Experimental Physics and
Industrial Control System

Goetz Pfeiffer via Tech-talk <[email protected]> · Thu, 20 Dec 2018 14:57:19 +0100

Hello,

first I would like to stress that this is not a bug in EPICS or channel access.
It is an effect due to a bug / misconfiguration / undocumented behavior on
debian 9 linux systems.

I pose the question here in order to know if someone else has run into this
problem, if it is known or if there is a different kind of work-around than the
one we found.

A channel access client determines the server of a process variable by sending
a UDP broadcast packet. More details are described here:
  https://epics.anl.gov/base/R3-16/1-docs/CAref.html#Environmen

At our research facility we have different networks with IOCs and OPI consoles.
In order to connect them all, we have installed several channel access
gateways.

If you are interested in the details, they can be found here:
  https://www-csr.bessy.de/control/ca-net-gateways/

We use VLANs to separate the networks but our IT has set up some networks with
a single VLAN that have separate IP address areas. As an example we have
network "acc" with these addresses:

Network    area     IP range
---------------------------------------------------
acc         1       193.149.12.0 - 193.149.12.255
acc         2       192.168.101.0 - 192.168.101.255

Both are in the same VLAN so a host in this network gets broadcasts from *both*
IP areas.

Now if I have host "elbe" (debian 7) with this network configuration:

  inet 193.149.12.27   netmask 255.255.255.0  broadcast 193.149.12.255

and host "lotus" (debian 9) with this network configuration:

  inet 192.168.101.86  netmask 255.255.255.0  broadcast 192.168.101.255

If I start a softioc on "elbe" and try to read a PV by running "caget" on
"lotus", it doesn't get a direct connection. This behavior was until recently
observedon all Linux systems and is the reason why we need a channel access
gateway toconnect both areas. This is in spite the fact that both hosts
are in thesame VLAN and by this in the same broadcast domain.

We assumed that a broadcast packet that is received on a network interface is
first matched against the configured netmask by the kernel and rejected if it
doesn't match.

However, if we start the softioc on the debian 9 system "lotus" and run "caget"
on "elbe, it gets a direct connection. Since we also have the channel access
gateway set up, we get an error "Identical process variable names on multiple
servers".  Somehow the debian 9 system receives the broadcast packet although
it doesn't match it's netmask.

After doing many tests we found:

  debian 9     : receives all broadcasts
  debian 7     : receives only broadcasts matching the netmask
  fedora 28    : receives only broadcasts matching the netmask
  ubuntu 18.10 : receives only broadcasts matching the netmask

As a work-around we found that if you start the softioc like this on the debian
9 system:

  EPICS_CAS_INTF_ADDR_LIST=192.168.101.86 softIoc -d test.db

it works as expected. The softIoc then only receives broadcasts matching the
netmask. This only works when you use EPICS Base 3.15 or newer.

If you have made the same experiences or know the reasons why debian 9 is
different of have another work-around, I would appreciate your feedback.

Greetings

  Goetz Pfeiffer

Experimental Physics and Industrial Control System

Experimental Physics and
Industrial Control System