Download as PDF, PPTX
Uploaded byStephen Hemminger
Linux Bridging: Teaching an old dog new tricks
This document summarizes the history and current state of Linux bridging. It discusses how bridging has evolved from Ethernet bridging in 1985 to modern standards like 802.1aq Shortest Path Bridging. It also outlines key topics in bridging including tunneling protocols, the spanning tree protocol for avoiding loops, and security features. The status section notes that VXLAN support is in the mainline kernel but that updates to spanning tree and additional security features may be added in future kernel versions.
More Related Content
Similar to Linux Bridging: Teaching an old dog new tricks
Linux Bridging: Teaching an old dog new tricks
- 1. Linux Bridging Teaching anOld Dog New Tricks Stephen Hemminger shemminger@vyatta.com
- 2. Topics ● Background ● Tunneling ● Security ● Status
- 3. Bridge History 1985 1990 1998 2000 2001 2004 2005 2012 Ethernet IEEE IEEE IEEE RSTP Bridging 802.1d 802.1d 802.1d MSTP SPB Invented 1998 2004 802.1s 802.1aq Linux IGMP Bridge Snooping
- 4. Bridge Forwarding Flood Multicast? Destination? Output IGMP table Forwarding Table
- 5. Spanning Tree Protocol Root Leaf BPDU BPD Disabled U Edge
- 7. Tunnels VXLAN1 VXLAN2 Bridge1 Bridge2 Bridge1 Bridge2 Guest Guest Guest Guest A B C D
- 8. Cloud Tunneling Protocols ● VxLan – Arista, Broadcom, Cisco, Vmware, Red Hat ● NVGRE – Microsoft, Intel, Dell, Broadcom, Emulex ● STT – Niciria
- 9. API flavor's ● Ioctl – Compatibility – non-extensible ● Sysfs – Text based ● Netlink – Notifications – TLV format
- 10. Hw offload ● Common netlink API – Forwarding table – monitoring
- 11. Security ● BPDU guard ● BPDU filter ● Root port protect ● Port locking
- 12. STP Security Issues Bridge (core) Bridge (core) Bridge (edge) Guest VM
- 13. BPDU Filter Core Bridge BPDU blocked Not sent or received BPDU Untrusted Host
- 14. BPDU Guard Core Bridge Rogue BPDU! Link disabled BPDU BPDU Untrusted Host/Bridge
- 15. Root Port Protect BPDU Core Bridge Allowed if Priority < Root BPDU BPDU Semi-trusted Host/Bridge
- 16. Port lock Source Address Core Bridge Must match Untrusted Guest
- 17. Spanning Tree ● Current – Kernel – 802.1d 1998 – Userspace – RSTP daemon ● Goal – Kernel – 802.1d/802.1s – Userspace – SPB or TRILL?
- 18. Status ● VXLAN – 3.7 ● Security – 3.8? ● STP update – 3.9??
- 19. Bridge vs Openvswitch EthernetBridge Openvswitch – Plug and Play – Table driven – Firewall rules – Flexible – Integrated – Management agent
- 20.