mirror of https://github.com/tLDP/LDP
Finalize version 0.49
This commit is contained in:
pbldp
parent
c2a993fb92
commit
0d072522ba
|
|
@ -51,8 +51,8 @@ Bieringer
|
|||
<revhistory>
|
||||
\layout SGML
|
||||
|
||||
<revision> <revnumber> 0.49work-in-progress.de.1</revnumber> <date>2005-10-03</date
|
||||
> <authorinitials>PB</authorinitials> <revremark>Details siehe
|
||||
<revision> <revnumber> 0.49.de.1</revnumber> <date>2005-10-03</date> <authorinitial
|
||||
s>PB</authorinitials> <revremark>Details siehe
|
||||
\begin_inset LatexCommand \ref[revision history]{revision-history}
|
||||
|
||||
\end_inset
|
||||
|
|
|
|||
|
|
@ -29,7 +29,7 @@ Bieringer
|
|||
<revhistory>
|
||||
|
||||
|
||||
<revision> <revnumber> 0.49work-in-progress.de.1</revnumber> <date>2005-10-03</date> <authorinitials>PB</authorinitials> <revremark>Details siehe <link linkend="revision-history">revision history</link></revremark></revision>
|
||||
<revision> <revnumber> 0.49.de.1</revnumber> <date>2005-10-03</date> <authorinitials>PB</authorinitials> <revremark>Details siehe <link linkend="revision-history">revision history</link></revremark></revision>
|
||||
|
||||
|
||||
<revision> <revnumber> 0.48.de.1</revnumber> <date>2005-01-11</date> <authorinitials>PB</authorinitials> <revremark>Details siehe <link linkend="revision-history">revision history</link></revremark></revision>
|
||||
|
|
@ -57,7 +57,7 @@ Das Ziel des Linux IPv6 HOWTO ist die Beantwortung von Basis- und Experten-Frage
|
|||
Allgemein
|
||||
</title>
|
||||
<remark>
|
||||
CVS-ID: $Id: Linux+IPv6-HOWTO.de.lyx,v 1.42 2005/10/03 19:22:03 pbldp Exp $
|
||||
CVS-ID: $Id: Linux+IPv6-HOWTO.de.lyx,v 1.43 2005/10/03 19:42:15 pbldp Exp $
|
||||
</remark>
|
||||
<para>
|
||||
Informationen über verfügbare Übersetzungen finden Sie im Abschnitt <link linkend="general-translations">Übersetzungen</link>.
|
||||
|
|
|
|||
|
|
@ -51,8 +51,8 @@ Bieringer
|
|||
<revhistory>
|
||||
\layout SGML
|
||||
|
||||
<revision> <revnumber>Release 0.49work-in-progress</revnumber> <date>2005-10-03</
|
||||
date> <authorinitials>PB</authorinitials> <revremark>See
|
||||
<revision> <revnumber>Release 0.49</revnumber> <date>2005-10-03</date> <authorini
|
||||
tials>PB</authorinitials> <revremark>See
|
||||
\begin_inset LatexCommand \ref[revision history]{revision-history}
|
||||
|
||||
\end_inset
|
||||
|
|
|
|||
|
|
@ -29,7 +29,7 @@ Bieringer
|
|||
<revhistory>
|
||||
|
||||
|
||||
<revision> <revnumber>Release 0.49work-in-progress</revnumber> <date>2005-10-03</date> <authorinitials>PB</authorinitials> <revremark>See <link linkend="revision-history">revision history</link> for more</revremark></revision>
|
||||
<revision> <revnumber>Release 0.49</revnumber> <date>2005-10-03</date> <authorinitials>PB</authorinitials> <revremark>See <link linkend="revision-history">revision history</link> for more</revremark></revision>
|
||||
|
||||
|
||||
<revision> <revnumber>Release 0.48.1</revnumber> <date>2005-01-15</date> <authorinitials>PB</authorinitials> <revremark>See <link linkend="revision-history">revision history</link> for more</revremark></revision>
|
||||
|
|
@ -69,7 +69,7 @@ The goal of the Linux IPv6 HOWTO is to answer both basic and advanced questions
|
|||
General
|
||||
</title>
|
||||
<remark>
|
||||
CVS-ID: $Id: Linux+IPv6-HOWTO.lyx,v 1.103 2005/10/03 19:22:03 pbldp Exp $
|
||||
CVS-ID: $Id: Linux+IPv6-HOWTO.lyx,v 1.104 2005/10/03 19:42:15 pbldp Exp $
|
||||
</remark>
|
||||
<para>
|
||||
Information about available translations you will find in section <link linkend="general-translations">Translations</link>.
|
||||
|
|
@ -130,7 +130,7 @@ Internet/IPv6 history of the author
|
|||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>
|
||||
1993: I got in contact with the Internet using console based e-mail and news client (e.g. look for "e91abier" on <ulink url="http://groups.google.com/">groups.google.com</ulink>, that's me).
|
||||
1993: I got in contact with the Internet using console based e-mail and news client (e.g. look for “e91abier” on <ulink url="http://groups.google.com/">groups.google.com</ulink>, that's me).
|
||||
</para>
|
||||
|
||||
</listitem>
|
||||
|
|
@ -181,7 +181,7 @@ He's currently living in Munich [northern part of Schwabing] / Bavaria
|
|||
Category
|
||||
</title>
|
||||
<para>
|
||||
This HOWTO should be listed in category "<emphasis>Networking</emphasis>/<emphasis>Protocols</emphasis>".
|
||||
This HOWTO should be listed in category “<emphasis>Networking</emphasis>/<emphasis>Protocols</emphasis>”.
|
||||
</para>
|
||||
|
||||
</sect1>
|
||||
|
|
@ -423,7 +423,7 @@ This HOWTO is currently written with LyX version 1.2.0 on a Red Hat Linux 7.3 sy
|
|||
Code line wrapping
|
||||
</title>
|
||||
<para>
|
||||
Code line wrapping is done using selfmade utility "lyxcodelinewrapper.pl", you can get it from CVS for your own usage: <ulink url="http://cvsview.tldp.org/index.cgi/LDP/users/Peter-Bieringer/">TLDP-CVS / users / Peter-Bieringer</ulink>
|
||||
Code line wrapping is done using selfmade utility “lyxcodelinewrapper.pl”, you can get it from CVS for your own usage: <ulink url="http://cvsview.tldp.org/index.cgi/LDP/users/Peter-Bieringer/">TLDP-CVS / users / Peter-Bieringer</ulink>
|
||||
</para>
|
||||
|
||||
</sect3>
|
||||
|
|
@ -441,13 +441,13 @@ Also some fixes are have to be made to create proper SGML code (see also here fo
|
|||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>
|
||||
Export of LyX table does not create proper "colspan" tags - tool for fixing: "sgmllyxtabletagfix.pl" (fixed since LyX 1.2.0)
|
||||
Export of LyX table does not create proper “colspan” tags - tool for fixing: “sgmllyxtabletagfix.pl” (fixed since LyX 1.2.0)
|
||||
</para>
|
||||
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
LyX sometimes uses special left/right entities for quotes instead the normal one, which will still exist in generated HTML. Some browsers don't parse this very well (known: Opera 6 TP 2 or Konqueror) - tool for fixing: "sgmllyxquotefix.pl"
|
||||
LyX sometimes uses special left/right entities for quotes instead the normal one, which will still exist in generated HTML. Some browsers don't parse this very well (known: Opera 6 TP 2 or Konqueror) - tool for fixing: “sgmllyxquotefix.pl”
|
||||
</para>
|
||||
|
||||
</listitem>
|
||||
|
|
@ -514,7 +514,7 @@ Linux IPv6 FAQ/HOWTO (outdated)
|
|||
The first IPv6 related document was written by <emphasis>Eric Osborne</emphasis> and called <ulink url="http://www.linuxhq.com/IPv6/">Linux IPv6 FAQ/HOWTO</ulink> (please use it only for historical issues). Latest version was 3.2.1 released July, 14 1997.
|
||||
</para>
|
||||
<para>
|
||||
Please help: if someone knows the date of birth of this HOWTO, please send me an e-mail (information will be needed in "history").
|
||||
Please help: if someone knows the date of birth of this HOWTO, please send me an e-mail (information will be needed in “history”).
