Re: Pfs tool and pfsync

["Brian A. Seklecki" <seklecki%noc.cfi.pgh.pa.us@localhost>]

> In a second time, I have ported pfsync(4) from OpenBSD. A full src diff can 
> be 
> found here 
>       ftp://ftp.netbsd.org/pub/NetBSD/misc/degroote/pfsync.diff
> 


Looks good on netbsd-5.  Only two notes:

1) netstat(8) needs the pfsync(8) section
2) tcpdump(8) needs to know about /etc/protcol(5) values:
    # Don't wait for IANA; I didn't see them hacking on OpenBSD
    pfsync 240 PFSYNC   # PF Synchronization


$ uname -a 
NetBSD cauldron-nbsd-netbsd-5-i386.lab02.pitbpa0.priv.collaborativefusion.com 
5.0_STABLE NetBSD 5.0_STABLE (GENERIC+PFSYNC) #0: Fri Aug  7 13:36:36 EDT 2009 
root@cauldron-nbsd -netbsd-5-i386.lab02. 
:/home/netbsd/obj.i386/20090729-2158EDT/
sys/arch/i386/compile/GENERIC+PFSYNC i386


pcn0: flags=8b43<UP,BROADCAST,RUNNING,PROMISC,ALLMULTI,SIMPLEX,MULTICAST> mtu 
1500
  address: 00:0c:29:67:52:18
  media: Ethernet autoselect (autoselect)
  inet 192.168.xxx.xxx netmask 0xffffff00 broadcast 192.168.xxx.xxx
  inet alias 192.168.xxx.xxxx.xxx netmask 0xffffff00 broadcast 192.168.xxx.xx
  inet6 fe80::20c:29ff:fe67:5218%pcn0 prefixlen 64 scopeid 0x1
  inet6 2607:f000:xxxx:xxxx:20c:29ff:fe67:5218 prefixlen 64
pfsync0: flags=41<UP,RUNNING> mtu 1460
  pfsync: syncdev: pcn0 syncpeer: 224.0.0.240 maxupd: 128
carp123: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
  carp: MASTER carpdev pcn0 vhid 123 advbase 1 advskew 0
  address: 00:00:5e:00:01:7b
  inet 192.168.xxx.169 netmask 0xffffff00 broadcast 192.168.xxx.255


[4]   Running                 tcpdump -n -tttt -vvvv -s4096 -i carp123 -e "host 
224.0.0.240" &
[5]-  Running                 tcpdump -n -tttt -vvvv -s4096 -e "host 
224.0.0.240" &
2009-08-07 14:16:52.805504 00:0c:29:67:52:18 > 01:00:5e:00:00:f0, ethertype 
IPv4 (0x0800), length 230: (tos 0x10, ttl 255, id 184, offset 0, flags [DF], 
proto unknown (240), length 216) 192.168.xxx.54 > 224.0.0.240:  ip-proto-240 196
2009-08-07 14:16:53.166751 00:0c:29:67:52:18 > 01:00:5e:00:00:f0, ethertype 
IPv4 (0x0800), length 534: (tos 0x10, ttl 255, id 185, offset 0, flags [DF], 
proto unknown (240), length 520) 192.168.xxx.54 > 224.0.0.240:  ip-proto-240 500
2009-08-07 14:16:53.517746 00:0c:29:67:52:18 > 01:00:5e:00:00:f0, ethertype 
IPv4 (0x0800), length 142: (tos 0x10, ttl 255, id 186, offset 0, flags [DF], 
proto unknown (240), length 128) 192.168.xxx.54 > 224.0.0.240:  ip-proto-240 108