote endpoint that MTU is too large and sending back DF?

CF?

Gilles

@Patrick I saw the ICMP frag needed packets. Apparently this didn't result in sending smaller packets, or something ate them on the way (I didn't dig enough to see which)

Patrick

8:41 PM

@Gilles yeah, now we're just talking generalities, not about your specific issue

@slm If any hop along the path cannot accomidate the packet, it sends back an ICMP fragmentation needed yes

slm

He was explaining PMTUD which I'd never heard of

Gilles

Hmmm, I wonder if it could be some complex stateful firewall on the hosting provider's side

Ramesh

so NAT is something that could be configured using iptables/firewall?

Patrick

@Ramesh iptables can perform NAT yes

slm

yeah one of the tables is called NAT

Gilles

8:43 PM

I can't remember who sent the ICMP packets: it should have been the home router, right?

slm

there are typically 3 if I'm not mistaken

Gilles

because that's where the MTU was reduced from 1500 to 1492

Patrick

@Gilles could have been anyone

slm

out of the box with iptables

Ramesh

Is that the only way or there are more ways to configure NAT in a machine?

Gilles

8:44 PM

@Patrick PC sends 1500-byte TCP packet. Router receives it. MTU on the next hop is 1492. What happens?

Patrick

@Gilles The router should know the MTU of the link and respond back with the ICMP packet.

Gilles

(packet sizes refer to the IP packet)

slm

anything that can be inserted into the flow of packets that can rewrite the envelope so that the network is re-written would be NAT

Gilles

@Patrick ok, thanks. So the PC receives ICMP fragmentation needed from the router. No packet has escaped the router.

I saw multiple ICMP replies. So that would indicate the PC sent another packet that's too large. Nothing would have reached the Internet let alone the hosting provider.

Patrick

@Gilles affirmative. If it tried to send a 1500 byte packet across a 1492 MTU link, you'd get line errors.

Gilles

8:46 PM

@Patrick couldn't the router fragment the IP packet?

Patrick

@Gilles Not if it was told not to, which is standard practice these days (for the "don't fragment" bit to be set on all traffic)

net.ipv4.ip_no_pmtu_disc controls the behavior

slm

This page was extremely helpful if you're attempting to follow Patrick's and Gilles conversation w/ the MTU above: resources.intenseschool.com/…

3

Ramesh

Thanks @slm.

slm

Also if you're interested in PMTUD the author is a network engineer and he explains the downsides of it

specifically around the blocking of ICMP packets which can be SOP when dealing with PCI compliance.

PCI - Payment Card Industry

Patrick

That's actually the #1 reason why I flat out refused to let my boss move us into Microsoft Azure cloud. Their network filters ALL ICMP packets.

Got a client with a 1492 MTU, well, tough shit, they can't talk to us.

slm

8:57 PM

Blocking ICMP seems so heavy handed

it's there so that the network can be managed, and then you're cutting it off at the knees

Ramesh

So is that reason why traceroute www.bing.com gives me * in return?

slm

hmm

Patrick

@Ramesh possibly. depends on if microsoft uses Azure for hosting their own stuff. It's also possible to only block certain types of ICMP packets

slm

@Ramesh yeah ICMP packets have nomenclature just like TCP and UDP and can be piecemeal blocked

Ramesh

But traceroute uses UDP right?

I see ping uses ICMP

slm

9:00 PM

What about this setting of the MSS in the packet, @Gilles?

it''s a similar solution to just blanket setting the MTU

traceroute sets the TTL of a request so that it induces the system to stall out as it sends packets to the ultimate destination.

Patrick

@Ramesh It can use either ICMP or UDP

@slm If that's the concern, you can add per-route MTUs

slm

are those part of the kernel?

or iptables?

Ramesh

Actually this request succeeded.

traceroute -T -p 80 www.bing.com

Patrick

@slm ip route add 1.2.3.4 mtu 1492 ...

slm

that's what he was doing already, right? I thought MSS was a different field in the TCP header

or IP header, hadn't looked deeper yet

Patrick

9:04 PM

@slm from my understanding he was setting the MTU on the link

slm

and the device itself?

your adding a routing rule via ip there

that's specific to that IP

Patrick

not following

slm

gilles set the mtu on the device ifconfig ....?

you're suggestion is moving it to an actual routing rule when the system is talking to that that IP?