|
||||
</para>
|
||||
|
||||
</sect3>
|
||||
|
|
@ -524,7 +524,7 @@ Please help: if someone knows the date of birth of this HOWTO, please send me an
|
|||
IPv6 & Linux - HowTo (maintained)
|
||||
</title>
|
||||
<remark>
|
||||
This HOWTO is really named "HowTo"
|
||||
This HOWTO is really named “HowTo”
|
||||
</remark>
|
||||
<para>
|
||||
There exists a second version called <ulink url="http://www.bieringer.de/linux/IPv6/">IPv6 & Linux - HowTo</ulink> written by me (<emphasis>Peter Bieringer</emphasis>) in pure HTML. It was born April 1997 and the first English version was published in June 1997. I will continue to maintain it, but it will slowly fade (but not full) in favour of the Linux IPv6 HOWTO you are currently reading.
|
||||
|
|
@ -632,7 +632,7 @@ Host
|
|||
<varlistentry>
|
||||
<term>
|
||||
Interface
|
||||
</term><listitem><para>Mostly same as "device", see also NIC
|
||||
</term><listitem><para>Mostly same as “device”, see also NIC
|
||||
</para>
|
||||
|
||||
</listitem>
|
||||
|
|
@ -668,7 +668,7 @@ Node
|
|||
<varlistentry>
|
||||
<term>
|
||||
Octet
|
||||
</term><listitem><para>A collection of 8 real bits, today also similar to "byte".
|
||||
</term><listitem><para>A collection of 8 real bits, today also similar to “byte”.
|
||||
</para>
|
||||
|
||||
</listitem>
|
||||
|
|
@ -860,7 +860,7 @@ Document related
|
|||
Long code line wrapping signal char
|
||||
</title>
|
||||
<para>
|
||||
The special character "¬" is used for signaling that this code line is wrapped for better viewing in PDF and PS files.
|
||||
The special character “¬” is used for signaling that this code line is wrapped for better viewing in PDF and PS files.
|
||||
</para>
|
||||
|
||||
</sect3>
|
||||
|
|
@ -1092,7 +1092,7 @@ As previously mentioned, IPv6 addresses are 128 bits long. This number of bits g
|
|||
]]>
|
||||
</programlisting>
|
||||
<para>
|
||||
Such numbers are not really addresses that can be memorized. Also the IPv6 address schema is bitwise orientated (just like IPv4, but that's not often recognized). Therefore a better notation of such big numbers is hexadecimal. In hexadecimal, 4 bits (also known as "nibble") are represented by a digit or character from 0-9 and a-f (10-15). This format reduces the length of the IPv6 address to 32 characters.
|
||||
Such numbers are not really addresses that can be memorized. Also the IPv6 address schema is bitwise orientated (just like IPv4, but that's not often recognized). Therefore a better notation of such big numbers is hexadecimal. In hexadecimal, 4 bits (also known as “nibble”) are represented by a digit or character from 0-9 and a-f (10-15). This format reduces the length of the IPv6 address to 32 characters.
|
||||
</para>
|
||||
<programlisting>
|
||||
<![CDATA[2^128-1: 0xffffffffffffffffffffffffffffffff
|
||||
|
|
@ -1121,7 +1121,7 @@ For simplifications, leading zeros of each 16 bit block can be omitted:
|
|||
]]>
|
||||
</programlisting>
|
||||
<para>
|
||||
One sequence of 16 bit blocks containing only zeroes can be replaced with "::". But not more than one at a time, otherwise it is no longer a unique representation.
|
||||
One sequence of 16 bit blocks containing only zeroes can be replaced with “::“. But not more than one at a time, otherwise it is no longer a unique representation.
|
||||
</para>
|
||||
<programlisting>
|
||||
<![CDATA[3ffe:ffff:100:f101:0:0:0:1 -> 3ffe:ffff:100:f101::1
|
||||
|
|
@ -1194,7 +1194,7 @@ During the design of IPv4, people thought that 32 bits were enough for the world
|
|||
So designers have chosen 128 bits, 4 times more in length and 2^96 greater in size than in IPv4 today.
|
||||
</para>
|
||||
<para>
|
||||
The usable size is smaller than it may appear however. This is because in the currently defined address schema, 64 bits are used for interface identifiers. The other 64 bits are used for routing. Assuming the current strict levels of aggregation (/48, /32, ...), it is still possible to "run out" of space, but hopefully not in the near future.
|
||||
The usable size is smaller than it may appear however. This is because in the currently defined address schema, 64 bits are used for interface identifiers. The other 64 bits are used for routing. Assuming the current strict levels of aggregation (/48, /32, ...), it is still possible to “run out” of space, but hopefully not in the near future.
|
||||
</para>
|
||||
<para>
|
||||
See also for more information <ulink url="http://www.faqs.org/rfcs/rfc1715.html">RFC 1715 / The H Ratio for Address Assignment Efficiency</ulink> and <ulink url="http://www.faqs.org/rfcs/rfc3194.html">RFC 3194 / The Host-Density Ratio for Address Assignment Efficiency</ulink>.
|
||||
|
|
@ -1243,7 +1243,7 @@ Addresses without a special prefix
|
|||
Localhost address
|
||||
</title>
|
||||
<para>
|
||||
This is a special address for the loopback interface, similiar to IPv4 with its "127.0.0.1". With IPv6, the localhost address is:
|
||||
This is a special address for the loopback interface, similiar to IPv4 with its “127.0.0.1”. With IPv6, the localhost address is:
|
||||
</para>
|
||||
<programlisting>
|
||||
<![CDATA[0000:0000:0000:0000:0000:0000:0000:0001
|
||||
|
|
@ -1267,7 +1267,7 @@ Packets with this address as source or destination should never leave the sendin
|
|||
Unspecified address
|
||||
</title>
|
||||
<para>
|
||||
This is a special address like "any" or "0.0.0.0" in IPv4 . For IPv6 it's:
|
||||
This is a special address like “any” or “0.0.0.0” in IPv4 . For IPv6 it's:
|
||||
</para>
|
||||
<programlisting>
|
||||
<![CDATA[0000:0000:0000:0000:0000:0000:0000:0000
|
||||
|
|
@ -1387,7 +1387,7 @@ anyone here with a special address (e.g. looking for a router)?
|
|||
|
||||
</itemizedlist>
|
||||
<para>
|
||||
They begin with ( where <emphasis>"x"</emphasis> is any hex character, normally <emphasis>"0</emphasis>")
|
||||
They begin with ( where <emphasis>“x”</emphasis> is any hex character, normally <emphasis>“0</emphasis>”)
|
||||
</para>
|
||||
<programlisting>
|
||||
<![CDATA[fe8]]><emphasis><![CDATA[x: <- currently the only one in use.]]></emphasis><![CDATA[
|
||||
|
|
@ -1424,7 +1424,7 @@ It begins with:
|
|||
]]>
|
||||
</programlisting>
|
||||
<para>
|
||||
(where<emphasis> "x"</emphasis> is any hex character, normally <emphasis>"0</emphasis>")
|
||||
(where<emphasis> “x”</emphasis> is any hex character, normally <emphasis>“0</emphasis>”)
|
||||
</para>
|
||||
<para>
|
||||
Note that there are discussions going on in deprecating this kind of addresses because there are several issues. Read the current draft for more: <ulink url="http://www.ietf.org/internet-drafts/">draft-ietf-ipv6-deprecate-site-local-XY.txt</ulink>.
|
||||
|
|
@ -1451,7 +1451,7 @@ It begins with (<emphasis>x</emphasis> are hex characters)
|
|||
]]>
|
||||
</programlisting>
|
||||
<para>
|
||||
Note: the prefix "aggregatable" is thrown away in current drafts.
|
||||
Note: the prefix “aggregatable” is thrown away in current drafts.
|
||||
There are some further subtypes defined, see below:
|
||||
</para>
|
||||
<sect3>
|
||||
|
|
@ -1668,7 +1668,7 @@ An example of this address looks like
|
|||
]]>
|
||||
</programlisting>
|
||||
<para>
|
||||
Used prefix shows that this is a link-local multicast address. The suffix is generated from the destination address. In this example, a packet should be sent to address "fe80::1234", but the network stack doesn't know the current layer 2 MAC address. It replaces the upper 104 bits with "ff02:0:0:0:0:1:ff00::/104" and leaves the lower 24 bits untouched. This address is now used `on-link' to find the corresponding node which has to send a reply containing its layer 2 MAC address.
