Best routers out there ?

[free_electron]

With 'best' i mean the following
- best throughput WIRED and wireless. Most reviews blabber about theoretical bandwidths on wifi but nobody talks about what the router can really handle. Most of my stuff is wired. The router should be able to handle many datastreams simultaneously and not fall over it has to manage 50+ devices all blabbering randomly with each other.

Current network topology. current router only has 4 ports.

router - 4 ports (let's call them a b c d) all gigabit
-SNIP- WRONG. NEW ACCURATE PLAN MADE... so much stuff has changed over years i lost track.

wifi is used only for wife's two laptop ( one work , one home ) and a few tablets ( 3x amazon tablets for home automation,  three ipads and 2 iphones plus 5 or 6 amazon dots)

current system works but wifi is spotty ( i can see at least 20 other networks form neighbours all fighting for channels ) and nas / internet can bog down when moving lots of data

I want to rearrange stuff to crank out more throughput , especially towards the nas devices. the amount of NAS devices is going to be reduced the LG's are on their way out, and the two asusstors will get more drives.
so the new topology would look like

new router. here is the idea
port 1 - nas1
port 2 - nas2
port 3 - 24 port switch housefeed
port 4 - 8 portswitch - legacy devices ( old nas , home auto hubs and timecapsule ) old nas will be gone by end of year
port 5 - ipcams
port 6 - garage
port 7+8 link aggregation to office

i want throughput between office and the main NAS devices and house and NAs devices and internet. Running new cables is not an option. Fortunately i have have 3 dedicated cat 6e running from network closet to office so i can use two for aggregation. The run is short ( max 10 meter ) so i should be able to do something there. Either aggregation or attempting 10gb link (one router i found has a 10gb port) to a local switch. in short : i want a bigger pipe there.

for wifi i want to use a mesh solution. those 'repeaters' are crap as you need to manually change wifi on your devices. it should work seamlessly. so i want a router that comes with real mesh functionality
there are so many choices out there...

budget is not a problem. new router + a wifi extender + new switch for office

[wraper]

I suggest looking into Mikrotik. They also have test results on their website. Like on bottom of this page:https://mikrotik.com/product/rb4011igs_5hacq2hnd_in#fndtn-testresults

[bd139]

God no not microtik after this shit: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/over-200-000-mikrotik-routers-compromised-in-cryptojacking-campaign . RouterOS is a piece of shit as well as is their licensing.

[wraper]

God no not microtik after this shit: https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/over-200-000-mikrotik-routers-compromised-in-cryptojacking-campaign . RouterOS is a piece of shit as well as is their licensing.

Because customers (ISPs) did not bother to update them for half a year since there was security patch released immediately after vulnerability became known.

[wraper]

How about Cisco? https://www.zdnet.com/article/thrangrycat-flaw-lets-attackers-plant-persistent-backdoors-on-cisco-gear/
The same can be said about almost any other manufacturer.

[free_electron]

never heard of Mikrotik. Prefer to stick to known brands such as linksys , netgear , cisco , d-link , asus that are readily available in US.

[bd139]

How about Cisco? https://www.zdnet.com/article/thrangrycat-flaw-lets-attackers-plant-persistent-backdoors-on-cisco-gear/
The same can be said about almost any other manufacturer.

Yeah not fan of them. I am currently arguing with their shit today 

Draytek up front, whack in a cheap 1G switch with 10G uplink port.

[wraper]

never heard of Mikrotik. Prefer to stick to known brands such as linksys , netgear , cisco , d-link , asus that are readily available in US.

All of those are just usual consumer gear while Mikrotik specializes mostly on ISPs/pro gear. You just don't realize how many Mikrotik is out there, basically in any country. I can find them in just about any airport I visited.

[Mr. Scram]

Get or build yourself a nice x86 router, separate capable switch and and get yourself a mesh network with a couple of access points. Most well known brands now have their own version, although publicly lesser known brands like Microtik and Ubiquiti seem to be popular options. That way you have near enterprise grade networking with excellent performance and configurability. If you don't want to go for the x86 router these brands also provide router options. I'd shy away from the typical consumer grade crap, no matter how many antennas they stuck on. It's always asking too much of too little hardware with a focus on the wrong qualities.

[sokoloff]

I use (and am happy with) Ubiquiti gear at home.
It's high-end consumer or mid-range SOHO type of gear.

I haven't tried link aggregation on the UniFi switches, but the feature is supported. (I have only one vertical Cat6 run up/down my house.)

[helius]

Furthermore the RouterOS vuln was specific to routers that had remote administration enabled. There is no need for this if you have your router in your own location. Many, many other manufacturers routers were and are vulnerable to remote attacks from woefully outdated OpenSSH versions and other things, but not all of them have proper disclosures and updates, nor ways to disable remote administration or backdoor passwords.
Consumer products are always going to have dire problems, like support for WPS or UPNP. In many cases you may be able to clean them up by loading a real operating system like DD-WRT or pfsense, but support will be better on systems that were designed to be used that way such as pcengine's Alix boards.

[bd139]

Get or build yourself a nice x86 router, separate capable switch and and get yourself a mesh network with a couple of access points. Most well known brands now have their own version, although publicly lesser known brands like Microtik and Ubiquiti seem to be popular options. That way you have near enterprise grade networking with excellent performance and configurability. If you don't want to go for the x86 router these brands also provide router options. I'd shy away from the typical consumer grade crap, no matter how many antennas they stuck on. It's always asking too much of too little hardware with a focus on the wrong qualities.

Not a terrible idea. Supermicro sell some decent machines for that.

Bit annoyed Soekris disappeared. I used one of their routers for about 5 years as an ADSL NAT router running OpenBSD.

Furthermore the RouterOS vuln was specific to routers that had remote administration enabled. There is no need for this if you have your router in your own location. Many, many other manufacturers routers were and are vulnerable to remote attacks from woefully outdated OpenSSH versions and other things, but not all of them have proper disclosures and updates, nor ways to disable remote administration or backdoor passwords.
Consumer products are always going to have dire problems, like support for WPS or UPNP. In many cases you may be able to clean them up by loading a real operating system like DD-WRT or pfsense, but support will be better on systems that were designed to be used that way such as pcengine's Alix boards.

RouterOS remote admin was on by default and reenabled itself on firmware update...

[free_electron]

couple of comments :
1) Building is not an option. no time , not willing to learn , no mucking about. looking for off the shelf turnkey.
2) no remote config will be enabled.
3) i am looking to remove bottlenecks in my current setup , especially between office / nas / internet  and  tv / nas.

[nctnico]

D-link has mesh enabled Wifi routers in their professional range. They work well (I have set these up in a large factory to have roaming wifi).

[rsjsouza]

Looking for a similar solution myself. Subscribed.

Currently using a consumer Dlink DIR-655, but its latest firmware goes back to 2014. I have no idea how many outstanding bugs it has untouched (including the Heartbleed).

[Monkeh]

So the million dollar question nobody has asked.. how fast is your WAN in reality?

[MrMobodies]

I was given a Draytek 2820n some years and was told it had problems with the wifi switching off.

I had it on for a while and no problems. When I took a look at the power supply provided, a tiny little thing I tested it and it couldn't deliver more than half of the rated, I think it was 12 1a. I have noticed with that model that it doesn't seem to work with double nat when I was testing it out.

Looking for a similar solution myself. Subscribed.

Currently using a consumer Dlink DIR-655, but its latest firmware goes back to 2014. I have no idea how many outstanding bugs it has untouched (including the Heartbleed).

I have got one of those from a bootsale in 2014. It was raining they were packing up and were going to throw it so they gave it to me for free. It is DIR-655 rev A2 VER 1.02. I was impressed with the wireless side but it kept on overheating and stopping so I replaced all the caps and cut the case to put a fan on it and now no problems since. I found from Russian website back then discussing it and got an upgrade they altered so I can downgrade to some version 1 (in sequence) to put it into proper bridge mode which they removed on the firmware above where you couldn't downgrade. I am sure it may have bugs but no problems for what I am using it for.

[free_electron]

My wan is 300 mBit/s

So the million dollar question nobody has asked.. how fast is your WAN in reality?

My wan is 300 mBit/s and , if you have read my original goal , that is not relevant for my question.

I am more concerned about what goes on in my internal LAN. Meaning :
My pc's and video / audio streamers to and from my NAS devices whether using a wired or wireless link.

Currently i can not attain the maximum throughput of my NAS boxes as the links are a bottleneck. ( i tried this by moving one nas and could get roughly 40% more speed )

My big concern is : how much data can the router's and switches backbone really move ? the switches are all sold as 8 port gigabit , but can the internal switch fabric really handle all 8 ports going full out ?
i found out ( in the past) that many 8 port switches are actually built from two 5 port chips. port 1234 are one chip 5678 on the other one. A 'hidden' port connected the two banks. With as result that
send from 1 to 2 and 3 to 4 simultaneously works top speed.
sending from 1 to 5 while also sending from 2 to 6 gives you half speed as both streams now have to go over the hidden port. There is a bottleneck there. Newer generation switches and true professional switches don't have that problem as their backbone can handle as many streams as there are ports.

My 24 port switch i such a beast. it actually has a two SFP ports that accepts  10Gb transceivers (Used Dell i got for 10$ ) but there are many cheap ones these days like the trendnet 24 port + 2x10g sfp. 88Gbps switching capacity

so i came to the following setup :

router : Netgear X10
why ? This router has 6 gigabit ports with 2 linkshare capable and a dedicated 10G sfp port.

interconnect : 10G SFP link cable ( no module , just a sfp to sfp cable ).

Main switch : 24 port switch .
SFP1 to router using the sfp-sfp cable
SFP2 to office using 10GbaseT SFP module

Office gets a new 8 port switch with 10G SFP port (either a GS110MX or a SX10) so these ports become essentially part of the main switch as it has a 10gb pipe

The two NAS boxes , the NVR and the apple timecapsule go on the router.
so the 10G links will never be overloaded.

one wifi extenders set up as AP.

final BOM

- Netgear X10 or XR700 router  360 .. 440$
- Netgear GS110MX for office 199$
- 10 G SFP cable : 15$
- SFP+ 10GT module : 54$
- EX7000 range extender for the wifi : 109$

In the future i may upgrade my dell switch to one with 4 SFP+ ports Then i can run 10G over all my house cables. ( i have a direct Cat 6 cable from router closet to office, downstairs and garage. )
This looks like it gives me the fattest pipes.

[Monkeh]

My wan is 300 mBit/s

So the million dollar question nobody has asked.. how fast is your WAN in reality?

My wan is 300 mBit/s and , if you have read my original goal , that is not relevant for my question.

It's very much relevant.

You don't need a new router. You just need a switch, and some APs. Your router has nothing to do with internal traffic, except for any built in AP.

Yes, a decent normal switch can handle full bandwidth on all ports.

[tautech]

wifi is used only for wife's two laptop ( one work , one home ) and a few tablets ( 3x amazon tablets for home automation,  three ipads and 2 iphones plus 5 or 6 amazon dots)

current system works but wifi is spotty ( i can see at least 20 other networks form neighbours all fighting for channels ) and nas / internet can bog down when moving lots of data

Have you considered shifting devices that are capable to 5G WiFi for better speeds ?

[free_electron]

wifi is used only for wife's two laptop ( one work , one home ) and a few tablets ( 3x amazon tablets for home automation,  three ipads and 2 iphones plus 5 or 6 amazon dots)

current system works but wifi is spotty ( i can see at least 20 other networks form neighbours all fighting for channels ) and nas / internet can bog down when moving lots of data

Have you considered shifting devices that are capable to 5G WiFi for better speeds ?

wifi speed is NOT the issue. (coverage is)

i am after wired speed.
right now if i send data from pc1 to nas1 while sending data from pc2 to nas2 , while sending data from the mac to the timecapsule , everything runs over a single 1gb link. and it slows down. plus some pipes carry always -on streams like the ip camera's which also eat bandwidth

Due to the way the house is wired and the endpoints of the cables i have to share some pipes. That is what i am trying to solve as problem 1. : upgrade the pipes to 10G
i can pump up the pipe from the network closet to my office to 10G so if all three computers are pumping data over their gigabit link , the shared pipe is not overloaded. i can't upgrade the computers to 10gb as they are laptops / all in ones (mac).

one thing i am not clear on is how packets really travel on a network and i can't really find a good explanation on the internet

assume this
- network without subnets. Everything lives on 192.168.1.xxx
- tree structure
- router at top.

Code: [Select]

  router
   +--- device 1
   +--- device 2
   +--- switch
           +--- device 3
   +--- device 4

when 3 talks to 1 that is loading the switching fabric of the router
when , at the same time, 4 starts talking to 2 , the cable between switch and router is a bottleneck

so this should remove bottlenecks ( assuming we have infinite backbone on the switch itself)

Code: [Select]

router
   |
   +--- switch
           +--- device 1
   +--- device 2
           +--- device 3
           +--- device 4

My question is : is the above true or not ?

i want to eliminate as much intermediate switches as possible. right now i have three level deep switching. (switches behind switches behind switches)
i want to convert that to 1 level. those links will be 10G.
i don't want to start mucking with managed switching ( later 3 / 4 ) or vpn. i tried that and it becomes a horrible mess figuring out what to put where so the devices can see what they need to see.
if i go to a scenario where there is only one device per switch port then switching happens purely by mac address. 1 port = 1 device. and my big switch can easily cope with that.

where i do need a 'geographical' break ( due to home wiring) i will use a fat pipe that cannot overload
home office : 3 computers + 3 printers on a 10G link to main switch
storage cabinet : router + 3 nas devices on a 10G link to main switch

in future : 10G link to garage and 10G link to media center. and i'm not sure i will do that as the required bandwidth there is low.
media center has a roku and an apple tv which are never used simultaneously so non issue. a single 1G link is sufficient
Garage : only used for some test equipment ( which is all 100Mbit and talks locally ) and 2 pc's . perfectly workable over a single 1G link.

the link from my office to the NAS / internet is much more important as i can currently overload that link.
the router / nas is in 1 location.
the main switch is a different location

[TERRA Operative]

My setup is as follows, and it works well:

Internet
| (1gig fiber)
Asus RT-AC88U (Running Asus Merlin firmware)
| (2gig LACP link aggregation)
24 port PoE switch
| (4gig LACP link aggregation)
Synology RS815+ NAS

All the rest of the wired network is hanging off the switch, 5 IP cameras, 3 printers, PC's/laptops, etc, etc.

I would suggest a similar topology, set up a link aggregated connection from router to switch, then branch everything off from there, using link aggregation where possible to increase bandwidth to end devices.
I don't use my router for switching duties, it handles the internet authentication, wifi, firewall, port forwarding etc, etc.
All the switching is done soley by the switch so I can get that sweet sweet link aggregation to whatever devices need it (the Asus will only support one 2gig LACP link max, my switch has no limit).

[tautech]

wifi speed is NOT the issue. (coverage is)

Then maybe a better range modem is required.
One like this here has given ~1km range on 2.4GHz albeit at low signal strengths at that distance.
https://www.tp-link.com/en/home-networking/wifi-router/archer-a9/?utm_medium=select-local

That you can also split WiFi usage onto 2.4 and 5 G bands means you can better share the loadings around.

In my limited experience LAN performance is greatly improved with switches strategically placed around the network.

[Halcyon]

pfSense for me. Either build your own machine or consider one of the Netgate appliances.

[free_electron]

wifi speed is NOT the issue. (coverage is)

Then maybe a better range modem is required.

i am talking WIRED as in hard ethernet cables. That is my prime goal. coming up with a network topology and equipment that maximizes throughput without having to run new wires.

Going wireless is not an option. Wireless is sucking through a straw ( 54mbit/s) in a congested airspace with 20 other neighbours also fighting for a time slot on the 11 available channels. Wifi is fundamentally broken. They need to open up much more airspace (channels).
just sniffing the airwaves i see like 60 devices from my neighbors ( printers, tablets, phones, amazon / google devices / sonoff switches ). it's unbelievable how congested it is.

i do want wifi but i am ok with what it is , as long as i can get it to work in the rooms i want ( currently one room with very intermittent connection and only like 1 bar ) so i will place a mesh extender on second floor ( router is on third floor ).

