thousands of messages in log files on sys. in same subnet

[dgroos]

Hi, The system admins where I run CmapServer (current or penultimate version) contacted me saying:

We get the following messages (literally thousands and thousands), in the log files of every system on the same subnet as this system.

Mar 12 14:05:32 xxx-xxx kernel: iptables REJECT IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff SRC=xxx.xxx.xxx.xxx DST=255.255.255.255 LEN=126 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=xxx DPT=4747 LEN=106

I replied:

About the error, while I’m no expert, a couple things caught my attention. First, it mentioned iptables, second it said the #4747 which I guess refers to the port needed to communicate with the directory of places. I went to this page:
viewtopic.php?f=3&t=158
and it gives some info.

I wonder if it might relate to a problem that I've seen. I know that students have had a hard time sometimes adding the cmapserver because it doesn’t show up in the directory of places.

They replied:

The server would not be in the broadcast domain of any student so we're not clear why you think it would appear. It appears to be broadcasting its services and we would prefer it not do that. That seems to be the issue sort of like some printers that advertise their service on the subnet they are on like the old days of appletalk or novell service advertisement and as there are no clients for it in it's subnet, it should not be advertising or probing.

Any idea about the problems they are having with the log files getting jammed or why students can't find our CmapServer in their directory of places?

Thanks!
David

[acanas]

Yes, the CmapServer is configured by default to use port 4747 to register with the DOP. You need to have the port open so that the CmapServer registers with the DOP, and so the students' client will locate the CmapServer.

You also need to configure the CmapServer to use ports that are open for students to access it. The default is 4447 but we also commonly use port 443 because it is usually open for https traffic. This port can be configured in the configuration file serverconfig.txt found in the 'bin' directory under the CmapServer installation.

Regarding advertising services, yes the CmapServer advertises its services so that clients in the same LAN can find them without the use of the DOP. This is a common situation, for example, in schools. In these cases it also acts as a DOP Proxy. This broadcast can be turned off in the slp.conf file, also in the same 'bin' directory.

[dgroos]

Yes, the CmapServer is configured by default to use port 4747 to register with the DOP. You need to have the port open so that the CmapServer registers with the DOP, and so the students' client will locate the CmapServer.

The admin for the system says: "Right now port 4747 is open for everything tcp and udp" So, I did this test I found from a previous forum post: "telnet dop2.ihmc.us 4747" but the results imply that it is not open:

Trying 184.182.233.158...
telnet: connect to address 184.182.233.158: Connection refused

But then I did try with a CmapTools client at this moment and it does locate our CmapServer in the List of Places. So, seems like this is an intermittent problem.

You also need to configure the CmapServer to use ports that are open for students to access it.

So, if a client can make and save cmap files on this server, that means that it is open and no issues, right?

This broadcast can be turned off in the slp.conf file...

I've gone through the slp.conf file several times... can you tell me which line I need to deactivate this local broadcasting? Also, this won't have other consequences turning this off except can't discover from local subnet?

And finally, I see this line in slp.conf file and wonder if there is something off since we don't publish on port 80 but 8009 (for example: http://xxx.xxx.edu:8009/rid=xxx):

net.slp.DAAddresses=dop2.ihmc.us:4748:80,dop.ihmc.us:80:8001

Thanks again,
David