|
||||
Used prefix shows that this is a link-local multicast address. The suffix is generated from the destination address. In this example, a packet should be sent to address “fe80::1234”, but the network stack doesn't know the current layer 2 MAC address. It replaces the upper 104 bits with “ff02:0:0:0:0:1:ff00::/104” and leaves the lower 24 bits untouched. This address is now used `on-link' to find the corresponding node which has to send a reply containing its layer 2 MAC address.
|
||||
</para>
|
||||
|
||||
</sect3>
|
||||
|
|
@ -1782,7 +1782,7 @@ For servers it's probably easier to remember simpler addresses, this can also be
|
|||
]]>
|
||||
</programlisting>
|
||||
<para>
|
||||
For manual suffixes like "::1" shown in the above example it's required that the 7th most significant bit is set to 0 (the universal/local bit of the automatically generated identifier). Also some other (otherwise unchosen ) bit combinations are reserved for anycast addresses, too.
|
||||
For manual suffixes like “::1” shown in the above example it's required that the 7th most significant bit is set to 0 (the universal/local bit of the automatically generated identifier). Also some other (otherwise unchosen ) bit combinations are reserved for anycast addresses, too.
|
||||
</para>
|
||||
|
||||
</sect2>
|
||||
|
|
@ -1795,7 +1795,7 @@ For manual suffixes like "::1" shown in the above example it's require
|
|||
Prefix lengths for routing
|
||||
</title>
|
||||
<para>
|
||||
In the early design phase it was planned to use a fully hierarchical routing approach to reduce the size of the routing tables maximally. The reasoning behind this approach were the number of current IPv4 routing entries in core routers (> 104 thousand in May 2001), reducing the need of memory in hardware routers (ASIC "Application Specified Integrated Circuit" driven) to hold the routing table and increase speed (fewer entries hopefully result in faster lookups).
|
||||
In the early design phase it was planned to use a fully hierarchical routing approach to reduce the size of the routing tables maximally. The reasoning behind this approach were the number of current IPv4 routing entries in core routers (> 104 thousand in May 2001), reducing the need of memory in hardware routers (ASIC “Application Specified Integrated Circuit” driven) to hold the routing table and increase speed (fewer entries hopefully result in faster lookups).
|
||||
</para>
|
||||
<para>
|
||||
Todays view is that routing will be mostly hierarchically designed for networks with only one service provider. With more than one ISP connections, this is not possible, and subject to an issue named multi-homing (infos on multi-homing: <ulink url="http://www.ietf.org/internet-drafts/">drafts*multi6*</ulink>,<ulink url="http://arneill-py.sacramento.ca.us/ipv6mh/">IPv6 Multihoming Solutions</ulink>).
|
||||
|
|
@ -2051,7 +2051,7 @@ A major issue is that because of the network layer structure of kernel implement
|
|||
</para>
|
||||
<sect3>
|
||||
<title>
|
||||
Currently known never "IPv6 capable links"
|
||||
Currently known never “IPv6 capable links”
|
||||
</title>
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
|
|
@ -2079,7 +2079,7 @@ ISDN with encapsulation <emphasis>rawip</emphasis>, device names: isdnX
|
|||
|
||||
<sect3>
|
||||
<title>
|
||||
Currently known "not supported IPv6 capable links"
|
||||
Currently known “not supported IPv6 capable links”
|
||||
</title>
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
|
|
@ -2369,19 +2369,19 @@ Also some command line options are very useful to catch and print more informati
|
|||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>
|
||||
"-s 512": increase the snap length during capturing of a packet to 512 bytes
|
||||
“-s 512”: increase the snap length during capturing of a packet to 512 bytes
|
||||
</para>
|
||||
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
"-vv": really verbose output
|
||||
“-vv”: really verbose output
|
||||
</para>
|
||||
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
"-n": don't resolve addresses to names, useful if reverse DNS resolving isn't working proper
|
||||
“-n”: don't resolve addresses to names, useful if reverse DNS resolving isn't working proper
|
||||
</para>
|
||||
|
||||
</listitem>
|
||||
|
|
@ -2499,7 +2499,7 @@ IPv6-ready telnet clients are available. A simple test can be done with
|
|||
]]>
|
||||
</programlisting>
|
||||
<para>
|
||||
If the telnet client don't understand the IPv6 address and says something like "cannot resolve hostname", then it's not IPv6-enabled.
|
||||
If the telnet client don't understand the IPv6 address and says something like “cannot resolve hostname”, then it's not IPv6-enabled.
|
||||
</para>
|
||||
|
||||
</sect2>
|
||||
|
|
@ -2537,7 +2537,7 @@ Current versions of openssh are IPv6-ready. Depending on configuring before comp
|
|||
]]>
|
||||
</programlisting>
|
||||
<para>
|
||||
If your ssh client doesn't understand the option "-6" then it's not IPv6-enabled, like most ssh version 1 packages.
|
||||
If your ssh client doesn't understand the option “-6” then it's not IPv6-enabled, like most ssh version 1 packages.
|
||||
</para>
|
||||
|
||||
</sect3>
|
||||
|
|
@ -2631,7 +2631,7 @@ Error message: "<emphasis>connect: Invalid argument</emphasis>"
|
|||
Kernel doesn't know, which physical or virtual link you want to use to send such ICMPv6 packets. Therefore it displays this error message.
|
||||
</para>
|
||||
<para>
|
||||
Solution: Specify interface like: "ping6 -I eth0 fe80::2e0:18ff:fe90:9205", see also <link linkend="program-ping6">program ping6 usage</link>.
|
||||
Solution: Specify interface like: “ping6 -I eth0 fe80::2e0:18ff:fe90:9205”, see also <link linkend="program-ping6">program ping6 usage</link>.
|
||||
</para>
|
||||
|
||||
</sect3>
|
||||
|
|
@ -2641,13 +2641,13 @@ Solution: Specify interface like: "ping6 -I eth0 fe80::2e0:18ff:fe90:9205&q
|
|||
Q: Cannot ping6 or traceroute6 as normal user
|
||||
</title>
|
||||
<para>
|
||||
Error message: "<emphasis>icmp socket: Operation not permitted</emphasis>"
|
||||
Error message: “<emphasis>icmp socket: Operation not permitted</emphasis>”
|
||||
</para>
|
||||
<para>
|
||||
These utilities create special ICMPv6 packets and send them out. This is done by using raw sockets in the kernel. But raw sockets can only be used by the "root" user. Therefore normal users get such error message.
|
||||
These utilities create special ICMPv6 packets and send them out. This is done by using raw sockets in the kernel. But raw sockets can only be used by the “root” user. Therefore normal users get such error message.
|
||||
</para>
|
||||
<para>
|
||||
Solution: If it's really needed that all users should be able to use these utilities, you can add the "suid" bit using "chmod u+s /path/to/program", see also <link linkend="program-ping6">program ping6 usage</link>. If not all users should be able to, you can change the group of the program to e.g. "wheel", add these power users to this group and remove the execution bit for other users using "chmod o-rwx /path/to/program". Or configure "sudo" to enable your security policy.
|
||||
Solution: If it's really needed that all users should be able to use these utilities, you can add the “suid” bit using ”chmod u+s /path/to/program”, see also <link linkend="program-ping6">program ping6 usage</link>. If not all users should be able to, you can change the group of the program to e.g. “wheel”, add these power users to this group and remove the execution bit for other users using “chmod o-rwx /path/to/program”. Or configure “sudo” to enable your security policy.
|
||||
</para>
|
||||
|
||||
</sect3>
|
||||
|
|
@ -2762,7 +2762,7 @@ Like mentioned earlier, this interfaces don't support IPv6 transport (sending is
|
|||
Ether-tap device
|
||||
</title>
|
||||
<para>
|
||||
Ether-tap devices are IPv6-enabled and also stateless configured. For use, the module "ethertap" has to be loaded before.
|
||||
Ether-tap devices are IPv6-enabled and also stateless configured. For use, the module “ethertap” has to be loaded before.
|
||||
</para>
|
||||
|
||||
</sect3>
|
||||
|
|
@ -3260,7 +3260,7 @@ Example:
|
|||
]]>
|
||||
</programlisting>
|
||||
<para>
|
||||
Metric "1" is used here to be compatible with the metric used by route, because the default metric on using "ip" is "1024".
|
||||
Metric “1” is used here to be compatible with the metric used by route, because the default metric on using “ip” is “1024”.
|
||||
</para>
|
||||
|
||||
</sect2>
|
||||
|
|
@ -3360,7 +3360,7 @@ There are some issues in current Linux kernels:
|
|||
Clients (not routing any packet!)
