Unscrewed: A Story About OpenBSD

I'll never forget this time in college when I had set up an OpenBSD router in our apartment and came home one weekend to find that I was unable to log into it via SSH.

Actually, it was timing out.

So I hooked up a monitor and a keyboard to this old old P1/133 with 32MB of ram that had been taken out of a dumpster to be our router to see what was going on.

A few months prior to this I had been playing around with rrd and started generating traffic graphs so that I could get pretty pretty pictures of our traffic (and to figure out when one of my roommates was streaming his porn).

I had set the cron jobs to run every 10 minutes. Initially the data sets were so small that this wasn't an issue, but over time the database got larger and suddenly the cron job was taking 10 minutes and 10 seconds, and then 10 minutes and 20 seconds... on and on until finally cron jobs were running over cron jobs.

So after about 2 minutes waiting to get logged in, I finally get the load average for the system and it was somewhere around 146.20. After another couple of minutes, I was able to disable the cron jobs and kill off rrd graphs. In another 10 minutes, the load average was back to All this time it was passing traffic without a hiccup and I believe it had another 100+ days of uptime after this before I moved out. What a box. I miss that router.

> through the [?] for each

BSD pf is interpreted by a kernel module in kernel mode. There is no e.g. kernel / user transition involved.

Sorry. "Kernel". Through the kernel. But you were there already - I hadn't twigged that there's no need to jump out of userland in the first place.

This topic is often discussed on nanog

The answers is the same as in software industry: Configuration management.

Plus it makes then harder to develop corporate cultures of deploying well known patterns that makes routers best used.

Plus it increases the surface of vulnerability for government backdoors.

In real life, there is a trend for going BSD box for cost/formation/stability/security reasons in the ISP world ... especially in non US countries that are getting kind of thinking the USA is becoming the new USSR in terms of systematic spying on every one.

These Europeans really don't get it, isn't it? They never were in the middle of cold war spying insanity where both power would puppet so called terrorists groups to make sure citizen would vote the right way under the fear.

What a bunch of stupid persons not believing that business companies are incorruptible and think they have incentive to betray them in exchange for gvt subsidies/regulations.

At the moment, network switching and routing with open source products + commodity servers can't scale like Cisco and Juniper...if you want to have a fairly standard network (OSPF, BGP, etc).

Google, for example, is able to use commodity hardware because what they are routing works with a non-traditional setup...specifically a Clos network. That works for them only because their app is designed in a way that it can served up like that. It would not work for the typical kinds of traffic that you see at a normal company.

At a certain scale, barring unusual exceptions, you really do have to go with someone like Juniper/Cisco, as the ASIC based acceleration and other features aren't there in the commodity world.

There's certainly some things in progress that may change all of that, like Intel's DPDK, QuickAssist, etc.