Re: Need clarification on UDP Broadcasting to multiple IOCs on same PC

[Ralph Lange via Tech-talk <tech-talk at aps.anl.gov>]

Hi, Adam,

On Tue, 7 Dec 2021 at 23:01, Manoussakis, Adamandios <manoussakis1 at llnl.gov> wrote:

Just to make sure I understand that rule then it is just replacing the header and wireshark would not see that traffic at .255 since its not really being sent to an interface?

Correct.

It works on incoming name resolution requests and just patches the header information.

 

If this is the case is there anyway to know for sure the iptables rule is being used if I cant see the traffic at .255 on wireshark?

The best and easiest test is the initial problem:

If you have multiple IOCs on the host, a CA client from a different machine doing a unicast name resolution request will see one IOC (rule is not active) or all IOCs (rule is active).

I thought when the EPICS_CA_ADDR_LIST is set to a specified IP address that the UDP are unicasts and when set to the broadcast address .255 then the UDP are broadcasts?

That's correct, but the client will also send broadcasts on all network interfaces (except loopback/localhost) unless EPICS_CA_AUTO_ADDR_LIST is set to NO.

EPICS_CA_AUTO_ADDR_LIST is the switch for "broadcast on all interfaces".

EPICS_CA_ADDR_LIST contains addresses that are used additionally, which may be unicast or broadcast addresses.

 

For example if I have my ENV variables EPICS_CA_ADDR_LIST=localhost isn’t the cagets going to be UDP unicasts?

Yes, the caget will use unicasts to localhost - in addition to sending broadcasts on all network interfaces (according to EPICS_CA_AUTO_ADDR_LIST setting).

Then if I also have the cagateway setup for EPICS_CA_ADDR_LIST=localhost also shouldn’t the client for the gateway also end up using the firewall iptables rule?  Cant seem to figure out why the client side of the gateway doesn’t seem to use iptables rule then.

The firewall rule is server-side and only needed on hosts that run multiple servers (IOCs or Gateways). Nowhere else.

If your gateway machine is running a single Gateway instance per network interface the Gateway binds to, it does not need to run the firewall rule.

What is the difference then between EPICS_CA_ADDR_LIST=192.168.0.255, EPICS_CA_SERVER_PORT=5064 and using the iptables rule of routing all 5064 udp traffic to 192.168.0.255:5064 instead of say localhost:5064?

These two things are not directly related as they are happening on two different machines.

Your environment settings are for a CA client running on the client host, where the firewall rule does not run.

The firewall rule is running on the server (IOC) host and affecting incoming name resolution requests.

Also note that the firewall rule trick does not work for CA clients on the same host as the multiple IOCs.

Cheers,
~Ralph