|
||||
</title>
|
||||
<para>
|
||||
Client can setup a default route like prefix "::/0", they also learn such route on autoconfiguration e.g. using radvd on the link like following example shows:
|
||||
Client can setup a default route like prefix “::/0”, they also learn such route on autoconfiguration e.g. using radvd on the link like following example shows:
|
||||
</para>
|
||||
<programlisting>
|
||||
<![CDATA[# ip -6 route show | grep ^default
|
||||
|
|
@ -3379,7 +3379,7 @@ Routers in case of packet forwarding
|
|||
Current mainstream Linux kernel (at least <= 2.4.17) don't support default routes. You can set them up, but the route lookup fails when a packet should be forwarded (normal intention of a router).
|
||||
</para>
|
||||
<para>
|
||||
Therefore at this time "default routing" can be setup using the currently only global address prefix "2000::/3".
|
||||
Therefore at this time “default routing” can be setup using the currently only global address prefix “2000::/3”.
|
||||
</para>
|
||||
<para>
|
||||
The USAGI project already supports this in their extension with a hack.
|
||||
|
|
@ -3404,11 +3404,11 @@ Note: take care about default routing without address filtering on edge routers.
|
|||
Neighbor Discovery
|
||||
</title>
|
||||
<para>
|
||||
Neighbor discovery was the IPv6 successor for the ARP (Address Resolution Protocol) in IPv4. You can retrieve information about the current neighbors, in addition you can set and delete entries. The kernel keeps tracking of successful neighbor detection (like ARP in IPv4). You can dig into the learnt table using "ip".
|
||||
Neighbor discovery was the IPv6 successor for the ARP (Address Resolution Protocol) in IPv4. You can retrieve information about the current neighbors, in addition you can set and delete entries. The kernel keeps tracking of successful neighbor detection (like ARP in IPv4). You can dig into the learnt table using “ip”.
|
||||
</para>
|
||||
<sect1>
|
||||
<title>
|
||||
Displaying neighbors using "ip"
|
||||
Displaying neighbors using “ip”
|
||||
</title>
|
||||
<para>
|
||||
With following command you can display the learnt or configured IPv6 neighbors
|
||||
|
|
@ -3430,7 +3430,7 @@ The following example shows one neighbor, which is a reachable router
|
|||
|
||||
<sect1>
|
||||
<title>
|
||||
Manipulating neighbors table using "ip"
|
||||
Manipulating neighbors table using “ip”
|
||||
</title>
|
||||
<sect2>
|
||||
<title>
|
||||
|
|
@ -3479,7 +3479,7 @@ Example:
|
|||
More advanced settings
|
||||
</title>
|
||||
<para>
|
||||
The tool "ip" is less documentated, but very strong. See online "help" for more:
|
||||
The tool “ip” is less documentated, but very strong. See online “help” for more:
|
||||
</para>
|
||||
<programlisting>
|
||||
<![CDATA[# ip -6 neigh help
|
||||
|
|
@ -3585,7 +3585,7 @@ The 6to4 address is defined like following (schema is taken from <ulink url="htt
|
|||
FP and TLA together (16 bits) have the value 0x2002. V4ADDR is the node's global unique IPv4 address (in hexadecimal notation). SLA is the subnet identifier (65536 local subnets possible) and are usable to represent your local network structure.
|
||||
</para>
|
||||
<para>
|
||||
For gateways, such prefix is generated by normally using SLA "0000" and suffix "::1" (not a must, can be an arbitrary one with local-scope) and assigned to the 6to4 tunnel interface. Note that Microsoft Windows uses V4ADDR also for suffix.
|
||||
For gateways, such prefix is generated by normally using SLA “0000” and suffix “::1” (not a must, can be an arbitrary one with local-scope) and assigned to the 6to4 tunnel interface. Note that Microsoft Windows uses V4ADDR also for suffix.
|
||||
</para>
|
||||
|
||||
</sect3>
|
||||
|
|
@ -3595,7 +3595,7 @@ For gateways, such prefix is generated by normally using SLA "0000" an
|
|||
6to4 upstream tunneling
|
||||
</title>
|
||||
<para>
|
||||
The node has to know to which foreign tunnel endpoint its in IPv4 packed IPv6 packets should be send to. In "early" days of 6to4 tunneling, dedicated upstream accepting routers were defined. See <ulink url="http://www.kfu.com/~nsayer/6to4/">NSayer's 6to4 information</ulink> for a list of routers.
|
||||
The node has to know to which foreign tunnel endpoint its in IPv4 packed IPv6 packets should be send to. In “early” days of 6to4 tunneling, dedicated upstream accepting routers were defined. See <ulink url="http://www.kfu.com/~nsayer/6to4/">NSayer's 6to4 information</ulink> for a list of routers.
|
||||
</para>
|
||||
<para>
|
||||
Nowadays, 6to4 upstream routers can be found auto-magically using the anycast address 192.88.99.1. In the background routing protocols handle this, see <ulink url="http://www.faqs.org/rfcs/rfc3068.html">RFC 3068 / An Anycast Prefix for 6to4 Relay Routers</ulink> for details.
|
||||
|
|
@ -3726,7 +3726,7 @@ Setup of point-to-point tunnel
|
|||
There are 3 possibilities to add or remove point-to-point tunnels.
|
||||
</para>
|
||||
<para>
|
||||
A good additional information about tunnel setup using "ip" is <ulink url="http://www.deepspace6.net/docs/iproute2tunnel-en.html">Configuring tunnels with iproute2 (article)</ulink> (<ulink url="http://mirrors.bieringer.de/www.deepspace6.net/docs/iproute2tunnel-en.html">Mirror</ulink>).
|
||||
A good additional information about tunnel setup using “ip” is <ulink url="http://www.deepspace6.net/docs/iproute2tunnel-en.html">Configuring tunnels with iproute2 (article)</ulink> (<ulink url="http://mirrors.bieringer.de/www.deepspace6.net/docs/iproute2tunnel-en.html">Mirror</ulink>).
|
||||
</para>
|
||||
<sect2>
|
||||
<title>
|
||||
|
|
@ -3966,7 +3966,7 @@ the generated 6to4 prefix will be
|
|||
]]>
|
||||
</programlisting>
|
||||
<para>
|
||||
Local 6to4 gateways should (but it's not a must, you can choose an arbitrary suffix with local-scope, if you feel better) always assigned the suffix "::1", therefore your local 6to4 address will be
|
||||
Local 6to4 gateways should (but it's not a must, you can choose an arbitrary suffix with local-scope, if you feel better) always assigned the suffix “::1”, therefore your local 6to4 address will be
|
||||
</para>
|
||||
<programlisting>
|
||||
<![CDATA[2002:0102:0304::1
|
||||
|
|
@ -4018,7 +4018,7 @@ Add (default) route to the global IPv6 network using the all-6to4-routers IPv4 a
|
|||
]]>
|
||||
</programlisting>
|
||||
<para>
|
||||
It was reported that some versions of "ip" (e.g. SuSE Linux 9.0) don't support IPv4-compatible IPv6 addresses for gateways, in this case the related IPv6 address has to be used:
|
||||
It was reported that some versions of “ip” (e.g. SuSE Linux 9.0) don't support IPv4-compatible IPv6 addresses for gateways, in this case the related IPv6 address has to be used:
|
||||
</para>
|
||||
<programlisting>
|
||||
<![CDATA[# /sbin/ip -6 route add 2000::/3 via 2002:c058:6301::1 dev tun6to4 metric 1
|
||||
|
|
@ -4029,7 +4029,7 @@ It was reported that some versions of "ip" (e.g. SuSE Linux 9.0) don't
|
|||
|
||||
<sect3>
|
||||
<title>
|
||||
Using "ifconfig" and "route" and generic tunnel device "sit0" (deprecated)
|
||||
Using "ifconfig" and "route" and generic tunnel device “sit0” (deprecated)
|
||||
</title>
|
||||
<para>
|
||||
This is now deprecated because using the generic tunnel device sit0 doesn't let specify filtering per device.