[Halcyon]

Even in congested RF environments, Wi-Fi can still be a very effective option, but you need decent gear to do it. Think Ubiquiti, Cisco, Aruba, that kind of thing. They are far more configurable and will out-perform the consumer crap in less than ideal situations, even on the 2.4 GHz band.

[sokoloff]

Wireless is sucking through a straw ( 54mbit/s) in a congested airspace with 20 other neighbours also fighting for a time slot on the 11 available channels. Wifi is fundamentally broken.

I get that you want wired.

I'll just note that modern 802.11ac wifi is significantly faster than what you cite there. Theoretical max is over a gigabit. I've never seen that, but I can speed test to approx the rating of my WAN connection. I pay for 200/10 Mbps (I think) and a wifi speed test out to Comcast's servers just now on my iPhone was 190.5/12.6 Mbps on 802.11ac.

That's phone wifi to a Unifi AC Pro AP then Cat 6 to a Unifi SW8-PoE then Cat 6 to a Unifi EdgeRouter X SFP then Cat 6 to an Arris 6190 cable modem to Xfinity/Comcast. (It's possible there's another SW8 between the SW8 upstairs and the Edgerouter-X. If you really care, I'll go look.)

[free_electron]

Wireless is sucking through a straw ( 54mbit/s) in a congested airspace with 20 other neighbours also fighting for a time slot on the 11 available channels. Wifi is fundamentally broken.

I get that you want wired.

I'll just note that modern 802.11ac wifi is significantly faster than what you cite there. Theoretical max is over a gigabit. I've never seen that, but I can speed test to approx the rating of my WAN connection. I pay for 200/10 Mbps (I think) and a wifi speed test out to Comcast's servers just now on my iPhone was 190.5/12.6 Mbps on 802.11ac.

That's phone wifi to a Unifi AC Pro AP then Cat 6 to a Unifi SW8-PoE then Cat 6 to a Unifi EdgeRouter X SFP then Cat 6 to an Arris 6190 cable modem to Xfinity/Comcast. (It's possible there's another SW8 between the SW8 upstairs and the Edgerouter-X. If you really care, I'll go look.)

Very nice but again all irrelevant for me as this is not what i am after.

3 computers , 2 nas devices , 1 internet connection. all hardwired
That's where i need my throughput. i do not store data locally on computers. files are all on nas boxes.
TV's and media players are all hardwired too. they get their stuff either from internet or nas

Wifi is only for surf the internet , read newspapers etc. i don't care if that is slow ( i do care to have connection ) other wifi is for echo ( alexa) and that's it. all low bandwidth. my Wifi is basically is an independent network from my wired network with no bridge between them.

This is not what i am looking for.
My original question was : what are the best ( as in fastest throughput ) routers out there.
i learnt a couple of new brands and some of the pointers given put me on the right track as it altered my perception of certain things and made me rethink topology.

the solution for me now is to
- switch my existing wiring to 10G ( i have Cat6 in the walls and nothing is longer than 25 meters ) by buying 1 SPF+ to 10GbaseT adapter and an 8 port switch with 10GBaseT
- keep my existing master switch which has 2 SPF+ ports, ditch all the intermediate switches
- Buy a router with SPF+ port and connect that using a SPF+ cable to my existing switch

the on-board router Ethernet ports become essentiall an 'extension' of my main switch. The link is 10GB and there are 6 ports so i can not fill the 10G link with the data from the 1G ports. Even including the wireless and wan traffic i can not fill the 10G pipe.
The office ports are the same way. 3 computers 3 printers not capable to fill the 10G pipe. 8 ports at 1Gbit into a 10G pipe. only 6 are used.

so my entire network basically changes to a fabric where every port becomes 1gbit capable without bottlecks. None of the 10G pipes can ever be fully loaded as there are not enough devices hanging off them to fill them (max 8 devices per 10G pipe)
That is a big step up from having to share 1G links for 6 to 8 devices with multiple hops between them.

As for my wifi : the new router has MU MIMO and beamforming , three band and there will be an extender also three band. the extender will use a hardwire as i don't want to sacrifice a wireless channel to link the extender. there's already too many devices in the air fighting for space.

my current wifi router has none of that. it is a simple AC1200.

in future i can upgrade my master switch to a 24port 1Gb + 4 port SPF+
then i can send 10G pipe to downstairs and to garage as well.

[tautech]

wifi speed is NOT the issue. (coverage is)

Then maybe a better range modem is required.

i am talking WIRED as in hard ethernet cables.

Understood from the OP.

Still, if you are having WiFi issues either a better router or access points will fix this.

I have ~30m CAT5 run to this PC from a switch and then ~10m CAT6 to our router and when adding another switch locally for test equipment connectivity this PC speed tests improved.
Not that I know for sure but I suspect switches have better cable driving ability than PC NICs.

In my case a cheap solution was additional switches gave me both more local options and better performance.

[Black Phoenix]

Understood from the OP.

Still, if you are having WiFi issues either a better router or access points will fix this.

I have ~30m CAT5 run to this PC from a switch and then ~10m CAT6 to our router and when adding another switch locally for test equipment connectivity this PC speed tests improved.
Not that I know for sure but I suspect switches have better cable driving ability than PC NICs.

In my case a cheap solution was additional switches gave me both more local options and better performance.

In a project I develop, were throughput was something users wanted, this was the solution: https://www.ebay.co.uk/itm/Mikrotik-Cloud-Smart-Switch-CSS326-24G-2S-RM-24-x-Gbit-LAN-2x-10Gbit-SFP-Cage/323813144298?epid=3016758178&hash=item4b64c476ea:g:cZQAAOSwLNxcDRey

24Gbit plus 2 10Gbit for connection with the server room with 10Gbit connection. It was a company that relied heavily in work from CAD Files saved in a Server Cluster.

[Berni]

I have dealt with Netgear, Asus, D-Link etc.. and they are just consumer grade toys. But its MiktoTik that has been rock solid reliable for me.

Okay yes they did have a security hole in RouterOS but don't think Cisco gear that costs over a grand doesn't have those. Even Ciscos VoIP phones had vulnerabilities that could be used to traverse a network or spy on people using the microphone.

So far MikroTik routers are the only ones that i found could route full 1Gbit throughput of realistic WAN traffic for something that costs under 100 bucks. It never needed a reboot in the many years of working and can be configured for nearly anything (Tho the configuration settings are pretty overwhelming to figure out unless you are a network admin). You can also easily get these routers with SFP ports to do fiber or 10Gbit Ethernet.

WiFi i haven't stress tested with >20 devices or something, but for home use WiFi never skipped a beat and provided plenty of range (I have a 1000mW TX power model), and if more range is needed multiple of these routers can configure themselves into a WiFi mesh network and intelligently route traffic along the best path while also doing proper seamless handover like the Ubiquity solutions (No lost packets or even a jump in ping time during handover).

[NivagSwerdna]

MikroTik combined with TP-link Deco mesh. Best solution I have had so far.
... And a sprinkle of power line which I am less happy about.

[Rerouter]

For my physical Internet I'm using an the one tautech recommended (archer9), soley because very few routers seem to come with a gigabit WAN port. have that hooked up to an 8 port Gigabit switch and that covers my house,

So far it as not been the limit for anything I have tried to accomplish, It happily routed 2 ports to 2 ports at full bandwidth when I was backing up my NAS,
still if you want real speed, you just plug that into a 10gig switch, let the internet be the only limited link at 1 gig, and keep the rest of the network as fast as you need it, with 3 slow ports on the average router, and 10 gig where ever else you need it.

[madires]

new router. here is the idea
port 1 - nas1
port 2 - nas2
port 3 - 24 port switch housefeed
port 4 - 8 portswitch - legacy devices ( old nas , home auto hubs and timecapsule ) old nas will be gone by end of year
port 5 - ipcams
port 6 - garage
port 7+8 link aggregation to office

Do you need the 8Gbps routed (network segmentation) or switched (one large LAN) ?

[Berni]

Handling 1Gbit of traffic between two LAN ports on a router or switch is a lot easier to do.

This local traffic gets routed according to the MAC address inside packets, this lets the switch just simply have a lookup table of what MAC address is accessible on what port. So there are a lot of chips that implement this Ethernet switch functionality in hardware. Because of this even the cheap crappy gigabit switches are actually capable of keeping with with a full 1Gbit of traffic between two ports. You can still get them on there knees by sending that full 1Gbit trough all ports simultaneously and this is where the big expensive professional switches are better at.

But when it comes to actually routing IP traffic out to the internet that is a much harder job. When a client inside the LAN wants to request a webpage it has to send a TCP connection request trough the router where that request is written down and when a response to the request comes back the router has to go back and look trough who made the request so that it can pass on the response to the right client inside the LAN. This makes for a lot more work as now the router has to actually look at the contents of the packet. This is where the cheap routers fall short. Most of these home grade consumer routers can't keep up with routing 1Gbit of traffic into the internet and can get overwhelmed by the traffic being too complex (Lots of tiny connections from various ports from a large number of clients). Proper enterprise grade routers have no trouble with this.

I found that i can actually predictably knock some crappy home routers offline by simply overwhelming them hard enough with traffic. Some even need a reboot to recover. The stress test is simply port scanning using nmap a large IP range as quickly as your PCs Ethernet port can send out tcp requests. Just to see what would happen i tried to send a flood of TCP requests at a friends router over the internet by sending them to his WAN IP and it crashed so badly it needed a reboot. At the same time my own MikroTik router was showing abnormally high CPU and RAM usage while routing the ~100Mbit/s of zero length ping requests, but internet inside my LAN kept working normally during that denial of service attack (The QOS routing was kicking in and load balancing the attack traffic with the traffic from other clients).

EDIT: This was done with my friend agreeing to it as an experiment, so it was nothing malicious.

[madires]

The reason for that is the typical architecture of a SOHO router. It's simply a MCU with 1 up to 3 ethernet interfaces and an ethernet switch chip. One ethernet interface is used to connect the MCU with the switch chip. While cheap MCUs with a single ethernet interface share that single link for LAN and WAN (traffic separated by VLAN), better ones use the second ethernet for a dedicated WAN port. Some MCUs have hardware NAT or other nice features integrated. All ethernet switching is done by the ethernet switch chip. Anything routed has to go through the MCU. On the software side you often face bufferbloat which causes traffic to stall. Some vendors still don't know about CoDel to solve the bufferbloat issue.

[Monkeh]

- Buy a router with SPF+ port and connect that using a SPF+ cable to my existing switch

There is absolutely no point in this as there will not be enough traffic to utilise it.

[madires]

BTW, there's 2.5GBASE-T and 5GBASE-T which work fine with Cat 5e cables. A few "high-end" SOHO routers provide a single 2.5GBASE-T port.

[Tom45]

I use a separate router for wired connections, and access points for wireless.

At home I have an old Netgear router which I think has been discontinued but it still works with no problems. More recently I've been using Ubiquiti Edgerouters.

For access points I now use Ubiquiti Unifi access points.

I don't have experience with a broad range of devices, so I can't say what is "best". But the Ubiquiti Edgerouters and Unifi access points do work well for a relatively modest amount of money.

[free_electron]

new router. here is the idea
port 1 - nas1
port 2 - nas2
port 3 - 24 port switch housefeed
port 4 - 8 portswitch - legacy devices ( old nas , home auto hubs and timecapsule ) old nas will be gone by end of year
port 5 - ipcams
port 6 - garage
port 7+8 link aggregation to office

Do you need the 8Gbps routed (network segmentation) or switched (one large LAN) ?

one large lan. but the layout has changed now. see picture.

[bd139]

Jebus. This is my day job and all I've got is a laptop, a router and an external USB drive 

[Monkeh]

Take all those NAS boxes off the router and put them on the switch. You do not need 10GigE on your router, you do not need a new router.

While you're at it forget having any wifi whatsoever on the router. It's a waste. Buy some nice Unifi APs and scatter them around (get a PoE capable switch).

[james_s]

I've always just looked at the supported hardware page for the open source Tomato firmware. I've been running it on various routers for more than a decade and have always been happy with it. Haven't really seen much difference in the hardware from one brand to another across the same generation, I figure most of them are probably pretty close to Broadcom reference designs.

[Berni]

Yep i also agree that there is no point in having a 10Gbit port on a router. You should just plug the modem and main switch into the router so that the only thing it does is route traffic out to the internet. You only need it once you have internet that is faster than 1Gbit, but good luck routing 10Gbit into the internet with any router that costs less than $500.

That is unless you want fancy routing rules with virtual LANs so that you can set what clients can access what areas of a LAN, cutting off some clients from the internet, etc... But if you want to do those sorts of stuff you need to buy an enterprise router anyway because the home toys don't have those features.

And yes Ubiquiti is the best large scale WiFi solution out there for a reasonable price.

[madires]

Since you need the router just for the internet uplink don't waste you money with 8 GigE ports and the SPF+ link between router and main switch. Some SOHO router with 4 GigE ports for LAN and another for WAN is totally fine. As monkey has already recommended, connect the NAS boxes to the main switch. Switch ports are cheap. This way you'll also get a lower latency in you LAN. IIRC, you've mentioned a WiFi extender. Two access points might be a better option than the router's WiFi plus extender. More flexible and more throughput.

[free_electron]

- Buy a router with SPF+ port and connect that using a SPF+ cable to my existing switch

There is absolutely no point in this as there will not be enough traffic to utilise it.

It will as i am using the ethernet ports on the router as an extension to my main switch fabric. I also want to hook up a harddisk to the usb3 port of the router.
instead of running a bunch of ethernet cables between my in-wall switching cabinet and my network rack to feed all the devices there , i can get away with a single SFP cable. i can pull out the existing cable from the pipe and pull a SFP cable in. it has to do with moving stuff into the network cabinet. All house wiring terminates in an in-wall cabinet where the main switch resides. Now there is a bunch of cables going in and out (so the door can;t close) going to the router , going to the nas boxes , traversing the room becasue there is not enough room in the in-wall pipe etc. i can do away with all that junk.

- in cabinet :
  - all nas boxes and iot hubs and other machinery
- in the pipe :
  - have one ethernet for modem to router
  - have one cat6 for future nas location
  - have one sfp cable to link router to main switch
- in the wall panel
  - main switch
  - docsis modem

so the room will be clean. no more stuff on the wall , on the floor, on the ceiling and cables everywhere. it is in the wall or in the cabinet.

The router i chose has 6 ethernet ports so i can hook up 6 devices where the router is. for the time being there will be some cables going to the old nas boxes but those are on the way out. in the coming months the data will be moved and they will be decommissioned. I have many nas boxes, simply because i got them free. they are old, slow and only hold 2 1tb drives + a dvd drive but they work well.

Ultimately The SFP link will feed data in and out of 3 NAS machines, the internet, and a usb connected harddisk. so i will have lots of traffic there but not enough to fill that pipe.

so here is the amended plan. This has been a good excercise in rethinking the structure and setup that has 'grown' over 10 years ...

[free_electron]

hmm. i like the idea of ditching the wifi and use a poe mesh. (but not googles. they already have too many fingers everywhere)

There is still the geographical issue. i want all the machinery in one cabinet. the pipe in the wall can only hold 4 wires really..
i could use two as 10G links. One for the future 10G nas and one to bundle 8 1GB links for the other stuff. ( legacy nas and iot stuff )
then i have two remiang. 1 for wan and a spare. that's good.

Then i can get away with a simple wired router that sits on a 1GB port.

i am thinking along these lines : (tell me if i am wrong)
i see the 10G links as an extention of my switching fabric. since none of the satellite switches will have more than 8 devices i can not exhaust the bandwidth on the 10G links.
So i have a bunch of 1Gbit ports that happen to be geographically distributed that behave as one big switch.

