Teaching a cheap ethernet switch new tricks (2019)

https://blog.benjojo.co.uk/post/dell-switch-hacking

by throwoutway • 5 years ago

231 103 5 years ago

blog.benjojo.co.uk

bluedino• 5 years ago

How much throughput does a device like this get with wireguard?

Hello71• 5 years ago

Normally, terrible. These systems are built with anemic, usually single-core CPUs usually in the low 100s MHz. The only way they can actually do gigabit switching is by hardware offload to dedicated ASICs. Anything going through the main CPU, even without encryption, will have terrible performance.

baybal2• 5 years ago

You don't need ONIE, nor any of that "Open" Compute stuff.

Linux has recently got native framework for control of switching chips called "Distributed Switch Architecture." This turns a lot of very cheap hardware with very basic hardware switching chips into high performance routers.

ComputerGuru• 5 years ago

Can that do L2 port management as well or is it restricted to L3 operations?

stephen_g2• 5 years ago

Yes. For example, if you bridge switch ports, it actually sets up the switch to do it in the switch hardware instead of in the kernel.

stephen_g2• 5 years ago

I don’t think there are any DSA drivers for Broadcom switch ICs (like the one in the device in the article) though? At least not in mainline last time I checked…

EDIT: No, actually, I was mistaken - there is one Broadcom series supported now I look again, BCM53xx, of which the one in the article does indeed appear to be. Looks like since the 4.8 kernel though, so not in the 4.4 kernel that comes with the device.

josteink2• 5 years ago

OpenWRT 21.02 supports DSA for select devices OOB (replaces swconf) and ships with a really recent 5.4 Linux kernel for all supported devices.

So going for a cheap, 2nd hand router supported by OpenWRT is probably the easiest and cheapest way there.

dhess• 5 years ago

Interesting! Is there a site that documents which off-the-shelf switch models work with DSA?

wtallis• 5 years ago

The most recent release of OpenWRT has started to migrate to DSA: https://openwrt.org/releases/21.02/notes-21.02.0#initial_dsa...

Their table of supported hardware for each of the platforms now using DSA probably includes all of the most affordable devices, since OpenWRT is mostly focused on consumer-grade equipment (and mostly routers/APs, but they support some purpose-built switches using Realtek CPUs).

geenew• 5 years ago

My main thought reading this as a non-network admin was of Mr Robot, and all the Linux installs on low level hardware used for hacks on that show.

Very interesting read and lots of upside to what is discussed, but the thought of the uncountable, almost invisible operating systems running in a large network give me a odd feeling in the pit of my stomach. So many potential places for malfeasance to hide.

myself2482• 5 years ago

Keep that feeling in the pit of your stomach for a few years. Watch as a multitude of forces (mostly related to surveillance capitalism) foist billions of such devices on unsuspecting consumers. Tell anyone who'll listen, how shortsighted this is, how much of a fall it's setting us up for.

Watch it happen anyway. Watch it accelerate. Watch the devices grow in complexity, capability, connectivity, and vulnerability. Watch innumerable manufacturers go out of business with no software-update succession plan, no code escrow, no upgrade path for victi^H^H^H^H^H end users.

The pit of your stomach gets pretty damn sick of the state of things.

matheusmoreira2• 5 years ago

Cyberpunk used to be fiction. It disgusts me when I realize I'm already living in it.

inetknght• 5 years ago

Wait until you hear about the Internet of Things

bonzini• 5 years ago

Also known as the Internet of Things That Should Not Be on the Internet.

jjoonathan• 5 years ago

The 'S' in 'IoT' stands for Security. (Old but good.)

kragen2• 5 years ago

They're not potential; do you know about Intel ME, cellphone baseband firmware, Apple's new on-phone CSAM scanning plans, and yellow printer dots?

jaywalk• 5 years ago

Intel ME and cellular baseband are particularly worrisome. They are essentially separate and inaccessible (outside of very restricted APIs) systems with their own CPU, running their own OS and applications with the lowest level access to all hardware.

sbierwagen2• 5 years ago

Another fun one is the "EURion constellation", a set of features on printed currency that photoshop and color copiers will read and then refuse to operate on: https://en.wikipedia.org/wiki/EURion_constellation

rincebrain• 5 years ago

I think my favorite "you put cleverness where it didn't belong, and look what it got you" is the Xerox "oops we stored your scan compressed and our compression matched some characters as identical that weren't so the thing we scanned has characters substituted in the image". [1]

Honorable mention goes to:

- the Dell switch with the changelog note "if you had a device with a MAC starting with these bytes plugged in, the last N ports on the switch will stop working"

[1] https://www.dkriesel.com/en/blog/2013/0802_xerox-workcentres...