|
||||
|
|
@ -4095,7 +4095,7 @@ Remove created tunnel device
|
|||
|
||||
<sect3>
|
||||
<title>
|
||||
Using "ifconfig" and "route" and generic tunnel device "sit0" (deprecated)
|
||||
Using “ifconfig” and “route” and generic tunnel device “sit0” (deprecated)
|
||||
</title>
|
||||
<para>
|
||||
Remove (default) route through the 6to4 tunnel interface
|
||||
|
|
@ -4148,7 +4148,7 @@ More information in the meantime: <ulink url="http://www.faqs.org/rfcs/rfc2473.h
|
|||
Kernel settings in /proc-filesystem
|
||||
</title>
|
||||
<para>
|
||||
<anchor id="proc-filesystem">Note: the source of this section is mostly the file "ip-sysctl.txt" which is included in current kernel sources in directory "Documentation/networking". Credits to Pekka Savola for maintaining the IPv6-related part in this file. Also some text is more or less copied & pasted into this document.
|
||||
<anchor id="proc-filesystem">Note: the source of this section is mostly the file “ip-sysctl.txt” which is included in current kernel sources in directory “Documentation/networking”. Credits to Pekka Savola for maintaining the IPv6-related part in this file. Also some text is more or less copied & pasted into this document.
|
||||
</para>
|
||||
<sect1>
|
||||
<title>
|
||||
|
|
@ -4156,10 +4156,10 @@ How to access the /proc-filesystem
|
|||
</title>
|
||||
<sect2>
|
||||
<title>
|
||||
Using "cat" and "echo"
|
||||
Using “cat” and “echo”
|
||||
</title>
|
||||
<para>
|
||||
Using "cat" and "echo" is the simplest way to access the /proc filesystem, but some requirements are needed for that
|
||||
Using “cat” and “echo” is the simplest way to access the /proc filesystem, but some requirements are needed for that
|
||||
</para>
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
|
|
@ -4205,7 +4205,7 @@ Normally, only entries in /proc/sys/* are writable, the others are readonly and
|
|||
Retrieving a value
|
||||
</title>
|
||||
<para>
|
||||
The value of an entry can be retrieved using "cat":
|
||||
The value of an entry can be retrieved using “cat”:
|
||||
</para>
|
||||
<programlisting>
|
||||
<![CDATA[# cat /proc/sys/net/ipv6/conf/all/forwarding
|
||||
|
|
@ -4220,7 +4220,7 @@ The value of an entry can be retrieved using "cat":
|
|||
Setting a value
|
||||
</title>
|
||||
<para>
|
||||
A new value can be set (if entry is writable) using "echo":
|
||||
A new value can be set (if entry is writable) using “echo”:
|
||||
</para>
|
||||
<programlisting>
|
||||
<![CDATA[# echo "1" >/proc/sys/net/ipv6/conf/all/forwarding
|
||||
|
|
@ -4234,13 +4234,13 @@ A new value can be set (if entry is writable) using "echo":
|
|||
|
||||
<sect2>
|
||||
<title>
|
||||
Using "sysctl"
|
||||
Using “sysctl”
|
||||
</title>
|
||||
<para>
|
||||
Using the "sysctl" program to access the kernel switches is a modern method today. You can use it also, if the /proc-filesystem isn't mounted. But you have only access to /proc/sys/*!
|
||||
Using the “sysctl” program to access the kernel switches is a modern method today. You can use it also, if the /proc-filesystem isn't mounted. But you have only access to /proc/sys/*!
|
||||
</para>
|
||||
<para>
|
||||
The program "sysctl" is included in package "procps" (on Red Hat Linux systems).
|
||||
The program “sysctl” is included in package “procps” (on Red Hat Linux systems).
|
||||
</para>
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
|
|
@ -4283,7 +4283,7 @@ A new value can be set (if entry is writable):
|
|||
]]>
|
||||
</programlisting>
|
||||
<para>
|
||||
Note: Don't use spaces around the "=" on setting values. Also on multiple values per line, quote them like e.g.
|
||||
Note: Don't use spaces around the “=” on setting values. Also on multiple values per line, quote them like e.g.
|
||||
</para>
|
||||
<programlisting>
|
||||
<![CDATA[# sysctl -w net.ipv4.ip_local_port_range="32768 61000"
|
||||
|
|
@ -4298,13 +4298,13 @@ Note: Don't use spaces around the "=" on setting values. Also on multi
|
|||
Additionals
|
||||
</title>
|
||||
<para>
|
||||
Note: There are sysctl versions in the wild which displaying "/" instead of the "."
|
||||
Note: There are sysctl versions in the wild which displaying “/” instead of the “.”
|
||||
</para>
|
||||
<para>
|
||||
For more details take a look into sysctl's manpage.
|
||||
</para>
|
||||
<para>
|
||||
Hint: for digging fast into the settings, use the option "-a" (display all entries) in conjunction with "grep".
|
||||
Hint: for digging fast into the settings, use the option “-a” (display all entries) in conjunction with “grep”.
|
||||
</para>
|
||||
|
||||
</sect3>
|
||||
|
|
@ -4322,7 +4322,7 @@ There are several formats seen in /proc-filesystem:
|
|||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>
|
||||
BOOLEAN: simple a "0" (false) or a "1" (true)
|
||||
BOOLEAN: simple a “0” (false) or a “1” (true)
|
||||
</para>
|
||||
|
||||
</listitem>
|
||||
|
|
@ -4368,7 +4368,7 @@ conf/all/*
|
|||
Change all the interface-specific settings.
|
||||
</para>
|
||||
<para>
|
||||
Exception: "conf/all/forwarding" has a different meaning here
|
||||
Exception: “conf/all/forwarding” has a different meaning here
|
||||
</para>
|
||||
<sect3>
|
||||
<title>
|
||||
|
|
@ -4481,7 +4481,7 @@ Default: TRUE
|
|||
|
||||
</itemizedlist>
|
||||
<para>
|
||||
Configure link-local addresses (see also <link linkend="chapter-addresstypes">Addresstypes</link>) using L2 hardware addresses. E.g. this generates automagically an address like "fe80::201:23ff:fe45:6789" on an interface with a L2-MAC address.
|
||||
Configure link-local addresses (see also <link linkend="chapter-addresstypes">Addresstypes</link>) using L2 hardware addresses. E.g. this generates automagically an address like “fe80::201:23ff:fe45:6789” on an interface with a L2-MAC address.
|
||||
</para>
|
||||
|
||||
</sect3>
|
||||
|
|
@ -5451,7 +5451,7 @@ Unknown, but probably not used by IPv6.
|
|||
IPv6-related entries in /proc/net/
|
||||
</title>
|
||||
<para>
|
||||
In /proc/net there are several read-only entries available. You cannot retrieve information using "sysctl" here, so use e.g. "cat".
|
||||
In /proc/net there are several read-only entries available. You cannot retrieve information using “sysctl” here, so use e.g. “cat”.
|
||||
</para>
|
||||
<sect2>
|
||||
<title>
|
||||
|
|
@ -5467,7 +5467,7 @@ Type: One line per addresss containing multiple values
|
|||
|
||||
</itemizedlist>
|
||||
<para>
|
||||
Here all configured IPv6 addresses are shown in a special format. The example displays for loopback interface only. The meaning is shown below (see "net/ipv6/addrconf.c" for more).
|
||||
Here all configured IPv6 addresses are shown in a special format. The example displays for loopback interface only. The meaning is shown below (see “net/ipv6/addrconf.c” for more).
|
||||
</para>
|
||||
<programlisting>
|
||||
<![CDATA[# cat /proc/net/if_inet6
|
||||
|
|
@ -5486,7 +5486,7 @@ IPv6 address displayed in 32 hexadecimal chars without colons as separator
|
|||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
Netlink device number (interface index) in hexadecimal (see "ip addr" , too)
|
||||
Netlink device number (interface index) in hexadecimal (see “ip addr” , too)
|
||||
</para>
|
||||
|
||||
</listitem>
|
||||
|
|
@ -5498,13 +5498,13 @@ Prefix length in hexadecimal
|
|||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
Scope value (see kernel source " include/net/ipv6.h" and "net/ipv6/addrconf.c" for more)
|
||||
Scope value (see kernel source “ include/net/ipv6.h” and “net/ipv6/addrconf.c” for more)
|
||||
</para>
|
||||
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
Interface flags (see "include/linux/rtnetlink.h" and "net/ipv6/addrconf.c" for more)
|
||||
Interface flags (see “include/linux/rtnetlink.h” and “net/ipv6/addrconf.c” for more)
|
||||
</para>
|
||||
|
||||
</listitem>
|
||||
|
|
@ -5533,7 +5533,7 @@ Type: One line per route containing multiple values
|
|||
|
||||
</itemizedlist>
|
||||
<para>
|
||||
Here all configured IPv6 routes are shown in a special format. The example displays for loopback interface only. The meaning is shown below (see "net/ipv6/route.c" for more).