I could use 4 mikrotik switches (1 office, 1 garage , 1 cabinet and 1 in switch panel ) combined with a mikrotik 4 port 10G switch.
As long as i dont fill up a 10g link i am ok. That is doable.
That is cheaper than other solutions.
Add mesh wifi.
Add a good wired only router. <- so now we get here... since i am saving money : i want security. self-brew is not an option. i'm tired of endless mucking about. i want turnkey

[Berni]

Yep that does make more sense to me.

Also if you are going for security then don't use a home router to host a USB drive to the outside. A better option of that is to have a dedicated machine on the network that has ports open to the internet, but also has special routing rules to keep it isolated from the rest of the LAN (VLAN or something). Some extra routing rules then make the machine available to the LAN without open ports. This effectively makes that public facing machine look like its just another computer in the internet, except its inside your network so you have full bandwidth to it. Any compromise to the public facing machine only exposes the infected machine to the internet, but not your LAN clients. You don't want routers to respond to any WAN requests at all, let a sacrificial quarantined machine do the risky work of talking to the scary internet and keep it updated. That way any potential security breach is contained from exposing your internal LAN.

Also with so many NAS servers around it really makes sense for you to just buy a big old enterprise rack mount NAS server and stuff all of your drives into that and give it a dual 10 Gbit NIC. Much easier to manage things in one place and keep backups of important data.

[geekGee]

pfSense for me. Either build your own machine or consider one of the Netgate appliances.

Same here... originally on a couple generations of Soekris units but now using a Super Micro 1U Atom-based server.

[David Hess]

I also recommend using pfsense.  Either repurpose some old desktop hardware, buy something from Netgate if you want an embedded box, or build a new box using something like an Athlon 200GE.

Then get a VLAN gigabit switch and use it as a port expander.  Now the router can route between every switch port for maximum security and untrusted hardware can be isolated from other systems on your LAN and the internet if necessary.

For wireless, use separate access points rather than integrating this function into the router.

I just recently switched over to pfsense after running m0n0wall which it is based on for almost 20 years.  This morning I configured all DNS from my network, except that which already goes over a VPN, to get resolved using DNS over HTTPS/TLS.  The UK (and my ISP, Charter) can kiss my ass.

[Berni]

Yeah the government trying to filter the internet is just a exercise in futility. Tho to be fair even basic things like DNS are quite effective against the average internet user that has no idea what a DNS or IP even is.

At least the grumpy old men in UK didn't come out with such an ridiculous argument that Australia did against end to end encryption in messaging apps:
"Prime Minister claims laws of mathematics 'do not apply' in Australia"
https://www.independent.co.uk/news/malcolm-turnbull-prime-minister-laws-of-mathematics-do-not-apply-australia-encryption-l-a7842946.html

[Bratster]

I use a separate router for wired connections, and access points for wireless.

At home I have an old Netgear router which I think has been discontinued but it still works with no problems. More recently I've been using Ubiquiti Edgerouters.

For access points I now use Ubiquiti Unifi access points.

I don't have experience with a broad range of devices, so I can't say what is "best". But the Ubiquiti Edgerouters and Unifi access points do work well for a relatively modest amount of money.

I'll put in another recommendation for Ubiquiti gear, we've got a few edgerouters in use at different locations.

The edgerouter 4 is our go to choice for any new installations.

They work great, our standard configuration is 1 wan port and 1 lan port and then use a separate switch to handle giving network to everything.



 We also use a bunch of unifi access points for WiFi and air Max radios for various long range links.



Sent from my Pixel 2 XL using Tapatalk

[Bassman59]

With 'best' i mean the following
- best throughput WIRED and wireless. Most reviews blabber about theoretical bandwidths on wifi but nobody talks about what the router can really handle. Most of my stuff is wired. The router should be able to handle many datastreams simultaneously and not fall over it has to manage 50+ devices all blabbering randomly with each other.

Dunno if it's really "best" but recently I bought a Synology RT2600ac router to replace the old stuff. It has a gigabit WAN port (the cable modem has a gigabit port), four gigabit LAN ports (one of which can be repurposed as a redundant/failover WAN port), and USB 3 and USB 2 ports. One LAN port connects to the Apple TV box near the router. Two of the other ports go to other rooms in the house, one being where we hide the security camera DVR and the other is my work room. In the latter I have an eight-port switch (which needs to be 16, but whatever). The three computers in the workroom are all on wired gigabit Ethernet.

Things are "noticeably" faster than with the old hardware. I hooked up a couple of USB 3 SuperSpeed drives to the router for Time Machine backup use, and those backups are faster. Most of our TV watching is streaming, and even with the kid watching video on his iPad while my wife watches TV everything seems "snappy."

The router has some pretty nifty management and monitoring tools, and a really handy VPN server feature.

WiFi can be extended with their mesh boxes, with which I have no experience.

[free_electron]

right now i am leaning towards going with

- ubuiquiti Amplifi-HD router with possibly a second one as RAMP. holding off on the second one for now.
- three mikrotik 24 port smart switches.

i can restructure my wiring in the cabinet so all machinery hangs off of one mikrotik. Including the router.

if i add up all theoretical bandwidth there i end up at 4 gb/s
- 3gb streams to the nasses ( my computers cant pump any faster as they are 1gb each)
- some iot stuff. 100 meg max
- ipcam and netflix/roku/appletv streams to various media players. 1gbyte max (which is grossly overstated as i can play three 4k movies over my current internet which is 300mbit without issues)

so all machinery sits in the cabinet. 2 wires leave
- 1 gig link from the modem to router
- 1 sfp to sfp cable carrying the 10g link (which i can not possibly fill up)

the wiring panel has a second mikrotik switch. There all the stuff from the in-wall wiring is plugged feeding the various devices in the house.

from the wiring panel one cat6 cable will carry a 10g link to my office where the thrid mikrotik switch will be.

I don't need 24 ports everywhere , but these machine are simply the cheapest. a simple 8 port netgear with a 10g link costs 200$ ...

I'm still a bit reluctant as mikrotik is a new brand for me and i have never seen them in stores.

[Monkeh]

I'm still a bit reluctant as mikrotik is a new brand for me and i have never seen them in stores.

When was the last time you saw Cisco, Juniper, Extreme, Nokia, Meraki and so forth in a store?

Consumer availability is generally a negative, not a positive.

[free_electron]

I'm still a bit reluctant as mikrotik is a new brand for me and i have never seen them in stores.

When was the last time you saw Cisco, Juniper, Extreme, Nokia, Meraki and so forth in a store?

Consumer availability is generally a negative, not a positive.

Plenty of times. Mainly in used equipment dealers though >  and cheap !. Cisco 48 port gigabit POE switch with redundant power supplies and 4 10G uplinks for 49$ ... but then again . They make a bloody racket , are humongous ( 19 inch rack and full depth ) and suck power like anything.
And not just one but stacks of hundreds ! Mellanox, Brocade , Palo alto networks, Baraccuda appliances , Dell , HP , Cisco , Juniper, 3Com , Meraki and plenty of others.
Makes you wonder why these expensive machines get ditched. What did those users upgrade to ?

I scored my Dell machine for 10$ ... works a treat but its big and bulky and powerhungry and time for it to go to the 'for parts' heap.
Same for NAS machines. There's plenty of HP Dell and SUN NAS boxes with room for 24 to 48 drives ( mainly SAS though. Sata is rare ) for 10$. but you need two people to lift those things. not suitable for my walk-in-closet .. SWMBO would bang me on the head with it.

[Mr. Scram]

Equipment gets ditched because service contracts run out. Buying off liability is a huge factor. The equipment is often aging at that point, so migrate to something new and be done with it. You don't want to know how much otherwise perfectly fine equipment gets trashed every year. More carrion for us vultures it seems. Whatever the case, Mikrotik is a known brand name.

[free_electron]

On the mikrotik switch . anyone has actual experience with those ? it seems there are issues with swos... some switches are shipped with a version that has a broken dhcp.
At powerup the config console runs at 192.168.88.1.. That's already different from most network equipment that sits in 192.168.1.xxx .
So what is going to happen if connect three of these things together.. they will all open 192.168.88.1 and create a network problem preventing from connecting to configure.
i don't want to install these things and then find out i have to jump through all kinds of hoops to get them to work.
it should be plug and play.

if i change their ip addresses ( i do not want them to be dynamic. everything is static in my home network where possible. either by being driven from the router , or hard set in the devices ) will this be retained ?

[Berni]

Yeah for some reason Mikrotik uses 192.168.88.1 as the default but its easily changed to whatever your network uses.(Tho can require some networking knowhow in some cases)

As long as you only use basic switch functionality it shouldn't really matter what it IP it is set up for (low level switching only looks at MAC addresses), but you may loose the ability to get into its configuration interface if the IPs are screwy. The typical way of handling this is to just change the IP and give each one a unique static IP like 192.168.1.2   192.168.1.3    192.168.1.4... also write it down on a sticker and stick it to the gear so you know what it is 3 years later when you want to fix something. Other way is to go oldschool and use the serial service port on the switch if it even still has one.

[Monkeh]

At powerup the config console runs at 192.168.88.1.. That's already different from most network equipment that sits in 192.168.1.xxx .

That would be the point. Lots of people insist on just dumping their networks somewhere obvious (ever wonder why it's 192.168.1.0/24? Because too many people were causing problems by using 192.168.0.0/24...) and things get messy.

So what is going to happen if connect three of these things together.. they will all open 192.168.88.1 and create a network problem preventing from connecting to configure.

The same thing which happens when you connect any unconfigured devices without thinking: It doesn't work.

it should be plug and play.

Yes. One at a time, preconfigure, and then off you go.

if i change their ip addresses ( i do not want them to be dynamic. everything is static in my home network where possible. either by being driven from the router , or hard set in the devices ) will this be retained ?

Of course it will.

[free_electron]

Yes. One at a time, preconfigure, and then off you go.

I don't agree with that. Proper equipment will search for a dhcp server and obtain an address. Not use just a some hardcoded one, which may already conflict with something else.
In my current router configuration i can just say : for this device : always hand out that ip address.
Any new device ends up in an 'unknown' bucket and they get a free random address. Then i can pick it up from there and assign an address.

Having to use a laptop , manually configure the laptops ip , then hooking it to the switch , changing parameter , unhooking the laptop from the switch , rebooting the switch , plugging the switch to the router ...  ugh ... not very friendly.
That's already a big turnoff for me. i see trouble and i will get frustrated.
What if , after a power cycle , the switches do not come up in proper order ?

Here is the topology : switch 1 connected to switch 2 using one sfp link . switch 2 connected to switch 3 using another sfp link.
router sits on port 1 of switch 1.

Assume switch 3 is the fastest booting up , 1 and 2 are still cycling. so switch 3 cannot lease an ip address as it can not see the router ( switch 1 and 2 are still booting.)  what will happen ?

i'm just trying to avoid buying a bunch of stuff and then , during install having to spend hours/days on forums finding answers for annoying things like that. I scrubbed the mikrotik forums and there were people with the same problems like i am anticipating. As recent as a few months ago switches were shipped with buggy firmware and required a lot of hoop jumping to get the new firmware on it to resolve this.

i am not a networks specialist and have ZERO interest in becoming one. Things must be plug and play. I'd rather pay 500$ more in hardware that works out of the box than spend 1 hour futzing around to do a firmware update and having to muck around with manually configuring a pc to talk to the switch first.

[Monkeh]

Yes. One at a time, preconfigure, and then off you go.

I don't agree with that. Proper equipment will search for a dhcp server and obtain an address. Not use just a some hardcoded one, which may already conflict with something else.

What if you don't have a DHCP server? What if you just want to set it up in isolation before approaching a live network? You cannot please everyone.

Having to use a laptop , manually configure the laptops ip , then hooking it to the switch , changing parameter , unhooking the laptop from the switch , rebooting the switch , plugging the switch to the router ...  ugh ... not very friendly.
That's already a big turnoff for me. i see trouble and i will get frustrated.
What if , after a power cycle , the switches do not come up in proper order ?

Here is the topology : switch 1 connected to switch 2 using one sfp link . switch 2 connected to switch 3 using another sfp link.
router sits on port 1 of switch 1.

Assume switch 3 is the fastest booting up , 1 and 2 are still cycling. so switch 3 cannot lease an ip address as it can not see the router ( switch 1 and 2 are still booting.)  what will happen ?

It will not get an IP. It should continue trying DHCP until it does. Once it's configured it doesn't even need an IP, so why worry?

i am not a networks specialist and have ZERO interest in becoming one. Things must be plug and play. I'd rather pay 500$ more in hardware that works out of the box than spend 1 hour futzing around to do a firmware update and having to muck around with manually configuring a pc to talk to the switch first.

Your goals conflict. You want fast networking, and you want plug and pray. The two do not co-exist in any reasonable fashion.

Pay someone $500 to do it for you if you're that desperate to avoid an hour of work.

[free_electron]

What if you don't have a DHCP server? What if you just want to set it up in isolation before approaching a live network? You cannot please everyone.

then there should be a hardware button to hold during powerup that lets it start with a fixed ip. DHCP should be default.

Your goals conflict. You want fast networking, and you want plug and pray. The two do not co-exist in any reasonable fashion.

2019 and we still have stupid shit like that. 

Pay someone $500 to do it for you if you're that desperate to avoid an hour of work.

it's not the hour of work. it's my blood pressure !
Modern stuff is so complicated it becomes aggravating.

There is multiple of these questions on the mikrotik forums. people can't get the damn things to work or update firmware without jumping through hoops. Even their tech support is useless.

Tech support replied : 'connect to the serial port'

wonderful ...
first of all : none of my computers don't have serial ports anymore. Good luck finding anything built in the last 5 years that still has a rs232 port. even then .. do you need a straight or crossed cable ? and will i have one around ...
second: now i need to go buy a usb to serial adapter, find a terminal program , find out the baudrate etc .. urgh ...
third : your damn switch doesn't have a serial port anymore ! the current versions (in last 2 years) sold have ditched it , so why does tech support even give that as an answer ?!?

That guy got very frustrated ...

i do not want to end up in that situation. so before i purchase this stuff i do some investigation.

[Monkeh]

What if you don't have a DHCP server? What if you just want to set it up in isolation before approaching a live network? You cannot please everyone.

then there should be a hardware button to hold during powerup that lets it start with a fixed ip. DHCP should be default.

Do I need to point out the security implications of changing system configuration via a button?

third : your damn switch doesn't have a serial port anymore ! the current versions (in last 2 years) sold have ditched it , so why does tech support even give that as an answer ?!?

I'm looking at their switches and all the larger models have console ports..

[Mr. Scram]

On the mikrotik switch . anyone has actual experience with those ? it seems there are issues with swos... some switches are shipped with a version that has a broken dhcp.
At powerup the config console runs at 192.168.88.1.. That's already different from most network equipment that sits in 192.168.1.xxx .
So what is going to happen if connect three of these things together.. they will all open 192.168.88.1 and create a network problem preventing from connecting to configure.
i don't want to install these things and then find out i have to jump through all kinds of hoops to get them to work.
it should be plug and play.

if i change their ip addresses ( i do not want them to be dynamic. everything is static in my home network where possible. either by being driven from the router , or hard set in the devices ) will this be retained ?

You're really looking for trouble where there is none. Assigning fixed IP addresses is common and not hard to do. Being so averse to configuring is  asking for trouble and persistent problems instead of doing it right once. Either settle for a simple box and suffer performance issues or buy proper kit and do a basic setup. It's far from rocket science. If you want a magic button which makes everything work, hire a guy and don't be skimpy.

[free_electron]

Do I need to point out the security implications of changing system configuration via a button?

only at powerup.

third : your damn switch doesn't have a serial port anymore ! the current versions (in last 2 years) sold have ditched it , so why does tech support even give that as an answer ?!?

I'm looking at their switches and all the larger models have console ports..
[/quote]

not the one he was asking about. even then.

[Monkeh]

Do I need to point out the security implications of changing system configuration via a button?

only at powerup.

If you can press the button you can power cycle.