Damogran6• 5 years ago

I'm not seeing them on this side of the pond for less than about $425...did the author drop a zero in the price?

rusk3• 5 years ago

Sadly since the majority of these [ONIE] switches are aimed at datacenter deployments they are generally unsuitable for use on my desk. ... On top these switches would be aggressively priced out of my budget ... That was until I found the Dell N1100 series, ... And I found a cheap vendor that sold refurbished ones for around 85 GBP.

did the author drop a zero in the price?

Not far off ...

benjojo122• 5 years ago

(Author here) These switches got a lot more expensive at the start of the pandemic, I think the chipsets became hard to source.

rusk3• 5 years ago

Minor Quibble: £85 is not a cheap ethernet switch.

It's an entertaining and informative read, but it's more like low-end datacentre hardware than that cheap €25 switch I've got in my home office.

A little disappointing as I was hoping I'd have a cheeky high-bandwidth raspberry-pi alternative on my hands ...

bserge2• 5 years ago

My favorites are TP-Link's WDR3600/4300, AC1200 and AC1750. Yeah, not switches per se, but $20-40, Gigabit Ethernet, dual band Wifi, very stable and fast with OpenWRT, can do anything. You can daisy chain a few of them if you need more ports, it's rather fun.

potiuper2• 5 years ago

Or instead of being a penny pincher get an AX wireless router and not contribute more ewaste.

throwaway35i2• 5 years ago

it's cheap compared to the £3,000 one normally pays for datacenter switches.

rusk3• 5 years ago

it's more like low-end datacentre hardware

yep covered that

iso1210• 5 years ago

£3k for just a managed access switch seems a bit high, you should be able to get a 48 port 1G juniper ex3400 with 4x10 uplinks for about £1500 (of course proper switch prices are always hidden in layers of mystery, which really pisses me off. Fortigate nearly lost a sale when they couldn't even give us a ballpark figure upfront)

dsr_2• 5 years ago

It's an amazingly cheap 10g switch. (It has 4x10g along with the 1g ports).

It's even a very cheap fully managed switch.

justinsaccount• 5 years ago

It has zero 10g ports:

  N1108T-ON: 
  1GbE Port Attributes Multi-speed:
  8x 10/100/1000Mbps half/full duplex RJ45 ports
  1GbE Port Attributes Single-speed:
  2x 1000Mbps half/full duplex RJ45 ports
  Integrated 1GbE SFP dedicated ports: 2
  Integrated 10GbE SFP+ dedicated ports: N/A

teh_klev• 5 years ago

Well it's cheap'ish for a managed gigabit switch...and "managed" is where you begin to add $$$, even in cheapo world.

Also current price on ebay for a refurb N1108T-ON unit is 360 quid, so I reckon relatively speaking you could say it's cheap.

gertrunde2• 5 years ago

Yeah, I found the same thing on the prices - but interestingly looking at completed sales, prices are more like ~£100. I'm assuming something has recently changed to make people mark them up more, and no-one's biting yet.

coding-saints• 5 years ago

I love I can still unexpectedly find a post that reminds me of why I even decided to focus on tech-related career. Great article! For me, following you down the rabbit hole is better than the result. Thanks.

wyager2• 5 years ago

The author mentioned that 10gig switches were expensive and loud, but these days you can get fanless 10gig switches for pretty cheap. I have a fanless mikrotik switch at home with 4 10Gb SFP+ ports that cost like $130 (and has excellent industrial design).

hosteur• 5 years ago

Cool. Which one?

cure• 5 years ago

Presumably the CRS112-8G-4S-IN, though I'm not sure that those SFP cages can do 10 Gigabit...

wyager2• 5 years ago

CRS305-1G-4S+IN

caminante• 5 years ago

Off-topic, but I just learned about another, practical networking utility, yesterday.

"powerline adaptors" [0]

Basically, buy these adaptors and for ~$100, you can have create a "wired" LAN connection using power outlets in a home.