|
||||
Here all configured IPv6 routes are shown in a special format. The example displays for loopback interface only. The meaning is shown below (see “net/ipv6/route.c” for more).
|
||||
</para>
|
||||
<programlisting>
|
||||
<![CDATA[# cat /proc/net/ipv6_route
|
||||
|
|
@ -5756,10 +5756,10 @@ Server socket binding
|
|||
</title>
|
||||
<sect2>
|
||||
<title>
|
||||
Using "netstat" for server socket binding check
|
||||
Using “netstat” for server socket binding check
|
||||
</title>
|
||||
<para>
|
||||
It's always interesting which server sockets are currently active on a node. Using "netstat" is a short way to get such information:
|
||||
It's always interesting which server sockets are currently active on a node. Using “netstat” is a short way to get such information:
|
||||
</para>
|
||||
<para>
|
||||
Used options: -nlptu
|
||||
|
|
@ -5872,7 +5872,7 @@ Router advertisement
|
|||
]]>
|
||||
</programlisting>
|
||||
<para>
|
||||
Router with link-local address "fe80::212:34ff:fe12:3450" send an advertisement to the all-node-on-link multicast address "ff02::1" containing two prefixes "2002:0102:0304:1::/64" (lifetime 30 s) and "3ffe:ffff:0:1::/64" (lifetime 2592000 s) including its own layer 2 MAC address "0:12:34:12:34:50".
|
||||
Router with link-local address “fe80::212:34ff:fe12:3450” send an advertisement to the all-node-on-link multicast address “ff02::1” containing two prefixes “2002:0102:0304:1::/64” (lifetime 30 s) and “3ffe:ffff:0:1::/64” (lifetime 2592000 s) including its own layer 2 MAC address “0:12:34:12:34:50”.
|
||||
</para>
|
||||
|
||||
</sect3>
|
||||
|
|
@ -5887,7 +5887,7 @@ Router solicitation
|
|||
]]>
|
||||
</programlisting>
|
||||
<para>
|
||||
Node with link-local address "fe80::212:34ff:fe12:3456" and layer 2 MAC address "0:12:34:12:34:56" is looking for a router on-link, therefore sending this solicitation to the all-router-on-link multicast address "ff02::2".
|
||||
Node with link-local address “fe80::212:34ff:fe12:3456” and layer 2 MAC address “0:12:34:12:34:56” is looking for a router on-link, therefore sending this solicitation to the all-router-on-link multicast address “ff02::2”.
|
||||
</para>
|
||||
|
||||
</sect3>
|
||||
|
|
@ -5904,12 +5904,12 @@ Neighbor discovery
|
|||
Neighbor discovery solicitation for duplicate address detection
|
||||
</title>
|
||||
<para>
|
||||
Following packets are sent by a node with layer 2 MAC address "0:12:34:12:34:56" during autoconfiguration to check whether a potential address is already used by another node on the link sending this to the solicited-node link-local multicast address.
|
||||
Following packets are sent by a node with layer 2 MAC address “0:12:34:12:34:56” during autoconfiguration to check whether a potential address is already used by another node on the link sending this to the solicited-node link-local multicast address.
|
||||
</para>
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>
|
||||
Node wants to configure its link-local address "fe80::212:34ff:fe12:3456", checks for duplicate now
|
||||
Node wants to configure its link-local address “fe80::212:34ff:fe12:3456”, checks for duplicate now
|
||||
</para>
|
||||
|
||||
</listitem>
|
||||
|
|
@ -5923,7 +5923,7 @@ Node wants to configure its link-local address "fe80::212:34ff:fe12:3456&qu
|
|||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>
|
||||
Node wants to configure its global address "2002:0102:0304:1:212:34ff:fe12:3456" (after receiving advertisement shown above), checks for duplicate now
|
||||
Node wants to configure its global address “2002:0102:0304:1:212:34ff:fe12:3456” (after receiving advertisement shown above), checks for duplicate now
|
||||
</para>
|
||||
|
||||
</listitem>
|
||||
|
|
@ -5938,7 +5938,7 @@ Node wants to configure its global address "2002:0102:0304:1:212:34ff:fe12:
|
|||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>
|
||||
Node wants to configure its global address "3ffe:ffff:0:1:212:34ff:fe12:3456" (after receiving advertisement shown above), checks for duplicate now
|
||||
Node wants to configure its global address “3ffe:ffff:0:1:212:34ff:fe12:3456” (after receiving advertisement shown above), checks for duplicate now
|
||||
</para>
|
||||
|
||||
</listitem>
|
||||
|
|
@ -5960,7 +5960,7 @@ Neighbor discovery solicitation for looking for host or gateway
|
|||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>
|
||||
Node wants to send packages to "3ffe:ffff:0:1::10" but has no layer 2 MAC address to send packet, so send solicitation now
|
||||
Node wants to send packages to “3ffe:ffff:0:1::10” but has no layer 2 MAC address to send packet, so send solicitation now
|
||||
</para>
|
||||
|
||||
</listitem>
|
||||
|
|
@ -5975,7 +5975,7 @@ Node wants to send packages to "3ffe:ffff:0:1::10" but has no layer 2
|
|||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>
|
||||
Node looks for "fe80::10" now
|
||||
Node looks for “fe80::10” now
|
||||
</para>
|
||||
|
||||
</listitem>
|
||||
|
|
@ -6007,7 +6007,7 @@ Some Linux distribution contain already support of a persistent IPv6 configurati
|
|||
</para>
|
||||
<sect1>
|
||||
<title>
|
||||
Red Hat Linux and "clones"
|
||||
Red Hat Linux and “clones”
|
||||
</title>
|
||||
<para>
|
||||
Since starting writing the <ulink url="http://www.bieringer.de/linux/IPv6/">IPv6 & Linux - HowTo</ulink> it was my intention to enable a persistent IPv6 configuration which catch most of the wished cases like host-only, router-only, dual-homed-host, router with second stub network, normal tunnels, 6to4 tunnels, and so on. Nowadays there exists a set of configuration and script files which do the job very well (never heard about real problems, but I don't know how many use the set). Because this configuration and script files are extended from time to time, they got their own homepage: <ulink url="http://www.deepspace6.net/projects/initscripts-ipv6.html">initscripts-ipv6 homepage</ulink> (<ulink url="http://mirrors.bieringer.de/www.deepspace6.net/projects/initscripts-ipv6.html">Mirror</ulink>). Because I began my IPv6 experience using a Red Hat Linux 5.0 clone, my IPv6 development systems are mostly Red Hat Linux based now, it's kind a logic that the scripts are developed for this kind of distribution (so called <emphasis>historic issue</emphasis>). Also it was very easy to extend some configuration files, create new ones and create some simple hook for calling IPv6 setup during IPv4 setup.
|
||||
|
|
@ -6016,7 +6016,7 @@ Since starting writing the <ulink url="http://www.bieringer.de/linux/IPv6/">IPv6
|
|||
Fortunately, in Red Hat Linux since 7.1 a snapshot of my IPv6 scripts is included, this was and is still further on assisted by Pekka Savola.
|
||||
</para>
|
||||
<para>
|
||||
Mandrake since version 8.0 also includes an IPv6-enabled initscript package, but a minor bug still prevents usage ("ifconfig" misses "inet6" before "add").
|
||||
Mandrake since version 8.0 also includes an IPv6-enabled initscript package, but a minor bug still prevents usage (“ifconfig” misses “inet6” before “add”).
|
||||
</para>
|
||||
<sect2>
|
||||
<title>
|
||||
|
|
@ -6073,7 +6073,7 @@ Check whether running system has already IPv6 module loaded
|
|||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>
|
||||
If result is "off", then enable IPv6 networking by editing /etc/sysconfig/network, add following new line
|
||||
If result is “off”, then enable IPv6 networking by editing /etc/sysconfig/network, add following new line
|
||||
</para>
|
||||
|
||||
</listitem>
|
||||
|
|
@ -7557,27 +7557,27 @@ Implementation was helped by the USAGI project.
|
|||
Automatic key exchange (IKE)
|
||||
</title>
|
||||
<para>
|
||||
IPsec requires a key exchange of a secret. This is mostly done automatically by so called IKE daemons. They also handle the authentication of the peers, either by a common known secret (so called "pre-shared secret") or by RSA keys (which can also be used from X.509 certificates).