[free_electron]

On the mikrotik switch . anyone has actual experience with those ? it seems there are issues with swos... some switches are shipped with a version that has a broken dhcp.
At powerup the config console runs at 192.168.88.1.. That's already different from most network equipment that sits in 192.168.1.xxx .
So what is going to happen if connect three of these things together.. they will all open 192.168.88.1 and create a network problem preventing from connecting to configure.
i don't want to install these things and then find out i have to jump through all kinds of hoops to get them to work.
it should be plug and play.

if i change their ip addresses ( i do not want them to be dynamic. everything is static in my home network where possible. either by being driven from the router , or hard set in the devices ) will this be retained ?

You're really looking for trouble where there is none. Assigning fixed IP addresses is common and not hard to do. Being so averse to configuring is  asking for trouble and persistent problems instead of doing it right once. Either settle for a simple box and suffer performance issues or buy proper kit and do a basic setup. It's far from rocket science. If you want a magic button which makes everything work, hire a guy and don't be skimpy.

i do want hrd coded. my gripe is i need to muck with configuring a pc in a non standard way to get into the config page.
and if i power up three of these things at the same time i have network conflicts.

i cant even remember how to configure a pc with a hard network address..

[free_electron]

Do I need to point out the security implications of changing system configuration via a button?

only at powerup.

If you can press the button you can power cycle.

yes , exactly , but only if you power cycle when holding the button does configuration kick in.
this requires you to be in my house , next to the switch to be able to muck with it.
if you are at my front door there is nothing you can do to hack my network.
you can powercycle my house but since you are not holding the button nothing happens.

same reason i don't allow router config from the wan side.

if you are in my house it is too late anyway.

setting changes require physical presence. they can not be done remotely (unless someone physically presses a button to allow changes. once changes are committed they are locked until next power+button press)
but then , that would be my preference.

after further reading it looks like the new os version does look for dhcp. if it finds one it grabs an address from there , if not it defaults to 192.168.88.1
so i hope i will get a machine with latest version. if not i'll have to jump through hoops.

[Monkeh]

Do I need to point out the security implications of changing system configuration via a button?

only at powerup.

If you can press the button you can power cycle.

yes , exactly , but only if you power cycle when holding the button does configuration kick in.
this requires you to be in my house , next to the switch to be able to muck with it.
if you are at my front door there is nothing you can do to hack my network.
you can powercycle my house but since you are not holding the button nothing happens.

same reason i don't allow router config from the wan side.

if you are in my house it is too late anyway.

Your limited concerns are not their only concerns.

after further reading it looks like the new os version does look for dhcp. if it finds one it grabs an address from there , if not it defaults to 192.168.88.1
so i hope i will get a machine with latest version. if not i'll have to jump through hoops.

And hopefully it can be configured away from using a static IP if DHCP fails..

The hoops are huge, touch the ground, and are large enough to walk through upright.

[Mr. Scram]

i do want hrd coded. my gripe is i need to muck with configuring a pc in a non standard way to get into the config page.
and if i power up three of these things at the same time i have network conflicts.

i cant even remember how to configure a pc with a hard network address..

Use Google. I seem to remember you're a clever guy and it's not rocket science. That button you're asking for is essentially what WPS does and that's a total security train wreck. You don't want to go anywhere near that.

[free_electron]

hehe.

first of all : let me apalogize if i come over as grumpy. don't take any of it personal.

In the 80's and 90's i did all of that stuff standing on one leg , one hand behind my back , other hand with a finger in my ear and using a pencil and my mouth typing in config files. and i loved it. all of it. All the technical hoops. And we didn't know any better because there wasn't anything else or better.
Then time passes and interests shift and you don't do that stuff for a while for a while and you grow accustomed to other things.

Alas, as i am growing older and time moves on i find myself more and more grumpy and short-fused.
My knee jerk reaction is : are we still dicking around with this 20 years on ? I'll look for something that doesn't need any of this. i am too old for this. i can't remember half of it. do i really need to go and look that stuff up ? again ... ?

-rant-
That's the reason i refuse to install windows 10. I can't find anything in that junk. If i wanted a command line to type in the name of the program to start i would go back to dos. And anything else you try to do is like going on a gopher hunt. It's all different from where it used to be under win 2k/xp/7. The stuff i grew up on.
It was already difficult enough adapting from win3 3.1 95 98 98se to the xp world. They changed the ui and control panels so drastically you had to learn a bunch of new stuff.
Isa cards were easy. Set jumpers for irq and base address and off you go. Then come these  newfangled plug and play isa boards can't even be configured if two are initially on same base address. What drunken swiss gyneacologist came up with that ?Why don't they have a 'slot' address so that shit can't happen ? ( solved in pci and pci express as the machine knows what lane you are in)

And now we have to do it all over again with win 10. they got us used to a start menu for 15 years , and then , out of the blue : you can't have that anymore. type it in. - mnjaaargh.... there goes my bloodpressure
And the endless update cycles and other crap you can't turn off. it is 2019 and they still cannot detect when you are working with the machine and postpone updates until when the machine is truly idle ( how hard is it to do environmental monitoring . it's 2 am , there has not been any movement or sound for the past 2 hours ( apart from snoring ) , no mouse or keyboard activity for 2 hours. virtually no net traffic... maybe now is a good time. oh and it falls in the middle of the allowed time period for updates. in fact it is three hours away from the given end time, so i should try now. let me pop up a notification that says i will do updates if i don't see a mouse or keyboard stroke in the next 15 minutes. if the system sees it is now only 20 minutes before end of given timeslot and it know the update will take 40 minutes : don't even start or suggest starting.

-endrant-

it is 2019 and i still have to muck with shit like we had to do in 1989. That's 30 years ! What have they done in those 30 years ? Made stuff more complicated !
We're going backwards. 2000 gates and 50k of code landed man on the moon.
5 billion gates and 2 gig of code to turn on a lightbulb today. lightbulbs with a quadcore cpu running linux. -urgh- 

And then, when you want to change a setting : go find your old serial port cable and dos pc and type in stuff  SERIOUSLY ?
Oh and if you are not careful someone will hack your lightbulb to use it as a bitcoin miner and use it as a gateway for the TOR network. While installing keyloggers to break into your bank account, while trying to flog you pills. Come on grampa take the blue pillz .. make grandma happy one more time. We'll be cleaning out the bank accounts.

and people ask me why i am grumpy ...

So , when i read that story about the guy having to find out how to flash the new version , using inexisting serial ports , reconfiguring the network on his pc , having to download files and a special program first , flashing it , then undoing all the networking stuff , getting it back where it needs to be. for a dumb thing like a switch ? that pretends to be carrier grade ? i can only say one thing : WTF?
No wonder so many people claim to get bad service from their carrier. The poor people in tech support are also screaming their head off. at their hardware providers ...

read it and weep :
https://forum.mikrotik.com/viewtopic.php?f=17&t=143728

[ogden]

and people ask me why i am grumpy ...

Because they do not see the obvious - that you are in fact old Back in the days I was configuring hardware out of my mind, now I am looking for plug & play solutions that just work out of the box - because of different perspective. Now I don't give a **k that SSID of my WiFi is "linksys" (kidding).

[Mr. Scram]

Time to get over it and get with the program, or get taken advantage of because you didn't firewall your lightbulb. It's going to happen sooner or later. Maybe it's best to give in and give up. I hear banks have pretty good restitution policies. Why bother with those pesky passwords at all!

[free_electron]

and people ask me why i am grumpy ...

Because they do not see the obvious - that you are in fact old Back in the days I was configuring hardware out of my mind, now I am looking for plug & play solutions that just work out of the box - because of different perspective. Now I don't give a **k that SSID of my WiFi is "linksys" (kidding).

i am. realistically speaking more than half of my lifespan is gone. ( i'm turning 49 this year ). time is precious. having to spend part of what remains finding a serial port cable for a port that doesn't exist is very off-putting. And the associated bloodpressure spike will move the needle even faster.

seriously i don't want to deal with stuff like that anymore. nobody should. it is ridiculous. in 30 years nobody came up with a better solution ? they should all be fired !

[tautech]

seriously i don't want to deal with stuff like that anymore. nobody should. it is ridiculous. in 30 years nobody came up with a better solution ? they should all be fired !

New career opportunity ! 

Oh no don't, not until after I get a Tesla !

[Monkeh]

seriously i don't want to deal with stuff like that anymore. nobody should. it is ridiculous. in 30 years nobody came up with a better solution ? they should all be fired !

It's the backup solution. And some use USB instead, but there's all sorts of driver related backlash, and Windows being truly hilariously bad at handling lots of serial ports (oh yes, this switch was COM26, that one in the other rack is COM72, and the one in the other site is COM12 - seriously, what the shit?) does not help. If you can't use the ethernet interface (and no fancy fallback methods are wise here because the network may or may not be trusted), you need another channel. Serial works.

[free_electron]

seriously i don't want to deal with stuff like that anymore. nobody should. it is ridiculous. in 30 years nobody came up with a better solution ? they should all be fired !

It's the backup solution. And some use USB instead, but there's all sorts of driver related backlash, and Windows being truly hilariously bad at handling lots of serial ports (oh yes, this switch was COM26, that one in the other rack is COM72, and the one in the other site is COM12 - seriously, what the shit?) does not help. If you can't use the ethernet interface (and no fancy fallback methods are wise here because the network may or may not be trusted), you need another channel. Serial works.

yes, serial works. except this model doesn't have a serial port ! a little oversight on their tech supports part too.... that's what irks me. the shoddy support from all these companies.
go read the topic .. it's so funny i could cry . go read the topic ..
try this, try that. no don't do that it won't work ( turns out that it is exactly what was said wouldn't work , did work... )

https://forum.mikrotik.com/viewtopic.php?f=17&t=143728

[free_electron]

NEW NETWORK LAYOUT

Thanks to all for the suggestions. I think i will take the risk using mikrotik machines. i will get them from amazon and if they don't behave properly i will kick them back.
any other advice ?

[Black Phoenix]

Looks solid to me, I hope that we see a Build Topic with all the interconnects and configs that you gonna do. 

[Monkeh]

seriously i don't want to deal with stuff like that anymore. nobody should. it is ridiculous. in 30 years nobody came up with a better solution ? they should all be fired !

It's the backup solution. And some use USB instead, but there's all sorts of driver related backlash, and Windows being truly hilariously bad at handling lots of serial ports (oh yes, this switch was COM26, that one in the other rack is COM72, and the one in the other site is COM12 - seriously, what the shit?) does not help. If you can't use the ethernet interface (and no fancy fallback methods are wise here because the network may or may not be trusted), you need another channel. Serial works.

yes, serial works. except this model doesn't have a serial port ! a little oversight on their tech supports part too.... that's what irks me. the shoddy support from all these companies.
go read the topic .. it's so funny i could cry . go read the topic ..
try this, try that. no don't do that it won't work ( turns out that it is exactly what was said wouldn't work , did work... )

https://forum.mikrotik.com/viewtopic.php?f=17&t=143728

Okay, that one's an oddity - also it says 'cloud' so it's expected to be crap. Don't buy those.

NEW NETWORK LAYOUT

Thanks to all for the suggestions. I think i will take the risk using mikrotik machines. i will get them from amazon and if they don't behave properly i will kick them back.
any other advice ?

Don't buy the 'cloud' switches - get the normal CRS variant. Personally, forget about the Amplifi router and use a few normal UAPs and an Edgerouter (or something from Mikrotik).

[free_electron]

Okay, that one's an oddity - also it says 'cloud' so it's expected to be crap. Don't buy those.
Don't buy the 'cloud' switches - get the normal CRS variant. Personally, forget about the Amplifi router and use a few normal UAPs and an Edgerouter (or something from Mikrotik).

now he tells me ....

The CSS is same hardware as CRS. In the CRS you pay extra for the RouterOs license. the Css only has SWoS.

I went with the amplifi router because there is a couple of other things from ubiquity i want to get and they all play nice together.  I especially like the Teleport. take it with you plug in and you are on your own home network. I have family on the other side of the world (both other sides : Belgium and india). i can just leave one there and connect to my stuff just like i was home.

[Mr. Scram]

now he tells me ....

The CSS is same hardware as CRS. In the CRS you pay extra for the RouterOs license. the Css only has SWoS.

I went with the amplifi router because there is a couple of other things from ubiquity i want to get and they all play nice together.  I especially like the Teleport. take it with you plug in and you are on your own home network. I have family on the other side of the world (both other sides : Belgium and india). i can just leave one there and connect to my stuff just like i was home.

That sounds like a basic VPN to be honest.

[Monkeh]

Okay, that one's an oddity - also it says 'cloud' so it's expected to be crap. Don't buy those.
Don't buy the 'cloud' switches - get the normal CRS variant. Personally, forget about the Amplifi router and use a few normal UAPs and an Edgerouter (or something from Mikrotik).

now he tells me ....

The CSS is same hardware as CRS. In the CRS you pay extra for the RouterOs license. the Css only has SWoS.

And you get a console port. Anything 'cloud' is liable to be a pain.

I went with the amplifi router because there is a couple of other things from ubiquity i want to get and they all play nice together.

Yes, but you can do much better with a dedicated router and APs located suitably.

I especially like the Teleport. take it with you plug in and you are on your own home network. I have family on the other side of the world (both other sides : Belgium and india). i can just leave one there and connect to my stuff just like i was home.

VPN in a box. Nifty. They're playing segmentation games so it only works with the bloody Amplifi.

You can just use a VPN as normal..

[free_electron]

VPN in a box. Nifty. They're playing segmentation games so it only works with the bloody Amplifi.

You can just use a VPN as normal..

exactly.
i really can't be bothered
- trying to learn how to set up a vpn,
- finding the right hardware to take with me
- installing vpn software on my computer
- trying to connect to my home ( i do not have a static ip )
- or having to pay a monthly subscription fee.

this thing you apparently plug into an existing ethernet port and it opens a wifi channel that is becomes an extention of your home network. nothing needed. perfect !
Most likely it is a small linux box that pings a machine at ubiquity that acts as a ddns lookup to find ones router and then sets up a vpn. but i'm ok with that. as long as it works and i don't have to mess with it.

i'll only get grumpy and i already had my dosage of grumpy today ....

My mom is in the hospital in Belgium for knee surgery. She has an iphone with dataplan so she can run facetime with me.
I tried contacting her. No avail.

Turns out there is no cellphone reception in the hospital , you have to stand outside...
The hospital does not have wifi for patients available. They are afraid of hackers.

so i had to buy an international calling card , pay 10 cents a minute + 40 cents connection fee to call the hospital dispatch who then connects me to the room... and then we can talk on a noisy creaky old rotary phone.

It took the better part of half an hour to jump through hoops. What good is all this modern technology if none of it works when you need it ?
I can call backland india using dial91 for 1 cent per minute and enjoy uninterrupted facetime / whatsapp or other video calling.
A big hospital in 'the capital of europe' ? Sorry, that does not work. -urgh-

[Bassman59]

hehe.

first of all : let me apalogize if i come over as grumpy. don't take any of it personal.

In the 80's and 90's i did all of that stuff standing on one leg , one hand behind my back , other hand with a finger in my ear and using a pencil and my mouth typing in config files. and i loved it. all of it. All the technical hoops. And we didn't know any better because there wasn't anything else or better.
Then time passes and interests shift and you don't do that stuff for a while for a while and you grow accustomed to other things.

Alas, as i am growing older and time moves on i find myself more and more grumpy and short-fused.
My knee jerk reaction is : are we still dicking around with this 20 years on ? I'll look for something that doesn't need any of this. i am too old for this. i can't remember half of it. do i really need to go and look that stuff up ? again ... ?

Gotta agree with all of this here. I have things to do, I don't need to spend time dicking around with networking issues.

[Mr. Scram]

exactly.
i really can't be bothered
- trying to learn how to set up a vpn,
- finding the right hardware to take with me
- installing vpn software on my computer
- trying to connect to my home ( i do not have a static ip )
- or having to pay a monthly subscription fee.

this thing you apparently plug into an existing ethernet port and it opens a wifi channel that is becomes an extention of your home network. nothing needed. perfect !
Most likely it is a small linux box that pings a machine at ubiquity that acts as a ddns lookup to find ones router and then sets up a vpn. but i'm ok with that. as long as it works and i don't have to mess with it.

i'll only get grumpy and i already had my dosage of grumpy today ....

