Virtual Networking Examples

Each directory contains a different networking example. All of the examples have a setup.sh and cleanup.sh file. These are indeted to be used before and after running the example.

sh -x setup.sh
sh -x cleanup.sh

The scripts are plain POSIX shell and self contained. They assume root privileges, since they create network devices and namespaces.

Core mechanics: network namespaces + veth

Every lab is built from two Linux primitives:

• Network namespaces (netns) give an isolated network stack: its own interfaces, routing table, ARP cache, firewall rules and sysctl knobs. Each behaves like a separate machine, standing in for a host, a switch or a router.
• veth pairs are virtual Ethernet cables, always created as a linked pair, so whatever enters one end leaves the other. An end in each namespace gives you a wire between two machines.

Four things will lie to you:

• Local delivery shortcut. Source and destination in one namespace are delivered via lo and never reach the wire. Your veth, bridge or router is bypassed, so the path you built is not the path tested.
• Shared routing table and ARP. One table and one cache for every interface leaves "which interface would really be used" and "did ARP resolve across the link" unanswerable.
• Reverse-path and source-address surprises. With several subnets on one stack, source-address selection and reverse-path filtering quietly pick or drop the wrong interface, in ways two real machines would not.
• Bad checksums in captures. Given -v, tcpdump reports bad udp cksum on nearly everything the labs send. Checksum offload has the kernel write only the pseudo-header partial sum and leave the hardware to finish it, but a veth never reaches hardware, so the peer skips validation and the capture happens before a step that never occurs. The tell is a value identical on every packet while the expected one changes. Pass -K, or ethtool -K <veth> tx off on the transmitting interface, which also disables segmentation offload.

The first three are why every device gets its own namespace rather than one stack carrying every interface. The fourth is not fixable that way: a veth is not a network card.