Hacker News Reader

Comment by rdtsc | Hacker News Reader

So based on that [3], open source then.

What are the high speed and feature-wise comparable open source solutions to a the compromised Juniper switches?

According to the article, the affected products are firewalls, not switches, but for switches, Facebook has open sourced the hardware and software for the switches used in production: https://code.facebook.com/posts/843620439027582/facebook-ope...

There are routers/switches based on Linux, here is one based on Debian. Unfortunately they still contain proprietary bits thanks to Broadcom.

http://cumulusnetworks.com/

There's also https://opennetlinux.org/ which is more open, but unfortunately only runs on a few high end switches right now.

You're really going to have a hard time finding something that satisfies your 3 requirements (open source, high-speed and capable of what a Juniper Netscreen can do). OpenBSD can be tuned to operate really well, hit maybe 80 or 90% feature parity with those Netscreens, but the performance won't even come close to what a Netscreen can do -- Juniper fabs their own ASICs and a general von Neumann x86 won't come close to being able to packet switching at those speeds.

You might be able to get close in performance with your high-end Altera's and Xilinx's gear, but that certainly won't be cheap and AFAIK the FPGA synthesis tools are still closed source -- so you're not going to get an 'open source' from top-to-bottom solution at all 3 levels (Silicon, firmware, OS and packet switching). It's arguably more trust-worthy than buying Juniper/Cisco which has complete control of the stack, from silicon to software, but you'll be paying through the nose either way.

The standard Intel e1000's running OpenBSD and libpacket might be the best trade-off you're going to get in price/performance (again, if you make the concession that Intel isn't backdooring on: a) the firmware and/or drivers for the e1000s, or b) somewhere along the controller bus path -> PHY on the processor). This whitepaper [1] re: OmniPath + Xeon/PHI architecture boasts brilliant numbers (page 7 for an architecture summary, column 2 for the network switching summary, page 8 for the benchmark numbers). Again, not open-source at the hardware level, but the drivers, libraries and OS can all be audited. And at those rates of transmission, I'm guessing you could use physical probing along each component to see if any deep-packet tomfoolery is occurring, as the latency increase would be detectable, and you can't just add an extra login password at that level.

Tyan's OpenPOWER compliant stack will run on BSD and other than the processor (which uses an IBM POWER8) pretty much uses jellybean components-- so you get what I'm going to coin as "security through vendor diversity" from now.[2]

It comes down to how tightly your tin-foil hat has been sized I suppose. The upside is right now there's a huge open-source hardware revolution going on. OpenCores' Virtex based RISC stuff is available and that's top-to-bottom open source, and if you were really motivated and had the engineering know-how, ASIC runs can be done for under a million.

[1] https://ramcloud.atlassian.net/wiki/download/attachments/224...

[2] http://www.tyan.com/campaign/openpower/index.html

> ... a general von Neumann x86 won't come close to being able to packet switching at those speeds.

Hmm, really? The highest end Netscreen (550, IIRC) only has 4 x 1 GbE interfaces. Linux or FreeBSD can't keep up?

The grandparent post refers to "not using any juniper gear" at all - which brings the performance requirements for a replacement to much higher than just the Netscreen products (which as far as I know represent an old product series that has been end of lifed ).

Modern Juniper JUNOS products like the EX switch series contain 1GbE, 10GbE, and 40GbE wire ports and I think push the upper limits of standard linux / freebsd on plain x86.

Note that JUNOS is actualy based on freebsd (Juniper forked freebsd a while ago into JUNOS) - but they do it on custom asics.

Sorry, I should have been more clear. When I asked if FreeBSD and/or Linux could keep up, I was referring to the forwarding rates across four 1 GbE interfaces, like what the higher end SSGs came with. I certainly didn't mean to imply that an x86 BSD box could perform right up there with a QFX10000, for example.

Now that I'm thinking about it, though, Arista runs a Linux kernel on their switches. Or they did anyways, the last time I was out there being briefed; it was a Fedora Core 3 install (yes, it's been a few years), if memory serves, so it must be possible anyways. No idea if they're still doing that but, at the very least, they were at some point.

A few Gbit/s is peanuts for modern machines. Even a low-power fanless machine can saturate that without breaking a sweat.

Arista does run software on their switches. But that is the supervisor, aka the control plane. The data plane, where the actual throughput is achieved, is done with ASICs, and in some cases where user programmability is needed, FPGAs. At no point does Linux handle 1 Gbps+ traffic in those switches.

We're closer than one might think: https://blog.pfsense.org/?p=1866

> So based on that [3], open source then.

nortel networks. no bugs in the last few years.

> nortel networks. no bugs in the last few years.

No known bugs.

Good luck buying from a company that's gone out of business.

> nortel networks. no bugs in the last few years.

One week ago we could say this of Juniper as well.

Good luck finding an open-source router that can compete on performance or scalability with a Juniper MX2020 or PTX5000.

(yes, those aren't the device that was found to be compromised, but the grandparent post suggested we "stop using Juniper's products altogether")

There isn't one.

Reply on news.ycombinator.com