My mom is in the hospital in Belgium for knee surgery. She has an iphone with dataplan so she can run facetime with me.
I tried contacting her. No avail.

Turns out there is no cellphone reception in the hospital , you have to stand outside...
The hospital does not have wifi for patients available. They are afraid of hackers.

so i had to buy an international calling card , pay 10 cents a minute + 40 cents connection fee to call the hospital dispatch who then connects me to the room... and then we can talk on a noisy creaky old rotary phone.

It took the better part of half an hour to jump through hoops. What good is all this modern technology if none of it works when you need it ?
I can call backland india using dial91 for 1 cent per minute and enjoy uninterrupted facetime / whatsapp or other video calling.
A big hospital in 'the capital of europe' ? Sorry, that does not work. -urgh-

International calling card? What year is this? Why don't you use pigeons instead? Much more modern.

[Mr. Scram]

Gotta agree with all of this here. I have things to do, I don't need to spend time dicking around with networking issues.

Again, what people overlook is that you replace "dicking around" with a black box which simply obscures the inevitable dicking around required. You're bound to suffer bad performance if you gamble on a magic one button fixes all solution. There's no magic fix and complaining about that won't change a thing. Either deal with the issues at hand or suffer in a hell of your own making.

[Berni]

Sometimes buying a ready to go solution is the way to go when you don't want to muck around with it and its good enough in the end.

That's most of the reason why my NAS server is ruining UnRaid. Its not free, i had to buy a license to use it. Its just linux with a bunch of fancy software on top, so i could have thrown together something really similar myself after a lot of work, but still set up everything trough a linux terminal instead of a convenient web UI. Its a slow solution when it comes to RAID as there is no speed gain from having a larger number of drives, but my LAN is only gigabit so that's the bottleneck anyway. I could have used FreeNAS but didn't want to deal with its proper raid stuff, here i can just throw more drives at it anytime and the array grows.

I know UnRaid is an expensive solution that performs slower than some of the alternatives. But i just threw it on, clicked a few buttons in a web UI and it worked straight away. Time is worth something too.

These Ubiquity wifi solutions are a similar sort of thing. Yes you are kinda locked into there ecosystem, but if you buy into it then stuff just auto-magicaly works, and works perfectly well enough.

[sokoloff]

Gotta agree with all of this here. I have things to do, I don't need to spend time dicking around with networking issues.

Again, what people overlook is that you replace "dicking around" with a black box which simply obscures the inevitable dicking around required. You're bound to suffer bad performance if you gamble on a magic one button fixes all solution. There's no magic fix and complaining about that won't change a thing. Either deal with the issues at hand or suffer in a hell of your own making.

There's a school of thought (that is mostly correct) that says the biggest leap in performance occurs at the moment a system goes from "not working at all" to "limping along". I get that.

What terrifies me is the thought of a non-updated box that obscures the VPN details and "just works". It's ultra convenient, which is why it sells. In any system that trades security against convenience, convenience wins every single time. If that box is capable of tunneling into my home network, what else is also capable of tunneling into my home network? Vendors do not have the strongest track record of maintaining security of internet devices.

I think the choice to pay for UnRAID is significantly different. It's more along the lines of choosing to pay Buffalo or Synology for their boxes instead of using the free software upon which they are based directly. Convenience within a framework of security being provided by the NAT isolation is one thing. Convenience in the form of "this things works its magic from anywhere in the world" scares the daylights out of me.

[free_electron]

exactly.
i really can't be bothered
- trying to learn how to set up a vpn,
- finding the right hardware to take with me
- installing vpn software on my computer
- trying to connect to my home ( i do not have a static ip )
- or having to pay a monthly subscription fee.

this thing you apparently plug into an existing ethernet port and it opens a wifi channel that is becomes an extention of your home network. nothing needed. perfect !
Most likely it is a small linux box that pings a machine at ubiquity that acts as a ddns lookup to find ones router and then sets up a vpn. but i'm ok with that. as long as it works and i don't have to mess with it.

i'll only get grumpy and i already had my dosage of grumpy today ....

My mom is in the hospital in Belgium for knee surgery. She has an iphone with dataplan so she can run facetime with me.
I tried contacting her. No avail.

Turns out there is no cellphone reception in the hospital , you have to stand outside...
The hospital does not have wifi for patients available. They are afraid of hackers.

so i had to buy an international calling card , pay 10 cents a minute + 40 cents connection fee to call the hospital dispatch who then connects me to the room... and then we can talk on a noisy creaky old rotary phone.

It took the better part of half an hour to jump through hoops. What good is all this modern technology if none of it works when you need it ?
I can call backland india using dial91 for 1 cent per minute and enjoy uninterrupted facetime / whatsapp or other video calling.
A big hospital in 'the capital of europe' ? Sorry, that does not work. -urgh-

International calling card? What year is this? Why don't you use pigeons instead? Much more modern.

Exactly ! Do you have any idea what is the cost of a direct phone call from the US to Europe ? It's frightening ! Especially from Cell to Cell . That's why you need a calling card.
Everybody is after our money.

[free_electron]

Gotta agree with all of this here. I have things to do, I don't need to spend time dicking around with networking issues.

Again, what people overlook is that you replace "dicking around" with a black box which simply obscures the inevitable dicking around required. You're bound to suffer bad performance if you gamble on a magic one button fixes all solution. There's no magic fix and complaining about that won't change a thing. Either deal with the issues at hand or suffer in a hell of your own making.

There's a school of thought (that is mostly correct) that says the biggest leap in performance occurs at the moment a system goes from "not working at all" to "limping along". I get that.

What terrifies me is the thought of a non-updated box that obscures the VPN details and "just works". It's ultra convenient, which is why it sells. In any system that trades security against convenience, convenience wins every single time. If that box is capable of tunneling into my home network, what else is also capable of tunneling into my home network? Vendors do not have the strongest track record of maintaining security of internet devices.

I think the choice to pay for UnRAID is significantly different. It's more along the lines of choosing to pay Buffalo or Synology for their boxes instead of using the free software upon which they are based directly. Convenience within a framework of security being provided by the NAT isolation is one thing. Convenience in the form of "this things works its magic from anywhere in the world" scares the daylights out of me.

You set up the router to only connect that tunnel to one of the vlans. And you expose only what you want. Ubiquity keeps their stuff up to date.

In order to have true security you would have to inspect all the source code of everything carrying your datastream. Onsite and offsite. every single bit of code , including the bootloaders and even the hidden microware in the processors themselves. Look at the trouble intel got into with the security holes in their management processors code. Are you really sure that none of the chips , somewhere in a closet are not 'leaking' or 'altering' your data ? And whereall does your data travel ? Some rogue state may be snorting all it can. The only safe way is to disconnect your computer from the network , glue all its communication ports shut , power it off and remove its batteries. There are toolchains that can sniff data by listening to the rf spectrum being emitted by a machine. there are viruses that transmit data using imperceivable clicks of the speaker , or by performing data seeks on harddisks. ( you can pick up the energy from the voice coil. they are basically transmitting morse code using disk seek operations.) . Rowhammer and other mechanisms can be exploited to sniff ram. And someone figured out that dram retains enough charge after a few seconds to be recoverable... powerdip the machine and take over the processor using a piece of firmware installed in the bios and you can dump all ram content. Few weeks ago they found a security hole in Infineon Trusted platform chipsets. Anything made in the last 8 years can be bypassed... oopsie.

so where do you draw the line ?

What are they going to steal off my nas ? family pictures and movies , a few text documents and a bunch of altium files containing my hobby projects. Nothing important. There's nothing useful or valuable. Does't mean i don't want to protect it. but my protection stops at someone else trying to delete or alter it. I don;t care if they can find out that my thermostat is set to 24 degrees or i am playing lady gaga on the radio in the kitchen. as long as they can't alter the setting or change the music to back street boys : i'm fine.

All i want is to be able to get to my files so i can show grandma -in-law some pictures or work a bit on one of my things when not home.
I don't want to become a network expert, vpn guru or drag along a home-brew contraption that weights 3 kg's to do all that stuff. Little box, size of a power adapter. works. kept up to data by its manufacturer. manufacturer with good reputation. i'm happy. Other people insist on having a totally open source hardware laptop with the source to all software and firmware . That is their right. I am ok buying a ready made machine. ( Have you seen LG's new laptop. That thing is fenomenally light and powerful, even has 4k display ). I trust that HP has done all they can to make it secure. If it were a Sony ... they have effed up in the past with drm to the point i don't trust them. Not after blu-ray (That format needs to die ! other story...)

I agree, If this was a business : different scenario.

Anyway. this thread started all because i simply wanted to upgrade my network to have higher bandwidth ( on my lan, the wan is a different thing ) and have more wifi coverage ( as in area , not in speed. i have dead zones ).
Security wise i am good (i think) . The reason for choosing ubiquity is they have a mesh system. so does google but those guys already have too many fingers everywhere. i don't want their routers ... and the others are 'too young' for my feeling. Ubiquity has been doing this much longer than anyone else. ( apart from real networks with mulitple access points like cisco et al, but that is not for home use. Too complicated to set up).

It's a balance. effort, convenience,price, security. i try to keep it reasonable. It's already cost me 800$ for the new hardware (two routers , three switches, some cables , two sfp modules ( yikes those are pricey !)... that's enough.
then again , it is the first time in roughly 10 years i upgrade my network. so i got all the life out of it that i could.

[Berni]

Yeah i think security should be far enough that automated attacks or random script kiddies can't get in.

If you get an experienced hacker targeting you specifically then good luck keeping him out. With enough determination they will find some point of entry and eventually get trough the network. Unless you have made some bad enemies in the wrong places these are the sort of attacks that a typical user should not be worried about.

The fact that you can get in from anywhere in the world is the point of a VPN. There is nothing truly secure anyway. If nothing else the US government is spying on all the traffic going out of that cable modem.

[Nominal Animal]

TL;DR: Split your needs into separate devices, and look for devices with OpenWRT support (here, under Special user views, Ideal for OpenWRT).


I've had a somewhat similar situation on my hands for over a year now, and I've been looking at the alternatives.  I'd prefer affordable off-the-shelf devices running some derivative of Linux, but all the existing options are either expensive (> 250€) or require too many compromises, so I've resigned to build my own. In my case:

• Most of the time, I am physically over 1000 km away from the installation
• Internet connection is through a 4G/LTE modem, and I want a good firewall with a fail2ban or ban-if-trying-certain-ports rules
• A couple of devices streaming TV off internet directly
• A few CCTV cameras
• A couple of local devices with access to CCTV cameras and the internet
• A local server for intrafamily document sharing
• Guest devices with internet access

Because of 1, I do need remote access myself.  Using a fixed IP address increases the monthly cost quite a bit, and I'd rather avoid that; instead, I want to use an actual modem.  USB dongles like ZTE823 (that I now use) are typically not bridging, but have a small Linux installation, and a NAT.  Some routers, like Asus RT-AC51U, do support publishing the router IP address to dyndns-like services, but that won't work with non-bridging dongles.

Because of 2 (and partially 1), I want the router with the firewall to have enough memory and CPU oomph to run my own rules, and allow me to connect to it and the network remotely.  (Specifically, I haven't seen any router, even OpenWRT, have a good banning module, so I'm resigned to do my own.  I run fail2ban on this particular machine, and it keeps a lot of the attacks at bay; I'd love to have it on a router.)  If it has half a gigabyte of RAM, I can run vanilla fail2ban with custom port knock banning rules.

Because of 3, 4, 5, I'd also like to subdivide the local wired networks into three subsets, but this is semi-optional.

Because of 6, I'd like to have a small Linux SMB with a couple of hundred gigabytes of storage, for exchanging family stuff that people are not willing to send over email; my family members aren't savvy enough to be trusted to use encryption.  (If they were, this would not be an issue at all.)  Again, this is optional, but from the start I've known this would be completely up to me to set up and maintain.  I only included it in this list to point out how complicated this setup has already evolved into.

To solve this, I've decided to split the router into two.

First router is an Odroid HC1 or La Frite SBC, with an USB WWAN/miniPCIe adaptor and a Huawei ME909s-120 4G/LTE modem appropriate for my region.  I like the HC1 hardware more (octacore big.little architecture, Samsung Exynos 5422), but have a La Frite (Amlogic AML-S508X) as a backup if that falls through. I intend to run straight vanilla upstream kernels, not vendor kernels.  I would have used OpenWRT, if I'd found suitable hardware within my tiny budget.

Second router handles the wireless connections, and is directly connected to the first router, and the local wired subnets.  This is much simpler device.  For now, I'm using an Asus RT-AC51U running OpenWRT, although it has only 100Mbit/s Ethernet, and it might lack 5 GHz support (I haven't checked 18.06.4, if it includes the MT7610EN support yet).  Another option is Mikrotik hAP ac running OpenWRT, which has triple-chain dual-band WiFi and five GbE ports.

The idea is that the second router manages the local wireless network, and the weak firewall/routing between the local wired network and wireless network (networks, I want both 5 GHz and 2.4 GHz, because reasons).  The firewall here is just to stop accidents, really.

The first router is the lynchpin.  I've mentioned here I have worked on a carrier board for a Teensy 3.2 to be connected to the HC1 (via 1.8V UART), to hold a small display and a few buttons, for non-technical users to see whether the network is okay or not.  Plus voltage and power measuring and shutdown control, as mains voltage losses and hickups are not rare there, and I don't want to spring for an UPS.  I already have a WD Green 240G SSD for the HC1, and I think I'll just setup Apache or Nginx on it to provide my minimal local server needs too.  I'm waiting for my 2.8" IPS display and gesture sensors for arrive, before I commit to the "final" version of the carrier board.  (I'm working on a variant of the Samsung serial driver that allows multiplexing the serial terminal with application data (essentially exposing two or more serial device nodes for the one hardware port, with kernel separating and escaping the data streams properly to keep them separate), so that I can use the display for a simple boot terminal if I want, or connect the Teensy via the USB connector to another computer for full serial terminal access, but I'll have to see if I have the mental werewithal to finish that and try and push that upstream.)

Splitting the functionality into separate parts meant I don't need to look at >$250 USD hardware, and can upgrade parts piecewise.  If something breaks, partial operation can easily be restored.  Right now, that network uses ZTE MF832 and Asus RT-AC51U, which works, but isn't that secure, and lacks the features I want -- but it is usable.

[Monkeh]

TL;DR: Split your needs into separate devices, and look for devices with OpenWRT support (here, under Special user views, Ideal for OpenWRT).

As much as I am a fan of, and some-time developer for, OpenWRT, it is not the tool free_electron is looking for.

[Nominal Animal]

As much as I am a fan of, and some-time developer for, OpenWRT, it is not the tool free_electron is looking for.

You're right -- it is definitely exactly the opposite: the kind of do-it-yourself stuff free_electron (and others) would like to avoid.

However, I have not found a single vendor I could trust to provide non-crap router firmware.  So, having hardware that has OpenWRT support means that if the vendor drops the support to the floor, you can fall back to using OpenWRT on it, instead of turning it into an expensive paperweight. Of those, the Linksys EA8300 looks particularly interesting, albeit outside my personal budget.  If you're dead set on not doing it yourself -- that is, if you'd rather drop some requirements than do it yourself --, then that is not useful either.

My point was more that I think it unlikely that off-the-shelf stuff will fulfill the needs.  It did not for me, and I've been looking for over a year.  If you can split the required functionality, then it becomes somewhat easier.  In my case, I can run the RT-AC51U on stock firmware (if I skip the LAN stuff), and just have that oddball firewall 4G/LTE custom router handle my other needs.

[NiHaoMike]

DD-WRT is an alternative for "daily drivers" as its name suggests, even though nowadays OpenWRT is just as usable.

Something I really like about OpenWRT and DD-WRT is that they expose pretty much all the wireless configuration details the hardware supports, allowing for fine tuning. For example, pretty much all of my 2.4GHz Wifi devices support 802.11n, so I set up 2 of my 3 2.4GHz APs to n only/"greenfield" mode. The third one I put on mixed g/n mode just in case I want to connect an 802.11g device. (I intentionally left out 802.11b since that's ancient and I'm not aware of one that would be compatible with WPA2 anyways.)