[0] https://www.techradar.com/news/the-best-powerline-adaptors

techopoly• 5 years ago

Can confirm, these are legit. Make sure you're aware of any outlets on the outside of your building though, as these could be plugged into with malicious intent.

severino• 5 years ago

Make sure you're aware of any outlets on the outside of your building though

I guess this also means inside your neighbor's home, if you live in an apartment building, right? That's why those devices typically use AES for encrypting the signal between the paired ones.

jchw• 5 years ago

In practice, my problem with these is reliability. They can have noticeable issues with maintaining an uninterrupted, low latency connection suitable for real time use, in my experience; and this was with a fairly high end powerline adapter. This is unfortunate, because it would be very convenient if you didn’t have to deal with making ethernet cable runs all over the place…

gattilorenz• 5 years ago

In practice, my problem with these is reliability. They can have noticeable issues with maintaining an uninterrupted, low latency connection

True,especially when a microwave, washing machine or other motor starts sending noise down the power line...

thecal• 5 years ago

I've used these for over a decade with limited success. Their performance is very specific to your wiring and can be fouled up with lots of things. Mine was sometimes no faster than WiFi. MoCA (Ethernet over coax wiring like for cable/satellite TV) seems to work better.

Lammy• 5 years ago

I had a lot more success with them after popping my electrical panel open and rearranging the relevant outlet circuits to all be on the same AC phase (making sure not to unbalance the amperage load since some were 15As and some were 20)

tylerfontaine• 5 years ago

I have had these jump outside of my house. I realize how crazy it sounds, but I had a pair (they were not encrypted - this was long ago, and I don't even know if encrypted ones existed) and my neighbor had a pair. I would, very occasionally, end up getting DHCP answered by the router in their network.

It took forever to figure out what was causing this, and I eventually figured it out by doing a (very slow) IP scan of every device on the network I was connecting to and finding a machine named with their first and last name. Unplugged the thing, and the problem went away forever.

If it hadn't happened to me, it's something I would have thought impossible!

(edited a small typo)

toast04• 5 years ago

Doesn't sound crazy at all, there's not really anything in your breaker panel or your meter or the outside wiring designed to stop these signals, it's just that there's also nothing designed to help the signals make it through all that, so you wouldn't expect it to continue beyond your house. Just like they tend not to work very well when used on different circuits, they shouldn't work very well outside your house, which is certainly not on the same breaker at all.

I think the newer ones all have some sort of encryption/pairing system which at least helps you ignore your neighbors transmissions.

Nexxxeh• 5 years ago

Same. Plugged in the device-side one of a pair and the device started working before I plugged in the router-side one. It'd connected to a house two or three doors down.

thescriptkiddie• 5 years ago

These are useful, but they add ~16 ms of latency, and depending on the quality of wiring and appliances in your building they can be very unreliable. A better option if you have RG-6 wiring is MoCA.

WaitWaitWha• 5 years ago

They are excellent solution where you cannot run Ethernet to, and do not want to use WiFi.

I used it in home automation (Thank you Home Assistant) for mostly sensors, and less important actuators, where I had power, but could not get Ethernet, or WiFi.

Anything else, very unstable and too much latency.

WorldMaker2• 5 years ago

It would be more practical in many places now to use leftover "hardline" phone plugs, especially because when they are disconnected from service they are sometimes quite literally disconnected and you have much fewer concerns about bleedover into neighbors.

Speeds won't be great for that sort of ethernet-over-phone wire, especially because most landlines used awful, cheeap wires, but in some cases it is faster than powerline adaptors.

Unfortunately all the companies that produce such equipment for "phone line adaptors" sell only to the phone companies and never directly to consumers.

So many houses today have vestigial phone wires that no one is using for anything.

zz865• 5 years ago

This happened to me. The phone lines are actually cat5 so just need a new socket for home ethernet. That was a happy day.

wl• 5 years ago

I've seen a lot of phone runs done with cat5e. Phone line adapters might not even be necessary in many cases, only new wallplates!

moftz• 5 years ago

Even if you could manage to find some ADSL+ equipment, you are going to tap out at around 48Mbps, I'm not sure if you can push unshielded, twisted 2-pair wire any faster. One downside would be that all of the phone jacks in the house are tied together, it would be a A->B kind of connection. I regularly get much faster speeds with my powerline adapters and if you have multiples paired, they create an actual network on the powerlines.

TakerofVita• 5 years ago

You can also get these for running ethernet over coax as well. Can't speak of the experience, though I'd bet it would be better than over power because it is isolated.

My apartment has some places that have coax runs but not ethernet runs.

josteink2• 5 years ago

Off-topic, but I just learned about another, practical networking utility, yesterday. "powerline adaptors"

Their performance depends on the electrical wiring in your house.