Patrick

gah, no ifconfig, death to ifconfig

slm

I'm reading the ip-route man page too

Patrick

9:08 PM

i'm not suggesting anything, just saying there's an alternative if the concern is setting the MTU globally

if he's got an ADSL link with a 1492 MTU, setting the MTU globally makes sense

slm

hey I'm trying to relearn what I just spent the last 10+ years learning....

whatever the command was to setup the device, he set it on the device using some command ifconfig/ip ...

your suggestion moves it to a routing rule, no?

ugh this ip-route man page sucks

is this called policy routing? <<<< @patrick

Patrick

if the problem only affects a single destination, and other destinations might be adversely affected by dropping the MTU, then a per-destination MTU make sense

@slm no

slm

   Route tables: Linux-2.x can pack routes into several routing tables identified by a number in the range from 1 to 2^31 or by name from the file /etc/iproute2/rt_tables By default all
   normal routes are inserted into the main table (ID 254) and the kernel only uses this table when calculating routes.  Values (0, 253, 254, and 255) are reserved for built-in use.

what the hell is this section of the man page saying to me

Actually, one other table always exists, which is invisible but even more important. It is the local table (ID 255). This table consists of routes for local and broadcast addresses.
The kernel maintains this table automatically and the administrator usually need not modify it or even look at it.

The multiple routing tables enter the game when policy routing is used.

ip route add
add new route

ip route change
change route

ip route replace
change or add new one

to TYPE PREFIX (default)

so your example is ip route add ....

Patrick

"normal routes are inserted into the main table (ID 254) and the kernel only uses this table when calculating routes"
^ that's bogus

slm

so you're ip route add to ... since that's the default?

hence my confusion

Patrick

9:15 PM

Yeah, whatever you're quoting from, stop reading that. it's all wrong

it might have been right back in the 90s

slm

LOL that's the firggin' man page for ip

wonderful

Patrick

ip rule show

^ that's your available tables right there

slm

$ ip rule show
0: from all lookup local
32766: from all lookup main
32767: from all lookup default

Patrick

precisely, main is 32766, not 254, local is 0, not 255

slm

???? - maybe we should fix this?

Patrick

9:16 PM

ohhhhh

wait, no. i'm stupid

completely ignore my last 6 mesages or so

yes, I was thinking rule numbers, yes, those table numbers might be right

yes, they are right

cat /etc/iproute2/rt_tables

slm

$ cat /etc/iproute2/rt_tables
#
# reserved values
#
255 local
254 main
253 default
0 unspec
#
# local
#
#1 inr.ruhep

these correspond with some output from ip route show?

when I looked it didn't

Patrick

correspond with what?

slm

those numbers (253, 254) are they just arbitrary numbers?

that represent a "routing table"?

Patrick

well, i think those (255, 254, & 253) might be fixed. I bet thats what the kernel uses by default and there's no way to change it.

slm

ip route list table 254

ip route list table 255

shows the lists

you have to know those numbers

Faheem Mitha

9:22 PM

what's the correct syntax for -> grep -R llc if you only want exactly llc? ^llc$ or something?

Patrick

@slm no, thats what the rt_tables file is for

slm

ok so go by the name, local, not the number

ip route show table local

Patrick

@slm Yeah. unless you're dealing with custom tables, the name is easier

slm

the file must get used when the ip stack is coming up then

Patrick

@slm eh?

slm

9:23 PM

mapping an alias to the numbers

Patrick

@FaheemMitha '^llc$' would work if you wanted to match llc on a line by itself yes

@slm no, the kernel doesn't need names. That file is only for use by the IProute2 suite. Kernel isn't even aware IProute2 exists

Faheem Mitha

@Patrick not on a line by itself, but preceded and followed by spaces. so the string llc separated by spaces on each side

slm

k

Patrick

@FaheemMitha with -E you could do grep -E '^\s*llc\s*$'

Faheem Mitha

@Patrick ok, thanks. any simpler alternative?

Patrick

9:26 PM

with posix grep it'd be ^[[:space:]]{0,}llc[[:space::]]{0,} iirc

yikes, that's worse.

grep -E ' llc '?

Oi.

hello

Is it alright if I ask a question here?

slm

9:27 PM

main site

ask it there

Anthony

Ugh.

Yeah, alright.

Thanks.

slm

it's a Q&A site

Anthony

Yeah I know, I often just ask question in the math chat room, though.

slm

regrets asking.... what is it?