[free_electron]

Monkeh is right.

i simply do not want to deal with homebrew anymore. i have no interest in it. There is too much to learn , too many decisions to find hardware and endless tinkering. Not my field of interest.
I use screwdrivers, i don't make them. i go to the store and find a good quality reasonably priced screwdriver. i use that screwdriver to get my work , in my field of interest done.

Of course, if you want to make screwdrivers : be my guest. I'm not stopping you.

anyway, stuff arrives today. report will follow.

[Mr. Scram]

\
There's a school of thought (that is mostly correct) that says the biggest leap in performance occurs at the moment a system goes from "not working at all" to "limping along". I get that.

What terrifies me is the thought of a non-updated box that obscures the VPN details and "just works". It's ultra convenient, which is why it sells. In any system that trades security against convenience, convenience wins every single time. If that box is capable of tunneling into my home network, what else is also capable of tunneling into my home network? Vendors do not have the strongest track record of maintaining security of internet devices.

I think the choice to pay for UnRAID is significantly different. It's more along the lines of choosing to pay Buffalo or Synology for their boxes instead of using the free software upon which they are based directly. Convenience within a framework of security being provided by the NAT isolation is one thing. Convenience in the form of "this things works its magic from anywhere in the world" scares the daylights out of me.

The point is that magic one button solutions don't exist. Everyone promises these, but sooner or later the magic in the black box breaks and you need to correct it but this time with one hand tied behind your back. I don't know how many times people said they want things to "just work". If any company was able to make things that "just work" others wouldn't exist. Yet they do. There's a lesson in there.

[NiHaoMike]

The point is that magic one button solutions don't exist. Everyone promises these, but sooner or later the magic in the black box breaks and you need to correct it but this time with one hand tied behind your back. I don't know how many times people said they want things to "just work". If any company was able to make things that "just work" others wouldn't exist. Yet they do. There's a lesson in there.

In particular, NAS appliances that do not use a standardized RAID filesystem effectively have a form of ransomware built in. Just ask Micah Elizabeth Scott about the experience she had repairing a Drobo to get the data off the disks. Worse than that, she uncovered several checks that crash the unit if they fail, when they could have just defaulted into a read only limp mode in order to allow recovery of important data.

[madires]

i simply do not want to deal with homebrew anymore. i have no interest in it. There is too much to learn , too many decisions to find hardware and endless tinkering. Not my field of interest.
I use screwdrivers, i don't make them. i go to the store and find a good quality reasonably priced screwdriver. i use that screwdriver to get my work , in my field of interest done.

Sorry, but network elements can be quite complex with all the features they support. You get plug'n'play only with dumb unmanaged switches or old school hubs. And even those allow you to screw up your network.

[Berni]

In particular, NAS appliances that do not use a standardized RAID filesystem effectively have a form of ransomware built in. Just ask Micah Elizabeth Scott about the experience she had repairing a Drobo to get the data off the disks. Worse than that, she uncovered several checks that crash the unit if they fail, when they could have just defaulted into a read only limp mode in order to allow recovery of important data.

Just your usual hardware RAID controller cards can do that.

For simple mirroring of drives no problem, but when it comes to more fancy raid setups there is no standardization between vendors. So quite often if your raid controller card dies you better have a spare identical or very similar one on hand to replace it with in order to get your raid array running again so that you can pull data from it. Even just inserting the same card and configuring it incorrectly could cause it to start falsely parity syncing and trampling over the precious data. But these hardware raid controller cards are the fastest spinning rust setup out there.

This is also the reason why i like UnRaid. Each drive in the array has its own linux filesystem on it and raid is only used to provide parity drives for redundancy. So you do still need a working instance of UnRaid in the correct configuration to recover a dead drives contents from parity data (and xfs filesystem checksums help in reconstruction), but if the raid array is healthy and the machine running UnRaid blows up then drives can be taken out, plugged one by one into any modern Linux machine and files copied off it like any other drive. So hopefully that keeps me from irrecoverably crashing my raid array due to my lacking IT skills.

[free_electron]

Each drive in the array has its own linux filesystem on it

-evils advocate-. that is also lock-in. i can't read those from a windows machine.

As for for managed switches : why is there no standard protocol inside the network that allows you to configure ports ? that would be vendor agnostic and could be driven from a central controller.
A switch would have a control channel on a specific ip range. When adding a switch to the network that ip is assigned automatically to a conmmand and control vlan on the upstream port only, that is under control of the admins and invisible to other ports.
When a switch sees such a channel come in from a lower port it switches it only up to the upstream port and other ports do not get to see the control stream.
Switches are designed so they can not originate commands. Switches will only listen to packets coming from upstream. they flow from the controller downward only. so no malicous switch could be plugged in to send commands on that channel as you can't send upstream, only receive or reply. only the controller would need guarding from being taken over. But it's easier to defend 1 element than hundreds.

There's already so many IP protocols. time for a command and control one ?

[Monkeh]

Each drive in the array has its own linux filesystem on it

-evils advocate-. that is also lock-in. i can't read those from a windows machine.

Sure you can. There's drivers available with some looking. But see, you don't have to pay for a license to use the proper software..

As for for managed switches : why is there no standard protocol inside the network that allows you to configure ports ? that would be vendor agnostic and could be driven from a central controller.
A switch would have a control channel on a specific ip. When adding a switch to the network that ip is assigned automatically to a conmmand and control vpn on the upstream port only, that is under control of the admins only and invisible to other ports.
When a switch sees such a channel come in from a lower port it switches it only up to the upstream port and other ports do not get to see the control stream.

There's already so many IP protocols. time for a command and control one ?

Openflow and OF-Config, OVSDB, etc..

[free_electron]

Mikrotiks arrived.

Marvell based chipset. 3 Switch/phy's each handling 8 ports linked to an upstream device handling the 10two 10GB ports and the three 8 port devices. looks like there are tx and two rx diff pair per 8 channel device running to the 10g device.

- Master clock is distributed using a diff pair clocking all devices driven from a TI cdcm61001
- There is room for a BGA SDRAM chip next to the big chip , which is not installed.
- some snot like 74595 and 74164 shift registers. for led's and status
- TI 54719 switchers for various rails . three times
- 25q19 flash for firmware
- a pair of AP3R60 mosfets combined with a switch controller. unknown. AO 5J H2K marking. which leads me to believ it is an alpha-omega part.. this one makes the 5 volt from the power supply / poe port to feed the TI switchers.
- footprint for console port.
- footprint for 28 pin rs232 converter chip in ssop narrow body
- and the usual grunt like the ethernet transformers , led's decoupling cap.

interesting find : one electrolytic , hand solder using VERY STINKY FLUX that has not been cleaned up.

most likely the chipset is 98dx421 combined with three 88e1680 devices

[tautech]

Pics ?

[free_electron]

coming ...

[Berni]

-evils advocate-. that is also lock-in. i can't read those from a windows machine.

You can read it on a windows machine just fine if you install a little tool that reads those filesystems such as DiskInternals Linux reader (30MB freeware tool). Im a windows user myself as well and don't keep any real linux machines around apart from a raspberry pi.

My point is that because its just a normal Linux partition means its possible to easily read data from it from pretty much any machine that has a SATA port, no matter if its windows, linux or even osx. As opposed to if you use a server with a real hardware raid controller card, or one of the off the shelf black box NAS solutions like Sinology. In those cases its incredibly difficult to get a single byte of usable data from the drives once you pull them out of the original machine. The RAID structure has to be reverse engineered with special expensive data recovery software, all done manually with lots of expert knowledge and you need to have all of the arrays drives(excluding pairity) in working order to recover anything.

These XFS and BTRFS filesystems used here are designed by Silicon Graphics and Oracle for use in enterprise storage solutions, but support for them ended up in mainstream Linux. They are specifically designed to be reliable and resilient against failures or improper shutdowns, so that even if large areas of a storage medium are garbled the filesystem can still read the surviving files and heal itself on the fly from smaller errors. You wouldn't normally pull drives from a large RAID NAS array and try to read them outside, but i find it comforting its easily possible in my NAS in case something bad happens to it.

As for for managed switches : why is there no standard protocol inside the network that allows you to configure ports ? that would be vendor agnostic and could be driven from a central controller.
A switch would have a control channel on a specific ip range. When adding a switch to the network that ip is assigned automatically to a conmmand and control vlan on the upstream port only, that is under control of the admins and invisible to other ports.
When a switch sees such a channel come in from a lower port it switches it only up to the upstream port and other ports do not get to see the control stream.
Switches are designed so they can not originate commands. Switches will only listen to packets coming from upstream. they flow from the controller downward only. so no malicous switch could be plugged in to send commands on that channel as you can't send upstream, only receive or reply. only the controller would need guarding from being taken over. But it's easier to defend 1 element than hundreds.

There's already so many IP protocols. time for a command and control one ?

Yes they already make that kind of switch. Its called an L2 unmanaged switch and they are quite heavily used in large networks.

Plug it in and it works out of the box. They don't even have a configuration web UI or anything since there is no need to set up anything. It simply routes packets towards the correct MAC address and does not even care about what IPs since it ignores the whole IP protocol all together. If that's the kind of switch you want then you just have to buy one. But as a result these simple unmanaged switches also don't give you any of the fancy functionality that needs setting up such as VLANs, trunking etc... or even layer 3 functionality that's normally found in routers.

[Monkeh]

My point is that because its just a normal Linux partition means its possible to easily read data from it from pretty much any machine that has a SATA port, no matter if its windows, linux or even osx. As opposed to if you use a server with a real hardware raid controller card, or one of the off the shelf black box NAS solutions like Sinology.

Synology are hardly black box, they're actually not doing anything particularly unusual. No problem at all to recover.

These XFS and BTRFS filesystems used here are designed by Silicon Graphics and Oracle for use in enterprise storage solutions, but support for them ended up in mainstream Linux.

Err... btrfs was developed from the very beginning to be in Linux.

They are specifically designed to be reliable and resilient against failures or improper shutdowns

XFS at least has nothing you'd consider special in that regard since, oh, the early 2000s. It's actually one of the least robust options presently available..

Yes they already make that kind of switch. Its called an L2 unmanaged switch and they are quite heavily used in large networks.

Are we speaking the same language, here?

[madires]

There's already so many IP protocols. time for a command and control one ?

There are several solutions for managing network elements, e.g. NETCONF. But the software and the modeling might be a little bit too much for the typical user.

[bd139]

Ansible:

https://docs.ansible.com/ansible/latest/modules/routeros_command_module.html

[Berni]

Okay for Synology its not as bad since they do use linux stuff to do it, but still if you have any sort of raid configuration that's not mirroring, then its going to be fairly involved to get a single file off the pile of drives, some other raid capable NAS solutions are worse still.

And yes BTRFS was developed to be used with Linux, but its a more enterprise oriented filesystem rather than the bog standard EXT4 that most linux desktop machine are likely going to be using. While XFS might not the the most resilient in the world its still plenty tough. It has mechanisms for recovering from improper partial writes and i did manage to run over a XFS system due to a failing drive, but running the command line XFS utility restored it to fully working state with no data loss.

Anyway my point is that this sort of slowly performing separate filesystem raid setup is the easiest to pull data off by simply taking one drive out of the array and plugging it into a PC, no matter what OS its running.

[free_electron]

SFP module teardown.

Marvell 88x3310P phy
54519 switcher

aac95n two times  6 pin dfn. looks like ldo

one chip marked

3h838
0g190u

and another one marked

l013z
cm4vg
sg802

[Zucca]

Dependig where you place them, free_electron please make sure to protect all the cables from hungry north american rats.
Some bloody mickey mouse could take the SFP link down.

I hate them.

[free_electron]

i know all about rats and mice and squirrels. a couple of years ago a squirrel was nesting in my attic and ate the bloody powerlines ( who makes the sheething of powerlines from plant material ? ) causing a short circuit that blew the fuses and a roasted stinking squirrel.

Problem in the us is homes are made from wood and sheetrock and cables are just loose in walls and attics. They use that stupid romex cable. I had the electrician replace the damaged cables with metal clad.

When i will build a house all cabling will be metal clad or run in steel pipes.

That aside. The teardown of the existing rack is done. new power distribution is in. i found a spot for the new switch. Tonite i will make a shelf for the switch and complete the switchover to the mikrotik switches in the network cabinet and wall panel.

[rsjsouza]

When i will build a house all cabling will be metal clad or run in steel pipes.

This is my dream as well - using conduits for wiring is something that would have saved me tons of dollars in labour to rewire or replace things. That and the fact that Romex in my house is attached with metal staples (?!?) - yeah, they surely to a great tie, but what would it do to the insulation if rust takes over?

But to me the worst offence is the bare wire buried to carry the 24V power to the sprinkler heads. Obviously that any work on the yard can potentially destroy anything - which in fact happened and we had to spend yet another round of green bills to fix. 

(sorry to derail the thread. Carry on)

[free_electron]

Same here. romex stapled to the rafters and studs. unbelievable how that can be allowed.
In europe everything has to be in pipe ( plastic or metal. wire in metal has to be double coated. )

but then , pipe is hard to work with. making bends etc.
i like the spiral metal clad wire.
straight stretches can be run with pipe. the moment it becomes winky wonky : switch over to a stretch of that.

[Mr. Scram]

Metal isn't allowed any more for obvious reasons. New installations have to be plastic. Not an issue when it's all in the actual brick and mortar walls.

[Monkeh]

Metal isn't allowed any more for obvious reasons. New installations have to be plastic. Not an issue when it's all in the actual brick and mortar walls.

Which obvious reasons are those?

[free_electron]

first post over the 10Gb link !

[Monkeh]

first post over the 10Gb link !

Welcome to the future 2006!

[Mr. Scram]

Which obvious reasons are those?

It conducts.

[Monkeh]

Which obvious reasons are those?

It conducts.

That's... not a problem.. Conductive enclosures have been used for decades. Metal conduits of various types are very much allowed and common pretty much everywhere.

[Mr. Scram]

That's... not a problem.. Conductive enclosures have been used for decades. Metal conduits of various types are very much allowed and common pretty much everywhere.

Looking into this I readily admit there doesn't seem to be a ban on metal conduits. I think I may be misremembering information from an electrician. Regardless, having your conduits potentially conduct instead of your actual conductors seems to pose a distinct risk.

[Monkeh]

That's... not a problem.. Conductive enclosures have been used for decades. Metal conduits of various types are very much allowed and common pretty much everywhere.

Looking into this I readily admit there doesn't seem to be a ban on metal conduits. I think I may be misremembering information from an electrician. Regardless, having your conduits potentially conduct instead of your actual conductors seems to pose a distinct risk.

.. not if you explicitly construct the installation to support this.

Metal conduit is perfectly normal and in almost all situations involving potential mechanical damage vastly safer than any other option.

[Mr. Scram]

.. not if you explicitly construct the installation to support this.

Metal conduit is perfectly normal and in almost all situations involving potential mechanical damage vastly safer than any other option.

Can that be statistically supported? I assume insurers have data on these kinds of things.

[Monkeh]

.. not if you explicitly construct the installation to support this.

Metal conduit is perfectly normal and in almost all situations involving potential mechanical damage vastly safer than any other option.

Can that be statistically supported? I assume insurers have data on these kinds of things.

I'm not an insurer, so you should probably ask one of those vultures.

[Zucca]

first post over the 10Gb link !

camooon free_el more details... happy with the installation? Was it more plug or pray?

[MyHeadHz]

Arstechnica has done quite a bit of testing throughout the years, including thorough real-world tests.  The first paragraph in the link below has some links to some other useful articles depending on what exactly you're interested in.

https://arstechnica.com/gadgets/2016/09/the-router-rumble-ars-diy-build-faces-better-tests-tougher-competition/

There may be more recent articles, but that was the last one I have bookmarked.

[Berni]

Those are some very nice tests, properly stressing the routing performance and all.