Ironically for me I’ve only managed to make them work on older electrical installations, and even then it was at best 802.11n speeds.

In my current house (newly built 2018), I can’t even get them to handshake. I suspect it’s due to improved electrical standards and better isolation between different circuits internally in the house, but I honestly don’t know.

sumedh• 5 years ago

Does it work between two outlets in the same room. If that works but multi room does not then probably you have different circuits internally.

anonymousisme• 5 years ago

The Dell N1100 is a nice switch, but a relatively new product (<3 years old). Also, the article mentions how noisy the cooling fans can be in "enterprise" grade switches, but they are quite loud in the N series too (at least in the case of the N3048). Early this year, I got contacted by DellEMC via a voicemail message, which I initially thought was spam or phishing because they should have used the email associated with my DellEMC support account. It turned out that the voicemail was legit, and the message was that I needed to update the firmware in all of our switches (including N1100) before 7/27/2021, or they would all stop working(!) It turns out that the feature license management system had a root certificate that was due to expire, and all licensed features would cease to function if the switches were not upgraded. I spent about a day on the phone with them upgrading our switches, and (almost) everything turned out okay in the end.

Below is my survey response to their support feedback request:

1) The products should not have a built-in time-bomb that causes them to stop working after only a few years.

2) Dell should have informed us of this issue by email. Instead they left a very "phishing" like voicemail on a manager's phone. (Not the phone of the registered point-of-contract for the cluster.) Perhaps this was done to avoid leaving evidence of #1 above?

3) I spent over an hour on hold when I returned the call, and was then disconnected. After trying again (to an extension other than the one given in the message), I reached somebody who confirmed the issue. I spent another four hours on the phone resolving it.

4) Shortly after all of the above, I discovered a new issue that severely impacted the cluster. The n3048 switch would no longer auto-negotiate a 100Mbps Ethernet link. Our network watchdog device (iBoot) was continuously cycling the power on our Internet Ingress (ONT+ASA).

5) I spent even more time troubleshooting and resolving this issue (by locking the iBoot port to 100Mbps instead of leaving it on Auto).

6) I did not waste any more of my time by reporting this issue. The technician I worked with to upgrade these switches assured me that the firmware releases we used were "stable".

benjojo122• 5 years ago

(Post Author here)

The non POE N1100's are fanless, Thankfully don't really contain any features that would require licencing, that being said also has no hardware Layer 3 capability, so not really in the same class as the N3XXX or N2XXX's

The licencing thing does suck though, that's poor from Dell who normally (at least switches wise) do a reasonably good job for the price.

WalterBright5• 5 years ago

The products should not have a built-in time-bomb that causes them to stop working after only a few years.

First Turtle Beach bricked my Audiotron by abandoning the web site required for it to function, then Grace Digital bricked my three GD streaming devices for the same reason.

ggrothendieck3• 5 years ago

Grace Digital bricked my three GD streaming devices

If you are referring to a Reciva based internet radio the web site which powers them was shut down by the owner of that site, not by Grace Digital. Also, if it is similar to my CC Wifi Reciva based radio it is still possible to access existing presets on the radio although you can no longer add presets or modify them any more. When you power it on wait for the Network Error caused by the lack of the back end and then press Back twice and then a preset. The media server functionality also still works.

m463• 5 years ago

I've been running openwrt on switches for a while.

I originally had two mikrotik rb2011* switches and a rb750gl, now I have two rb3011 switches.

system2• 5 years ago

TP-Link 5 port ethernet switch is cheap which is $12. The one in the article is not, which is $690. I know companies with server included budget less than this "cheap" switch. Nice tricks but clickbait title.

phibz2• 5 years ago

I just bought a Friendlyarm r4s two port gigabit rk3399 4GB linux SBC for $90 USD. It supposedly has hardware acceleration for networking. Though I see 910 Mbps vs the 950Mbps I was getting with the ATT router. I was able to acquire my EAP-TLS certs and can connect directly to the ONT. I even got ipv6 prefix delegation and wireguard working. Next up is transparent ad blocking a la pihole.

It's a fantastic device if all you need is 2 ports.

rootsudo• 5 years ago

The writing reminds me of a 2600 article. I miss those days. Super cool though! I'll pick one up, eventually :)

axiolite• 5 years ago

An interesting read, but I just don't understand why ONIE was even desirable. Cheap OpenWRT switches+routers can do Wireguard as easily as any Linux system.

Teaching a cheap ethernet switch new tricks (2019)

Related Stories