Anthony

I love you

I was told to
adjust the /etc/profile.local with following lines
(as user root)

----------------------------------------------
export PATH=$PATH:~/cmds:.
export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:~/lib
export LIBRARY_PATH=$LIBRARY_PATH:~/lib
export ALLOW=1

slm

9:29 PM

pls don't

Faheem Mitha

@Anthony What are you trying to do, exactly?

slm

already regretting I said to ask

yeah ask it on the main site

Anthony

@slm I'll just talk to Faheem, I'll post on the main site if it doesn't resolve

yeah

I will. Thanks. Sorry.

slm

np

Anthony

@FaheemMitha I'm trying to install some software for a lithography machine, but the guy from the company told me to do that.

Faheem Mitha

9:31 PM

@slm does that work to search for llc with spaces to left and right?

@Anthony Eek

Anthony

I don't have a profile.local, though, I don't think.

Faheem Mitha

@Anthony is this proprietary software?

Anthony

I'm not... sure?

slm

.bashrc or .bash_profile

as root the adding of . to your PATH is generally a bad idea

Faheem Mitha

@Anthony to be clear, you got a set of instructions and you are having difficulty following them, or you don't know whether you should?

Anthony

9:32 PM

difficulty following.

I trust the man.

slm

~/cmds isn't so dangerous, though I'd make it /root/cmds

/root/.bashrc /root/.bash_profile

Anthony

@slm I don't know what you're saying, I should probably ask on the mainsite. I'm relatively new to linux. :P

Faheem Mitha

@Anthony I'd probably post on the site stuff you don't understand.

Anthony

Yeah.

slm

those are 2 files that are similar to what you're asking about for root, there's also /etc/profile.d/ where you can add files for everyone on the system

Anthony

9:34 PM

Well I mean, I just don't have the file he said to update.

I tried adding to the one for everyone, but it didn't seem to do anything. The main problem is the program I'm running needs access to cmds, but I think it can't see it?

slm

If it's for everyone on the box, add it to /etc/profile.d/lithograph.sh

Anthony

And if I just want it for my account?

slm

$HOME/.bashrc $HOME/.bash_profile

I would put it there if it's just for you

Faheem Mitha

Neither grep -E '^\s*llc\s*$' or grep -E ' llc ' seem to anything here. They just hang. And I don't see any processes running.

slm

the s/w will need to be installed into your home account with those settings though

@FaheemMitha did you tell it what to grep?

grep -E ... <file> or grep -RE ... <dir>

Faheem Mitha

9:38 PM

@slm i want the current directory. Add .?

Current directory, recursive.

grep -E -R '^\s*Common\s*$' ?

slm

grep -RE ... .

... are your REGEX

Faheem Mitha

well, at least it is running. isn't current directory the default?

Anthony

Ugh yeah, I'm not following. I'll probably ask on the mainsite.

Thanks guys.

slm

the use of \sllc\s is best b/c it tells grep to explicitly look for llc bound by spaces

mainsite

Faheem Mitha

grep -E -R '^\s*Common\s*$'

Anthony

9:41 PM

That's what I said...?

Faheem Mitha

for example doesn't work, but grep -E -R ' Common ' does return hits.

Anthony

Thanks.

Faheem Mitha

is this globbing? I always get confused.

slm

that's regex

Faheem Mitha

Maybe I need to see a therapist to get over my fear of regular expressions.

Patrick

9:57 PM

'\%(//\%(\%([[:alpha:][:digit:]$-_.~!*\'(),+;&=]*@\)\=\%([[:alnum:]][[:alnum:]-‌]*[[:alnum:]]\|[[:alnum:]]\.\)*\%(\a[[:alnum:]-]*[[:alnum:]]\|\a\)\%(:\d\+\)\=\)\‌=\|/at/\%([[:alpha:][:digit:]$-_.~]\|\\\x\x\)\{1,31}:\%([[:alpha:][:digit:]$-_.~]\|‌\\\x\x\)\{1,31}\%([[:alpha:][:digit:]$-_.~]\|\\\x\x\)\{1,31}\|/ipx/\x\{8}:\x\{12}:\x\‌{4}\)\%(/\%([[:alpha:][:digit:]$-_.~!*\'()+;?:@&=+]\|\\\x\x\)*\)*\%(;[^()\\!<=>~[:cn‌trl:]* \t_]\+\%(=[^()\\!<=>~[:cntrl:] ]\+\)\=\)*'

jimmij

zsh: parse error near `;&'

Faheem Mitha

11:46 PM

can someone remind me how to remove *.pyc files?

I have -> find . -name *.pyc

and I pass this to rm via a pipe?

slm

find . -name *.pyc -delete {} +

man find, look for delete

Transcript for