Tho to be fair this is pretty severe stress compared to something that it might typically see at home, but it does show the differences between even higher performance solutions.

[free_electron]

There were a couple of small snags during the install.

The router did not immediately get a wan ip address. I had to reboot the modem. But that may be a modem issue. New Modem ordered ( i will upgrade from 300Mbit/s to a 1G link )
Router configuration was super easy. The router talks bluetooth to a tablet app. There is no public visible config on wan or lan thru  web page. You need to connect using an app. So that closes points of attack.

Signal strength is very high in the entire house, to the point i probably won't need an extender ... I am starting to think that those fancy routers with 6 antenna's are more show than anything else ....
10G link over SPF to SPF cable was up immediately. ( 15 ft cable)

The mikrotik switches came up on their 192.168.88.xxx. I could see them using the winbox utility but no way to get into their config page as they all had the same address.

Only option was to powercycle in such a way that the one closest to the router came up first , got an address in 192.168.156 range, then the next one , then the last one.
So what will happen after a power loss ? if the one closest to the router comes up last the other two will sit in 192.168.88.xxx.

Fortunately there is a config setting where you can tell it the fallback address. So i hardcoded the fallback to 192.168.156.2 , 3 and 4 ( for the three machines ) and let them attempt dhcp anyway. the router will use those addresses through dhcp also, so irrespective if the switches can get a dhcp lease or use their fallback : their ip address does not change.

The router is set up to only deal out dhcp above 192.168.156.100 and hands out pseudo static addresses linked to the mac addresses.
All my 'static' devices like the tv , roku , apple tv , ipcams, nvr, nas boxes have been assigned ip addresses locked in the router. The devices are still dhcp but the router will always hand out the same IP address for that specific device
Same goes on wifi. The alexa dots,spots and echos and the home automation has pseudo statics but on wifi
Router only deals out 'guest' wifi for unknown mac addresses with a limit of 1 device and only internet connection at 1mbit/s. So i can bring in new devices one by one and then assign them in the router.

I had to powercycle a number of devices as they were in the 192.168.1.xxx and looking for the gateway at 254. the new router is 192.168.156.1
and run the network diagnostic on the windows machines to fix the network settings.
Many devices only search for a gateway at powerup.
Devices over wifi do not have that issue. The moment you connect to the new wifi port all is well. All hardwired devices have problems.
They should be able to detect : my gateway is offline , let me see if there is another one available.

Next thing i will attempt is to create vlans so that the entertainment ( tv and media players) sit in one vlan. Then all apple devices in another vlan.
office will be one vlan. the nas boxes will be allocated so that some are visible only on one vlan , some on multiple vlans.

[NiHaoMike]

Router configuration was super easy. The router talks bluetooth to a tablet app. There is no public visible config on wan or lan thru  web page. You need to connect using an app. So that closes points of attack.

That seems like it would be less secure, unless you have the option to flip a switch on the unit to disable that feature when not in use?

[free_electron]

you need to be in range with bluetooth to pick it up. then it hands over to wifi and it is password protected.

[SteveyG]

Not sure how widespread it was amongst Mikrotik's devices, but it's worth a quick check of the power supply input circuitry. On the device I use, the buck regulator datasheet suggests it was not designed to work up to 24V with the power supply bundled with the device.

Some info here:

[Zucca]

Next thing i will attempt is to create vlans so that the entertainment ( tv and media players) sit in one vlan. Then all apple devices in another vlan.
office will be one vlan. the nas boxes will be allocated so that some are visible only on one vlan , some on multiple vlans.

Not an Internet of Terror VLAN?

Thanks for wrtiting it up.

One router only with no further mesh antennas in different places? Sorry if it is a stupid questions I am learning the mesh wifi jazz right now.

[free_electron]

yup. The amplifi HD has a much stronger signal throughout the house. i have not been able to find any deadspots. Compared to the big Netgear with impressive looking three antenna's ...

[Nominal Animal]

Uh, am I the only one running a small SBC (NanoPi in my case) as a honeypot, just because, uh, reasons? 

[ogden]

Uh, am I the only one running a small SBC (NanoPi in my case) as a honeypot, just because, uh, reasons? 

Don't worry. It comes and goes. When you grow up, you most likely will do other, even more exciting stuff.

[Nominal Animal]

Uh, am I the only one running a small SBC (NanoPi in my case) as a honeypot, just because, uh, reasons? 

Don't worry. It comes and goes. When you grow up, you most likely will do other, even more exciting stuff.

I'm afraid I stopped growing upwards and started growing my insulating lard layers instead, about two decades ago.. does that mean I don't get to do that even more exciting stuff?
I hope it is spaceflight, by the way.  It's one of the very few things left in my bucket list.

[ogden]

I'm afraid I stopped growing upwards and started growing my insulating lard layers instead, about two decades ago..

I did not mean maturing but professional growth instead Anyway could you please share more about your honeypot system? It's intended purpose in your case?

[Nominal Animal]

your honeypot system? It's intended purpose in your case?

I tend to have the same IP address for long stretches, and rather defensive firewall settings, because I really hate exploiters (script kiddies and the like).  I do like doing sysadmin stuff, if I get free range to do it properly.  Yes, I have done it as a job as well.

Normally, a honey pot like that would be configured to log everything remotely, so that one can detect successful unauthorized accesses hopefully before they get to the more important machines, and maybe have a few tripwires in place, but I don't actually bother.  Instead of a tool to catch botnetters and script kiddies that manage to break in, I use it to waste their time.  You create a system image on a microSD card, then replace crucial binaries with custom ones, like bash/ls/cat that simulates filesystem access, requiring interactive actions (something that looks like a prompt) at login to ensure a human must investigate, but occasionally just exits (drops the connection).  Maybe a copy of 42.zip as passwords.zip in /root.  Stuff like that.  It soothes my desire to retaliate, I guess.

I don't bother to run it often, though, as all attempts (that I see) are automated nowadays, and in general the (password!) security is so bad they don't bother doing anything manually (even if you set the host name to "cameraserver") -- there are plenty of machines they can get to using scripts.  (I do not let script attacks through.)

[Againgly]

ASUS RT-AC 5300. Equipped with NitroQAM technology, the router provides unprecedented speed of wireless data transfer - up to 5334 Mbit / s. This is one of the most powerful routers that can be found on the market today.

[Monkeh]

ASUS RT-AC 5300. Equipped with NitroQAM technology, the router provides unprecedented speed of wireless data transfer - up to 5334 Mbit / s. This is one of the most powerful routers that can be found on the market today.

Excellent work outing yourself as a paid spammer.

[EEVblog]

DELETED. Equipped with NitroQAM technology, the router provides unprecedented speed of wireless data transfer - up to 5334 Mbit / s. This is one of the most powerful routers that can be found on the market today.

Excellent work outing yourself as a paid spammer.

LOL, yep!

[Halcyon]

ASUS RT-AC 5300. Equipped with NitroQAM technology, the router provides unprecedented speed of wireless data transfer - up to 5334 Mbit / s. This is one of the most powerful routers that can be found on the market today.

Excellent work outing yourself as a paid spammer.

One issue about this router is that it only has Gigabit Ethernet ports. So you're limited to 1 Gbps tops. So much for 5.3 Gbps

Also, just another overpriced consumer router tarting itself as being something special. My pfSense box and Ubiquiti/Cisco wireless APs blow your crappy Asus out of the water.

[sokoloff]

Well, it's sold as a router that happens to have a few switch ports not a core switch.

Very few people have a LAN connection of over 1 Gbps. Almost no one has a WAN connection of even 1 Gbps, let alone over.

[Monkeh]

ASUS RT-AC 5300. Equipped with NitroQAM technology, the router provides unprecedented speed of wireless data transfer - up to 5334 Mbit / s. This is one of the most powerful routers that can be found on the market today.

Excellent work outing yourself as a paid spammer.

One issue about this router is that it only has Gigabit Ethernet ports. So you're limited to 1 Gbps tops. So much for 5.3 Gbps

Also, just another overpriced consumer router tarting itself as being something special. My pfSense box and Ubiquiti/Cisco wireless APs blow your crappy Asus out of the water.

It's wifi, the number on the box is always a lie..

[Halcyon]

ASUS RT-AC 5300. Equipped with NitroQAM technology, the router provides unprecedented speed of wireless data transfer - up to 5334 Mbit / s. This is one of the most powerful routers that can be found on the market today.

Excellent work outing yourself as a paid spammer.

One issue about this router is that it only has Gigabit Ethernet ports. So you're limited to 1 Gbps tops. So much for 5.3 Gbps

Also, just another overpriced consumer router tarting itself as being something special. My pfSense box and Ubiquiti/Cisco wireless APs blow your crappy Asus out of the water.

It's wifi, the number on the box is always a lie..

I'm aware. But even if you halve the theoretical maximum Wi-Fi throughput (2.6 Gbps) which is typical of half-duplex communication with decent equipment and a strong signal, you're still limited to 1 Gbps through the Ethernet ports. Even if you have a NAS at home, it's unlikely you'll be connecting it to the rest of your network via Wi-Fi. Then there is the whole WAN side of things.

It's a bit like owning a car capable of 300 km/hr but driving them on roads limited to 110 km/hr.

It's all marketing bullshit.

Having said that, there are genuine uses for >1Gbps Wi-Fi capability, but that is generally reserved for many clients on enterprise radios with aggregated Ethernet links or 10 Gbps backhaul. You won't see that in a consumer product.

[Black Phoenix]

Even if you have that Router, what kind of internal modules on notebooks support it? Intel Wi-Fi 6 AX200 is the only one I know and still that one only goes to 2.5Gbps on 802.11ax via 2x2 MU-MIMO.

The only use I see that total bandwidth to be used is in a lot of equipments using the WIFI in intense mode, like a lot of 4k streaming plus gaming, plus torrenting... and even that you are limited by the WAN speed with 1Gbps Ethernet Ports. - Didn't saw that in the post above this part was already touch...


Plus how much sustained traffic at that rate the equipment endures until the processor starts trotting the traffic because of heat output?

[sokoloff]

It does support link aggregation, so you can get ~2Gbps.

[Monkeh]

It does support link aggregation, so you can get ~2Gbps.

This assumes that you're dealing with multiple streams, and that the CPU port is greater than 1Gbps, which is questionable.

[NiHaoMike]

Having said that, there are genuine uses for >1Gbps Wi-Fi capability, but that is generally reserved for many clients on enterprise radios with aggregated Ethernet links or 10 Gbps backhaul. You won't see that in a consumer product.

At least until wireless VR takes off and creates a demand for high resolution, low latency wireless video.

[madires]

It's wifi, the number on the box is always a lie..

... by a factor of two. For WiFi the net throughput is about the half of the gross throughput advertised (per band).

[Monkeh]

It's wifi, the number on the box is always a lie..

... by a factor of two. For WiFi the net throughput is about the half of the gross throughput advertised (per band).

At best.

[Halcyon]

It does support link aggregation, so you can get ~2Gbps.

Link aggregation only serves to increase the total amount of bandwidth shared among all clients. It won't increase the bandwidth to/from a single client device, you're still limited by the speed of a single port (in this case 1 Gbps).

This is a common assumption people often make when it comes to aggregating NICs. To put it another way, let's say you had a desktop PC and a NAS, both with 2x 1 Gbps NICs aggregated. The transfer speed between those two devices would still only be 1 Gbps max, however it means that the NAS still has 1 Gbps "spare" capacity to service other clients on  the network.

Having said that, there are genuine uses for >1Gbps Wi-Fi capability, but that is generally reserved for many clients on enterprise radios with aggregated Ethernet links or 10 Gbps backhaul. You won't see that in a consumer product.

At least until wireless VR takes off and creates a demand for high resolution, low latency wireless video.

Latency on current 802.11 networks is negligible if your wireless access points are decent and you've properly planned and built your network to suit your RF environment. Even when 802.11ax becomes the norm, almost no one will notice a difference. I can see benefits of 802.11ax, but not until 10 Gbit Ethernet becomes standard in homes.

[David Hess]

It does support link aggregation, so you can get ~2Gbps.

Link aggregation only serves to increase the total amount of bandwidth shared among all clients. It won't increase the bandwidth to/from a single client device, you're still limited by the speed of a single port (in this case 1 Gbps).

This is a common assumption people often make when it comes to aggregating NICs. To put it another way, let's say you had a desktop PC and a NAS, both with 2x 1 Gbps NICs aggregated. The transfer speed between those two devices would still only be 1 Gbps max, however it means that the NAS still has 1 Gbps "spare" capacity to service other clients on  the network.

Round-robin link aggregation will increase the throughput of a single connection but it is not generally supported because it is really hard on the TCP/IP stack due to packet reordering.  Linux supports it natively but Windows only supports it as part of the network driver if at all.

[NiHaoMike]

Latency on current 802.11 networks is negligible if your wireless access points are decent and you've properly planned and built your network to suit your RF environment. Even when 802.11ax becomes the norm, almost no one will notice a difference. I can see benefits of 802.11ax, but not until 10 Gbit Ethernet becomes standard in homes.

The low latency target for VR means a lot of bandwidth since heavy video compression is no longer possible, easily many Gbps. Either consumer 802.11ay APs will get USB-C ports to plug into GPUs or some arrangement will be made to connect GPUs to SFP sockets - probably adapters to convert USB-C to SFP at first and GPUs getting SFP sockets built in later on.

[Halcyon]

Latency on current 802.11 networks is negligible if your wireless access points are decent and you've properly planned and built your network to suit your RF environment. Even when 802.11ax becomes the norm, almost no one will notice a difference. I can see benefits of 802.11ax, but not until 10 Gbit Ethernet becomes standard in homes.

The low latency target for VR means a lot of bandwidth since heavy video compression is no longer possible, easily many Gbps. Either consumer 802.11ay APs will get USB-C ports to plug into GPUs or some arrangement will be made to connect GPUs to SFP sockets - probably adapters to convert USB-C to SFP at first and GPUs getting SFP sockets built in later on.

I think it's important to remember that latency and throughput are two different things. You can still have fast links with high latency (and the reverse is also true). I also think that this is "pie in the sky" thinking (at least for the moment). When you're talking traversing data links across continents, the latency of a good wireless connection is almost negligible, typically under 10 milliseconds.

[Jeroen3]

The latency of a fedex truck with hard drives is very high, but the throughput is also very high.

So... if WiFi does theoretically 5 Gbps, when connected to only 802.11ax clients, does that mean you can serve 4 clients on 1 Gbps to LAN half duplex?
Or will you hit the limit of the processor?

[Zucca]

Link aggregation only serves to increase the total amount of bandwidth shared among all clients. It won't increase the bandwidth to/from a single client device, you're still limited by the speed of a single port (in this case 1 Gbps).

This is a common assumption people often make when it comes to aggregating NICs. To put it another way, let's say you had a desktop PC and a NAS, both with 2x 1 Gbps NICs aggregated. The transfer speed between those two devices would still only be 1 Gbps max, however it means that the NAS still has 1 Gbps "spare" capacity to service other clients on  the network.

Thanks Halcyon for the information and to moderate this new forum branch, I am loving it so far.
Back to the topic, so those LACP:

My setup is as follows, and it works well:

Internet
| (1gig fiber)
Asus RT-AC88U (Running Asus Merlin firmware)
| (2gig LACP link aggregation)
24 port PoE switch
| (4gig LACP link aggregation)
Synology RS815+ NAS

are not increasing the bandwidth because are 1:1 devices connections? Or the magic will happens when one IP/device has to communicate with several differents IP addresses/devices through i.e. switches?

[Jeroen3]

Ethernet keeps frame order. The maximum speed between two points should then be the slowest physical link, which is one of the bonded links.
However, mikrotik offers a custom one: balance-rr, that does allow one stream to be split up. Messing with the order, putting a higher load on the clients reassembling the data. No problem for UDP though.
So pairing is a bad idea for clients, good for backhaul.

Wait for MPTCP?

[madires]

Link aggregation only serves to increase the total amount of bandwidth shared among all clients. It won't increase the bandwidth to/from a single client device, you're still limited by the speed of a single port (in this case 1 Gbps).

