This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
Home Products Support Community News


Re: [Xen-users] DomU PV network problems

To: "Fajar A. Nugraha" <fajar@xxxxxxxxx>
Subject: Re: [Xen-users] DomU PV network problems
From: Sauro Saltini <saltini@xxxxxx>
Date: Wed, 08 Sep 2010 14:25:23 +0200
Cc: xen-users@xxxxxxxxxxxxxxxxxxx
Delivery-date: Wed, 08 Sep 2010 05:24:53 -0700
Envelope-to: www-data@xxxxxxxxxxxxxxxxxxx
In-reply-to: <AANLkTimXJNtdND61eEzd5CFiVeQDK9XeP9MPgYfHht4O@xxxxxxxxxxxxxx>
List-help: <mailto:xen-users-request@lists.xensource.com?subject=help>
List-id: Xen user discussion <xen-users.lists.xensource.com>
List-post: <mailto:xen-users@lists.xensource.com>
List-subscribe: <http://lists.xensource.com/mailman/listinfo/xen-users>, <mailto:xen-users-request@lists.xensource.com?subject=subscribe>
List-unsubscribe: <http://lists.xensource.com/mailman/listinfo/xen-users>, <mailto:xen-users-request@lists.xensource.com?subject=unsubscribe>
References: <4C86AC12.90902@xxxxxx> <AANLkTimXJNtdND61eEzd5CFiVeQDK9XeP9MPgYfHht4O@xxxxxxxxxxxxxx>
Sender: xen-users-bounces@xxxxxxxxxxxxxxxxxxx
User-agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv: Gecko/20100121 Lightning/1.0b1 Thunderbird/3.0.1

On 08/09/2010 10:42, Fajar A. Nugraha wrote:
On Wed, Sep 8, 2010 at 4:18 AM, Sauro Saltini<saltini@xxxxxx>  wrote:
My current configuration is :
- Xen 4.0.0
- DOM0 kernel
- DOMU kernels either or 2.6.36-rc3 (vanilla)
As soon as I've converted the fw DomU's to a PV domain (using either or 2.6.36-rc3 kernels with PV drivers) something changed in a
weird way...
Do you mean convert it to PV domain, or keep it as HVM but use PV drivers?
I've converted it to a PV domain (builder=linux)
on Dom0 "tcpdump -nvvi br0" (br0 = external bridge) never shows up any
traffic !
What does tcpdump on domU's vif (by default it's named vifx.y, where x
and are numbers) within dom0 shows?
Does both dom0 and your PV domU has ip forwarding
(/proc/sys/net/ipv4/ip_forward) enabled?
Do you still use ioemu line? What does your domU config look like?

tcpdump on domU's vif shows no traffic, except some arp requests coming from the firewall domU asking for the external pinged address.
Both dom0 and domU has ip_forward activated
I have type=paravirtual for both firewall domU's nics in domU's config

my config is quite simple:

vif=[ 'type=paravirtual, bridge=br0, mac=00:16:3e:00:00:02',
      'type=paravirtual, bridge=br1, mac=00:16:3e:00:00:20' ]
disk=[ 'drbd:fw,hda,w' ]
root='/dev/xvda3 ro'

The chosen kernel is the same xenified kernel built from sources and used for dom0

Please help...
Many thanks in advance.

It seems that the packet flow interrupts in some way inside xen's PV netfront/netback drivers (i.e. between vethx.y and vifx.y) but ONLY for packets coming from another domU and forwarded.

As I said i can regularly ping both domU's network and external lan from the fw domU, only the packets coming from the other domU's disappear !

Just for clarity, having :
testing (pinger) domU : /24 (gw
fw domU "internal" nic -eth0- (domU's gateway): /24
fw domU "external" nic -eth1- (bridged to LAN): /24
pinged lan host : /24

On fw domU:
echo "1" > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

Pinging from FW works, and tcpdump -nvvi on dom0 (both listening on vifx.y or bridge) gives:
14:09:40.553104 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP (1), length 84) > ICMP echo request, id 24837, seq 1, length 64 14:09:40.553223 IP (tos 0x0, ttl 64, id 21099, offset 0, flags [none], proto ICMP (1), length 84) > ICMP echo reply, id 24837, seq 1, length 64

Pinging from testing domU ( doesn't work, and tcpdump -nvvi on dom0 (both listening on vifx.y or bridge) gives (every 5 to 10 seconds):
14:17:29.922210 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has tell, length 28 14:17:29.922304 ARP, Ethernet (len 6), IPv4 (len 4), Reply is-at 00:09:6b:89:d0:8a, length 46

but no icmp traffic at all !

You can try using xenified kernel on domU and see if it helps: patch
from http://code.google.com/p/gentoo-xen-kernel/downloads/list +
kernel (or whatever 2.6.34.x that the patch can cleanly apply

Xen-users mailing list