|
||||
IPsec requires a key exchange of a secret. This is mostly done automatically by so called IKE daemons. They also handle the authentication of the peers, either by a common known secret (so called “pre-shared secret”) or by RSA keys (which can also be used from X.509 certificates).
|
||||
</para>
|
||||
<para>
|
||||
Currently, two different IKE daemons are available for Linux, which totally differ in configuration and usage.
|
||||
</para>
|
||||
<para>
|
||||
I prefer "pluto" from the *S/WAN implementation because of the easier and one-config-only setup.
|
||||
I prefer “pluto” from the *S/WAN implementation because of the easier and one-config-only setup.
|
||||
</para>
|
||||
<sect2>
|
||||
<title>
|
||||
IKE daemon "racoon"
|
||||
IKE daemon “racoon”
|
||||
</title>
|
||||
<para>
|
||||
The IKE daemon "racoon" is taken from the KAME project and ported to Linux. Modern Linux distributions contain this daemon in the package "ipsec-tools". Two executables are required for a proper IPsec setup. Take a look on <ulink url="http://lartc.org/howto/lartc.ipsec.html">Linux Advanced Routing & Traffic Control HOWTO / IPSEC</ulink>, too.
|
||||
The IKE daemon “racoon” is taken from the KAME project and ported to Linux. Modern Linux distributions contain this daemon in the package “ipsec-tools”. Two executables are required for a proper IPsec setup. Take a look on <ulink url="http://lartc.org/howto/lartc.ipsec.html">Linux Advanced Routing & Traffic Control HOWTO / IPSEC</ulink>, too.
|
||||
</para>
|
||||
<sect3>
|
||||
<title>
|
||||
Manipulation of the IPsec SA/SP database with the tool "setkey"
|
||||
Manipulation of the IPsec SA/SP database with the tool “setkey”
|
||||
</title>
|
||||
<para>
|
||||
"setkey" is important to define the security policy (SP) for the kernel.
|
||||
“setkey” is important to define the security policy (SP) for the kernel.
|
||||
</para>
|
||||
<para>
|
||||
File: /etc/racoon/setkey.sh
|
||||
|
|
@ -7620,17 +7620,17 @@ Example for a end-to-end encrypted connection in tunnel mode
|
|||
]]>
|
||||
</programlisting>
|
||||
<para>
|
||||
For the other peer, you have to replace "in" with "out".
|
||||
For the other peer, you have to replace “in” with “out”.
|
||||
</para>
|
||||
|
||||
</sect3>
|
||||
|
||||
<sect3>
|
||||
<title>
|
||||
Configuration of the IKE daemon "racoon"
|
||||
Configuration of the IKE daemon “racoon”
|
||||
</title>
|
||||
<para>
|
||||
"racoon" requires a configuration file for proper execution. It includes the related settings to the security policy, which should be set up previously using "setkey".
|
||||
“racoon” requires a configuration file for proper execution. It includes the related settings to the security policy, which should be set up previously using “setkey”.
|
||||
</para>
|
||||
<para>
|
||||
File: /etc/racoon/racoon.conf
|
||||
|
|
@ -7695,7 +7695,7 @@ File: /etc/racoon/psk.txt
|
|||
|
||||
<sect3>
|
||||
<title>
|
||||
Running IPsec with IKE daemon "racoon"
|
||||
Running IPsec with IKE daemon “racoon”
|
||||
</title>
|
||||
<para>
|
||||
At least the daemon needs to be started. For the first time, use debug and foreground mode. The following example shows a successful IKE phase 1 (ISAKMP-SA) and 2 (IPsec-SA) negotiation:
|
||||
|
|
@ -7723,7 +7723,7 @@ At least the daemon needs to be started. For the first time, use debug and foreg
|
|||
]]>
|
||||
</programlisting>
|
||||
<para>
|
||||
Each direction got its own IPsec-SA (like defined in the IPsec standard). With "tcpdump" on the related interface, you will see as result of an IPv6 ping:
|
||||
Each direction got its own IPsec-SA (like defined in the IPsec standard). With “tcpdump” on the related interface, you will see as result of an IPv6 ping:
|
||||
</para>
|
||||
<programlisting>
|
||||
<![CDATA[20:35:55.305707 2001:db8:1:1::1 > 2001:db8:2:2::2: ESP(spi=0x0a6e53c4,seq=0x3)
|
||||
|
|
@ -7734,7 +7734,7 @@ Each direction got its own IPsec-SA (like defined in the IPsec standard). With &
|
|||
As expected, the negotiated SPIs are being used here.
|
||||
</para>
|
||||
<para>
|
||||
And using "setkey", current active parameters are shown:
|
||||
And using “setkey”, current active parameters are shown:
|
||||
</para>
|
||||
<programlisting>
|
||||
<![CDATA[# setkey -D
|
||||
|
|
@ -7770,17 +7770,17 @@ And using "setkey", current active parameters are shown:
|
|||
|
||||
<sect2>
|
||||
<title>
|
||||
IKE daemon "pluto"
|
||||
IKE daemon “pluto”
|
||||
</title>
|
||||
<para>
|
||||
The IKE daemon "pluto" is included in distributions of the *S/WAN projects. *S/WAN project starts at the beginning as <ulink url="http://www.freeswan.org/">FreeS/WAN</ulink>. Unfortunately, the FreeS/WAN project stopped further development in 2004. Because of the slow pace of development in the past, two spin-offs started: <ulink url="http://www.strongswan.org/">strongSwan</ulink> and <ulink url="http://www.openswan.org/">Openswan</ulink>. Today, readily installable packages are available for at least Openswan (included in Fedora Core 3).
|
||||
The IKE daemon “pluto” is included in distributions of the *S/WAN projects. *S/WAN project starts at the beginning as <ulink url="http://www.freeswan.org/">FreeS/WAN</ulink>. Unfortunately, the FreeS/WAN project stopped further development in 2004. Because of the slow pace of development in the past, two spin-offs started: <ulink url="http://www.strongswan.org/">strongSwan</ulink> and <ulink url="http://www.openswan.org/">Openswan</ulink>. Today, readily installable packages are available for at least Openswan (included in Fedora Core 3).
|
||||
</para>
|
||||
<para>
|
||||
A major difference to "racoon", only one configuration file is required. Also, an initscript exists for automatic setup after booting.
|
||||
A major difference to “racoon”, only one configuration file is required. Also, an initscript exists for automatic setup after booting.
|
||||
</para>
|
||||
<sect3>
|
||||
<title>
|
||||
Configuration of the IKE daemon "pluto"
|
||||
Configuration of the IKE daemon “pluto”
|
||||
</title>
|
||||
<para>
|
||||
The configuration is very similar to the IPv4 one, only one important option is necessary.
|
||||
|
|
@ -7834,7 +7834,7 @@ File: /etc/ipsec.secrets
|
|||
|
||||
<sect3>
|
||||
<title>
|
||||
Running IPsec with IKE daemon "pluto"
|
||||
Running IPsec with IKE daemon “pluto”
|
||||
</title>
|
||||
<para>
|
||||
If installation of Openswan was successfully, an initscript should exist for starting IPsec, simply run (on each peer):
|
||||
|
|
@ -7844,7 +7844,7 @@ If installation of Openswan was successfully, an initscript should exist for sta
|
|||
]]>
|
||||
</programlisting>
|
||||
<para>
|
||||
Afterwards, start this connection on one peer. If you saw the line "IPsec SA established", all worked fine.
|
||||
Afterwards, start this connection on one peer. If you saw the line “IPsec SA established”, all worked fine.
|
||||
</para>
|
||||
<programlisting>
|
||||
<![CDATA[# ipsec auto --up ipv6-peer1-peer2
|
||||
|
|
@ -7858,7 +7858,7 @@ Afterwards, start this connection on one peer. If you saw the line "IPsec S
|
|||
]]>
|
||||
</programlisting>
|
||||
<para>
|
||||
Because *S/WAN and setkey/racoon do use the same IPsec implementation in Linux 2.6.x kernel, "setkey" can be used here too to show current active parameters:
|
||||
Because *S/WAN and setkey/racoon do use the same IPsec implementation in Linux 2.6.x kernel, “setkey” can be used here too to show current active parameters:
|
||||
</para>
|
||||
<programlisting>
|
||||
<![CDATA[# setkey -D
|
||||
|
|
@ -7900,7 +7900,7 @@ Because *S/WAN and setkey/racoon do use the same IPsec implementation in Linux 2
|
|||
Additional informations:
|
||||
</title>
|
||||
<para>
|
||||
On Linux Kernel 2.6.x you can get the policy and status of IPsec also using "ip":
|
||||
On Linux Kernel 2.6.x you can get the policy and status of IPsec also using “ip”:
|
||||
</para>
|
||||
<programlisting>
|
||||
<![CDATA[# ip xfrm policy
|
||||
|
|
@ -7921,7 +7921,7 @@ On Linux Kernel 2.6.x you can get the policy and status of IPsec also using &quo
|
|||
Quality of Service (QoS)
|
||||
</title>
|
||||
<para>
|
||||
IPv6 supports QoS with use of Flow Labels and Traffic Classes. This can be controlled using "tc" (contained in package "iproute").