Sorry, but I have to disagree. The way the traffic is distributed across multiple links is determined by the load sharing algorithm implemented. In the past there were quite simple methods which could cause the scenario you've described. But today's algorithms are more sophisticated and consider several parameters to optimize load sharing. Several network elements offer fine tuning by configuration, i.e. you can tell the device which parameters to use. Of course, if you have a server supporting only some poor algorithm it won't be able to utilize multiple links properly and would create an asymmetrical load sharing with the LAN switch. Another thing to know is that even the most sophisticated algorithms aren't able to utilize all links 100%, but they do a decent good job.

[madires]

are not increasing the bandwidth because are 1:1 devices connections? Or the magic will happens when one IP/device has to communicate with several differents IP addresses/devices through i.e. switches?

You have to look into how each device handles the load sharing across the LACP links. There's no simple answer like yes or no.

[free_electron]

My system is running perfectly fine . Not a single hiccup.

Cabinet shows the entire setup. It is an IKEA KALLAX cabinet , single column, two stacked on top of each other. (one is modified to shorten it by one compartment)
The bottom compartment is a set of drawers that hold spare ethernet cable,s usb cables, power cables etc.
The slot above that holds a UPS to power the cabinet.
Above that are the four old NAS machines (routernas.jpg). They each hold two 2TB drives and a DVD burner. One has a Blu-Ray burner.
Above that is the Amplifi router in a slot by itself.
Above that are two NAS boxes each holding two 4TB drives with two blank slots ( they can hold 4 drives each)
The bay above that has two western Digital NAS machines. The white one is 2TB , the black one has two 2TB drives in it. There is room to bring one up from the garage ( a 1TB)
The last bay has the Apple Time Capsule and the Home automation ( not everything is there yet. I will move the other boxes from their various locations into this cabinet.) and one more Switch that serves this cabinet.

When all data is moved the LG NAS machines will essentially become 'cold storage'. They will serve as backup for the two main NAS machines. (once a month they sync in overwrite/prune mode). I use a piece of software called ViceVersa that is installed on the laptop running the NVR. The drives are powered off and the NAS responds to wake-on-lan from the laptop.
The main NAS machines already mirror each other.
The White WD will become a cloud drive.(Accessible from the big bad internet. It doesn't hold anything important. If it gets hacked ,or stuff stolen from it : no loss.)
The Black WD will replace the Apple Time Capsule. That thing is at the end of its life. It only has a 1TB drive and it is full ... My Mac has a 2TB drive with 850GB used. So there is not much 'time machining' to be done with a 1TB drive.
The Mac holds all the family pictures / video's etc. It is only used for that purpose.

I have 4 copies of everything.
- 1 on the computer
- 2 on the main nas boxes ( 1 per nas box, they clone each other )
- 1 in cold storage on the old nas

why ? because hard disks are essentially spinning rust that can and will die at the most unexpected point , when you need it the most. I worked in harddisks for 10 years of my life. i know what can go wrong.
and SSD is not any better. Contrary, it is worse ... if a harddisk goes bad you can at least attempt data recovery by swapping boards or headstacks. You have a 80 to 90 % chance it is recoverable. The only really unrecoverable is those glass harddisks (laptops) . if they shatter : game over.
The one below took 4 years to recover , but they got the data off...
Not bad considering it came in falling from space when the Space Shuttle Columbia burned up.
[url]https://gizmodo.com/charred-hard-drive-from-space-shuttle-columbia-recovere-388465[url]

If an SSD goes bad .. essentially kiss your data goodbye. There is no swapping of a fried board or headstack... a fried chip is a fried chip. if a flash chip no longer talks there is no (cost-effective. you could try e-beam probing to read bits , but then restoring that to real working data is another thing due to wear leveling algorithms . and in case of three level storage , or stacked dies it becomes a real nightmare...) way to get data out.

oh, and before you say : what if the house burns down ? I do have a fifth backup 'chez apple icloud'

[Halcyon]

Ethernet keeps frame order. The maximum speed between two points should then be the slowest physical link, which is one of the bonded links.
However, mikrotik offers a custom one: balance-rr, that does allow one stream to be split up. Messing with the order, putting a higher load on the clients reassembling the data. No problem for UDP though.
So pairing is a bad idea for clients, good for backhaul.

Wait for MPTCP?

Correct, splitting frames and taking them out of order essentially breaks the "fabric" of Ethernet, but as you and David Hess also suggested, there are some tricky ways around this but it involves both hardware and software support. More often than not (even on Enterprise gear) you'll be using LACP or similar link aggregation.

Sorry, but I have to disagree. The way the traffic is distributed across multiple links is determined by the load sharing algorithm implemented. In the past there were quite simple methods which could cause the scenario you've described. But today's algorithms are more sophisticated and consider several parameters to optimize load sharing. Several network elements offer fine tuning by configuration, i.e. you can tell the device which parameters to use. Of course, if you have a server supporting only some poor algorithm it won't be able to utilize multiple links properly and would create an asymmetrical load sharing with the LAN switch. Another thing to know is that even the most sophisticated algorithms aren't able to utilize all links 100%, but they do a decent good job.

That's right, but you have to consider how it shares that load, usually it's based off the client's IP and/or MAC address. When you aggregate ports, you're creating a virtual adapter which has it's own single unique MAC address. You're fundamentally limited by how Ethernet works, if you have frames coming in on an interface out of order, things break. As I mentioned, there are some special ways to get around this, but it's not often done. In the Enterprise world, you just upgrade your networking hardware to 10 Gbps or more and not mess around with this.

Link aggregation is generally used for redundancy or increasing link capacity to multiple clients. That's what it was designed for.

But don't take it from me, do a test yourself on your own NAS or between desktop machines, you'll see exactly what I mean.

[free_electron]

Correct, splitting frames and taking them out of order essentially breaks the "fabric" of Ethernet, but as you and David Hess also suggested, there are some tricky ways around this but it involves both hardware and software support. More often than not

wait ? what ?

Ethernet doesn't care as this is handled on individual protocol levels.

a TCP packet has a sequence number that allows you to reconstruct the payload if you get out-of-order packets or, if you get duplicate packets when a retransmit was requested and the original packet arrives.

[David Hess]

Correct, splitting frames and taking them out of order essentially breaks the "fabric" of Ethernet, but as you and David Hess also suggested, there are some tricky ways around this but it involves both hardware and software support. More often than not

wait ? what ?

Ethernet doesn't care as this is handled on individual protocol levels.

a TCP packet has a sequence number that allows you to reconstruct the payload if you get out-of-order packets or, if you get duplicate packets when a retransmit was requested and the original packet arrives.

It only requires software support.  Ethernet will happily deliver the packets but the problem is on the receiving end where the TCP part of the IP stack has to put the packets back into the correct order which is very demanding on the processor at high data rates.  Windows does not even bother to support it natively so the ethernet card driver has to handle it.  But it is built into Linux and I assume BSD.

[NiHaoMike]

I think it's important to remember that latency and throughput are two different things. You can still have fast links with high latency (and the reverse is also true). I also think that this is "pie in the sky" thinking (at least for the moment). When you're talking traversing data links across continents, the latency of a good wireless connection is almost negligible, typically under 10 milliseconds.

Many of the tricks used for video compression are not compatible with low latency, plus there's not much that can be done to reduce the bitrate of sudden scene changes and still have low latency. If streaming VR (PC to headset) could be handled by 802.11ac, they would have already done it...

[Halcyon]

Correct, splitting frames and taking them out of order essentially breaks the "fabric" of Ethernet, but as you and David Hess also suggested, there are some tricky ways around this but it involves both hardware and software support. More often than not

wait ? what ?

Ethernet doesn't care as this is handled on individual protocol levels.

a TCP packet has a sequence number that allows you to reconstruct the payload if you get out-of-order packets or, if you get duplicate packets when a retransmit was requested and the original packet arrives.

Sorry, I should have been more specific.

TCP can handle the odd out of order packet or two, but if it's consistent, you'll start getting retransmissions occurring. This is something you don't want to happen because it impacts performance.

Although this is starting to get outside the scope of normal residential or low-end commercial link aggregation.

I think it's important to remember that latency and throughput are two different things. You can still have fast links with high latency (and the reverse is also true). I also think that this is "pie in the sky" thinking (at least for the moment). When you're talking traversing data links across continents, the latency of a good wireless connection is almost negligible, typically under 10 milliseconds.

Many of the tricks used for video compression are not compatible with low latency, plus there's not much that can be done to reduce the bitrate of sudden scene changes and still have low latency. If streaming VR (PC to headset) could be handled by 802.11ac, they would have already done it...

What do you mean? A quick Google reveals a bunch of 802.11 VR headsets. It appears Wi-Fi is very much able to handle the data rates and latency.

[Berni]

WiFi speeds do have to be taken with a grain of salt.

With the faster wifi standards its often required to have multiple clients in order to get that speed, additionally the clients might need to support simultaneously using multiple channels. Router manufacturers also tend to have a habit of summing together the bandwidth of multiple modes. such as 2.4GHz and 5Ghz and advertising the sum of the speeds.

And even when you have all the ducks in a row the theoretical speeds never seam to be reached even if the devices are just a meter apart. The speed then degrades even further when there are other networks shouting over its channel spectrum and degrades even further once you put a wall or two in between you and the access point. But not only does the speed drop off a lot, you also start getting lost packets, this takes time for the wifi interfaces to notice and retransmit, so you get big spikes in the latency and that mess up anything that needs a good consistent ping time like video calls, multiplayer games, streaming etc... or god forbid live game streaming.

[madires]

That's right, but you have to consider how it shares that load, usually it's based off the client's IP and/or MAC address. When you aggregate ports, you're creating a virtual adapter which has it's own single unique MAC address. You're fundamentally limited by how Ethernet works, if you have frames coming in on an interface out of order, things break. As I mentioned, there are some special ways to get around this, but it's not often done. In the Enterprise world, you just upgrade your networking hardware to 10 Gbps or more and not mess around with this.

Most non-SOHO switch ASICs use load balancing algorithms based on L3 or L4 hashes. IIRC, linux comes with four different load balancing methods to choose from. There are also adaptive algorithms, e.g. Juniper. In the enterprise world load balancing works really well because of the large number of different clients/servers and sessions. And when upgrading the throughput of your network one key point is cost. If LAG is less expensive then moving to the next speed level, why pay more?

Back to the NAS example with a LAG of two GigEs for NAS and PC to explain load balancing. If the PC establishes just one single TCP connection with the NAS the traffic will go through one GigE because the load balancing algorithm has only one hash from that single TCP connection to decide which GigE to use. When the PC establishes a second connection with the NAS we have two TCP sessions creating two hashes for load balancing. Now the load balancing algorithm can send traffic for session #1 via GigE #1 and traffic for session #2 via GigE #2 controlled by the hashes.

[Jeroen3]

Correct, splitting frames and taking them out of order essentially breaks the "fabric" of Ethernet, but as you and David Hess also suggested, there are some tricky ways around this but it involves both hardware and software support. More often than not

wait ? what ?

Ethernet doesn't care as this is handled on individual protocol levels.

a TCP packet has a sequence number that allows you to reconstruct the payload if you get out-of-order packets or, if you get duplicate packets when a retransmit was requested and the original packet arrives.

You're mixing the layers. Ethernet is L2, TCP is L4.
Ethernet isn't supposed to change the order of frames, FIFO. TCP allows for fragmentation of packets on L3.

Since SMB multichannel allows multiple stream the balancing per stream should work fine. If your NAS supports it.

[NiHaoMike]

What do you mean? A quick Google reveals a bunch of 802.11 VR headsets. It appears Wi-Fi is very much able to handle the data rates and latency.

There are VR headsets with built in processing, but those don't match the realism offered by a full PC.

[free_electron]

Correct, splitting frames and taking them out of order essentially breaks the "fabric" of Ethernet, but as you and David Hess also suggested, there are some tricky ways around this but it involves both hardware and software support. More often than not

wait ? what ?

Ethernet doesn't care as this is handled on individual protocol levels.

a TCP packet has a sequence number that allows you to reconstruct the payload if you get out-of-order packets or, if you get duplicate packets when a retransmit was requested and the original packet arrives.

You're mixing the layers. Ethernet is L2, TCP is L4.
Ethernet isn't supposed to change the order of frames, FIFO. TCP allows for fragmentation of packets on L3.

Since SMB multichannel allows multiple stream the balancing per stream should work fine. If your NAS supports it.

Ethernet is basically fire and forget. Packets will be blasted out in the order they are received from the OS. They will be in sequence , but they may be a mix of multiple streams.
Ethernet itself has no handshake or retransmit mechanism. That is handled on protocol level.

How packets travel through various switches, routers , fiber optic, undersea , satellite is an unknown. That is where stuff may go out of order. So by the time it arrives somewhere the packet order is no longer guaranteed. It is up to information contained in the payload to make sure the entire message can be reconstructed and packets can be put back in order.

[Halcyon]

WiFi speeds do have to be taken with a grain of salt.

100%. A general rule of thumb I use is half the maximum speed with a good set up (that means decent hardware, good signal strength and someone who knows how to configure it). On consumer gear, I often find that number far less than half.

[madires]

How packets travel through various switches, routers , fiber optic, undersea , satellite is an unknown. That is where stuff may go out of order. So by the time it arrives somewhere the packet order is no longer guaranteed. It is up to information contained in the payload to make sure the entire message can be reconstructed and packets can be put back in order.

As you know, TCP is able to deal with lost packets and packets out of order (will slow down the session). But many protocols don't have those features and have to rely on a proper packet order. Those protocols aren't inferior than TCP, they are simply designed for different purposes. Carriers/telcos/ISPs try to minimize out-of-order packets as much as possible, and network elements are designed to keep the packet order for each connection/session. Otherwise it would break some protocols.

[gmb42]

Carriers/telcos/ISPs try to minimize out-of-order packets as much as possible, and network elements are designed to keep the packet order for each connection/session. Otherwise it would break some protocols.

I wish.  Verizon, in particular, seem to love to re-order UDP packets.  Maybe my customers are buying some cheapskate package from Verizon that doesn't have the "supply packets in the order they were transmitted" extra-cost option though.

[madires]

That's really bad! But it's not the lack of the "plus package", it's poor network engineering. I know of specific line/interface cards causing out-of-order packets (mostly buffer issues of an ASIC) but those are usually replaced by the vendor with the next revision with a fixed ASIC. One of the protocols suffering from out-of-order packets is VoIP, i.e. RTP for streaming voice. RTP has a sequence number to detect packet loss and order problems but the VoIP phone can't wait and has to simply ignore late packets, creating poor voice quality.

[David Hess]

Carriers/telcos/ISPs try to minimize out-of-order packets as much as possible, and network elements are designed to keep the packet order for each connection/session. Otherwise it would break some protocols.

I wish.  Verizon, in particular, seem to love to re-order UDP packets.  Maybe my customers are buying some cheapskate package from Verizon that doesn't have the "supply packets in the order they were transmitted" extra-cost option though.

I would not surprise me if that is deliberate to discourage competing services which rely on real time traffic.

[gmb42]

Carriers/telcos/ISPs try to minimize out-of-order packets as much as possible, and network elements are designed to keep the packet order for each connection/session. Otherwise it would break some protocols.

I wish.  Verizon, in particular, seem to love to re-order UDP packets.  Maybe my customers are buying some cheapskate package from Verizon that doesn't have the "supply packets in the order they were transmitted" extra-cost option though.

I would not surprise me if that is deliberate to discourage competing services which rely on real time traffic.

This is telemetry data, so not actually real time.  Still, the protocol spec has an app note that says not to use UDP because of out-of-order issues, but customers do it because they think it will be cheaper than the extra overhead of TCP (when they're paying per-byte).  Unfortunately the extra re-transmissions required to "recover" from UDP out-of-order issues negate any savings they may have had.

[helius]

Considering the future of the web protocols (HTTP/3) is over UDP, this may be seriously disadvantageous to users of some ISPs.