SciCOs: 3Com switches

George Ross 2nd December 1998 Assumption: you’re familiar with ethernet, 10baseT, 100baseT, …

Repeaters (hubs)

• copy packets’ bits from a port to all others as they’re received

Bridges

• learn MAC addresses and remember which port they were last seen on

• read and buffer some or all of a packet before retransmitting

• only send to “necessary” ports Pro repeaters (hubs):

• Simple

• Cheap

• Diagnostic snooping easy

Con repeaters (hubs):

• Simple, brainless

• Shared bandwith on logical wire

• Security-breach snooping easy

• Distance and repeater-count limitations (100m, 10baseT 5-4-3 rule)

• Single speed devices Pro bridges (switches):

• Higher aggregate bandwidth

• “No” security-breach snooping

• Mixed speeds on same logical ether

• Terminate collision domains, easing distance problems

• More intelligence (VLANs, trunking, multi-cast filtering)

Con bridges (switches):

• More expensive, more complicated to set up

• Diagnostic snooping less straightforward

• Senders can gang up on receivers

\overline{VLANs 4}

What’s a VLAN?

• switch logically divided internally into Virtual LANs

• can be by port, by protocol, by source address, …

• ports can carry more than one VLAN using 802.1Q tagging

3Com 3300 has VLANs in firmware version 2.xx. Some limitations (at present?)

• only 16 VLANs per switch (backward compatibility with a proprietary method)

• switch itself lives in the default VLAN

• default VLAN’s tag is “1” and can’t be changed (this can make carrying VLANs over EdLAN awkward)

• only static port-based VLANs

• web-based interface easy but cumbersome

• no telnet-based interface (so no expect scripts to set switches up)

Packets usually go only to the intended recipient, but we do sometimes (??) need to snoop to see what’s going on.

• (flood the switch to fill its tables — 6000 max on 3Com 1100, 12000 max on 3300)

• (just listen, as there might be some leakage anyway)

• configure a port (one at a time?) to be a monitor port

• can then add one (or more?) to be monitored

• we haven’t tried this yet

• received wisdom: don’t rely on switches for security!

Trunking …

• connects two devices using several parallel connections

• load-sharing between the links

• resilience — if one link goes down the rest pick up the load

• (only one out of an untrunked redundant set can be active at a time)

• we have tried this — we have a 200Mb full duplex link between our two main hub sites

• 3300: only 2 trunk sets per switch Multi-casts and broadcasts still get sent to all ports. If there’s a lot of this traffic it could be a significant load.

• 3300 can watch for multicast group join/leave requests (IGMP, 802.1p) and configure ports appropriately

• we haven’t tried this yet

Network managers might want to give some kinds of traffic priority.

• many switches are quite flexible about how “priority” traffic is defined

• 3300 has something called “PACE” (Priority Access Control Enabled”), but is pretty vague about what it means!

\overline{SNMP 8}

• we haven’t tried this yet SNMP (“Simple Network Management Protocol”)

• allows a network management station to query a device’s tables and counters and control its state

• access control based on a simple cleartext “community string” (in SNMP v1; v2 was so complicated no-one used it)

But I don’t have a management station … ?

• that’s OK, your 3300 has SNMP enabled, ready for when you get one

• the default read community string is “public” and the default write one is “private” — you really want to change these!

• the web interface doesn’t know about SNMP, you have to use telnet instead

• you need at least firmware version 1.07 before you can do this.

OK, I’ve got my management station now …

• good for you — you can use it to find out about lots of counters and tables and things

• you might still have to work to interpret them, though, as 3Com’s implementation is reported to be rather quirky

• as well as the standard MIB stuff there’s a 3Com-specific one too, but you’ll have to work really hard to get its definition out of them … Finally, my overall impressions of the 3300 and 1100 switches:

• does most of what we’ve asked of it so far, but only after a firmware upgrade (which was quite a bit later than originally claimed)

• feels like a placeholder product, not right there on the leading edge

• some annoying limitations

• we haven’t exercised all of it yet

• web interface effective but cumbersome

• telnet interface effective but incomplete