|
||||
IPv6 supports QoS with use of Flow Labels and Traffic Classes. This can be controlled using “tc” (contained in package “iproute”).
|
||||
</para>
|
||||
<para>
|
||||
Additional infos:
|
||||
|
|
@ -8392,7 +8392,7 @@ Additional notes
|
|||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>
|
||||
Apache2 supports a method called "sendfile" to speedup serving data. Some NIC drivers also support offline checksumming. In some cases, this can lead to connection problems and invalid TCP checksums. In this cases, disable "sendfile" either by recompiling using configure option "--without-sendfile" or by using the "EnableSendfile off" directive in configuration file.
|
||||
Apache2 supports a method called “sendfile” to speedup serving data. Some NIC drivers also support offline checksumming. In some cases, this can lead to connection problems and invalid TCP checksums. In this cases, disable “sendfile” either by recompiling using configure option “--without-sendfile” or by using the "EnableSendfile off" directive in configuration file.
|
||||
</para>
|
||||
|
||||
</listitem>
|
||||
|
|
@ -8540,7 +8540,7 @@ This route needs to be replaced every time the prefix changes, which is the case
|
|||
Debugging
|
||||
</title>
|
||||
<para>
|
||||
A program called "radvdump" can help you looking into sent or received advertisements. Simple to use:
|
||||
A program called “radvdump” can help you looking into sent or received advertisements. Simple to use:
|
||||
</para>
|
||||
<programlisting>
|
||||
<![CDATA[# radvdump
|
||||
|
|
@ -8967,7 +8967,7 @@ That's all.
|
|||
Other daemons
|
||||
</title>
|
||||
<para>
|
||||
Nowadays it's mostly simple, look for either a command line option or a configuration value to enable IPv6 listening. See manual page of the daemon or check related FAQs. It can happen that you can bind a daemon only to the IPv6-"any"-address (::) and not to bind to a dedicated IPv6 address, because the lack of support (depends on that what the programmer has implemented so far...).
|
||||
Nowadays it's mostly simple, look for either a command line option or a configuration value to enable IPv6 listening. See manual page of the daemon or check related FAQs. It can happen that you can bind a daemon only to the IPv6-“any”-address (::) and not to bind to a dedicated IPv6 address, because the lack of support (depends on that what the programmer has implemented so far...).
|
||||
</para>
|
||||
|
||||
</sect1>
|
||||
|
|
@ -9788,7 +9788,7 @@ Linux related per distribution
|
|||
<varlistentry>
|
||||
<term>
|
||||
PLD
|
||||
</term><listitem><para><ulink url="http://www.pld-linux.org/">PLD Linux Distribution</ulink> ("market leader" in containing IPv6 enabled packages)
|
||||
</term><listitem><para><ulink url="http://www.pld-linux.org/">PLD Linux Distribution</ulink> (“market leader” in containing IPv6 enabled packages)
|
||||
</para>
|
||||
|
||||
</listitem>
|
||||
|
|
@ -12288,7 +12288,7 @@ Releases 0.x
|
|||
<varlistentry>
|
||||
<term>
|
||||
0.39
|
||||
</term><listitem><para>2003-01-13/PB: fix a bug (forgotten 'link" on "ip link set" (credits to Yaniv Kaul)
|
||||
</term><listitem><para>2003-01-13/PB: fix a bug (forgotten 'link” on “ip link set” (credits to Yaniv Kaul)
|
||||
</para>
|
||||
|
||||
</listitem>
|
||||
|
|
@ -12369,7 +12369,7 @@ Releases 0.x
|
|||
<varlistentry>
|
||||
<term>
|
||||
0.34
|
||||
</term><listitem><para>2002-11-19/PB: Add information about German translation (work in progress), some fixes, create a small shortcut explanation list, extend "used terms" and add two German books
|
||||
</term><listitem><para>2002-11-19/PB: Add information about German translation (work in progress), some fixes, create a small shortcut explanation list, extend “used terms” and add two German books
|
||||
</para>
|
||||
|
||||
</listitem>
|
||||
|
|
@ -12477,7 +12477,7 @@ Releases 0.x
|
|||
<varlistentry>
|
||||
<term>
|
||||
0.26
|
||||
</term><listitem><para>2002-07-13/PB: Fill /proc-filesystem chapter, update DNS information about depricated A6/DNAME, change P-t-P tunnel setup to use of "ip" only
|
||||
</term><listitem><para>2002-07-13/PB: Fill /proc-filesystem chapter, update DNS information about depricated A6/DNAME, change P-t-P tunnel setup to use of “ip” only
|
||||
</para>
|
||||
|
||||
</listitem>
|
||||
|
|
@ -12630,7 +12630,7 @@ Releases 0.x
|
|||
<varlistentry>
|
||||
<term>
|
||||
0.18.1
|
||||
</term><listitem><para>2002-01-23/PB: Move "the end" to the end, add USAGI to maillists
|
||||
</term><listitem><para>2002-01-23/PB: Move “the end” to the end, add USAGI to maillists
|
||||
</para>
|
||||
|
||||
</listitem>
|
||||
|
|
@ -12675,7 +12675,7 @@ Releases 0.x
|
|||
<varlistentry>
|
||||
<term>
|
||||
0.16
|
||||
</term><listitem><para>2002-01-19/PB: Minor fixes, remove "bold" and "emphasize" formats on code lines, fix "too long unwrapped code lines" using selfmade utility, extend list of URLs.
|
||||
</term><listitem><para>2002-01-19/PB: Minor fixes, remove “bold” and “emphasize” formats on code lines, fix “too long unwrapped code lines” using selfmade utility, extend list of URLs.
|
||||
</para>
|
||||
|
||||
</listitem>
|
||||
|
|
@ -12693,7 +12693,7 @@ Releases 0.x
|
|||
<varlistentry>
|
||||
<term>
|
||||
0.14
|
||||
</term><listitem><para>2002-01-14/PB: Minor review at all, new chapter "debugging", review "addresses", spell checking, grammar checking (from beginning to 3.4.1) by Martin Krafft, add tcpdump examples, copy firewalling/netfilter6 from IPv6+Linux-HowTo, minor enhancements
|
||||
</term><listitem><para>2002-01-14/PB: Minor review at all, new chapter “debugging”, review “addresses”, spell checking, grammar checking (from beginning to 3.4.1) by Martin Krafft, add tcpdump examples, copy firewalling/netfilter6 from IPv6+Linux-HowTo, minor enhancements
|
||||
</para>
|
||||
|
||||
</listitem>
|
||||
|
|
@ -12850,7 +12850,7 @@ Credits for fixes and hints are listed here, will grow sure in the future
|
|||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>
|
||||
S .P. Meenakshi <meena at cs dot iitm dot ernet dot in>: For a hint using a "send mail" shell program on tcp_wrapper/hosts.deny
|
||||
S .P. Meenakshi <meena at cs dot iitm dot ernet dot in>: For a hint using a “send mail” shell program on tcp_wrapper/hosts.deny
|
||||
</para>
|
||||
|
||||
</listitem>
|
||||
|
|
@ -12988,7 +12988,7 @@ Bjoern Jacke <bjoern at j3e dot de>: Triggered me to fix some outdated inf
|
|||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
Christoph Egger <cegger at chrrr dot com>: Sending note about "ip" has problems with IPv4-compatible addresses on SuSE Linux 9.0 and trigger to add a hint on 6to4-radvd example
|
||||
Christoph Egger <cegger at chrrr dot com>: Sending note about “ip” has problems with IPv4-compatible addresses on SuSE Linux 9.0 and trigger to add a hint on 6to4-radvd example
|
||||
</para>
|
||||
|
||||
</listitem>
|
||||
|
|
|
|||
Loading…
Reference in New Issue